We, at Xplenty Inc. ("Xplenty"), put great efforts in making sure that we secure your personally identifiable information and use it properly.
This policy explains our privacy practices for processing your personally identifiable information on our Xplenty SaaS application and associated services, as well as through the Xplenty website and other registration or contact channels ("Service"). We process your personally identifiable information subject to the terms of this policy.
The summary of this policy will give you a quick and clear view of our practices. Please take the time to read our full policy.
A Summary of The Policy
The Personally Identifiable Information That You Provide Us – We receive and store any information you provide to us through our website or any other source. If you register with the Service we will need your name, your company name, email address and password, your payment details and additional personally identifiable information that you provide when you contact us. Read more.
The Personally Identifiable Information That We Collect – We collect usage information about the time, type and manner of use of the Service, sometimes by using third parties' web analytics and session replay services. Read more.
The Personally Identifiable Information That You Upload – You can upload content with personally identifiable information. Please use caution and do not upload the personally identifiable information of others without their appropriate consent. Read more.
What Do We Do With Personally Identifiable Information? – We provide, maintain, modify and improve the Service as well as protect ourselves, our customers and the Service from misuse and law violations. Read more.
Sharing Information with Others – We use service providers for a variety of reasons, such as processing payments, providing support and sending email messages. We will transfer information when we change our corporate structure, and we will share the information with our affiliated entities. Read more.
Disclosure of Information to Authorities – We will obey orders and other lawful requirements by authorities to disclose information. Read more.
Aggregated and Analytical Information – Aggregated data is not identifiable. We use it for legitimate business purposes. Read more.
Your Choice – You may opt-out of our mailing lists and terminate your use of the Service. Our Service does not respond to Do Not Track (DNT) signals. If you are a California resident, you are entitled to your California opt-out privacy-related rights. Read more.
Accessing Your Personally Identifiable Information – At any time you can request access to your personally identifiable information. Read more.
Your EU Data Subject Rights – If we process your personal data when you are in the EU, further terms apply to our processing in relation to your rights as a data subject under EU data protection laws. Read more.
Data retention – We retain data to provide the service and for legitimate and lawful purposes, as further explained in the data retention section. Read more.
Transfer of Data Outside your Territory – We use cloud-based services to store and process data in various territories at our clients’ election. We will store these services at additional sites, at our discretion. These service providers provide us adequate security and confidentiality commitments. Read more.
EU-US Privacy Shield – We are certified with the EU-US Privacy Shield Framework, in connection with transferring personally identifiable information from EU member states. The Federal Trade Commission (FTC) has jurisdiction over our compliance. Read more.
Information Security – We implement systems, applications and procedures to secure your personally identifiable information, to minimize the risks of theft, damage, or loss of information, and to prevent unauthorized access or use of your information. Read more.
Dispute Resolution – Contact us at: firstname.lastname@example.org for any request or complaint. We will make good-faith efforts to resolve any existing or potential dispute with you. As an EU data subject, you may refer unresolved complaints to our designated recourse mechanism and invoke arbitration in certain cases. Further details are available here. Read more.
Incorporation to the Terms of Service – This policy is an integral part of the Xplenty Terms of Service or, if applicable, of any other Service subscription agreement entered into between you (or the entity that you represent) and us.
Contact Us – Please contact our privacy team at: email@example.com for further information.
The Personally Identifiable Information That You Provide
We receive and store any information you enter on our website or give us in any other way.
You provide most of your information while registering to the Service and/or by using the Xplenty application.
If you register with the Service through our website at www.xplenty.com, or through a separate subscription agreement with us, we will ask you to provide personally identifiable information as part of your registration, including your name, your company name, your email address and password.
As a paying user of the Service, we will receive your payment transaction details (for example, your name, the amount paid and the date of payment), from the payment service provider that processed your payment.
When you contact us, or when we contact you, we will receive and process any personally identifiable information that you provide us.
The Personally Identifiable Information That We Collect
Like many websites, we use "cookies", and clear gifs and/or similar technologies.
Xplenty will collect, including via third parties' web analytics and session replay services, usage information about the time, type and manner of use of the Service. This may include, information regarding the Internet Protocol (IP) address and Geo-IP parameters, your activity events, non-personal usage statistics (e.g. time of usages, number of clicks on each link, etc.), crash reports, information regarding your browsing history and web activities, and other information regarding the use of the Service.
The Personally Identifiable Information That You Upload
The content you upload to the Service, whether from your own device or from a cloud-based hosting service, including any data, text, graphic, audio and audio-visual files, may include personally identifiable information. The content that you upload and designate as public will be accessible to others.
Please use caution when uploading the content and avoid any involuntary disclosure of your personally identifiable information or disclosure of others' personally identifiable information without their consent.
What Do We Do With Personally Identifiable Information?
We use the personally identifiable information we collect and receive to provide the Service to you and to other users; to enable the Service's tools and features; to enhance users' experience with the Service; to study and analyze the functionality of the Service and users' activities; to provide support; to measure Service activity for pricing purposes; to provide automatic updates of new versions of the Service; and to maintain, develop, and continue to improve the Service.
We will use your email address to contact you when necessary, to send you reminders and to provide you with information and notices about the Service. We will include commercial and marketing information about our Service and related services to the Xplenty application.
If necessary, we will use your personally identifiable information to enforce our terms, policies and legal agreements; to comply with court orders and warrants; to assist law enforcement agencies; to collect debts; to prevent fraud, misappropriation, infringements, identity thefts and any other misuse of the Service; and to take any action in any legal dispute and proceeding.
Sharing Personally Identifiable Information with Others
We do not sell, rent or lease your personally identifiable information. We will share your personally identifiable information with service providers and other third parties, if necessary, to fulfill the purposes for collecting the information. Any such third party will commit to protecting your privacy as required under the applicable law and this policy.
For example, we will share your payment transaction details with the payment services providers to process and verify your payments. We will use a service provider to manage our email message transmissions. We will also share necessary details with our ticketing service providers, and use a session replay service, to support and enhance your experience with the Service.
We will also share your personally identifiable information with our affiliates. These mean companies within the Xplenty group and include subsidiaries, sister-companies and parent companies, with the express provision that their use of your personally identifiable information will comply with this policy.
We will also share your personally identifiable information with our affiliates. These mean companies within the Xplenty group, including subsidiaries, sister-companies and parent companies, with the express provision that their use of your personally identifiable information will comply with this policy.
We will report any content that you upload and share if we believe, in our sole discretion, that such content is illegal, abusive, or may violate any third-party rights.
Additionally, a merger, acquisition or any other structural change will require us to transfer your personally identifiable information to another entity provided that the receiving entity will comply with this policy.
We will be liable for onward transfers to third parties in violation of the Privacy Shield Principles. For further information, please read the EU-US Privacy Shield section of this policy.
Disclosure of Information to Authorities
We will need to disclose personally identifiable information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
Aggregated and Analytical Information
We use standard analytics tools. The privacy practices of these tools are subject to their own privacy policies and they use their own cookies to provide their service. For further information about cookies, please see the 'Cookies' section in this policy.
We use anonymous, statistical or aggregated information and will share it with our partners for legitimate business purposes. It has no effect on your privacy, because there is no reasonable way to extract data from such information that we or others can associate specifically to you.
We will share your personally identifiable information only subject to the terms of this policy, or subject to your prior consent.
At any time, you can unsubscribe to our mailing lists or newsletters, by sending us an opt-out request to: firstname.lastname@example.org.
At any time, you can stop using the Xplenty website. Termination of your Xplenty Service account is subject to the Xplenty Terms of Service or other subscription agreement with us.
Note that if one of our customers uploaded content to our Service with your personally identifiable information, then you can contact our customer who uploaded that content and request to remove your personally identifiable information.
At any time, you can exercise your following opt-out options: (i) object to the disclosure of your personally identifiable information to a third party, other than to third parties who act as our agents to perform tasks on our behalf and under our instructions, or (ii) object to the use of your personally identifiable information for a purpose that is materially different from the purposes for which we originally collected such information, pursuant to this policy, or you subsequently authorized such use. You can exercise your choice by contacting us at: email@example.com.
We request and collect personally identifiable information that we need for the purposes that we describe in this policy. Following the termination or expiration of the Service, we will stop collecting any personally identifiable information from or about you. However, we will store and continue using or making available your personally identifiable information according to our data retention section in this policy.
Web browsers offer a "Do Not Track" ("DNT") signal. A DNT signal is HTTP header field indicating your preference for tracking your activities on a service or through cross-site user tracking. Our Service does not respond to DNT signals.
Your California Privacy Rights
If you are a California resident, California Civil Code Section 1798.83 permits you to request in writing a list of the categories of personally identifiable information relating to third parties to which we have disclosed those categories of personally identifiable information during the preceding year, for the third parties’ direct marketing purposes. To make such a request, please contact us at: firstname.lastname@example.org.
Accessing Your Personally Identifiable Information
If you find that the information on your account is not accurate, complete or up-to-date, please provide us the necessary information to correct it.
At any time, you can contact us at email@example.com and request to access the personally identifiable information that we keep about you. We will ask you to provide us certain credentials to verify your identity. We will make good-faith efforts to locate your personally identifiable information that you request to access.
Under your right of access, you can obtain confirmation from us regarding whether we are processing personally identifiable information about you. You can also receive a copy of that data, so that you could:
- verify its accuracy and the lawfulness of its processing;
- request the correction, amendment or deletion of your personally identifiable information if it is inaccurate or if you believe that the processing of your personally identifiable information is in violation of the applicable law or the Privacy Shield Principles (please see the EU-US Privacy Shield section in this policy for further information).
We will use judgement and due care to redact personally identifiable information related to others from the data we make available to you.
Your EU Data Subject Rights
If EU data protection laws apply to the processing of your personal data by Xplenty, then the following terms apply:
For the purposes of the Xplenty application, we are a data processor and our customers are data controllers, or data processors as well. Xplenty's data processing addendum, which is available on request, applies to such processing.
Where Xplenty processes your personal data as a data controller, then we process your personal data for the following lawful grounds:
- All processing of your personal data which are not based on the lawful grounds indicated below, are based on your consent.
- We process your account and payment details to perform the contract with you.
- We will process your personal data to comply with a legal obligation and to protect your and others' vital interests.
We will further rely on our legitimate interests, in which we have good-faith belief that they are not overridden by your fundamental rights and freedoms, for the following purposes:
- Communications with you, including direct marketing where you are our client or a user of our client, or where you contact us through our website and other digital assets
- Cyber security
- Support, customer relations, service operations
- Enhancements and improvements to yours and other users' experience with our services
- Fraud detection and misuse of the Service
In addition to your rights under other sections in this policy, you have the following rights:
- At any time, you may contact us if you want to withdraw your consent to the processing of your personal data. exercising this right will not affect the lawfulness of processing based on consent before its withdrawal.
- You may request to delete or restrict access to your personal data. We will review your request and use our judgment to make a decision pursuant to the provisions of the applicable law.
- If you exercise one (or more) of the above-mentioned rights, in accordance with the provisions of applicable law, you may request to be informed that third parties that hold your personal data, in accordance with this policy, will act accordingly.
- You may ask to transfer your personal data in accordance with your right to data portability.
- You may object to the processing of your personal data for direct marketing purposes. Additional information about this right is available under the Choice section in this policy.
- You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affecting you.
- You have a right to lodge a complaint with a data protection supervisory authority of your habitual residence, place of work or of an alleged infringement of the General Data Protection Regulation (EU) 2016/679 ("GDPR").
A summary and further details about your rights under EU data protection laws are available on the EU Commission's website here.
Note that when you send us a request to exercise your rights, we will need to reasonably authenticate your identity and location. We will ask you to provide us credentials to verify your identity and will ask you further questions to understand the nature and scope of your request.
If we need to delete your personal data following your request, we will make every effort to remove your residual copies of your personal data from our active servers and backup systems within a reasonable amount of time.
If you have any concerns about the way we process your personal data, you are welcome to contact our privacy team at firstname.lastname@example.org. We will investigate your inquiry and make good-faith efforts to respond promptly.
We retain different types of personally identifiable information for different periods of time depending on the purposes for processing the information, our legitimate business purposes, and in compliance with legal requirements under the applicable law.For example, we will need to keep the information about the payment transactions that you made for several years due to tax-related requirements as well as accounts settling, record keeping, archiving, and legal issues.
We will maintain your contact details to help us stay in contact with you. At any time before or after the termination of your account, you can contact our privacy team at email@example.com and request to delete your contact details. Note that for legal matter we may keep your details without using them unless necessary, and for the necessary period of time.
We will keep aggregated non-identifiable information without limitation, and to the extent reasonable, we will delete or de-identify potentially identifiable information when we no longer need to process the information.
By default, as long as you use the Service, we will keep information about you, unless the law requires us to delete it, or if we decide to remove it at our discretion, according to the terms of this policy.
Transfer of Data Outside Your Territory
The Service is a web-based service. We store and process information in various territories around the world at our clients’ election on our cloud-based services' sites. From time to time, we will make operational decisions which will have an impact on the sites in which we maintain personally identifiable information. We make sure that our data hosting service providers supply us with adequate confidentiality and security commitments.
If you are a resident in a jurisdiction where transfer of your personally identifiable information to another jurisdiction requires your consent, then you provide us your express and unambiguous consent to such transfer. You can contact our privacy team at firstname.lastname@example.org for further information about data transfer.
EU-US Privacy Shield
We comply with the EU-US Privacy Shield Framework as set forth by the US Department of Commerce regarding the collection, use, and retention of personally identifiable information from European Union member countries.
We adhere to the Privacy Shield Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, Recourse, Enforcement and Liability.
Cookies and Clear Gifs
“Cookies” are small files that a web server sends to a user's device when the user browses online.
Your device removes session cookies when you close your browser session. Persistent cookies last for longer periods. You can view the expiry date of each cookie through your browser settings.
We use both types. We use persistent cookies to remember your log-in details and make it easier for you to log-in the next time you access the Service. We use both persistent and session Cookies for additional purposes, to facilitate the use of the Service's features and tools.
Every browser allows you to manage your cookies preferences. You can block or remove some or all cookies through your browser settings. Please bear in mind that blocking or removing cookies will influence your user experience with our Service. For example, disabling or blocking our cookies will require you to re-enter your log-in details, or even prevent you from using some features of the Service.
We also use clear gifs, which are tiny graphics with a unique identifier used to count user or visitor visits/clicks to web pages while using the Service. These do not retain any personally identifiable information.
We and our hosting services implement systems, applications and procedures to secure your personally identifiable information, to minimize the risks of theft, damage, loss of information, and to prevent unauthorized access or use of information.
These measures provide sound industry standard security. However, although we make efforts to protect your privacy, we cannot guarantee that the Service will be immune to all wrongdoings, malfunctions, unlawful interceptions or access, or other kinds of abuse and misuse.
We perform periodical assessments of our data processing and privacy practices, to make sure that we comply with this policy, to update the policy when we believe that we need to, and to verify that we display the policy properly and in an accessible manner.
If you have any concerns about the way we process your personally identifiable information, you are welcome to contact our privacy team at email@example.com, or write to us. Our address is published on our website at www.xplenty.com and, if applicable, is indicated in your subscription agreement with us.
We will review your query and make good-faith efforts to resolve any existing or potential dispute with you.
We have further committed to refer unresolved privacy complaints under an EU-US Privacy Shield acknowledged recourse mechanism. You can file a complaint to such a recourse service at no charge. Further details, including how to file a complaint, are available on the Xplenty Privacy Shield page here.
Additionally, if you are an EU data subject, you can invoke binding arbitration in certain cases as provided by Annex I of the EU-U.S. Privacy Shield Agreement. For further information, please visit the Privacy Shield website at www.privacyshield.gov, or contact our privacy team.
If you have any questions or concerns, please write to us at the address listed above. We will investigate and attempt to resolve complaints and disputes regarding use and disclosure of Personal Data in accordance with the Privacy Shield Principles.
In the event we are unable to resolve your concern, you may contact JAMS, which provides an independent third-party dispute resolution body based in the United States, and they will investigate and assist you free of charge. A binding arbitration option may also be available to you in order to address residual complaints not resolved by any other means. Xplenty is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (“FTC”).
From time to time, we will update this policy. If the updates have minor if any consequences, they will take effect 10 days after we post a notice on the Service's website. Substantial changes will be effective 30 days after our we initially posted the notice.
Until the new policy takes effect, if it materially reduces the protection of your privacy right under the then-existing policy you can choose not to accept it and terminate your use of the Service. Continuing to use the Service after the new policy takes effect means that you agree to the new policy. Note that if we need to adapt the policy to legal requirements, the new policy will become effective immediately or as required by law.
From time to time, we will update this policy. Minor changes will take effect 10 days after we post a notice on the Service's website. Substantial changes will be effective 30 days after the notice is posted.
Note that if we need to adapt the policy to legal requirements, the new policy will become effective immediately or as required by law.
If changes to this policy materially reduce the protection of your privacy right, you have until the new policy takes effect to reject the changes by terminating your use of the Service. Continuing to use the Service after the new policy takes effect means that you agree to the new policy.
Incorporation to the Terms of Service
This policy is an integral part of the Xplenty Terms of Service or, if applicable, of any other Service subscription agreement entered between you (or the entity that you represent) and us.
Reporting of Unethical Activity
Any time that a customer, vendor, 3rd party, or employee has a concern regarding the propriety or legality of any action taken or proposed by Xplenty or any employee, this concern should be promptly reported to firstname.lastname@example.org.
Please contact our Privacy Team at email@example.com for further information.