When you use Contentsquare to understand how people use your website or app, your implementation can collect information about visitors.
Some of this information can identify an individual. This is called personal data or Personally Identifiable Information (PII). Examples include an email address, name, phone number, account number, or other information that can identify a person.
Contentsquare provides safeguards to help prevent unnecessary personal data collection. However, you remain responsible for deciding what personal data your organization collects and for ensuring that your implementation follows the privacy laws that apply to you.
Who is responsible for personal data collection
Responsibility is shared between you and Contentsquare, but each party has a different role.
| Party | Role | Main responsibilities |
| Your organization | Data Controller | Decides why and how personal data is collected and used. |
| Contentsquare | Data Processor | Processes personal data on your behalf and according to your instructions and contractual agreements. |
As the Data Controller, you are responsible for making sure that personal data collection is lawful, necessary, transparent, and secure.
As the Data Processor, Contentsquare remains responsible for processing the data according to your instructions, protecting it with appropriate security measures, and meeting its obligations under the Data Processing Agreement.
Your responsibilities as the Data Controller
You are responsible for the personal data collected through your website, app, and Contentsquare implementation.
Define why you collect personal data
Before collecting personal data about your visitors, define what categories of personal data you need and why you need it.
Only collect data that is necessary for the purpose defined in the Data Processing Agreement.
Retrieve the visitor’s consent
You are responsible for determining the legal basis for collecting and processing personal data about your visitors.
Depending on the applicable law and your use case, you may need to obtain consent before collecting personal data. If consent is required, a cookie banner should be set up in order to configure the consent management process before activating Contentsquare collection. You may also need to communicate a privacy notice to your visitors.
Your privacy notice must provide several information, including:
- What categories of personal data you collect
- Why you collect it
- How long you keep it
- Which service providers process it
- How visitors can exercise their privacy rights
Contentsquare provides samples of cookie description here to help you draft your cookie banner.
Prevent unnecessary personal data collection
Review your website, app, and Contentsquare implementation before you start collecting personal data.
Make sure that you:
- Do not send personal data that you do not need
- Mask sensitive data or regulated data before it is collected
- Review URLs, page content, clicked elements, and other collected content
- Check the data sent through custom properties, identifiers, events, and integrations and avoid sending personal data through those channels
- Use “identify” feature (with the hashed option) to send personal data you need for your purpose
- Use internal identifiers instead of direct identifiers, such as email addresses, whenever possible
Use masking and privacy controls
Contentsquare provides masking and privacy controls that can help prevent personal data from being collected or displayed.
Contentsquare automatically detects and replaces certain types of personal data before any information leaves the visitor’s browser. This happens without any configuration. You can see it here.
Contentsquare provides several privacy settings to mask personal data you shouldn’t collect. Use the appropriate settings for your implementation, such as:
- Data masking
- Element masking
- Page masking
Configure masking before enabling a new collection feature. Review your settings whenever you:
- Publish new pages
- Add new forms or fields
- Change your website or app structure
- Enable a new Contentsquare capability
- Add a new integration
- Change your tracking or data collection configuration
For more information, see How to set up and manage Data masking.
Check your data regularly
Personal data can be introduced after your initial implementation. For example, a website redesign may add a new form, URL parameter, page element, or custom data field.
Review your collected data regularly to make sure that:
- The data still matches your original purpose
- Masking rules still work as expected
- New pages and features do not expose personal data
Test your implementation with fictional data. Do not use real personal data when testing.
Manage visitor’s privacy rights and data retention
As the data controller, you are responsible for handling visitor’s privacy requests under applicable privacy laws. These rights can include access, correction, deletion, restriction, or portability.
If Contentsquare receives a request directly from a visitor, we will not action it ourselves; we will forward it to you as the data controller, so that you can respond in accordance with your obligations.
Contentsquare processes and deletes the personal data collected through the platform in accordance with the product-defined retention rules and your agreement with us.
Where you need our assistance to respond to a visitor's privacy request, we require the relevant user ID in order to locate and retrieve the personal data associated with that individual. Without the user ID, we are unable to identify the visitor's data within the platform.
What if you find personal data that shouldn’t have been collected
If you find personal data in Contentsquare that you did not intend to collect:
- Identify the affected data. Record the affected page, app screen, capability, data type, and approximate collection period.
- Prevent further collection. Apply the appropriate masking or exclusion setting. If the capability supports it, temporarily disable the affected collection.
-
Contact Contentsquare promptly.
Email support@contentsquare.com or contact your Contentsquare representative. - Contact your internal privacy team or your external counsel. They can determine whether additional notifications or actions are required.