Data processing agreement

Who does what

You are the controller of personal data about your visitors, customers and callers. Sporetag is your processor under the GDPR and the UK GDPR, and your service provider under the California Consumer Privacy Act. For your own account data, Sporetag is the controller, as the privacy policy says.

What we process

• Whose data: visitors to your sites, people who click your short links, people in your customer profiles, people who get your emails and texts, and people who call your tracking numbers.
• What data: page views, events, clicks and heatmaps without an IP address; with 90-day tracking, a random id; where you turn them on, email addresses, phone numbers, names, orders, consent records, messages, call details and call recordings.
• Why: to measure your sites and links, attribute sales to ads, and send the messages and run the tools you set up.
• How long: while your account is open, within your plan's history (30 days on Free), and for the periods on Data, retention and backups.

What we promise

• We process the data only to run Sporetag for you, on your instructions: these terms and the settings you choose. We tell you if we think an instruction breaks the law.
• We never sell it, share it for advertising, or combine it with data from other customers, except to run and secure the service.
• People at Sporetag who can see it are bound to keep it confidential.
• We protect it as our security page says.
• We help you answer requests from people about their data. You can find, export and delete a person's profile yourself in the app.
• If we learn of a breach of your data, we tell you without undue delay, with what we know, so you can meet your own duties.
• We help with data protection impact assessments where you need what only we know.
• We answer reasonable questions about how we protect your data, and give you what you need to show you meet the law.

Subprocessors

You allow us to use the subprocessors on Data, retention and backups. Each is bound by a written agreement that protects your data at least as well as this one. We email account holders before we add or replace one. If you object for a real data protection reason, tell us within 30 days; if we cannot meet it, you may cancel and we refund the time you paid for and did not use. Tools you connect yourself (listed here) receive data on your instruction and are your own choice, not our subprocessors.

Transfers out of Europe

Sporetag is run from the United States. Where personal data from the EEA reaches a country without an adequacy decision, the EU Standard Contractual Clauses (Commission Decision 2021/914, Module 2, controller to processor) apply between you and us and are part of this agreement. For the UK, the UK International Data Transfer Addendum applies; for Switzerland, the clauses apply with the Swiss law changes the Federal Data Protection and Information Commissioner asks for.

When you leave

Before you go, download your data in Settings, Account. When you delete your account, we delete your data as the privacy policy says: from the live database within hours, and from backups as they expire.

Contact

Questions about this agreement or a request about your data: hello@sporetag.com, or by post to Sporetag LLC, 5142 N Academy Blvd PMB 1021, Colorado Springs, CO 80918, United States.