Effective January 1, 2020, the California Consumer Privacy Act (CCPA) establishes protections for consumer data and imposes requirements on companies that collect, process, and/or store personal data. As many consumers who use Bazaarvoice products reside in California, Bazaarvoice is committed to full compliance with all CCPA requirements.
Common questions
What personal data does Vibe collect, process, and store?
Vibe collects two classes of personal data on behalf of its clients:
-
User Generated Content (UGC). Vibe collects UGC and its associated metadata. This content typically takes the form of images or video, often from social media channels like Instagram. The associated metadata may include the customer's name, email address, and/or social media profile. Customers may provide UGC to clients (via Vibe) in one of two ways:
- On Social Media, by posting the content publicly using a client-specific hashtag, or at-mention.
- Using the Upload button rendered in the clients' on-site gallery experience.
- User Interaction Data. Vibe will instrument and record all impressions, hovers, and clicks on any experiences embedded on the clients' website, as well as on any web-based experiences hosted by Bazaarvoice. This user interaction data will be recorded along with IP address and browser user-agent. User interaction data is not linked, either directly or indirectly, to personally identifiable information such as email addresses.
In what capacity does Vibe collect, process, and store personal data?
Vibe acts solely as a Service Provider when it collects, processes, and stores personal data.
Why does Vibe collect, process, and store personal data?
Vibe collects, processes, and stores personal data exclusively for the purpose of performing the services specified in our MSA. Vibe does not sell personal data (or client data), nor does Vibe collect, process, or store personal data (or client data) for any purpose other than providing the services specified in our MSA.
Does Vibe share and sell personal data with any third parties?
Vibe will never sell client data (including any personal data). Further, Vibe does not share client data (including any personal data) with third parties without your consent. Vibe supports integrating with email service providers (ESPs) for the purposes of exporting emails captured using Vibe. All emails are captured with active consent from the end-user. Vibe touchpoints such as Like2Buy and Showroom support integrations with third-party tracking pixels, remarketing pixels, and retargeting pixels.
Is personal data pseudonymized and/or anonymized?
User Interaction Data is promptly pseudonymized upon collection. It is then aggregated, analyzed, and used for both reporting and personalization. UGC is neither pseudonymized nor anonymized.
Is personal data encrypted at rest and in transit?
Yes, Vibe uses secure (HTTPS) channels when collecting personal data and when transmitting personal data between internal services. In addition, all databases which store personal data use disk-level encryption.
Where is personal data stored?
Vibe stores personal data in one of three data centers in Virginia, USA.
What is the Vibe retention policy for personal data?
Vibe retains UGC on behalf of a client for the life of that client's business relationship with Bazaarvoice. Bazaarvoice will permanently delete UGC when its relationship with a client expires, or when either of the following occurs:
- The client submits a written request for data deletion.
- The customer in question revokes their consent for the data to be used.
User Interaction Data is deleted on a scheduled basis after being aggregated and anonymized.
Does Vibe comply with the PCI DSS?
Vibe does not process payment information.
Has Vibe ever been the subject of any inquiry or investigation by a data protection, data privacy, or information security regulator in any state or country?
No.
Are all employees trained as to their responsibilities regarding data security?
Yes. All new employees must attend training within two weeks of their start date. In addition, all employees must attend security refresher training at least once per year.
Are employees required to sign a confidentiality agreement and agree to their responsibilities for information security?
Yes. The Employee Agreement includes a confidentiality clause, and new employees must sign the Acceptable Use policy on their first day of employment.
In the event of a data loss, does Vibe have an Incident Response Plan in place?
Yes. As part of its incident response plan, Bazaarvoice commits to identifying impacted clients of a security incident within 24 hours of becoming aware thereof. We will subsequently provide updates no less frequently than daily until the issue is resolved.
What is the basis for Vibe Information Security policy?
Vibe information security policies and procedures are based on industry best practices, including (but not limited to) the CIS-20 Controls.
What about GDPR compliance?
As many Bazaarvoice clients (and their customers) reside in the European Union, Bazaarvoice is committed to full compliance with all GDPR requirements.
To facilitate the lawful transfer of personal data between the EU and the US, Curalate has self-certified under both the EU-US and Swiss-US Privacy Shield frameworks. Our Privacy Shield Notice can be found here. As part of the certification process, Curalate has designated TrustE as its independent recourse mechanism.
Curalate also offers a Data Processing Addendum to its existing contracts to help clients meet their obligations under the GDPR. This addendum also includes the Standard Contractual Clauses 2010/87/EU (Model Clauses). Clients can obtain the Data Processing Addendum with Model Clauses by reaching out to their Client Solutions Manager.
