Navattic Privacy Policy
Navattic Privacy Policy
Navattic, Inc. (“Navattic,” “we,” “us,” “our”) care about how your personal information is used and shared, and we take your privacy seriously. Please read the following to learn more about our Privacy Policy. By visiting or using the various websites owned and operated by Navattic under the navattic.com domain, including, without limitation, the https://navattic.com/ website (each, a “Website, and collectively, the “Websites”), accessing, or viewing demos hosted by Navattic and/or accessing or using any other functionalities, features, applications or services offered from time to time by Navattic in connection with the Websites (collectively, the “Services”) in any manner, you acknowledge that you accept the practices and policies outlined in this Privacy Policy, and you hereby consent to our collection, use, and sharing of your information as described in this Privacy Policy. Where we process information as a service provider on behalf of a Customer (as described in Section I below), that processing is governed by our agreement with, and the instructions and privacy notice of, that Customer, rather than by the consent described in this paragraph.
I. What Does This Privacy Policy Cover?
This Privacy Policy covers our treatment of (1) personally identifiable information, as defined by numerous statutes in the United States (such statutes, the “PII Laws”), (2) information protected by the California Consumer Privacy Act (the “CCPA”) and the California Online Privacy Protection Act (“CalOPPA”), (3) personal information and private information, as defined by the New York Stop Hacks and Improve Electronic Data Security Act (the “SHIELD Act”); (4) personal data, as defined by the European Union General Data Protection Regulation (the “GDPR”), and (5) personal information, as defined by Canada’s Personal Information Protection and Electronics Documents Act (“PIPEDA,” and collectively with the PII Laws, CCPA, CalOPPA, the SHIELD Act, and GDPR, the “Privacy Laws”) (collectively, “Personal Information”), which we gather when you are accessing, viewing or using any of our Websites, Media and/or Services. This policy does not apply to the practices of companies that we do not own or control, or to individuals that we do not employ or manage.
Our Two Roles. Navattic handles Personal Information in two different capacities, and this Privacy Policy should be read with that distinction in mind:
(1) Information we handle as a business/controller for our own purposes. This includes Personal Information about our own account holders, website registrants, and prospects, and information we use to provide, secure, administer, and market our Websites and Services and to run our own business. Except where we state otherwise, the rest of this Privacy Policy describes how we handle this information, and where we rely on your consent or our legitimate interests, that basis is described in Section IV(E). For this information, Navattic is the “business” under the CCPA and the “controller” under the GDPR and UK GDPR.
(2) Information we process as a service provider/processor on behalf of our Customers (Demo Visitors and Prospects). When you view or interact with an interactive product demo, guided tour, or related content that one of our Customers created and made available using the Services, Navattic collects and processes lead data and engagement data about that interaction — such as your name and business email where you provide it, company, job title, IP address, device and browser information, approximate location, and engagement data such as demos and pages viewed, clicks, time spent, steps completed, and form responses — solely as a service provider (as defined by the CCPA) and processor (as defined by the GDPR and UK GDPR) on behalf of, and at the direction of, the applicable Customer. For this information:
- the Customer, not Navattic, is the business and controller, and is responsible for providing any required notice to you and for the legal basis for the processing;
- Navattic uses this information only to provide the Services to that Customer for the business purposes the Customer specifies, and does not sell or share it, use it for its own purposes (including our own marketing), or combine it with information from other sources, except as permitted for a service provider under the applicable Privacy Laws;
- if you wish to exercise privacy rights over this information, please contact the relevant Customer; if you contact Navattic, we will refer your request to, or handle it on behalf of, that Customer; and
- our processing of this information is governed by our data processing agreement with the applicable Customer.
References in this Privacy Policy to information we “collect,” “use,” or “share,” and to the legal bases, retention, and rights described below, apply to information we handle as a business/controller under (1) above, except where we state that we are acting as a service provider on behalf of a Customer under (2) above.
II. What Information Does Navattic Collect?
Navattic does not collect Personal Information indiscriminately. We limit the type of Personal Information and the amount of Personal Information to what is necessary to fulfill the purposes identified in this Privacy Policy. With that in mind, we collect the following types of information:
A. Information You Provide to Us:
We may collect Personal Information from you when you visit any of our Websites, register for or subscribe to our Services, contact us with questions or concerns, and/or otherwise interact with our Websites or Services. For example, when you register for our Services, we may collect your name and e-mail address so you can access the Services. You can choose not to provide us with certain information, although that may affect the functionality of the Services.
B. Information Collected Automatically:
Whenever you interact with any of our Websites, we automatically receive and record information on our server logs from your browser including data related to demo usage and “cookie” information. “Cookies” are identifiers we transfer to your computer or mobile device that allow us to recognize your browser or mobile device and tell us how and when pages in our Website are visited and used and by how many people. You may be able to change the preferences on your browser or mobile device to send “do not track” signals or to prevent or limit your computer or device’s acceptance of cookies, but this may prevent you from taking advantage of some of our Website’s features. If you click on a link to a third party website, such third party may also transmit cookies to you. This Privacy Policy does not cover the use of cookies by any third parties. Where demo usage and related engagement data is collected through an interactive demo or guided tour that a Customer created and made available using the Services, we collect and process that data as a service provider on behalf of that Customer, as described in Section I.
C. E-mail and Other Communications:
We may contact you, by email or other means; for example, we may send you promotional offers on behalf of other businesses, or communicate with you about your use of any of the Websites. When we do this, we may receive a confirmation when you open an email from us. This confirmation helps us make emails more interesting and improve our service.
D. Personal Information Navattic Has Collected in the Last 12 Months:
Navattic has collected the following categories of Personal Information in the 12 months immediately preceding the Effective Date of this Privacy Policy, listed at the bottom of this document: names; contact information; payment card information; browser information; device information; information related to the use of the Websites and Services; email confirmations; e-mail addresses to permit access to the Services; the content of communications and user profile information and submissions. Please see the other portions of Section II above for an explanation of the categories of sources from which we collect the information described in the previous sentence. The business purposes of this information are described in Section III below. The categories of third parties we share this information with are described in Section IV. Some of the information in these categories — in particular the lead data and engagement data of demo visitors and prospects — is processed by Navattic as a service provider on behalf of our Customers rather than for Navattic’s own purposes, as described in Section I.
III. What Does Navattic Do With Personal Information?
We may use Personal Information (including: names; contact information; browser information; device information; information related to the use of the Websites and Services; email confirmations; the content of communications and user profile information) to personalize and improve our Services, to administer and improve our Websites, to allow our users to set up a user account and profile, to contact users, to fulfill your requests for certain products and services, to analyze how users utilize the Websites, and as otherwise set forth in this Privacy Policy. The uses described in the previous sentence apply to Personal Information that Navattic handles as a business/controller under Section I, and not to the lead data and engagement data of demo visitors and prospects that Navattic processes as a service provider on behalf of a Customer. We require that users verify their e-mail address to protect user accounts. We may use payment card information to process payments to Navattic. With respect to the lead data and engagement data of demo visitors and prospects, Navattic processes that information solely as a service provider on behalf of the applicable Customer and makes it available to that Customer so that the Customer may (i) assess, improve, and develop the interactive demos it builds on Navattic and (ii) use the information for its own business purposes. Navattic does not use this demo visitor and prospect data to personalize or improve its own Services, to analyze how users use the Websites for Navattic’s own purposes, or for any other purpose of its own.
IV. Will Navattic Share Any of the Personal Information it Collects?
We share your Personal Information with third parties as described below.
A. Customers:
When you interact with an interactive demo or guided tour that a Customer built on Navattic, we make available to that Customer the lead data and engagement data we collect through that interaction, which may include information collected via Navattic forms, browser information, device information, and information related to the use of the demo and Services. As described in Section I, Navattic processes this information as that Customer’s service provider, and making it available to the Customer is a disclosure to the business/controller on whose behalf it was collected. It is not a sale or a “share” of Personal Information, and Navattic does not disclose this information to any other third party except as instructed by the Customer or as permitted for a service provider under the applicable Privacy Laws.
B. Business Transfers:
We may choose to buy or sell assets. In these types of transactions, customer information is typically one of the business assets that is transferred. Also, if we (or substantially all of our assets) are acquired, or if we go out of business, enter bankruptcy, or go through some other change of control, Personal Information would be one of the assets transferred to or acquired by a third party. Personal Information that Navattic processes as a service provider on behalf of a Customer (as described in Section I) is not among the assets we would sell, and in any such transaction it would continue to be subject to the service-provider restrictions in this Privacy Policy and the applicable data processing agreement.
C. Protection of Navattic and Others:
We reserve the right to access, read, preserve, and disclose any information that we reasonably believe is necessary to comply with law or court order; enforce or apply our conditions of use and other agreements; or protect the rights, property, or safety of Navattic, our employees, our users, or others. This includes exchanging information with other companies and organizations for fraud protection and credit risk reduction.
D. With Your Consent:
Except as set forth above, you will be notified when your Personal Information may be shared with third parties, and will be able to prevent the sharing of this information.
E. What Is Navattic’s Legal Basis for Collecting and Using Your Personal Information?
As relevant, Navattic collects and uses your Personal Information (1) pursuant to your informed consent, which you have granted by confirming the prompts produced by the Websites and by continuing to use the Websites and Services, consistent with the Privacy Policy and Navattic’s terms of service, (2) in order to pursue Navattic’s legitimate business interests providing the Services, and maintaining the Websites, and/or (3) in order to perform a contract to which you are a party. Any one or more of the bases in the previous sentence are the legal basis for Navattic’s collection and use of your Personal Information, depending on how your use of the Websites and Services, and your relationship with Navattic. For further information about the specific legal basis or bases permitting Navattic to collect and use your Personal Information, please contact Navattic at privacy@navattic.com. The legal bases described in this Section apply to Personal Information that Navattic collects and uses as a business/controller for its own purposes. For the lead data and engagement data of demo visitors and prospects that Navattic processes as a service provider on behalf of a Customer (as described in Section I), the Customer — not Navattic — is responsible for determining and maintaining the legal basis for the processing and for providing any required notice to, or obtaining any required consent from, you.
F. How Long Does Navattic Retain Your Personal Information?
Except upon the request of an individual, as explained in Section VII below, and except as the law permits and requires, Navattic maintains Personal Information as follows: a. Logs of known users of the Websites are retained while Navattic has reason to believe that particular user may return to use the Websites. b. Emails submitted and used for marketing are retained while Navattic pursues relevant marketing efforts. Other than as listed above, we will determine the retention period for Personal Information based on the following criteria:
The nature of our relationship with the relevant Customer;
The existence of other ongoing or expected projects with the relevant Customer;
The nature of the Personal Information in question; and
Our business needs.
Lead data and engagement data of demo visitors and prospects that we process as a service provider is retained and deleted in accordance with the instructions of the applicable Customer and our data processing agreement with that Customer, rather than on the basis of Navattic’s own retention criteria.
V. What Are Users’ Rights to Control Their Personal Information?
Except where permitted or required by law (including, but not limited to, compliance with a legal obligation, to further a public interest, and establishing and/or exercising a legal claim or defense), you have the following rights regarding Navattic’s collection and use of your Personal Information. The rights and request process described in this Section V apply to Personal Information that Navattic handles as a business/controller. If your request concerns lead data or engagement data that Navattic processes as a service provider on behalf of a Customer (as described in Section I), please submit your request to the relevant Customer; if you submit it to Navattic, we will refer it to, or handle it on behalf of, that Customer, and the Customer will be responsible for responding.
A. Requests to Navattic:
You may request (1) the correction, updating, deletion, or restriction of collection and use of your Personal Information, (2) the categories of Personal Information Navattic has collected, (3) the categories of sources from which Navattic has collected your Personal Information, (4) the business purpose(s) for collecting and disclosing your Personal Information, (5) an account of how Navattic has used or is using your Personal Information, (6) a copy of your Personal Information retained by Navattic, to be delivered in a structured, commonly used and machine readable format to review or to transfer or transmit to another entity without hindrance, to the extent that that is technically feasible, (7) the categories of third parties with whom Navattic shares your Personal Information, (8) the categories of Personal Information which we share with third parties, and the contact information for such affiliates and/or third parties, (9) a list of all third parties that have received your Personal Information from Navattic, and (10) the specific pieces of Personal Information Navattic has collected about you.
We will respond to all such requests within 30 days, subject to lawful extension of that period, and there may be a delay in processing a request while we verify that the request is valid and originates from you as opposed to an unauthorized third party. Our verification process varies based on the source and nature of the request, but may include: comparing data in the request against Personal Information we retain; contacting you using other contact information; and requesting further information, although we will avoid doing so to the extent possible. To the extent permitted by the Privacy Laws, Navattic retains the right to deny any request if we cannot verify that it originated from you. If you request that your Personal Information be deleted or that we restrict our disclosure of your Personal Information such that we cannot provide that information to third parties we rely on to provide Websites and Services, we reserve the right to terminate and/or limit your access to the Websites and Services. If we do not have your Personal Information, have not collected your Personal Information, or have not disclosed or transferred your Personal Information to another party, we will inform you in response to a request regarding your Personal Information.
In order to make any of the requests above, please follow the following directions:
Requests for (a) the categories of Personal Information Navattic has collected, (b) the categories of sources from which Navattic has collected your Personal Information, (c) the business purpose(s) for collecting and disclosing your Personal Information, (d) the categories of third parties with whom Navattic shares your Personal Information, (e) the categories of Personal Information which we share with third parties, and the contact information for such affiliates and/or third parties, (f) the specific pieces of Personal Information Navattic has collected about you, and (g) a copy of your Personal Information retained by Navattic, to be delivered in a structured, commonly used and machine readable format to review or to transfer or transmit to another entity without hindrance, to the extent that that is technically feasible, may be sent to us at privacy@navattic.com.
When you update information, we may maintain a copy of the unrevised information in our records. Please note that some information may remain in our private records after your deletion of such information from your account. We may use any aggregated data derived from or incorporating your Personal Information after you update or delete it, but not in a manner that would identify you personally.
B. Authorized Agent:
You may authorize an agent to request information about your Personal Information, to request that Navattic delete your Personal Information, and to opt out of the sale of your Personal Information. In order to do so, you must provide written permission to the authorized agent and written notice to Navattic that Navattic may act on requests for information, deletion, and opting out of sales submitted to Navattic by the agent on your behalf. Navattic does not sell, and does not provide an opt-out of sale for, Personal Information that it processes as a service provider on behalf of a Customer, because that information is not sold; requests concerning that information should be directed to the relevant Customer as described above.
C. Withdrawal of Consent:
You may withdraw your consent at any time by contacting us at privacy@navattic.com.
D. Object or Challenge:
You may object, on grounds relating to your particular situation, at any time to the collection and use of your Personal Information based on Navattic’s legitimate interests or based on public interests, or otherwise challenge our compliance with the Privacy Laws, by contacting us at privacy@navattic.com.
Navattic shall respond within at least 30 days, subject to lawful extension of that period. Where such objection is received from an individual whose Personal Information Navattic collects and uses as the processor for a controller (as those terms are defined in the GDPR), or as the service provider for a business (as those terms are defined in the CCPA), Navattic shall inform the relevant Customer of the objection within at least 30 days, subject to lawful extension of that period, and that Customer will be responsible for responding.
E. Prohibit Automated Processing:
At your request, Navattic will terminate any automated decision making that is the sole source of decisions that produce a legal effect concerning you or similarly significantly affect you. Please note that consistent with Section XIII, Navattic does not employ any such decision making at this time.
F. Accessibility for Users with Disabilities:
If you are unable to review this Privacy Policy or any portion of this Policy, please contact us at privacy@navattic.com to receive the information in an alternative format.
G. Non-Discrimination:
Navattic will not discriminate against you because you have exercised any of the rights above or any other rights you retain pursuant to Privacy Laws, including, but not limited to by: denying goods or services to you or providing a different level or quality of goods or services to you.
VI. Is Personal Information About Me Secure?
We employ appropriate administrative, organizational, technical, and physical measures to protect your Personal Information, which we regularly review and update as necessary. Further information follows. Your account is protected by email verification for your privacy and security. You must prevent unauthorized access to your account and Personal Information by limiting access to your computer or device and browser by signing off after you have finished accessing your account. We endeavor to protect the privacy of your account and other Personal Information we hold in our records, but we cannot guarantee complete security. Unauthorized entry or use, hardware or software failure, and other factors, may compromise the security of user information at any time. The Websites may contain links to other sites. We are not responsible for the privacy policies and/or practices on other sites. When following a link to another site you should read that site’s privacy policy.
VII. Children’s Privacy
Our Services do not address anyone under the age of 13. We do not knowingly collect personal identifiable information from children under 13. In the case we discover that a child under 13 has provided us with personal information, we immediately delete this from our servers. If you are a parent or guardian and you are aware that your child has provided us with personal information, please contact us at privacy@navattic.com so that we can take appropriate action.
VIII. Contractual or Statutory Requirement
Except as noted in this Privacy Policy or in contractual documents, Navattic’s collection and use of Personal Information is not a contractual or statutory requirement or a requirement necessary to enter into a contract.
IX. Failure to Provide Personal Information
You can always opt not to disclose information to us, but keep in mind some information may be needed to register with us or to take advantage of some of our special features.
X. Automated Decision Making
Navattic does not rely on automated decision making, including profiling, and will not subject you to decisions based solely on automated processing which will produce legal effects concerning you or similarly significantly affecting you.
XI. Changes to this Privacy Policy
We may amend this Privacy Policy from time to time. Use of information we collect now is subject to the Privacy Policy in effect at the time such information is used. If we make changes in the way we use Personal Information, we will update the privacy policy found on the Websites. You are bound by any changes to the Privacy Policy when you use the Website after such changes have been first posted.
XII. Questions or Concerns; Contact Information
If you have any questions or concerns regarding our privacy policies, please contact our privacy team at privacy@navattic.com