SparkPost Privacy Policy

We hereby state:

1. We agree to participate in, and adhere to, the U.S. – E.U. Privacy Shield Principles, which are detailed at: http://www.privacyshield.gov as well as the Privacy Shield Supplemental Principles and the Privacy Shield Annex set out in that link (collectively the “Principles“).  We further disclose that the full list of the organizations participating in U.S. – E.U. Privacy Shield is available at: https://www.privacyshield.gov/list.  This Privacy Shield portion of the Privacy Policy is designed to be compliant with the Principles; to the extent it is not compliant, then this Privacy Shield portion of the Privacy Policy shall be deemed to be modified to the extent required to be, and construed to be, consistent and in compliance with the Principles;

2. We collect the types of personal data disclosed in the section entitled “Personally Identifiable Information” of our Privacy Policy and all of our affiliated entities, namely: (i) Message Systems EMEA Limited, a private company limited by shares registered in England and Wales; (ii) Message Systems, Pte. Ltd., a private limited company organized under the laws of Singapore; and (iii) Port 25 Solutions, Inc. a Maryland corporation (collectively our “Affiliates“), also agree to adhere to the Principles;

3. Our commitment to be subject to the Principles in regards to all EU-PII received in reliance of the Privacy Shield;

4. The purposes for which we collect and use EU-PII is stated in the section entitled “Personally Identifiable Information” in the Privacy Policy;

5. You may contact us (including any of our Affiliates) with any inquiries or complaints as follows:

   SparkPost
   Message Systems, Inc.
   9130 Guilford Road
   Columbia, MD 21046
   USA
   c/o Privacy Officer or via email:
   privacy@sparkpost.com with the subject “PRIVACY INQUIRY”. A request should include sufficient identifying information, such as name, address, telephone number, and email address.  We may request additional authentication and verification information from you, including residency verification. HOWEVER, PLEASE DO NOT INCLUDE ANY OTHER PII OR OTHER SENSITIVE INFORMATION IN ANY EMAIL SENT TO US.  EMAIL IS INHERENTLY INSECURE AND WE DO NOT GUARANTEE ANY PROTECTION OF EMAIL SENT TO US THAT CONTAINS PII OR OTHER SENSITIVE INFORMATION. If you are not satisfied with the response of the Privacy Officer, you can appeal to our General Counsel by sending a written letter to:

   SparkPost
   Message Systems, Inc.
   9130 Guilford Rd.
   Columbia, Maryland 21046
   USA
   c/o General Counselor via email:
   legal@sparkpost.com with the subject “PRIVACY APPEAL”

6. The type and, where applicable, identity of third parties to which we disclose personal information and the purposes for which we do so is set forth in the section entitled “Personally Identifiable Information” in the Privacy Policy;

7. Individuals have a right to access their personal data, as described more fully below in the section entitled “ACCESS;”

8. Individuals have the choices and means for limiting the use and disclosure of their personal data, as described more fully below in the section entitled “CHOICES;”

9. We have selected JAMS, https://www.jamsadr.com/eu-us- privacy-shield, as the independent dispute resolution body (the “Arbiter“) designated to address your complaints and provide appropriate recourse to you free of charge.  JAMS is an alternative dispute resolution provider based in the United States.  An individual who decides to invoke this arbitration option must first, prior to initiating an arbitration claim, raise the claimed violation directly with us and afford us an opportunity to resolve the issue within the timeframe set forth in the Principles. If you have exhausted all other means to resolve your concern regarding a potential violation of our obligations under the Principles, you may invoke binding arbitration before the Privacy Shield Panel. For additional information about the arbitration process please visit the Privacy Shield website at www.privacyshield.gov;

10. We are subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC) and other United States governmental agencies;

11. We are required to disclose your personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements; and

12. We are liable in cases of onward transfers of your personal information to third parties, as discussed more fully below in the section entitled “ACCOUNTABILITY FOR ONWARD TRANSFER.”

In connection with the above we make the following additional statements and commitments:

Access

We encourage users to keep their contact information up to date. If we maintain information about you covered by this Privacy Shield portion of the Privacy Policy, we will provide you with access, correction and deletion rights in line with applicable legal requirements of the Principles.

We may also maintain publicly available or restricted information (i.e. information shared with a limited set of people such as “friend-only” content) that you have posted.  In some cases, we may permit you to modify that information, but in other cases, we may prohibit modification and either allow you to select a configurable option to make the information publicly unavailable via privacy settings or to change the types of people who can review such information.  Examples of instances where we may prevent modification:  (i) where we have received a notice that such content infringes a third party’s rights; (ii) where we have received a “litigation hold” letter; (iii) where we believe we owe a legal duty to retain the original posting; (iv) where a law enforcement officer demands we preserve our records and; (v) in other similar types of circumstances.

Anyone seeking to know if we have information about them under Privacy Shield or applicable law or who wants access to (or a copy of) his or her personal data can make a request in writing as provided in the section entitled “NOTICE” above.

We will not normally charge you to inspect or receive a copy of the information we maintain about you. We reserve the right, however, to impose reasonable charges for requests that are very detailed, and for repeated requests and to deny or ignore requests we deem to be harassing.  If we receive a subpoena or other similar court order or government request relating specifically to your information, we reserve the right to impose on you reasonable charges for responding to such request, unless prevented from doing so by applicable law.

A request for correction should identify the contested information; should state whether the information is incorrect, inaccurate, or incomplete; and should state what information should appear in place of the contested information.

In compliance with applicable laws, we may elect to provide some or all of the PII you requested via electronic means, or to provide an electronic view of your data that we retain.

We do not permit modification of anonymous data, or transactional data for payment transactions, support requests or other relationship related communications, nor may you modify data that is generated merely by operation of your interaction with us, such as tracking, Site use or other similar types of automatically collected information.

Choice

Except as noted below, we offer individuals the opportunity to choose (opt out) whether their personal information is: (i) to be disclosed to a third party; or (ii) to be used for a purpose that is materially different from the purpose(s) for which it was originally collected or subsequently authorized by the individuals.  We provide clear, conspicuous, and readily available mechanisms to exercise this choice on the site.

We note that we do not provide the above opt out choice when disclosure is made to a third party that is acting as an agent to perform task(s) on behalf of and under the instructions of the organization, where we have entered into a contract with such agent.

With respect to sensitive information (i.e., personal information specifying medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership or information specifying the sex life of the individual), which we do not collect, but if we ever do collect such information, we will obtain affirmative express consent (opt in) from individuals if such information is to be: (i) disclosed to a third party; or (ii) used for a purpose other than those for which it was originally collected or subsequently authorized by the individuals through the exercise of opt-in choice.  We will also treat as sensitive any personal information received from a third party where the third party identifies and treats it as sensitive.

Subject to the next paragraph of this Section, we offer users the opportunity to opt out of being contacted by us.  All promotional and research email messages you receive from us will include an option to opt out of future email communications from the particular business unit that contacted you.  In addition, you may use technological tools to block or restrict automated data collection we perform, as disclosed in the section entitled “Cookies” in the Privacy Policy.  As disclosed there, blocking some automated data collection tools we use will impair or in some cases prevent the functionality of our site.

Exceptions:  Users cannot opt-out of some data collection and data use and disclosure of information, for example opt-outs do not affect our use of personal information to communicate with you on Services related issues (for example, notices of changes to our Terms of Use or this policy, or notices regarding Services unavailability) and in internal management or the disclosure of personal information to third parties who are our agents and that have a reasonable need to know of or use the information to assist us in providing you the Services (as discussed above).

Accountability For Onward Transfer

We enter into contracts with third-party data controllers, which provide (i) that data subject to the Privacy Shield may only be processed for limited and specified purposes consistent with the consent provided by the individual; and (ii) that the recipient will provide the same level of protection as the Principles and will notify us if it makes a determination that it can no longer meet this obligation and that if such a determination is made, the third-party controller will cease processing or will take other reasonable and appropriate steps to remediate.

We transfer personal data to a third party acting as an agent under the following conditions: (i) for limited and specified purposes; (ii) we ascertain that the agent is obligated to provide at least the same level of privacy protection as is required by the Principles; (iii) we take reasonable and appropriate steps to ensure that the agent effectively processes the personal information transferred in a manner consistent with the organization’s obligations under the Principles; (iv) we require the agent to notify the us if it makes a determination that it can no longer meet its obligation to provide the same level of protection as is required by the Principles; (v) we will, upon notice, take reasonable and appropriate steps to stop and remediate unauthorized processing; and (vi) we will provide a summary or a representative copy of the relevant privacy provisions of our contract with that agent to the U.S. Department of Commerce (the “Department“) upon request.

Security

We use reasonable, industry-standard precautions, including appropriate technical, administrative, and physical procedures, to protect EU-PII from loss, misuse, unauthorized access, disclosure, alteration, and destruction.  Due to the design of the Internet and other factors outside our control, we cannot guarantee that communications between you and our servers will be free from unauthorized access by third parties.

When we share EU-PII with third parties hired to help us with our activities, we require that they provide reasonable security for the information.  However, we are not responsible for any breach of security by third parties (except to the extent applicable law or the Privacy Shield provides otherwise).

Data Integrity and Purpose Limitation

Consistent with the Principles, we collect only personal information that is relevant for the purposes of processing it.  We do not process personal information in a way that is incompatible with the purposes for which it has been collected or subsequently authorized by the individual.  We take reasonable steps to ensure that personal data is reliable for its intended use, accurate, complete, and current.  We will adhere to the Principles for as long as we retain such information.

We retain information that is in a form identifying or making identifiable the individual only for as long as it serves a purpose of processing within the meaning of the Principles.  This obligation does not prevent us from processing personal information for longer periods for the time and to the extent such processing reasonably serves the purposes of archiving in the public interest, journalism, literature and art, scientific or historical research, and statistical analysis. In these cases, such processing shall be subject to the other Principles and provisions of the Privacy Shield Framework and we will take reasonable and appropriate measures in complying with this provision.

Recourse, Enforcement and Liability

We provide readily available independent recourse mechanisms by which each individual’s complaints and disputes are investigated and expeditiously resolved at no cost to the individual and by reference to the Principles, and we acknowledge that we will be liable for damages awarded where the applicable law or private-sector initiatives so provide.

Specifically these independent recourse mechanisms are:  (i) compliant with private sector developed privacy programs that incorporate the Privacy Shield Principles into their rules and that include effective enforcement mechanisms of the type described in the Recourse, Enforcement and Liability Principle; (ii) compliant with legal or regulatory supervisory authorities that provide for handling of individual complaints and dispute resolution; and (iii) commited to cooperating with European Union data protection authorities (“DPAs”) or their authorized representatives.

Specifically, we commit to cooperate with the DPAs, including but not limited to cooperating with the DPAs in the investigation and resolution of complaints brought under the Privacy Shield and complying with any advice given by the DPAs where the DPAs take the view that we need to take specific action to comply with the Principles, including remedial or compensatory measures for the benefit of individuals affected by any non-compliance with the Principles, and we further agree to provide the DPAs with written confirmation that such action has been taken.

We have procedures to follow-up to verify that the attestations and assertions we make about our privacy practices are true and that privacy practices have been implemented as presented and, in particular, with regard to cases of non-compliance. Note that we are currently verifying compliance with the Principles through self-assessment, however, we may later elect for third party verification. In connection with such self-assessment, we state we have in place procedures for: (i) training employees in implementation of the Principles; (ii) disciplining them for failure to follow them; and (iii) periodically conducting objective reviews of compliance with the above.

In creating, maintaining, using or disseminating personal information, we commit to taking reasonable and appropriate measures to protect such personal information from loss, misuse and unauthorized access, disclosure, alteration and destruction, taking into due account the risks involved in the processing and the nature of the personal data.

We agree to remedy problems arising out of failure to comply with the Principles and we state our adherence to such Principles.

We agree that we will respond promptly to inquiries and requests by the Department and EU member states for information relating to the Privacy Shield and our compliance with it.

We will follow the terms set forth in Annex I to the Privacy Shield, provided that an individual has invoked binding arbitration by delivering notice to us and following the procedures and subject to the conditions set forth in Annex I. Note that terms set forth in Annex I to the Privacy Shield may be subject to the procedures of our designated Arbiter.

Ver 1.0 August 26, 2016