www.showpad.com
Open in
urlscan Pro
3.66.240.95
Public Scan
URL:
https://www.showpad.com/privacy-principles/
Submission: On February 15 via api from DE — Scanned from DE
Submission: On February 15 via api from DE — Scanned from DE
Form analysis 2 forms found in the DOM
GET https://www.showpad.com
<form action="https://www.showpad.com" method="get" class="search:form d:f p:r">
<label for="s" class="sr-only">Search the site</label>
<input type="text" value="" name="s" id="s" class="search:form:input p:a">
<button class="search:form:button" type="submit">
<svg class="d:b l_w:20 l_h:20 i_search">
<use xlink:href="#i-search"></use>
</svg> </button>
</form>GET https://www.showpad.com/
<form role="search" method="get" class="search-form" action="https://www.showpad.com/">
<input type="hidden" name="site_section" value="site-search">
<input type="search" class="search-field" placeholder="Search" value="" name="s" id="s2">
</form>Text Content
Change Language
English
Nederlands English Français Deutsch
Nederlands
English
Français
Deutsch
Search the site
Login
Request a Demo
* Product
* Solutions Overview
Explore the Showpad eOS®
* Use Cases
* Sales Content Management
* Seller Effectiveness
* Buyer Engagement
* Analytics and Insights
* Team Functions
* Showpad for Marketing
* Showpad for Sales
* Showpad for Sales Enablement
* Why Showpad?
Deliver ROI
* Showpad Content
Centralize and customize assets
* Showpad Coach
Onboard and coach at scale
* Showpad Video
Personalize and streamline communication
* Integrations
Enhance workflows and systems
* Professional Services
Partner to be best-in-class
* Pricing
* Showpad Pricing
* The ROI of Showpad
Deliver bigger results, faster
* Customers
* Partners
* Showpad EcoSystem
* Partner program
* Company
* About Us
* Culture
* Our History
* Team
* Board of Directors
* Investors
* Analysts and 3rd party reports
* Careers
Kick-start your career
* Press
See what people are saying
* Contact
Get in touch
* Resources
* Blog
Stay on the cutting edge
* Sales Enablement Maturity Calculator
Measure your team’s capabilities
* Events
Attend industry events
* Webinars
Learn from the experts
* Reports
Dive into the latest research
* Help Center
Answers & resources
* Developer Portal
Showpad eOS developer resources
* Showpad Academy
Level up your Showpad experience
* Showpad Enablement Exchange
Join our community
* Login
Request a Demo
Nederlands English Français Deutsch
--------------------------------------------------------------------------------
SHOWPAD PRIVACY PRINCIPLES
* Showpad NV / Showpad inc. (“Showpad”) operate, exploit and maintain certain
SaaS Products and Services (“Products and Services”) for and on behalf of
Showpad customers’ use and benefit.
* These Showpad Privacy Principles wish to explain what processing activities
are taking place in respect of information relating to individuals (as being
an identified or identifiable natural person) (“Personal Data”) when such
individual (the “Data Subject”) is interacting, directly or indirectly (e.g.
through an integration or through a software client), with the Products and
Services and/or certain content of the Showpad Customer managed thereon (see
FAQ B7.).
* These Showpad Privacy Principles do NOT apply in situations other than
explained above, or in the specific situations where the Showpad Privacy
Policy applies (showpad.com/privacy-policy).
* These Showpad Privacy Principles are always subject to i) the terms of the
Agreement between Showpad and the Showpad Customer, as well, ii) the
applicable polic(y)(ies) of the Showpad Customer (e.g. as being Your
employer, the applicable Showpad Customer Privacy Policy, …) (“Customer
Policy”) that apply to Your interaction with the Products and Services and/or
certain Customer Content managed thereon (see FAQ A2.).
* Showpad may change these Privacy Principles at any time, and all such changes
are effective immediately upon posting a revised version of these Privacy
Principles on the Showpad website. You should review these Privacy Principles
often to stay informed of changes that may affect You. Your Interactions
constitute Your continuing agreement to these Privacy Principles, as they are
amended from time to time.
(last update December 14, 2023)
--------------------------------------------------------------------------------
A. General
1. Applicable data protection legislations
As a company that finds its roots in the European Union, and that considers
compliance to privacy legislation a core principle of its organisation, Showpad
has created these Privacy Principles based upon the foundations of the EU
General Data Protection Regulation (GDPR) (Regulation (EU) 2016/679 of the
European Parliament and of the Council of 27 April 2016 on the protection of
natural persons with regard to the processing of personal data and on the free
movement of such data).
As GDPR currently is the most advanced and elaborate data protection legislation
in the world, Showpad uses GDPR as its main benchmark for its companywide
privacy program.
Seeing the global activities of Showpad, it goes without saying that with these
Privacy Principles, in addition to GDPR, also want to take into account the
principles of other applicable data protection laws (such as the California
Consumer Privacy act of 2018, or, the Swiss Data Protection act).
The principles of such other data protection legislations have either already
been incorporated through GDPR (in most of the cases) or either have
specifically been added to these Privacy Principles.
2. What is the aim of these Privacy Principles & relationship with the Customer
Policy?
These Privacy Principles are provided for convenience only and want to provide
as much information as Showpad is able to provide under applicable data
protection laws (e.g. sections 13/14 GDPR).
Showpad is acting as “Processor” / “Service Provider” in respect of the
operation of the Products and Services and not as data controller (see FAQ B12),
which means that the Customer Policy shall always have priority over these
Privacy Principles.
In no way do these Privacy Principles or the publication thereof mean that
Showpad is taking up a role as data “Controller” under these Privacy Principles
or taking up additional liabilities or responsibilities than as legally
applicable between a controller and processor.
The publication of, or getting acceptance against, the Customer Policy (or
absence thereof) occurs solely under the responsibility of the Showpad Customer.
Where the Data Subject already has accepted the Customer Policy (or where such
(updated) Customer Policy subsequently becomes applicable) that cover Your
interaction, directly or indirectly (e.g. through an integration or through a
software client), with the Products and Services and/or certain Customer Content
managed thereon, the Customer Policy shall apply instead of these Privacy
Principles.
3. What "Interactions" trigger these Privacy Principles to be applicable?
Unless the Customer Policy applies (see FAQ A2) these Privacy Principles apply
to the interactions, direct or indirect (e.g. through an integration or through
a software client), that the Data Subject may have with the Products and
Services and/or certain Customer Content managed thereon.
These Privacy Principles are being provided under the responsibility of the
Showpad Customer, who is acting as data “Controller” for the processing
activities covered under these Privacy Principles (see FAQ B12).
These Privacy Principles do NOT apply in situations other than explained above
or in situations where the Showpad Privacy Policy applies
(www.showpad.com/privacy-policy) (Showpad acting as data “Controller”, including
in respect of Showpad’s use of its own Products and Services).
B. Showpad Products and Services
1. What do the Products and Services consist of?
Showpad is offering Products and Services mainly in the field of sales
enablement / guided selling that measure, analyse and report on the engagement
and behaviour of individuals with content being made available to them through
the Products and Services (“Customer Content”), including “Showpad Content”,
“Showpad Coach”, and “MeetingIQ” (i.e. virtual human interactions for instance
through online meetings). These Products and Services are offered under a
“Software as a Service” model, which is a software licensing and delivery model
in which software is centrally hosted and made available to multiple users over
a network, including through interacting products (including front-end clients,
apps, Web-Interface, plugins, or connectors to third-party applications).
To the extent the Data Subject is interacting with the Products and Services
(see the then current Products and Services offerings at
www.showpad.com/overview), and/or the Customer Content managed thereon, the Data
Subject’s engagement therewith is measured, analysed and reported back to the
Showpad Customer.
The aim is to provide the Showpad Customer through the Products and Services
with the information, insights, analytics and tools to help the Showpad Customer
to streamline and improve interactions by and between their internal
collaborators (e.g. sales teams, marketing teams, …) and/or third parties (e.g.
potential buyers).
Except in the limited cases as explicitly stated in the Showpad Privacy Policy
for which Showpad is data “Controller” (see FAQ B12), Personal Data in respect
of the Products and Services is not processed for any other purpose.
For avoidance of doubt, under these Privacy Principles, Showpad does NOT process
the Personal Data for any other purposes than as described in this FAQ B1.
2. Does Showpad process Personal Data for other purposes than exploiting the
Products and Services?
Under these Privacy Principles, Showpad does NOT process the Personal Data for
any other purposes than for the Products and Services (see FAQ B1) as data
“Processor” on instruction and for the benefit of the Showpad Customer (as being
the data “Controller”) (see FAQ B12).
As Showpad is not the owner of the dataset containing the Personal Data, Showpad
does NOT sell, trade or otherwise commercialise Personal Data as being processed
through the Products and Services to or for the benefit of anyone else than the
Showpad Customer, nor does Showpad use the Personal Data for Showpad’s direct
marketing purposes.
3. What categories of Personal Data are being processed by the Products and
Services?
Depending on the role within the Products and Services (see FAQ B7) certain
categories of Personal Data may be processed as follows:
* Contact information (e.g. name, email address, telephone number, …)
* Account information (e.g. password, profile picture, role, device
information, logon information, Language preference from the browser…)
* Usage/behavior statistics (e.g. sessions, in app views, shares, channel
subscriptions, # of interactions with the Customer Content, …)
* Connection information (e.g. IP address, geolocation, …)
* Customer Content (e.g. documents, presentations, audio, video, … as uploaded
onto and managed by the Products and Services)
* Communications (e.g. Chat content, reviews, comments, Admin announcements, …)
* Information from third party integrations (connected calendars, CRM data,
Marketing data, …)
The Products and Services process Personal Data for and on behalf of Showpad
Customer. It is the Showpad Customer who is acting as data “Controller” (see FAQ
B12) and therefore who determines what Personal Data of which Data Subject to
process.
This information is also made available to the Showpad Customer via the privacy
settings within the Administrator part of the Products and Services. In case you
require more input, you can contact the Showpad data protection officer via
privacy@showpad.com.
4. Are the Products and Services processing regulated or so-called "sensitive”
Personal Data?
Seeing the scope of the Products and Services (see FAQ B1), the Products and
Services are NOT intended or equipped to Process any Personal Data in respect of
genetic data, biometric data, data concerning health (e.g. HIPAA regulated data)
or data concerning a natural person’s sex life or sexual orientation, nor any
Personal Data revealing racial or ethnic origin, political opinions, religious
or philosophical beliefs, trade union membership, or such other data that the
applicable data protection law indicates being “regulated” or “sensitive”
(“Sensitive Personal Data”).
The Showpad Customer – as being data “Controller” (see FAQ B12) – is responsible
for ensuring that no such Sensitive Personal Data is being Processed through the
Products and Services, or where it does, that it does so under its own
assessment and responsibility.
Showpad does not provide for additional means or provide additional effort in
order to have Sensitive Personal Data processed through the Products and
Services.
5. Are the Products and Services processing data regulated by the “PCI Security
Standards Council”?
Seeing the scope of the Products and Services (see FAQ B1), the Products and
Services are NOT intended or equipped to Process any data that is regulated by
the Payment Card Industry Security Standards Council (PCI SSC), nor do the
Products and Services offer features that are subject to the Payment Card
Industry Data Security Standards (PCI DSS).
The Showpad Customer – as being data “Controller” (see FAQ B12) – is responsible
for ensuring that no such PCI regulated data is being Processed through the
Products and Services, or where it does, that it does so under its own
assessment and responsibility.
6. Are the Products and Services making use of automated decision-making
processes?
The Products and Services are NOT intended or equipped to process Personal Data
for any automated decision-making processes or techniques which create or deny
rights to the Data Subject.
The Showpad Customer – as being data “Controller” (see FAQ B12) – is responsible
for ensuring that no automated decision-making processes or techniques are being
added to the Products and Services, or where it does, that it does so under its
own assessment and responsibility.
7. What Roles / interactions exist within the Products and Services?
You can interact with the Products and Services through the following roles:
* “Administrator”: someone generally managing the Products and Services (e.g.
managing User accounts, having privileges for making Customer Content
available for use by the User through the Products and Services, being able
to generally/individually monitor usage statistics);
* “Privileged User”: someone having privileges for managing parts of the
Products and Services (e.g. managing Users accounts of divisions, making
Customer Content available to divisions for use by the division User through
the Products and Services, being able to generally/individually monitor
division usage statistics);
* “User”: someone who through the Products and Services is i) interacting with
the Customer Content being made available to him by the
Administrator/Privileged User, ii) making Customer Content and/or virtual
human interactions (e.g. online meetings) available to a Third-Party Data
Subject, and/or iii) monitoring that Third-Party Data Subject’s engagement
with such content/during such virtual human interactions, as well as the
related usage statistics;
* “Third-Party Data Subject” someone (usually the prospect / potential buyer)
receiving specific information from the User through the Products and
Services usually in respect of a potential business transaction to be
negotiated/concluded with the User, and being allowed access to the Products
and Services and/or Customer Content managed thereon, by or on behalf of the
Showpad Customer (either under or outside of an account).
Each of these roles will generate their specific analytics as to the way how
they interact with the Products and Services and/or Customer Content managed
thereon.
All roles and related user management is controlled and managed by You.
8. What about re-sharing Customer Content through the Products and Services?
To the extent the Administrator – Privileged User – User enables re-sharing of
Customer Content via the Products and Services by the Third-Party Data Subject,
when re-sharing such Customer Content via the Products and Services with a
second Third-Party Data Subject, the first Third-Party Data Subject needs to
ensure:
* being allowed to process the email address of the second Third-Party Data
Subject for that purpose; and
* living up to the respective applicable law or regulation in respect of
fraudulent and misleading activity or sending unsolicited email, mass emails,
or spam (e.g. EU e-privacy regulations).
9. Are there third-party integrations interacting with the Products and
Services?
The Showpad Customer may activate or use certain integrations with third party
applications, through different methods (e.g. the API of the Products and
Services, iFrame, linking to third-party URL’s, …).
Such integration may lead to the fact that third-party applications receive
access to certain Personal Data or Customer Content either directly from the
Data Subject or through the Products and Services.
Such activation, implementation, combination and/or Customer Content offering
occurs solely under the responsibility of the Showpad Customer and the Customer
Policy. Consequently, Showpad does not take any responsibility for this.
10. Which recipients may receive access to Personal Data?
Under these Privacy Principles, Personal Data of Data Subjects may be made
available:
* within the functionality of the Products and Services (as determined by the
Showpad Customer) to:
* Users – Administrators – Privileged Users; and
* Third-Party Data Subjects (e.g. in respect of collaborative functionalities
of the Products and Services such as Shared Spaces)
* within the functioning of the architectural set-up (incl. maintenance &
support) of the Products and Services, to:
* Showpad (including its collaborators); and
* the respective Sub-Processors ((including their collaborators), providing
processing activities for the Products and Services (see FAQ B13).
Disclosures within the functioning of the architectural set-up shall:
* be limited to the Personal Data as required for the specific purpose in
question of the respective recipient; and
* take into account the necessary provisions on confidentiality, integrity,
availability and security of the Personal Data involved.
To the extent required as per applicable Data Protection law, Showpad shall
remain responsible towards the Showpad Customer for such Sub-Processors to
ensure that the processing by such Sub-Processors remain in line with the
applicable data protection law.
Where applicable to the Products and Services in question, Third-Party Data
Subject interactions with Customer Content occurring under “Kiosk Mode” will be
attributed to, and aggregated under the analytics of, the User Account linked to
the “Kiosk Mode”.
11. Are the Products and Services targeted towards minors and children?
The Products and Services, are typically solutions that aim at selling products,
negotiating a sales transaction and/or providing learning capabilities within
professional organisations. As such, the Products and Services are not aimed
towards children and minors, nor should it be used for such purpose.
The Products and Services do not knowingly process Personal Data of children and
minors.
If a parent or guardian becomes aware that his or her child has provided
Personal Data that is processed by the Products and Services without their
consent, he or she should contact the Showpad Customer who is the data
“Controller” (see FAQ B12).
12. Is Showpad acting as Data "Processor" or Data "Controller" in respect of the
Products and Services
It is the Showpad Customer who:
* Manages user accounts to the Products and Services (e.g. password reset,
access rights, third-party integrations, suspending accounts, grouping users,
assigning channels, …);
* Manages the Customer Content being made available through the Products and
Services;
* Determines which Data Subjects to interact with through the Products and
Services (and thus whose Personal Data are to be processed);
* Determines for which purpose the Products and Services are to be used.
It is therefore the Showpad Customer who legally is acting as the so-called data
“Controller”.
Therefore, all inquiries the Data Subject may have, or rights the Data Subject
may want to exercise with regard to the processing of one’s Personal Data
through the Products and Services, need to be addressed to the Showpad Customer
(see FAQ E2). Should Showpad receive such request directly from a Data Subject,
Showpad can legally only pass such request on to the Showpad Customer. Showpad
is legally not allowed to respond to such request, unless as instructed by the
Showpad Customer.
Seeing the above, Showpad is only offering the means allowing the Showpad
Customer to interact with the Data Subject through the Products and Services,
and as Showpad is merely acting upon instructions of the Showpad Customer, this
means that Showpad is processing the Data Subject’s Personal Data as a so-called
data “Processor” for and on behalf of the Showpad Customer.
Notwithstanding the above, in the limited cases as explicitly stated in the
Showpad Privacy Policy (see FAQ A3), certain Personal Data resulting from the
relationship between Showpad and the Showpad Customer, may be processed by
Showpad as being the data “ Controller” (e.g. as required for Showpad as a
controller to administer the (contractual) relationship between Showpad and its
Customer, or, providing support). More info can be found in the Showpad Privacy
Policy (Controller).
13. Do the Products and Services involve Sub-Processors?
The Products and Services make use of two types of sub-processors; 1) “Core
Sub-processors” and 2) “Feature dependent Sub-processors”.
* Core Sub-processors (e.g. hosting partners) are subprocessors that are key to
the functioning of the Products and Services and without whom Showpad cannot
guarantee the functioning of the respective Products and Services, or to meet
the contractual warranties and service levels.
* Feature dependent Sub-processors are sub-processors that offer a certain
functionality that is either not present in all versions of the Products and
Services, either are optional (and thus can be switched off).
To the extent required as per applicable Data Protection law, Showpad shall
remain responsible towards the Showpad Customer for such Sub-Processors to
ensure that the processing by such Sub-Processors remain in line with the
applicable data protection law.
For more information on which sub-processors are used in the Products and
Services as well as the respective details of the processing activity (overview
of sub-processors, location of processing, etc.), see here or see the privacy
settings within the Administrator part of the Products and Services.
In case you require more input on this topic, you can contact the Showpad data
protection officer via privacy@showpad.com.
14. Do the Products and Services Transfer Personal Data to third countries?
Showpad transfers Personal Data to third countries if and when required by:
* Its and its affiliates’ employees and collaborators;
* Third-party technology and service providers as used for the purposes
described in this Privacy Policy (see Sub-Processors) ;
* Third-party maintenance & support recipients (including related
service/technology providers);
* Other third parties to the extent Showpad has good faith belief that such
disclosure is reasonably necessary to (a) comply with a law, regulation or
compulsory legal request from a public or law enforcement authority; (b)
national security (c) protect the safety of any person from death or serious
bodily injury; (d) prevent fraud or abuse; (e) as necessary to protect or
enforce our legal rights & those of our collaborators as well as the
integrity of our Product and Services.
Such disclosures shall always be limited to the Personal Data as required for
the specific purpose of the recipient while taking into account the necessary
provisions on confidentiality, integrity, availability and security of the data
involved.
In the current set-up of the Showpad organisation, such export of personal data
is required to guarantee the functioning of the respective Products and
Services, or to meet the contractual warranties and service levels.
To the extent required as per applicable Data Protection law, where such export
occurs, Showpad shall ensure that such transfer occurs under the necessary legal
provisions as required by the applicable legislation.
To the extent data is being (re)transferred Showpad shall ensure to that such
(re)transfer occurs under such instruments as allowed per the GDPR and providing
for an adequate level of protection of Your Personal Data (e.g. adequacy
decision of the EU commission, binding corporate rules, or EU standard
contractual clauses, …).
15. Under what legal ground is Personal Data being processed through the
Products and Services?
Before each Administrator’s, Privileged User’s and/or User’s Personal Data is
processed, consent from those Data Subjects will be sought at the moment of
creation of their account.
The legal basis for processing Third-Party Data Subject’s Personal Data is
dependent on the privacy setting (as determined by the Showpad Customer), for
example, where processing of Third-Party Data Subject’s Personal Data uses the
setting of:
=> Seeking prior consent from the Third-Party Data Subject:
* consent will be sought at the moment of first interaction with the Products
and Services or the Customer Content made available thereon (except for
virtual human interactions (e.g. online meetings)).
* For virtual human interactions (e.g. online meetings) consent needs to be
obtained from the Third-Party Data Subject(s) participating to such virtual
human interactions (e.g. through oral consent) at the start of the virtual
human interactions.
=> Informing the Third-Party Data Subject:
* an information banner can be made to appear at the moment of first
interaction with the Products and Services or the Customer Content made
available thereon (except for virtual human interactions (e.g. online
meetings)), referring such Third-Party Data Subject to an applicable privacy
policy.
* An information footer can be enabled in the emails that are send out of the
Products and Services to a Third-Party Data Subject.
In respect of EEA residents, consent is an allowed basis for the lawful
processing of Personal Data (see section 6,1 (a) GDPR). Additionally, certain
Personal Data is processed based on legitimate interest (e.g. see section 6,1
(f) GDPR) because:
=> necessary for technical reasons, e.g.:
* IP address is used to determine origin of the request resulting in certain
privacy settings becoming applicable or not;
* email address of a (re-shared) Third-Party Data Subject is used for the
technical aspects of delivering the message to the recipient under an SMTP
protocol;
* email pixel is incorporated in emails sent out (without reporting back if
outside of policy coverage);
* in order to capture consent (e.g. online meetings).
=> used as training material for internal training purposes of the Showpad
Customer, e.g.:
* (deactivated) account analytics (e.g. User analytics of (former)
Administrators/Privileged Users/Users)
* Pitch IQ video’s / training video’s
* (peer) reviews/comments
16. How long is Personal Data retained on the Products and Services?
Data in Showpad hosted environment (production):
* Showpad Customer Instance: The Showpad Customer instance (including all data
it then contains) remains available on production environment for up to 90
days following closure of the Showpad Customer Instance (e.g. where the
contract with the Showpad Customer has expired).
* Administrator/Privileged User/User (“Showpad Content” & “Showpad Coach”):
Subject to the above, from the moment the respective user account is closed
(as part of account management done by the Showpad Customer), the account and
the Personal Data it then contains remains available on production
environment for up to 90 days following user account closure. After such
period, the respective Personal Data of that Administrator/Privileged
User/User is deleted, resulting in the fact that analytics are anonymised for
that user account.
* Third-Party Data Subject (“Showpad Content”): Subject to the above, as long
as the respective Third-Party Data Subject is interacting with or through the
Products and Services and for a certain period after the last interaction
such Party has had with or through the Products and Services (period as
determined and set by the Showpad Customer) the respective Personal Data of
that Third-Party Data Subject is deleted, resulting in the fact that
analytics of that Third-Party Data Subject are anonymised.
* Training content & information (“Showpad Coach”): Subject to the above, such
Personal Data remains available on production environment for up to 90 days
following deletion of such data by the Showpad Customer, after which such
data is deleted or anonymised (as applicable).
* Deletions on production environment occurs in weekly runs.
Data in Showpad hosted environment (backup):
* Backups of the production environment are made on a daily as well as weekly
basis;
* Backups are kept for up to 90 days in addition to the above;
* data will be permanently and irrevocably deleted in backup after such 90-day
period.
* Deletions on backup environment occurs in weekly runs.
17. Are Showpad technology providers and subprocessors vetted by Showpad?
Any supplier, technology provider or subprocessor being onboarded by Showpad is
subject to the Supplier review and vetting process in line with the controls of
the certified Showpad information management system (ISO 27001) and privacy
information management system (ISO 27701), as well as such controls being part
of the Showpad SOC 2 reporting.
In respect of technology providers or subprocessors that are being added to the
Showpad platform stack, these are subject to the highest tier of supplier
vetting by Showpad on security, privacy and compliance before being allowed by
Showpad, and includes the regular re-assessment of their security, privacy and
compliance posture.
18. Does the Showpad platform make use of Artificial Intelligence (AI) services
Some of the Showpad services make use of artificial intelligence (AI).
No AI service may be running under a third-party service or at third-party
location other than as detailed here.
Showpad features that make use of AI services may be using third party AI
models. As Showpad is a data processor, Showpad is not allowed to share customer
data with any other party outside of our subprocessing relationship. This is a
principle that applies to all customer data and for all other purposes,
including third party AI model training.
C. Showpad organistion
1. What is Showpad doing in order to help its Customers comply with applicable
data protection laws?
Showpad has several organisational as well as product related initiatives in
that regard.
* Organisational initiatives include:
* Dedicated privacy website & FAQ’s in respect of the Showpad privacy
program: www.showpad.com/gdpr-information-hub/ and www.showpad.com/gdpr
* Data protection officer (DPO): Showpad has appointed a qualified data
protection officer who supervises the entire data privacy program at
Showpad and works in close conjunction with the Showpad Information
Security Manager. The data protection officer is registered with the
Belgian Data Protection Authority (https://www.dataprotectionauthority.be/)
and can be reached via privacy(at)showpad.com.
* Vetting by Showpad of its vendors & subprocessors: Each vendor to Showpad
is vetted by Legal, Infosec and the Showpad DPO in the areas of security,
contractual terms and privacy related matters (e.g. data processing
agreements, and applicable transfer mechanisms (e.g. EU standard
contractual clauses). Special attention is given to subprocessor that are
acting as subprocessor with regard to the Products and Services.
* Contractual documents / privacy policies: Our contractual documents are
state-of–the-art and contain the necessary provisions, including in respect
of data processing agreements, end-to-end confidentiality, and privacy
policies (meeting all necessary legal requirements).
* intra-group data processing agreement, including Standard contractual
clauses: all companies of the Showpad group are bound by the intra-company
data processing agreement and, where applicable to such entities, include
the Standard contractual clauses, in order to facilitate and safeguard
intra-group data transfers of Personal Data.
* ISO certification: The Products and Services are covered under the Showpad
ISO 27001 and ISO 27701 certification.
* Information security Management system (ISMS): Showpad has implemented an
elaborate ISMS managing and following up on internal policies on data
security.
* Product related initiatives include:
* * EU Data centres / CDN opt out: Showpad’s principle hosting infrastructure
is located within the EU at a first-class world-renowned hosting partner
(AWS – 2 separate EU regions). CDN (Content delivery network) happens
trough global points of presence through AWS Cloudfront and can be switched
off per customer instance.
* Product engineering: All new product capabilities that are to be introduced
within the Products and Services are vetted and checked for privacy
compliance and follow three key cornerstones: (i) the GDPR principles of
“privacy by design” and “privacy by default”, (ii) giving flexibility to
both EU customers and non-EU customers to allow for localized application
of the Products and Services – while (iii) keeping all changes as simple as
possible.
* Elaborate privacy settings: The Products and Services provide for elaborate
privacy settings allowing e.g. for a localized approach in a granular way
or enabling/disabling tracking options.
* Data Protection Agreement (DPA): To the extent the activities of the
Showpad customer are covered by the material and territorial scope of an
applicable data protection law, such applicable data protection law may
require that the processing of the personal data by the Showpad Products
and Services is covered under a data processing agreement concluded between
Showpad and its Customer. Showpad thereto makes available a DPA via
showpad.com/dpa that reflects the unique aspects of the Products and
Services and containing all required specifics in order for the Showpad
Customer to meet his legal obligations. Where relevant or needed, the DPA
shall be an integral part of the Showpad master services agreement
(showpad.com/msa).
2. What security measures are used for the Products and Services?
Showpad has implemented appropriate technical and organisational measures to
ensure a level of security appropriate to the risk, including inter alia as
appropriate: (a) the pseudonymisation and encryption of personal data; (b) the
ability to ensure the ongoing confidentiality, integrity, availability and
resilience of processing systems and services; (c) the ability to restore the
availability and access to personal data in a timely manner in the event of a
physical or technical incident.
Showpad shall thereto take into account the state of the art, the costs of
implementation and the nature, scope, context and purposes of processing as well
as the risk of varying likelihood and severity for the rights and freedoms of
natural persons.
Showpad uses industry standard encryption technologies, including application to
application communication channels are TLS encrypted and data at rest is
encrypted using AES 256 bits encryption. These encryption technologies are
incorporated into the Showpad Product and cannot be managed by the Showpad
customers themselves.
While Showpad aims to implement industry-leading safeguards designed to protect
Personal Data, we cannot guarantee that any Personal Data which was incidentally
processed by the Showpad Customer (e.g. regulated or sensitive Personal Data,
see FAQ’s B4 and B5) is maintained at levels of protection to meet specific
needs or obligations the Showpad Customer may have relating to that type
information.
The Showpad Information security program is covered under an ISO 27001
certification
(see https://www.bsigroup.com/en-GB/our-services/certification/certificate-and-client-directory/),
BSI certificate n° IS653767), as well as an ISAE3402 accreditation, and is
audited on a regular basis by an external audit firm.
The Showpad Information security program is managed by the Showpad Information
Security Team.
3. Does Showpad have a Data Processing Agreement available?
To the extent the activities of the Showpad Customer are covered by the scope of
an applicable data protection law, such applicable data protection law may
require that the processing of the personal data by the Products and Services is
covered under a data processing agreement concluded between Showpad and its
Customer.
Showpad thereto makes available a DPA via showpad.com/dpa that reflects the
unique aspects of the Products and Services and containing all specifics – as
required per the applicable data protection law – in order for the Showpad
Customer to meet his legal obligations (e.g. standard contractual clauses).
Where relevant or needed, the DPA shall be an integral part of the Showpad
master services agreement (showpad.com/msa).
D. Cookies
1. What are Cookies and similar technology?
When making use of the Products and Services the following technology may be
used to store information on the device you use to connect to the Products and
Services (“Device”) or access information already stored on your Device:
* Cookie: a tiny data file that may be placed on Your Device when making use of
the Products and Services that stores certain information and makes it
available to the publisher of the cookie;
* Embedded scripts: programming code that is designed to collect information
about your interactions with the Products and Services, such as the links you
click on. The code is temporarily loaded onto your Device from a web server
or a third-party service provider, and is active while your Devices is
connected to the Products and Services.
* Web Beacons: Small graphic images (also known as “1×1 GIFs” or “clear GIFs”)
that is designed to collect information about your interactions with the
Products and Services, such as the emails you open. Web Beacons are
temporarily loaded onto Your Device from a web server when making use of the
Products and Services.
2. Do the Products and Services use Cookies or similar technology?
The Cookies/Embedded scripts/Web Beacons used within the Products and Services
enables certain features and functionalities of the Products and Services.
A Cookies/Embedded script/Web Beacons does not contain or collect information in
isolation, but when read by a server via Your web browser or through the
Products and Services, it can provide information to such server (e.g. to
facilitate a more user-friendly service by registering users’ preferences,
detect errors, account information, device identification, statistical data, …).
The Products and Services use the following Cookies/Embedded script/Web Beacons:
name Function Where used Essential? May Personal Data be involved?
https://dialog.filepicker.io Filepicker cookie placed by Showpad enables
uploading assets from specific non-native locations Showpad admin Settings Yes
No www.filepicker.io Filepicker cookie placed by Showpad enables uploading
assets from specific non-native locations Showpad admin Settings Yes No _dd_s
DataDog cookie placed by Showpad provides web performance analytics Showpad
admin Settings yes No Pendo cookies (ft_* / mr_*) Pendo Cookie placed by Showpad
monitor the technical functioning of the Products and Services / User NPS
Scoring – Showpad admin Settings
– Showpad User Webapp
– Prospect microsite
– Shared space Yes No SHOWPAD_REMEMBER_ME Showpad Cookie enabling the “Remember
me” functioning of the Products and Services – Showpad admin Settings
– Showpad User Webapp Yes Yes SHOWPAD_SESSION Showpad Cookie allowing for
communications to occurs with the Showpad REST API. Allowing for the behaviour
monitoring within the Products and Services of account users – Showpad admin
Settings
– Showpad User Webapp
– Shared space Yes Yes PLAY_SESSION Showpad Cookie allowing for communications
to occurs with the Showpad REST API. Allowing for the behaviour monitoring
within the Products and Services of account users Showpad User Webapp Yes Yes
Consent checking if consent was given to the privacy policy. Allowing for
behaviour monitoring within the Products and Services Prospect microsite No Yes
SHOWPAD_SESSION Allowing for communications to occurs with the Showpad REST API
Prospect microsite Yes No Showpad_web_app_session Showpad Cookie allowing for
the behaviour monitoring within the Products and Services of account users
Showpad User Webapp Yes Yes Showpad_share_space_session Allowing for the
behaviour monitoring within the Products and Services Shared space Yes Yes
Showpad pixel pixel used for the email tracking functionality of the Products
and Services Emails generated through the Products and Services Yes Yes Google
Firebase crashlytics Real time crash reporting Mobile apps Yes No Google
Firebase analytics Real time crash reporting Mobile apps Yes No Segment A
real-time application monitoring platform identifying issues with the Products
and Services Mobile apps Yes No Amazon Web Services (AWS*) Load balancing
Cookies for website performance Showpad.com/privacy-principles Yes No Cloudflare
(cf_*) Load balancing Cookies for website performance
Showpad.com/privacy-principles Yes No BIGipServers* This cookie name is
associated with the BIG-IP product suite from company F5. Usually associated
with managing sessions on load balanced servers, to ensure user requests are
routed consistently to the correct server. Showpad.com/privacy-principles Yes No
Cookie Control Cookie used for the functioning of the cookie control centers
Showpad.com/privacy-principles Yes No OptinMonster (_oma*) Cookie ensuring opt
out of marketing pop-ups running on the Showpad commercial website
Showpad.com/privacy-principles Yes No
Unless where otherwise indicated in the table above, these Cookies/Embedded
script/Web Beacons are essential to the Products and Services, without which
Showpad can’t provide the Products and Services as warranted to the Showpad
Customer, or guarantee the correct functioning of the Products and Services.
3. Can the Cookies be disabled or deleted?
Apart from the Showpad CONSENT Cookie in the Prospect microsite environment, the
Cookies/Embedded scripts/Web Beacons are an inherent and essential part of the
Products and Services and are necessary in order for Showpad to be able to
provide for the Products and Services as warranted towards the Showpad Customer,
or guarantee the correct functioning of the Products and Services.
The Showpad CONSENT cookie in the Prospect microsite environment, is optional
and placing this cookie on an end user Device is dependent on the applicable
privacy settings as determined by the administrator of the Showpad platform at
our customers. this Cookie logs whether or not consent as given by the Prospect
in question to become subject to the profiling towards the Customer Content
shared, and thus to allow for such profiling to take place. If consent was
provided, this cookie will be placed and has a limited validity period
(standardly 14 days, but can be increased to 60 days if so specifically
requested from Showpad) , after which consent will be asked again to confirm
continued tracking. Deleting this cookie restricts further processing of
Personal Data of the Prospect in question.
Deleting or disabling a Cookie can be done by using the following options:
* Web browser
Most web browsers (e.g. Internet Explorer, Mozilla Firefox, Safari, and Google
Chrome) have cookies automatically enabled. You can decide on whether and to
what extent cookies will access Your end device by changing your browser
settings.
* Online assistance
More information on cookies and the way to manage or refuse cookies per browser
type (e.g. Internet Explorer, Mozilla Firefox, Chrome, Safari, …) can be found
at https://www.allaboutcookies.org , https://www.aboutcookies.org or
http://www.youronlinechoices.eu
* Tools
Certain tools (e.g. “Ghostery”, “Disconnect”, … ) may provide you with more
granular options in order to manage cookies.
E. Rights of Data Subjects
1. What rights do Data Subjects have?
Subject to such right being entrusted by Applicable Data Protection Law, Data
Subjects may have the right to:
* Obtain access to and/or rectification of one’s Personal Data as processed by
the Products and Services;
* Request to receive one’s Personal Data in a format at the discretion of the
Showpad Customer (e.g. excel, .CSV file, via the Showpad API, …), that allows
for the data portability of such data to a similar service;
* Withdraw one’s consent for processing of one’s Personal Data (be advised that
such leaves unharmed and does not affect the prior lawful processing of one’s
Personal Data, or the continuation of processing of (part of) Your Personal
Data as allowed under an applicable legal ground (see FAQ B15)
* The restriction of processing of Your Personal Data under article 18 GDPR
and/or right to object to the processing of Your Personal Data under article
21 GDPR.
Please check the applicable data protection legislation for the ability to
exercise such rights.
As Showpad is merely the data “Processor” (see FAQ B12) such rights need to be
exercised towards the Showpad Customer, as being the data “Controller”. In order
to exercise such rights, You may be required by the Showpad Customer to provide
proof of Your identity by providing an official document (e.g. ID Card, driver’s
license, …).
2. How to exercise Your rights as Data Subject?
As Showpad is merely the Data “Processor” (see FAQ B12), in order to exercise
Your rights (see FAQ E1), You need to contact the Showpad Customer. In order to
exercise such rights, You may be required by the Showpad Customer to provide
proof of Your identity by providing an official document (e.g. ID Card, driver’s
license, …).
Should Showpad receive such request directly from You, Showpad can legally only
pass such request on to the Showpad Customer. Showpad is legally not allowed to
respond to such request, unless as instructed by the Showpad Customer.
3. How does Showpad respond to a request from a Data Subject?
Should Showpad receive a request directly from a Data Subject, Showpad can
legally only pass such request on to the Showpad Customer. Showpad is legally
not allowed to respond to such request, unless as instructed by the Showpad
Customer.
From the moment it is established that the Data Subject request is related to a
processing activity for which the Showpad Customer is data “Controller”, and to
the extent the Showpad Customer is identified, Showpad shall pass on such
request without undue delay to the respective Showpad Customer, in order for the
Showpad Customer to respond to such request.
4. Where to log a complaint?
In case You as a Data Subject have a complaint about the way Showpad is
processing Personal Data, You can always contact the Showpad DPO directly
at privacy@showpad.com and we will listen to Your complaint and see if we can
help You to resolve this.
If You have an unresolved complaint, You always have the right to log a
complaint with the competent “data protection authority”. Information on the
competent data protection authority and the way of logging a complaint can be
found here (or the URL as updated by the European Commission).
Showpad NV, located in Belgium, acts as so-called:
* “main establishment” in the EEA under GDPR.
* “representative“ in line with section 27 GDPR for and on behalf of Showpad
Inc.
As a result, the competent Data Protection Authority for Showpad NV is the
Belgian DPA (Drukpersstraat 35, 1000 Brussel / +32 (0)2 274 48 00
/ contact@apd-gba.be / https://www.dataprotectionauthority.be/).
5. Who can I contact if I require more information?
Showpad NV, located in Belgium, is a so-called “main establishment” in the EEA
under GDPR and also acts as the so-called representative in line with section 27
GDPR for and on behalf of Showpad Inc.
Showpad has appointed a data protection officer for the whole Showpad Group who
can be contacted at “Office of the Data Protection Officer – Showpad NV –
Moutstraat 62 – 9000 Gent (Belgium)” or privacy@showpad.com.
THIS SITE USES COOKIES
Some of these cookies are essential, while others help us to improve your
experience by providing insights into how the site is being used.
For more detailed information, please check our Cookie and Privacy Policy
Accept Recommended Settings Reject All
--------------------------------------------------------------------------------
NECESSARY COOKIES
Necessary cookies enable core functionality. The website cannot function
properly without these cookies, and can only be disabled by changing your
browser preferences.
--------------------------------------------------------------------------------
ANALYTICS
Analytical cookies help us to improve our website in reporting information on
its usage.
--------------------------------------------------------------------------------
MARKETING
We use marketing cookies in order to offer you the most relevant information.
Marketing On Off
YOUR CHOICE REGARDING COOKIES ON THIS SITE
We use cookies to optimise site functionality and give you the best possible
experience.
Accept Reject Cookie Preferences
* Company
* About Us
* Culture
* Team
* Careers
* Resources
* Resources
* Showpad EcoSystem
* Showpad vs. Seismic
* Press
* Blog
* Events
* Webinars
* Showpad Community
* What Is Sales Enablement
* Help Center
* Privacy Policy
* Online Terms
* Data Security and Privacy
* GDPR Information Hub
* Responsible Disclosure
* Request a Demo
* Request a Demo
* Showpad Login
* Contact
logologomarkarrow-open-rightClose