Privacy Policy – Personal Data Protection Compliance | DataGrail

This Privacy Policy covers DataGrail’s policies on the collection, use, and disclosure of Personal Data/Personal Information/Personally Identifiable Information (as defined by applicable law and hereinafter collectively referred to as “Personal Data”) when visitors and Customers (collectively “Users”) access the DataGrail website located at www.datagrail.io (“Site”) and/or subscribe to and access DataGrail’s related Privacy Management Software-as-a-Service applications (the “Services”) (collectively the “Platform”).

By accepting DataGrail’s Privacy Policy, you are consenting to the collection, use and storage of the Personal Data pursuant to the disclosures contained within this Privacy Policy. You may withdraw your consent at any time through the DataGrail’s Privacy Request Form or by email at privacy@datagrail.io.

DataGrail is a Delaware corporation with offices in the United States. Company collects Personal Data and processes, transfers, and stores data within the United States.

1. Personal Data Collected by DataGrail on the Platform

How You Can Control Advertising Cookies. Cookies are also utilized to deliver advertising on our Site. Among other uses, they allow us to show more relevant advertising to people who visit the Site by showing you ads that are based on your browsing patterns and the way you have interacted with our Sites. We may use the following advertising partners. You can find information about how to opt out of targeted ads and related data collection here:

Even if you opt out of cookies/ads personalization, you may still see ads based on factors such as your general location derived from your IP address, your browser type, and your search terms.

2. Personal Data Received by DataGrail or Disclosed or Shared by DataGrail

Personal Data is collected to facilitate the Platform offered, for marketing of our Services, and for internal analysis relating to product improvements and data security. DataGrail shares Personal Data with only those contractors, service providers and other third parties who are bound by contractual obligations to keep Personal Data confidential and to limit such use only for the purpose for which it is disclosed. Personal Data collected is processed to facilitate the provision of the Services on the Platform or as otherwise disclosed at the time of collection to:

Provide Services. Personal Data is used to:

Share with Service Providers. DataGrail has engaged with third party service providers to facilitate the DataGrail Services and operate our business, including without limitation, database management hosting, information technology, email delivery, customer support, sales and marketing outreach, consent management, analytics, data security and compliance services necessary to provide the Services. For each service provider, DataGrail will have in place written contracts that describes the purpose of the service and disclosure of Personal Data, and requires the service provider to both keep the Personal Data confidential and not use it for any purpose except performing the Services pursuant to such contract.

3. Personal Data of Minors

Only persons ages 18 or older are authorized to create a DataGrail account. We do not knowingly collect Personal Data from anyone under the age of 18. If a parent or guardian becomes aware that his or her minor child (as defined by the applicable privacy rules or regulations pertaining to the minor child) has provided us with Personal Data without their consent, he or she should contact DataGrail through the DataGrail’s Privacy Request Form or at privacy@datagrail.io. We will delete such Personal Data from our files within a commercially reasonable time, but no later than required under the applicable law relating to the child’s state and/or country of residence.

4. Retention and Deletion of Personal Data; De-Identified Data

Unless erasure is otherwise requested under applicable law or as otherwise stated in this Privacy Policy, DataGrail will retain account data as long as it is necessary to provide services to our customers. Personal Data obtained from Platform visitors will be maintained as long as it is necessary to provide requested communications and information-based services or until a visitor exercises the right to opt-out of requested communications or information-based services. Anonymized and pseudo-anonymized data will be retained as long as DataGrail determines such data is commercially necessary for its legitimate business interests.

5. DataGrail’s Security Practices

DataGrail implements appropriate administrative, technical and physical security measures that comply with industry standards and applicable laws and regulations to protect Personal Data against unauthorized access, destruction or alteration. However, although we endeavor to provide reasonable security for Personal Data we process and maintain, no security system can ever be 100% secure.

6. Response To “Do Not Track” Signals

“Do Not Track” is a feature enabled on some browsers that sends a signal to request that a website disable its tracking or cross-website user tracking. DataGrail shall treat any user-enabled universal opt-out mechanisms such as Global Privacy Control, a browser plug-in or privacy setting, device setting, or other mechanism, that communicate or signal the consumer’s choice to opt-out of the sale or behavioral advertising related sharing of their Personal Data as a valid request submitted pursuant to California, Colorado, Connecticut consumer privacy laws for that browser or device, or, if known, for the consumer.

7. Changes to this Privacy Policy

If we make material changes to our Privacy Policy, we will notify you by (i) changing the Effective Date at the top of the Privacy Policy, or (ii) sending an electronic notification to all active account holders, or (iii) adding a banner/notification to the Site itself.

8. Supplemental U.S. State-Specific Notices – Notice of Collection

This supplemental notice sets forth the disclosures and rights applicable to U.S. residents residing in U.S. states which have enacted consumer data privacy laws.