Botcopy + GDPR
Botcopy has aligned our policies and practices with the General Data Protection Regulation (GDPR). This page provides a high-level summary. Please contact your CSM or support@botcopy.com with any questions.
Overview.
Botcopy, as a Data Processor, collects and stores a minimum of Personal Data only as instructed by our Customer, the Data Controller, for the purposes of delivering the Botcopy Services.
This page will cover:
- The data we collect and store on behalf of our customers
- How we comply with GDPR with respect to obtaining consents, honoring Data Subject Requests, putting in place the appropriate contracts, and maintaining appropriate safeguards.
- Our sub-processors and what we do to ensure they keep customer data safe.
Looking for more information? Here are some reference pages:
How do you collect and store Data?
Botcopy collects, processes and stores Personal Data about people who chat with the Customer via Botcopy or who reply to the Customer’s email marketing campaigns, only as directed by the Customer. Botcopy does not sell any Contact Data collected on behalf of the Customer or market Botcopy Services to the Customer’s site visitors.
Categories of Data Subjects:
- Customer’s end-user customers or prospects
- Customer’s employees or other authorized users or administrators of Botcopy
Categories of Personal Data:
- Name
- Contact information (company, business email address and phone number)
- IP Address*
- Cookie Data**
- Photographs (we will use photographs of customer employees if the Customer is routing the chats to them after bot qualification)
*Botcopy will only use the IP address for data enrichment, i.e. to determine if it is associated with a business and then give you additional information re: that business such as industry and # of employees).
**Botcopy will only use cookies to track the activities of your site visitors within your site, e.g. whether they visited a particular product page or the pricing page before engaging with the messaging widget. Botcopy will NOT track users across domains or build profiles.
How we comply with GDPR.
Collecting Consents.
You can configure Botcopy to collect consents via chat prior to collecting email addresses or additional personal data.
Botcopy is able to read the consent flag passed from your Consent Management Platform (CMP) and act accordingly.
Appropriate Safeguards.
Per Article 32 of the GDPR, we have in place appropriate technical and organizational measures to keep your data secure. All data is securely stored in Amazon Web Services. Please visit our Security Page for additional information on how we keep your data secure.
Contracts
We have in place the appropriate Data Processing Agreements (DPAs) with all vendors and sub-processors that process data on our behalf. Check out the Sub-processor section below for more information on how we vet and contract with our sub-processors.
Honoring Data Subject Rights.
We have processes in place to honor data subject requests. Botcopy will export, correct, or delete Contact Data upon request by the Customer. If we receive a request directly from a Data Subject, we will work with the Customer to honor the request.
Our Subprocessors.
Some important notes on sub-processors:
- We have a diligence process to ensure that we only trust parties who have stringent standards regarding the safety and security of Personal Data.
- We have in place Data Processing Agreements with all of our sub-processors.
- We rely on a combination of Privacy Shield Certifications and execution of EU Model Clauses where data is being transferred across borders.
- We will notify you of new sub-processors via our Sub-processor Notification Process and give you an opportunity to object.
Here is a list of our sub-processors:
- Amazon Web Services, Inc - Could Infrastructure
- Mongo DB, Inc - Data Enrichment
- Mailchimp, Inc - Email delivery services
- Sendgrid, Inc - Email delivery services