Skip to main content

Optimove GDPR & CCPA Compliance

Natalie Samuels
  • Updated

Consumer data protection and privacy have always been important concerns for organizations that process personal customer data. Responding to the increased incidence of data breaches worldwide, governments are also focusing on consumer data security in the form of new legislation. Organizations are required to comply with these continuously evolving regulations while staying innovative and developing their products and services.

The General Data Protection Regulation (GDPR) is European Union legislation that represents the most significant change to data protection laws in the EU since 1995. The GDPR replaces that year’s Data Protection Directive (Directive 95/46/EC) and unites data protection regulations across the entire EU.
 
The GDPR presents significant challenges for any organization doing business in Europe or with EU citizens, regardless of where the organization is located. The GDPR specifies non-compliance fines at 4% of a company’s annual global revenue or €20 million, whichever is greater. As no organization wants to face huge fines or a negative impact on their reputation among customers, investors, and employees, compliance with the GDPR has received much attention from organizations of all sizes.
 
Your customers need to know that they can trust you with their personal data and trust that you are taking the necessary measures to ensure the security of this information. If an organization fails to comply with the GDPR, it may indicate to the market that the organization is not doing everything it must to keep its customers’ data secure. When this level of trust is missing, it can lead to the loss of customers and employees, drops in share price, and other hazards of a tarnished reputation.
 

|| GDPR and CCPA

The GDPR, which came into effect on 25 May 2018, is one of the world's most comprehensive data protection laws to date. Due to the lack of comprehensive federal privacy law in the U.S., the CCPA (California Consumer Privacy Act) is considered the most crucial legislative privacy development. The two regulations bear similarities concerning their definition of terminology, the establishment of protections for individuals, and the inclusion of rights to access personal information.

How the GDPR Applies to Optimove

The GDPR defines two main entities: “data processor” and “data controller”. The definitions of, relationships between and responsibilities of data controllers and data processors are specified with the goal of protecting the rights of EU citizens whose personal data is stored or processed. The GDPR describes the particular types of security, IT, and administrative activities that might be considered necessary for handling personal data, including encryption, documentation, and taking measures to ensure the integrity, confidentiality, availability, resilience, assessment, and post-incident recovery of processing systems and services.

In our business relationship with you, Optimove acts as a data processor, while your company is a data controller.
  • Data controller (You) – Controllers bear the primary responsibility for GDPR compliance. As a data controller, you manage customer data, access controls, and authentication.
  • Data processor (Optimove) – Any entity that processes personal data under the controller’s instructions. As a data processor, we provide cloud-based software, services, infrastructure, and support. As a data processor, we are obliged to make our best efforts to protect your customer data and enable you to fully meet GDPR requirements.

Prepared for the GDPR

At Optimove, we are committed to full compliance with everything required by the GDPR, as well as taking additional precautions to ensure the complete security and privacy of your customers’ data. Optimove has always focused on data protection and regulatory compliance, and we are constantly looking for better ways to secure data in transit, at rest, and in use. We strive to meet the demands of our client base of more than 300 companies from more than 25 countries to comply with all relevant regional laws and regulations.

We have prepared for GDPR by actively enhancing our products to ensure that your organization meets the data privacy, protection, confidentiality, integrity, and availability challenges that the GDPR places on the data that we handle for your organization.
 
These preparations have included low-level mapping of PII, data privacy vision and strategy, data protection impact assessments, employee awareness and training, data breach management planning, and others.
 
We have also assigned a Data Protection Officer. The primary responsibility of this role is to ensure that Optimove is correctly and sufficiently protecting regulated personal data according to the GDPR and other relevant laws and regulations.
 

All of Optimove’s applications and data reside, on cloud, in multiple datacentres (multi region) belonging to Amazon Web Services (AWS), Google Cloud Platform (GCP) and Microsoft Azure. Leveraging cloud providers and services enables us to offer maximum performance for predictable workloads and greatest elasticity for burst workloads.

 

How Optimove Complies with the GDPR

The following table presents the specific ways in which Optimove complies with the requirements of the GDPR.
 

GDPR Requirement

How Optimove Complies or Enables Your Compliance
Information and transparency
Each Optimove instance is configured and documented with the help of “workbooks and procedures”. Workbooks and procedures describe the features and processes used to store, process and protect customer data.
Access to data
All personal data for a data subject is available for reporting using our Customer Explorer and Customer 360 interactive reports, as well as various functions of theOptimove API.
Rectification of data
Using the Optimove Batch Data Process, you can change an individual’s personal data. Overriding data retention laws or other legal requirements may prevail.
Erasure of data
Data purge (in the sense of complete and irrevocable deletion or erasure of an individual customer’s data) is possible using both Optimove web interface and theOptimove API, which you can use to implement your requirements. Purging of customer data must be explicitly indicated by you for specific customers by specifying each customer’s ID. See below for details about implementing customer data erasure.
Restriction of processing
Optimove admin users can restrict data processing of an individual customer by purging their data from the Optimove database as described below.
Data portability
All personal customer data in Optimove is available for reporting, export/download and access via functions of theOptimove API.
Data breach notification
Data breach notification handling for Optimove as a data processor is described in the Data Processing Agreement (DPA), Section 3.4. For your own processes, the tools for read access logging can be used.
Privacy by design
Privacy by design is inherent in all Optimove products, as data protection and privacy have always been an important element in our products and services. While Optimove’s software and systems have been developed based on data protection principles and best practices, you are still responsible for configuring and using them appropriately.
Privacy by default
Optimove products meet the privacy-by-default requirement of GDPR, namely that technical and organizational measures are in place to ensure that, by default, only personal data necessary for a specific purpose is processed.
Consent
You are responsible to demonstrate end user consent.
Automated decisions
Optimove admin users are able to prevent the making of automated decisions regarding an individual customer by purging that customer’s data from Optimove as described below.
Cross-border data transfer
You can decide which data center location your organization will use for hosting your Optimove instance: Frankfurt, Germany or Washington, DC. Optimove does not transfer your customer data out of the country in which it is hosted.

Implementing the Right to Erasure (or, the Right to be Forgotten)

As discussed in Article 17 of the GDPR, the right to erasure, also known as ‘the right to be forgotten’, obligates data controllers to erase the personal data of individuals upon request, without undue delay. To this end, Optimove provides two facilities that you can use to completely and permanently delete all data related to a particular individual from all Optimove systems:

  • By using the RemoveCustomerPIIfunction of the Optimove API.
  • By manually uploading a CSV file using the User Settings web interface. This single-column CSV file (which does not require a column header row) should contain only a list of the Customer IDs used in Optimove that you wish to erase.
  • During the onboarding process, you will need to notify Optimove which fields should be marked as Personal Identifiable Information (PII).
  • After onboarding, you must contact your CSM to mark new fields or unmark existing ones as PII.
  • It may take up to 72 hours from the original erasure request until all data related to a particular customer is completely removed from all Optimove systems.
  • Deleting a customer’s data will erase all personally identifiable data from Optimove (both current and historical data). However, in order to maintain the integrity of campaign and application usage analytics, aggregated anonymous data will not be amended when a user is deleted (for example, a campaign’s “increase in” metric value will not be recalculated once a user is deleted). This is not a problem vis-à-vis the GDPR because this aggregated data cannot be connected back to an individual.
  • You are obliged to make sure that no data from any such customers are delivered to Optimove in the future (e.g., as part of the Optimove Batch Data Process).

Frequently Asked Questions about Optimove and the GDPR

Is Optimove GDPR compliant?
 
Yes, as explained above in this document.
Is Optimove a Data Processor or a Data Controller?
 
As regards your customer data, Optimove is a data processor, while you are a data controller. As your data processor, we are obliged to make our best efforts to protect your customer data and enable you to fully meet the relevant GDPR requirements.
 
In addition, Optimove is a data controller regarding data we collect from our employees who are EU citizens and, with respect to EU citizens in general, from visitors to the Optimove website or other personal data that we may collect in connection with our marketing programs.
Does Optimove have a data center in Europe?
 
Yes, Optimove operates a data center in Frankfurt, Germany. Optimove offers you the option to store your data at either the Frankfurt data center or a data center located in the US. To find out which data center currently hosts your data, or to change its location, contact your CSM.
 
Optimove will not transfer the storage or processing of your customers’ personal data outside the country where it is hosted, in conformance with your instructions as the data controller.
If an EU citizen is located outside of the EU, does the GDPR still apply to them?
 
Yes. The physical location of an EU citizen is not relevant under the GDPR. The GDPR applies to organizations that collect personal data of EU citizens, regardless of where the organization is located, and regardless of where the EU citizen is located at the time the data is collected.
Does the GDPR apply to companies with no presence in Europe?
 
Yes. The GDPR applies to any organization anywhere in the world that collects or processes personal data about EU citizens.
Does the GDPR apply to data collected prior to 25 May 2018 (the day that the GDPR goes into effect)?
 
Yes. Under the GDPR, EU data subjects have control over their personal data, regardless of when the data was collected.
What data am I allowed to collect from EU citizens and what data am I not allowed to collect?
 
The GDPR does not limit the types of personal data that can be collected. Instead, the GDPR requires organizations that collect such data to demonstrate “Data Security by Design” – a dedicated policy that evidences sound principles of security designed to protect personal data from unauthorized access, use or other types of processing.
How does Optimove ensure that a data subject who has asked to be forgotten is excluded from all further processing?
 
When data subjects request to be forgotten, you, as the data controller, are responsible for ensuring that their data is removed from Optimove’s systems, as described above.
How will Optimove technically implement right of rectification, the right of erasure and the right of access?
 
Optimove fully understands and supports the requirements of the GDPR which give data subjects control over their personal data. In fact, Optimove’s focus, as a data processor, is to automate, as much as is technically feasible, the ability of its clients, the data controllers, to respond to requests made by data subjects:
  • Access to data – All personal data stored by Optimove relating to every data subject is available to you via the Customer Explorer and Customer 360 pages, as well as via various functions of the Optimove API.
  • Rectification of data – Using the Optimove Batch Data Process, you can change an individual’s personal data. Overriding data retention laws or other legal requirements may prevail.
  • Erasure of data – Data purge (complete and irrevocable deletion or erasure) is possible as described above.
Are Optimove’s sub-processors GDPR-compliant?
 
Yes. Optimove is responsible for the acts and omissions of its sub-processors and is therefore responsible for ensuring their compliance with GDPR. For example, Optimove uses SendGrid as its email service provider (ESP) for sending emails via Optimail, Optimove’s native email sending module. As an Optimove sub-processor, Optimove is responsible for confirming that SendGrid is GDPR compliant.
 
 
Please address any questions regarding Optimove’s GDPR compliance to your Customer Success Manager. Your CSM will be able to connect you with Optimove’s Data Protection Officer, if necessary.

Related articles