Carketa Privacy & Cookie Notice

Navigations

Introduction

At Carketa®, we are committed to protecting personal information. In this Privacy & Cookie Notice (“Notice”), Carketa, Inc. and its affiliated entities (“Carketa,” “we,” or “us”) set out how we, as data controller, may collect, create, share and use personal information relating to identifiable individuals (“Personal Data”) and provide you with information regarding your Personal Data rights and choices.

1. Scope of this Notice

This Notice describes Carketa’s privacy practices for Personal Data collected by Carketa websites (“Sites”) as well as other activities, such as if you visit our offices, attend a Carketa event or otherwise interact with Carketa and provide Personal Data, such as corresponding by email, unless such activities are covered by our other notices outlined below. Please read this Notice in full. By using our Sites or participating in other activities with Carketa described below, you consent to the collection, creation, sharing and use of information as described in this Notice, where consent is required by relevant law.

Carketa also operates a public forum on Carketa websites. The purpose of this forum is to discuss our products and services. Please note that any Personal Data you choose to post in Carketa Community may be read or used by other visitors (for example, to send to you unsolicited messages). Carketa Community forum users should not upload sensitive or confidential content on this public forum.

For indirect customers (through a Carketa partner), while Carketa’s collection and processing of your Personal Data is explained below in this Notice, any direct Personal Data sharing by you with a Carketa partner will be governed by that Carketa partner’s policies/your agreement with them.

As a convenience to visitors to our Sites, we may also provide links to other websites that are not governed by this Notice. These linked websites are not under the control of Carketa and we are not responsible for the content on such websites or the protection/privacy of any information which you provide while visiting such websites.

For information about Personal Data and other data we collect with Carketa products see Section 11.

2. Personal Data we may collect

The Personal Data Carketa may collect about you will depend on your interaction/relationship with us. It may include:

if you browse our Sites, information systems data relating to your interaction with our Sites, such as location (e.g., IP address), cookie related information (see section 6 below), usage (e.g., mouse clicks, page visits, feature usage, view time, downloads) and other information, such as language preference;
if you complete a webform on our Sites (e.g., to attend a Carketa event or create a Carketa Account), attend a Carketa event (online or in-person) or office, or otherwise send this data to Carketa (e.g., by email, telephone, exchange of business cards), identifying/contact information such as your name, job title, work email, organization/employer name, work telephone, and location information such as work address;
if you or your organization purchases Carketa products or services, financial or billing data, such as name, address, credit card number or bank account information (though these will typically be those of your employer organization);
if you attend a Carketa event (in-person or online) or our offices, your attendance details (e.g., entry time);
if you avail of Carketa services, such as attend a training class or submit a technical support case, your activity with Carketa to interact with and take part in these services;
your image and/or voice, such as for phone/video call recordings (for training, quality assurance and administration purposes), if you attend a Carketa event (event recording) or office (e.g., CCTV), post an image/recording to a Carketa Site (e.g., add a profile photo to Carketa Community) or you otherwise send a recording/image to Carketa;
information from otherwise engaging/interacting with you, such as your feedback to us through our Sites and responses to any promotional or survey communications; and/or
information considered sensitive under local law, namely health information, if you visit our offices or attend an in-person Carketa event and, if due to local COVID-19 related requirements, you are required to provide information regarding your health, vaccination status and recent travel history; and/or if in the course of visiting our offices or attending a Carketa event, if you choose to disclose to us disability-related health information for the purpose of us making an accommodation/adjustment. Carketa will only ever process sensitive information in connection with the purpose for which it was collected, for example to comply with local health & safety laws.

We may also collect Personal Data about you from third parties, such as from colleagues of yours at your organization (e.g., when registering multiple participants at an organization/company for Carketa training, or where your details are provided by a colleague as a contact for your organization’s account), public sources (e.g., your organization’s website, LinkedIn), vendors (e.g., web analytics tools, data enrichment providers) and Carketa partners (e.g., where your contact details are provided to enable delivery of Carketa software, for customer success purposes and/or in relation to maintenance/support, including renewal and/or cancellation of same). We also maintain social media pages and may collect Personal Data from you when you interact with these or communicate with us through our social media pages.

3. Use of Personal Data

Depending on your relationship with Carketa, we may use your Personal Data for different purposes. Where required by applicable law in relation to the particular use, we will obtain your consent to collect and use your Personal Data. Otherwise, we will rely on another legal basis, such as in connection with a contract or for our legitimate interests, as set out below.

Perform a contract: We may process your Personal Data in connection with a contract with you or your organization, such as to process relevant payments, deliver (customer) or receive (vendor) products/services, manage our relationship with you as a Carketa partner under our Carketa partner agreement with you, and manage our relationship with you or your organization generally throughout the contract lifecycle, including managing renewals.
Operate our Sites: We may use your Personal Data to provide our Sites, content and offerings (e.g., downloads, registrations for accounts or profiles, such as a Carketa Account), including necessary functionality, content customization (e.g., based on what we think will interest you), and functionality to enhance ease of use (e.g., make the Sites easier for you to use by not making you enter information more than once, etc.). Unless such processing is in connection with a contract or our legitimate interests, it will be on the basis of your consent.
Improve our Sites: We process your interactions with our Sites, content and offerings (e.g., Carketa support) to assess and improve these and the user experience, such as by use of cookies (see section 6 below). This data is typically aggregated unless Personal Data is required for the particular processing operation. We process your Personal Data for this purpose for our legitimate interests of maintaining and improving our Sites and providing tailored content, or where required by law, on the basis of your consent.
Manage contact requests: We may use your Personal Data to reply to contact initiated by you, such as through a webform, chatbot, survey responses or Carketa support. We process your Personal Data for these purpose for our legitimate interest in replying to/fulfilling your request, collecting survey responses and to carry out our contractual obligations under the applicable terms (e.g., providing Carketa support).
Other communications: We may use your Personal Data to otherwise communicate with you to manage our relationship with you/your organization, such as to manage our offerings, for customer success purposes, to contact you regarding updates to our offerings you may be interested in, and to run surveys and contests. Such processing will be to fulfil our contractual obligations, where necessary for our legitimate interests or, where legally required, with your consent.
Call recording: We may record phone or video calls (e.g., Zoom) for training, quality assurance and/or administration purposes. We process this Personal Data on the basis of our legitimate interests however, if required under applicable law, we will obtain your consent or give you the option to object to the call being recorded.
Marketing: We may use your Personal Data to contact you for marketing purposes, such as to alert you to product upgrades, special offers, updated information/services from Carketa, and to contact you (e.g., by phone or email) regarding your interest in our offerings and/or invite you to Carketa events. Such contact will be on the basis of legitimate interest or, where legally required, on the basis of your consent. To opt-out of marketing contact, please unsubscribe here http://support.carketa.com.
Events: We may process your Personal Data to operate Carketa events, including training/education related activities, in-person and online, that you have selected to attend. Such processing will be on the basis of our legitimate interests or to perform a contract with you under the applicable terms of service.
Manage premises: Where you attend our offices, we may process your Personal Data to administer our premises and fulfil our legal obligations regarding health and safety, and to manage the security of our premises to ensure there is no unauthorized access. Such processing will be on the basis of our legitimate interests and/or to carry out our legal obligations.
Compliance and Security: We process your Personal Data to comply with our legal obligations and to ensure compliant use/security, such as to ensure the use of our Sites, content and offerings in compliance with our terms and/or to ensure their security, to cooperate with courts, regulators or other government authorities to the extent processing/disclosure of Personal Data is required under applicable law, where it is necessary to protect our legal rights or those of others, or for other compliance purposes such as auditing, investigations and responding to legal processes or lawful requests. Where we process health related data for Covid-19 related reasons or to accommodate a reasonable adjustment for a disability, we will only do so to carry out our legal obligations relating to health and safety, under applicable law.

We may also combine Personal Data we hold about you. For example, we may combine your B2B contact with your usage data relating to our offerings and our Sites for the purposes above, such as to improve our Sites and our offerings, as well as to create more tailored experiences by providing content that may be of interest to you. We may also use your Personal Data to fulfil any other purposes disclosed to you at the time of collection or as otherwise required/permitted by applicable law.

4. Sharing Personal Data

We accept the following forms of payment:

Carketa may share Personal Data for various purposes, such as:

within the international group of Carketa companies to operate our business and provide our Sites, products and services;
with authorized Carketa vendors, advisors and contractors providing services on our behalf (such as a technology or professional service providers) to operate our business, Sites, products and services;
if you register for or attend a Carketa event, Carketa may share participant information (e.g., your name, organization, work email) with other participants, organizers or hosts of the same event in order to facilitate the event and the subsequent exchange of ideas. Carketa may also share your contact details with event sponsors where you have consented, e.g., through registration, to these sponsors contacting you regarding their own offerings. Your contact details may also be used by other hosts of the same event, such as to send marketing material, according to their privacy notices provided to you;
if you use or complete training provided by Carketa, such as through the resources at https://support.carketa.com, your training results may be shared with your organization or third-party training organizers of theirs, for example training or subscription administrators;
third-party networks/websites so that we can advertise on their platforms;
if you use Carketa products and services, we may share with your organization/colleagues certain data, such as your download and usage data of Carketa products and/or your use of Carketa support;
with Carketa partners (such as distributors and resellers of Carketa software, Carketa compatible software and/or services) in order to follow up (e.g., by email, post or phone) on your interest in Carketa’s products or Carketa-compatible products, or to provide services (e.g., consulting, technical support, training) where such services are to be carried out by Carketa partners. A list of Carketa’s partners can be found on our Find a Partner Page; and/or carketa.com/partners.
if you are a Carketa partner or potential Carketa partner, Carketa may share your contact data with other Carketa partners with whom we do business so that they may contact you regarding their opportunities.

Carketa will only share Personal Data to the extent needed to perform the relevant use and will take such steps as are necessary to safeguard Personal Data. For example, our vendors, advisors and contractors are required to keep such Personal Data confidential and not to use it other than for the purposes intended. Carketa partners are obliged to comply with the privacy rules set out in their agreement with Carketa. Carketa does not sell or rent Personal Data to third parties.

Carketa may also disclose Personal Data to comply with legal requirements, such as in relation to legal proceedings or investigations by governmental or law enforcement agencies, or to meet tax or other reporting requirements, including to (a) protect and defend the rights or property of Carketa, including the defence and management of legal claims and investigations, (b) act in urgent circumstances to protect the personal safety of users our Sites, our Carketa team members, or the public, (c) as part of a merger or change in corporate ownership or control, and/or (d) as otherwise permitted or required by applicable law.

5. Where we may transfer Personal Data

To operate our business your Personal Data may be transferred from your country (e.g., the UK/European Economic Area) to a destination (e.g., USA) which may not be considered by relevant authorities of your country to have an equivalent level of privacy protection. In such instances, in addition to the other measures outlined in this Notice, Carketa will put in place appropriate safeguards for such transfers, for example, UK/EU standard contractual clauses.

6. Cookies and similar technologies

As is true of most websites, when you visit our Sites, cookies will be placed on your device (computer, mobile or tablet). A “cookie” is a small text file that is placed on your device by websites you visit. Some of the cookies we use are strictly necessary to operate our Sites. Others relate to the Site’s performance, functionality and/or to advertising. Information relating to a cookie or similar technology may include identifiers such as IP address, and information like general location, browser type and language, and internet activity such as timestamps. Carketa uses the following types of cookies and similar technologies on our Sites:

Strictly Necessary: These cookies enable the Sites to function correctly and deliver the services and products you have requested. These cookies do not gather information about you that could be used for marketing or remembering other websites you have visited on the internet.
Functional: These cookies do things like remember your preferred language, understand your preferences and associate users to forms submitted to enable pre-completion of subsequent forms as well as improve and customize your experience on our Sites.
Performance: We use third-party analytics tools to help us analyze how our Sites and other electronic mediums are used, such as allowing us to compile reports on website activity, providing us other services relating to website activity and internet usage and whether email communications are opened or left unread.
Advertising: These cookies may be set on our Sites by our advertising partners. They may be used to build a profile of your interests and/or show you relevant adverts on other sites. If you wish to not have your online information used for this purpose you can also visit resources such as https://optout.networkadvertising.org and/or https://www.youronlinechoices.eu (please note these and similar resources do not prevent you from being served ads as you will continue to receive generic ads).

Cookies can be session-based (which disappear once you close your device or browser) or persistent (which remain on your device afterwards). Carketa may also rely on cookies or similar technology operating on other websites, for example to display our adverts to you. You can generally disable the use of cookies by changing your browser settings. To disable non-essential cookies for carketa.com sites (for example to turn off advertising cookies), and to view their retention periods and relevant third-party operators/recipients, you can access our Cookie Preference Center. You may also adjust your browser settings, however if you choose to not have your browser accept cookies from the Carketa Sites, you will not be able to experience a personalized visit and it may limit your ability to use some features on our Sites. For more information about cookies, visit https://www.aboutcookies.org. We may also use pixels, web beacons and similar technologies on our Sites and in emails, for example in a marketing email that notifies us if you click on a link in the email.

7. Protection of Personal Data

Carketa takes appropriate precautions to protect Personal Data from loss, misuse, unauthorized access, disclosure, alteration or destruction. Such measures may include (i) using security controls such as, passwords, firewalls and/or encryption, (ii) restricting Personal Data to those with a legitimate purpose in receiving/accessing it, (iii) deidentifying Personal Data, or assigning codes or pseudonyms when the personal identifiers are not required for the purpose at hand, (iv) using data retention controls to ensure that Personal Data is not kept for longer than is necessary, (v) providing training and internal policies to team members to embed privacy and security across our organization, and (vi) putting in place relevant procedures (such privacy and security vetting) and contracts relating to the use and protection of Personal Data with third parties.

8. How long we retain Personal Data

Carketa will retain and process Personal Data for a period of time consistent with the purpose of collection (see section 3 above) and/or as long as necessary to fulfil our legal obligations. We determine the applicable retention period by taking into account the (i) amount, nature and sensitivity of the Personal Data, (i) relevant use, including whether we can achieve the use through other means (e.g., by instead using deidentified data); (iii) potential risk of harm from unauthorized use or disclosure of the Personal Data, and (iv) applicable legal requirements (e.g., statutes of limitation). After the applicable retention period, we will delete the Personal Data, hold it in a form that no longer identifies you or, if we are unable for technical reasons to delete/deidentify it entirely, will implement appropriate measures to prevent any further use of such Personal Data. For example, checks are made on a regular basis for any contact details that have remained inactive in our sales and marketing databases, and if they are inactive for two years, we delete them.

9. Your rights relating to your Personal Data

You may have certain rights relating to your Personal Data, subject to applicable privacy laws. For example, under the UK/EU GDPR and similar laws, you may have the right to:

request access to and/or obtain a copy of your Personal Data;
request corrections to your Personal Data if it is inaccurate;
request further information about the processing of your Personal Data by Carketa;
request deletion of your Personal Data that is no longer necessary to fulfil the purposes for which it was collected, or does not need to be retained by Carketa for other legitimate purposes;
where we process your Personal Data on the basis of consent, withdraw this consent at any time. If you withdraw your consent to Carketa to processing your Personal Data, this will not affect any processing which has already taken place;
request a restriction or raise an objection to the processing, sharing and/or further use of your Personal Data;
if applicable, that your Personal Data be transferred to another company/organization;
not be subject to a decision based solely on automated processing, including profiling, which produces legal effects (“Automated Decision-Making”). Please note that Automated Decision-Making currently does not take place on our Sites or other activities covered in this Notice;
if you feel that your request/complaint has not been dealt with satisfactorily, make a compliant to your relevant privacy/data protection authority; and
not be discriminated against for exercising the above rights.

These rights will depend on which privacy/data protection laws are applicable to your Personal Data (typically, where you are resident), the type of Personal Data involved and the reason it is processed. There may be circumstances when Carketa is unable to accommodate requests, either wholly or in part, for reasons under local law. Depending on applicable law, this may include situations where the information contains Personal Data of other individuals and it is not possible to separate out your Personal Data, if Carketa cannot validate the request, if you ask us to delete Personal Data which we are required by law or have compelling legitimate interests to keep, or where information cannot be disclosed for legal, security, or other reasons based on local law. Carketa will endeavor to advise you of any reason for denying or restricting any Personal Data request. Where legally permitted under relevant law you may designate an authorized agent to submit a privacy request on your behalf. In order to verify this agent request, you/agent will need to complete the Privacy Request form and validate the request through the email validation link sent to email address associated with the request. To make a request complete the Privacy Request form, validate the request through the email validation link and Carketa will respond to any legitimate requests in line with local laws. Further contact details are also available in section 11 below. We will contact you if we need further information, for example to verify your identity to authenticate your request. If your request is to opt-out/unsubscribe from marketing contact from Carketa, please visit https://www.carketa.com/opt-out.

For more information regarding your privacy rights, we encourage you to visit the website of your local privacy/data protection authority, such as that of Brazil, California (USA), EU, Singapore and the UK.

10. Children's Privacy

Carketa does not knowingly or intentionally collect information from anyone under the age of 16, and we request that anyone under the age of 16 does not submit Personal Data to us. If you become aware that a child has provided us with Personal Data, please contact us at support@carketa.com. If we become aware that someone under the age of 16 has submitted Personal Data, we will delete this information from our records.

11. Carketa Product Privacy Terms

Carketa’s products are accessed by utilizing a cloud hosted solution provided and managed by Carketa (the “Carketa Cloud”). A mobile application is also available from which to use the application.

Carketa Cloud

What user Personal Data is processed by Carketa when a user uses Carketa Cloud?
Personal Data: Carketa is the Data Controller of user Personal Data collected and processed by us to administer, maintain and improve our products and services. When using Carketa Cloud, user data processed may include (i) licence/tenant activation and consumption data, (ii) authentication data such as usernames and passwords, (iii) technical data from interacting with Carketa Cloud, such as IP address, (iv) usage data such as frequency of log-in, feature usage, usage per day, etc. and (v) contact data, such as work email, for example when a user is invited into a tenant. Such data may be provided directly by you, or by others within your organization (e.g., when a colleague uses your work email to invite you into a tenant). Such data may be Personal Data where it is associated with or contains your name or other identifiers. You may also provide contact details (e.g., name, work email, work phone number, employer organization, job title), for example when completing a feedback form or otherwise contact us in-product.
Uses of Personal Data: Carketa processes Personal Data described above for the uses set out below.

(a) Operate Carketa Cloud: We may process your Personal Data to ensure the availability and quality of Carketa Cloud (e.g., authentication) and to monitor consumption (e.g., licences) for customer consumption management purposes. We do this to carry out our contract with you/your organization under the applicable terms.

(b) Carketa Services: We may process your Personal Data to provide you with Carketa services, such as Support and/or Consulting services. We do this to carry out our contract with you/your organization under the applicable terms.

(c) Customer success & adoption: We may process your Personal Data for customer success purposes to assist customers and users in improving their use of Carketa Cloud, for example by making tailored suggestions and delivering insights to customers/users based on their interaction with our offerings. We may also use this data to enhance conversations with existing customers by providing Carketa account teams with greater context and background regarding how customers deploy and use our offerings. We do this to carry out our contract with you/your organization under the applicable terms and for our legitimate business interests in ensuring customers improve/maximize their use of our offerings.

(d) Communication: We may process your Personal Data to contact you, such as in relation to errors, or if you complete a feedback form in the product and ask to be contacted by us. We process Personal Data for this purpose for our legitimate interest in reviewing your submission and to fulfil/respond to your request.

(e) Improve our offerings: We may process your Personal Data to analyze use of our products and services (e.g., reviewing trends and which features are popular) to improve these. We do this for our legitimate interest in improving our offerings.

(f) Security & compliance: We may process user Personal Data for our legitimate interests in ensuring the security of our offerings, for example to monitor for suspicious activity, and for compliance purposes, such as to review compliance with the applicable usage terms (e.g., validate licensed user numbers) and to comply with our legal obligations (e.g., regarding restricted/denied party lists).

While certain uses of Personal Data may require it to be individualized (e.g., for authentication), Personal Data identifiers are typically removed by Carketa where the data is used for other purposes (e.g., when using statistical data to analyze usage trends to improve our offerings).

Sharing of your product usage data

Carketa may share data relating to your use of Carketa offerings in the following ways:

to assist your organization in managing its Carketa offerings.
with our affiliates to perform our services and/or operate our products, as well as with third party service providers who may use this information to in order to operate our business.
with our partners who may use such information to market products to you, modify product offerings to you, or use such information for operating their own business.
where your organization has purchased our offerings through a Carketa partner, we may share such data with that relevant partner to manage our relationships with your organization, the relevant partner, and to aid the direct relationship between your organization and the relevant partner.

Carketa Services

Please note that Content Data provided to Carketa for support or consulting services may leave the customer’s region. As such, support tickets may be dealt with by Carketa team members outside the customer’s region and support Content Data may be stored/accessible outside of the customer’s region.

Carketa uses third party subprocessors in relation to Carketa Cloud and Carketa services Content Data.

Carketa applications for mobile devices

Analytics & Diagnostic Data: Carketa mobile applications for mobile devices available through device stores and other sources (collectively, “Carketa Mobile App(s)”) may collect and send to Carketa analytics data and/or diagnostic data. Analytics data is data about the usage of features within Carketa Mobile Apps and users can deactivate this analytics data collection in the Carketa Mobile App settings. Carketa may collect analytics data so that Carketa can optimize, improve and promote its products.

Sharing of Content Data within Carketa Mobile Apps: Carketa Mobile Apps may download customer Content Data from relevant customer Carketa data sources (e.g., Carketa Cloud) onto their relevant Carketa Mobile App on their device. Authentication and authorization to such data is controlled by customers and their users. Carketa cannot access Content Data within a user’s Carketa Mobile App and Carketa will not receive such content unless explicitly shared by the user with Carketa. Depending on the location of the customer user device and use of certain features, such as push notifications, such Content Data stored in the Carketa Mobile Apps may leave the relevant region of the customer.

International Data Transfers

For Personal Data which Carketa is a Data Controller of, Carketa has in place relevant agreements and protections to protect Personal Data. These may include, for example, data protection agreements supplemented, where necessary, by additional protections such as the UK/EU Standard Contractual Clauses to ensure the lawful transfer of Personal Data by Carketa within our international group of companies and with relevant third parties (e.g., service providers). For our measures in relation to Personal Data for which Carketa is a Data Processor (e.g., subprocessors), please see our customer Data Processing Addendum.

Contact Information

For privacy inquiries or complaints, or to otherwise contact Carketa’s, please email support@carketa.com).

Changes to this Notice

Carketa reserves the right to modify or update this Notice from time to time to reflect changes in technology, our practices, law and other factors impacting the collection/use of Personal Data. You are encouraged to regularly check this Notice for any updates. We may also collect, use and disclose Personal Data for other purposes otherwise disclosed to you at the time of collection/processing in a supplementary notice.