Privacy Policy

mParticle, Inc., a corporation organized under the laws of the State of Delaware, U.S.A. (“mParticle”, “we”, “us” and “our”), is a global software-as-a-service company headquartered in New York, New York, U.S.A., with operations in the United Kingdom and the European Union and Economic Area. We offer a suite of technology services and features that enable marketers to connect, distribute and otherwise process their customer data. Our platform consists of: (a) the mParticle service, our core customer data service, (b) Analytics, a data analytics service (formerly known as the Indicative Service), and (c) Cortex, a machine learning or artificial intelligence service (collectively, the “Platform”).

Purpose of this privacy policy

At mParticle, we are committed to protecting your data. We also work very hard at being transparent about the information we hold about you and our customers. Using data allows us to develop a better understanding of how you and other users interact with our communications, and in turn to provide you with relevant and timely information about the work that we do. Data also helps us to engage with our current and potential customers, as applicable (“Customers”).

mParticle collects personal data in the course of its business. The definition of personal data varies depending on the laws where you are located. For example, in the European Union (EU), personal data is defined broadly, and would include data that may be used to contact or identify a person (e.g., email, telephone number), as well as pseudonymous data that is generally only able to identify a computer, browser or a mobile device. The state of California and other U.S. States have also adopted a broad definition of personal information. We will explain the different types of personal data below, and will try to be clear when we’re describing our use of each throughout this Privacy Policy (this “Policy”).

The purpose of this Policy is to explain how information is collected, used and processed by mParticle and its subsidiaries mParticle Limited (UK), mParticle Limited (Canada), mParticle Pty Ltd (Australia), Indicative, Inc., and Vidora, LLC, including how such information:

is treated for recruiting purposes;
is collected from our Customers; and
is collected, used and disclosed via the Platform.

Our objective is to give you a clear explanation about how we collect and process your information through your use of our websites, including any data you may provide through this website and when you sign up to our newsletters, register for an event or ask us to get in touch with you.

It is important that you read this Policy together with any other notices we may provide on specific occasions when we are collecting or processing information about you, so that you are aware of how and why we are using your information. This Policy supplements our other policies and is not intended to override them.

If you have any questions, please contact our Data Protection Officer using the contact details at the end of this Policy.

+ Expand

Who we are

+ Expand

Information we may collect about you

Our Sites are primarily directed to our Customers, companies that provide services to us (“Vendors”), companies that we partner with on things like industry events (“Partners”), and current and prospective employees. Employee (HR) data is covered under a separate privacy policy. Customers, Vendors and Partners are generally businesses (as opposed to individuals). We collect personal data via the Sites that can be used to identify or contact a unique person (“PII”). We generally will only collect PII via the Sites when you provide it directly to us.

For example, you may provide PII, such as an email address or a telephone number, by sending us an email or filling out a form on the Site. Prospective employees may also send their resume that includes their postal address and other employment details. Further, our Customers may register via the Sites with their email address, creating their own password and providing other contact details such as their name, company and title. By registering for and accessing the Sites, our Customers can access the Platform.

If you fail to provide PII

Where we need to collect PII by law or under the terms of a contract we have with you, and you fail to provide that information when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with more information about an event). In this case, we may have to cancel a product or service you have with us, but we will notify you if this is the case at the time.

Users under 16, children

Our Sites and the Platform are directed to businesses. We do not knowingly contact or collect information from children under 16. If you believe we have inadvertently collected such information, please contact us so we can promptly obtain parental consent or remove the information. If you are under 16, or the age of majority in the jurisdiction in which you reside, you may only use the Sites and Platforms with the consent of your parent or legal guardian.

+ Expand

How we collect your data

+ Expand

How we may use your information

We will only use your information when the law allows us to. Most commonly, we will use your information in the following circumstances:

Where we need to perform the contract we are about to enter into or have entered into with you (e.g., where we process your email address in order to access our systems or for billing purposes);
Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests;
Where we need to comply with a legal or regulatory obligation; and
Where we have your consent before using information; provided that you have the right to withdraw consent to marketing at any time by contacting us, and you can find the relevant contact details at the end of this Policy.

Purposes for which we will use your PII and other personal data

We use the information we collect primarily to provide, maintain, protect and improve our current products, to develop new ones and to manage Customer accounts and human resources functions.

We use PII for the general purpose it was provided.

For example, if you ask a question about our products and services, we may send you an email in response, and might even have a salesperson contact you to gauge your interest in learning more about the Platform.

In general, we may use your information to:

Improve the Platform, Sites and how we operate our business;
Understand and enhance your experience using our Sites, products and Platform;
Provide and deliver products and services you request;
Respond to your comments or questions and allow our team to provide service;
Send you related information, including confirmations, invoices, technical notices, updates, security alerts and support and administrative messages;
Communicate with you about promotions, upcoming events and news about products and services offered by mParticle and our selected Partners;
Link or combine it with other information we get from third parties, to help understand your needs and provide you with better service; and
Protect, investigate and deter against fraudulent, unauthorized or illegal activity.

Marketing communications

We aim to communicate with you about the work that we do in ways that you find relevant, timely, respectful, and never excessive. To do this, we use data that we have stored about you, such as which events you have booked for in the past, as well as any contact preferences you may have told us about.

We use consent or in some cases, legitimate interest as the legal basis for communications by email and for the collection of PII in the context of our sales and marketing activities where we have evaluated that our interests are not overridden by your fundamental rights. We will give you an opportunity to opt out of receiving electronic communications. If you do not opt out, we will provide you with an option to unsubscribe or manage your preferences in every email that we send you subsequently. Alternatively, you can use the contact details at the end of this Policy to update your contact preferences.

+ Expand

Data collection and use for the Platforms

The Platforms is designed to allow our Customers to better understand how their customers, prospective customers and other individuals (their “Users”) utilize the products and services offered by our Customers. mParticle operates the Platform as a service provider and data processor with respect to each Customer’s data. We are contractually required to only process data as directed by our Customers and for no other purpose. The Platform provides our Customers with the ability to collect information based on User interactions with Customer owned or operated mobile application(s), mobile website(s) or other digital properties where Customers have integrated with the Platform (collectively, “Customer Digital Properties”) and send communications to such Users. Some information is automatically collected from or about Users when they visit or use Customer Digital Properties. The types of information collected via Customer Digital Properties for the Platform may include: the date/time for a visit to a Customer Digital Property, referrer information such as what search engine and search keywords Users may have used to get to a Customer Digital Property, information about the browser or device your User is on such as their operating system, as well as the city/country location of Users, and any pseudonymous tokens and mobile advertising IDs (e.g., AAID in the Android o/s). In addition, our Customers can each choose what other User data they want to collect and store on the Platform such as an IP address, precise location information such as lat/long, a User’s age, user names, real names, email addresses and other custom data points as determined by each Customer. Each Customer determines whether we transfer data from the Platform and what specific data points are transferred.

Our standard practice is to prohibit Customers from placing onto the Platform sensitive information (e.g., passwords, authentication credentials, credit cards, social security or driver’s license numbers), special categories of data as defined under applicable data protection laws or information that is deemed sensitive by applicable law or self-regulatory codes. mParticle functions strictly as the data processing agent of our Customers. As a data processor and agent of our Customer, mParticle processes data via the Platform as directed by our Customer and for no other purposes. Accordingly, other than those aforementioned restrictions, the data stored on the Platform is subject to the privacy policies of each Customer.

Our standard practice is to prohibit Customers from placing onto the Platforms sensitive information (e.g., passwords, authentication credentials, credit cards, social security or driver’s license numbers), special categories of data as defined under applicable data protection laws or information that is deemed sensitive by applicable law or self-regulatory codes. mParticle functions strictly as the data processing agent of our Customers. As a data processor and agent of our Customer, mParticle processes data via the Platforms as directed by our Customer and for no other purposes. Accordingly, other than those aforementioned restrictions, the data stored on the Platforms is subject to the privacy policies of each Customer.

+ Expand

Disclosure of your details to third parties

Sharing of information, onward transfer

There are certain circumstances under which we may disclose your information to third parties. These are as follows:

We may share your information with certain third-parties as specified below:

With third-party agents, including Vendors who work on our behalf as sub-processors, provided such third parties contractually agree to adhere to the same privacy principles as mParticle;
With Partners, including companies that we think offer complementary services as mParticle, provided such Partners agree to adhere to the same privacy principles as mParticle (e.g., marketing events at industry trade shows) where we have your permission;
Our Customers may request that we send their data to integration Partners – some of which may be found at https://docs.mparticle.com/integrations/, https://www.vidora.com/solutions/integrations/ and https://www.indicative.com/product/integrations/; however, please note that each Customer determines which integration partners to use (if any) and what data gets transferred subject to each Customer’s privacy policy;
To protect the rights and property of mParticle, our agents, employees, Partners, Vendors, Customers and others including enforcement of our agreements, policies and terms of use;
In an emergency, including protection of the personal safety of any person;
For the purposes of a business deal (or negotiation of a business deal) involving sale or transfer of all or a part of our business or assets (business deals may include, for example, any merger, financing, acquisition, divestiture or bankruptcy transaction or proceeding); and
As required in response to a lawful request by public authorities, including meeting of national security or law enforcement requirements.

In cases of onward transfer to third parties of data of EU, UK or Swiss residents received pursuant to the EU-U.S. Data Privacy Framework (“DPF”), the UK Extension to the EU-U.S. DPF, and/or the Swiss-U.S. DPF, mParticle is responsible for the processing of personal information it receives under the above listed DPF programs and subsequently transfers to a third party acting as an agent on its behalf. mParticle shall remain liable under the above listed DPF programs if its agent processes such personal information in a manner inconsistent with the DPF program principles, unless the organization proves that it is not responsible for the event giving rise to the damage.

This Policy does not cover any third-party websites services. To learn about those third parties’ privacy practices, please visit their privacy policies.

Certain U.S. State laws, such as the California Consumer Privacy Act, provide data subjects with the right to opt-out of the sale or sharing of their personal information. mParticle does not sell data as part of the Platform. Similarly, we do not sell identifiable personal data (e.g., email, telephone number) collected via the Sites or pursuant to our sales and marketing activities. However, our marketing team may co-promote events with other companies that may involve the sharing of attendee lists. The sharing of those attendee lists across companies may constitute a sale. Moreover, we enable third-parties operating on our Sites to place pixels that collect pseudonymous data from visitors to our Sites and which may be deemed a sale of personal information in California and other places. This pseudonymous data includes pseudonymous IDs, IP addresses and similar information and is used for marketing and advertising purposes. We provide a notice of these practices when you first visit our Sites and provide the appropriate choice mechanism as required by law. You may control the use of cookies via your browser settings. You may also opt-out from the sale or sharing of this information by mParticle as described in the Cookie Policy.

+ Expand

Security of your information

We take reasonable steps to help protect your information in an effort to prevent loss, misuse, unauthorized access, disclosure, alteration and destruction.

We have put in place appropriate safeguards (both in terms of our procedures and the technology we use) to keep your information as secure as possible. We will ensure that any third parties we use for processing your information do the same and that they will only process your information on our instructions. The third parties will also be subject to a duty of confidentiality.

It is your responsibility to protect your usernames and passwords to help prevent anyone from accessing or abusing your accounts and services. You should not use or reuse the same passwords you use with other accounts as your password for our services. No security or encryption method can be guaranteed to protect information from hackers or human error. Information we collect may be stored or processed on computers located in any country where we do business.

Data Localization, Onward Transfer

mParticle may store and process PII in the United States and the European Economic Area. By using the Platform as a Customer, you consent to this transfer of your information into the U.S. unless you’ve selected a data localization option.

mParticle complies with the EU-U.S. Data Privacy Framework (DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF as set forth by the US Department of Commerce regarding the collection, use, and retention of personal data from the European Union, United Kingdom and Switzerland. mParticle will not use the UK Extension to the EU-U.S. DPF or the Swiss-U.S. DPF as a transfer mechanism for personal data until such time as those programs receive an adequacy designation from the EU Commission.

mParticle has certified that it adheres to the DPF program principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement and Liability. If there is any conflict between the policies of this privacy policy and the DPF program principles, the DPF program principles shall govern. To learn more about the DPF programs, and to view our certification page, please visit https://www.dataprivacyframework.gov/s/participant-search.

As an alternative or in addition to DPF, mParticle may utilize the Standard Contractual Clauses approved by the EU Commission for the transfer of personal data from the EU, UK (along with the UK IDTA or Addendum) and Switzerland.

+ Expand

Data retention

+ Expand

Your legal rights

U.S. Data Subjects

The California Consumer Privacy Act (“CCPA”) provides additional privacy protections for California consumers, including: (a) the right to see what data we have about you, your computer or device (i.e., the right to know), (b) the right to delete the data we have about you, your computer or device (i.e., the right to delete), (c) the right to edit or correct data we have about you, your computer or device (i.e., the right to correct), (d) the right to port that data over to a different provider, and (e) the right to opt-out of the sale to certain third parties (i.e., the right to opt-out from sales of your information). Other U.S. States (e.g., Colorado, Connecticut, Virginia, and Utah) have privacy laws with similar rules as California that grant you similar rights. mParticle uses the same process to honor CCPA and other U.S. State privacy law rights including but not limited to right of access and deletion that we use for GDPR rights for EU and Swiss data subjects. That process is described below.

We do not discriminate against you if you exercise any of the above rights. Moreover, we may not be able to honor a right if doing so would violate applicable law. In some places (e.g., Colorado and Virginia) you may have the right to appeal decisions you feel are incorrect to your state’s attorney general. mParticle may transfer data to third parties pursuant to operating our Sites and as such are considered to have sold data over the past twelve months pursuant to the CCPA. You may view the entities collected data via the site and any choices provided by viewing our cookie policy for mParticle, Vidora and Indicative. We do not sell data via the Platform and do not share data via the Platform except as directed to by the applicable Customer.

Under the CCPA and other U.S. State privacy laws, your request to see the personal information that we have about you may include: (1) specific pieces of personal information that we may have about you; (2) categories of personal information we have collected about you; (3) categories of sources from which the personal information is collected; (4) categories of personal information that we sold or disclosed for a business purpose about you; (5) categories of third parties to whom the personal information was sold or disclosed for a business purpose; and (6) the business or commercial purpose for collecting or selling personal information.

As required by the CCPA and certain other U.S. State privacy laws, you may make an access or deletion request via an authorized agent by having such agent follow the process below. Please note that we will request any authorized agent demonstrate that they have been authorized by you to make a request on your behalf, and we will attempt to verify your request. We require any authorized agents to provide us with contact details such as an email address and phone number so that we may ensure a timely response to the consumer.

Individuals who have provided information directly to one of mParticle’s Customers must send follow-up requests to access or delete such information to that particular mParticle Customer.

If you have any questions, or to make an access, deletion or similar privacy request outlined above, please contact mParticle at privacy@mparticle.com, via the toll-free CCPA number at (888) 441-2022 or via the postal addresses at the bottom of this Policy.

EU, UK, Brazil and Swiss Individuals

mParticle acknowledges that EU, UK, Swiss and Brazil individuals have certain legal rights including the right to complain to a local supervisory authority (e.g., the ICO in the UK) and the right to access the personal data that we maintain about them. An EU, UK, Swiss or Brazil individual who seeks access, or who seeks to correct, amend, or delete inaccurate data, should direct their query to privacy@mparticle.com. If requested to remove data, we will respond within the legally mandated time. In the EEA, mP responds within 30 days. Please note that mParticle is a processor of the data contained on the Platform. If you seek to exercise data subject access rights for data processed via the Platform, we ask that you reach out to the applicable Customer.

Under these circumstances, you have rights under data protection laws in relation to your personal data, as follows:

a) Request access to your personal data

You have a right to request a copy of the personal data that we hold about you. Please use the contact details at the end of this Policy if you would like to exercise this right, or any of the rights listed below. If you are a European resident and consider our use of your personal data to be unlawful, you have the right to lodge a complaint with the relevant supervisory authority.

b) Request correction of your personal data

You have the right to request that we correct the personal data we hold about you, although we may need to verify the accuracy of the new information you provide to us as well as possibly your identity, depending upon your request.

c) Request erasure of your personal data

You have the right to request that we delete or remove personal data where there is no good reason for us continuing to process it. Please note that we may not always be able to comply with your request for erasure if there are specific legal reasons, which will be notified to you at the time of your request.

d) Object to processing of your personal data

You have the right to object to the processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation that makes you want to object to processing on this ground as you feel it impacts your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes, when we are disclosing your personal data to a third party, or where the personal data is used for purposes that are materially different from the purpose(s) for which it was originally collected or subsequently authorized by you. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information that override your rights and freedoms, or we are unable to unilaterally address your concerns where we are acting on the written instructions of our Customer, who is the Controller of your personal data.

e) Request restriction of processing your personal data

You have the right to request that we suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

f) Request transfer of your personal data

You have the right to request that the personal data we hold about you is transferred to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Please note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

g) Right to withdraw consent

In circumstances where we are relying on your consent to process your personal data, you have the right to withdraw your consent at any time. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

h) Rights related to automated decision making

You have the right to learn more about and request to not to be subject to a decision based solely on automated processing where it has a legal or similarly serious effect.

Please also note the following:

No fee usually required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, under EU law, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month unless a shorter time period is required by applicable law. Occasionally, it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Access to your personal data

If you are a Customer, you can contact your customer success manager within mParticle to view the PII we have stored, such as your name, email, address or phone number. You can also contact us by email with a request to view this information.

If you are a job applicant, Vendor or Partner of mParticle and have provided this kind of information, you can also contact us via e-mail with a request to view the information we have in our systems.

Your information choices and changes

You may opt out of receiving promotional emails from mParticle by following the instructions in those emails. If you opt out, we may still send you non-promotional emails, such as emails about your mParticle projects or our ongoing business relationship. An individual wishing to limit the use or sharing of their data should contact email privacy@mparticle.com.

Individuals who have provided information directly to one of our Customers must send follow-up requests to change or delete such information to that particular Customer.

+ Expand

CCPA Requests received by mParticle

	To Know	Average Time to Respond
2020	1	7 days
2021	0	0 days
2022	0	0 days
2023	0	0 days

+ Expand

Notification of changes to our privacy policy

+ Expand

Contact details and further information

Please get in touch with us if you have any questions about any aspect of this Policy, and in particular if you would like to object to any processing of your personal data that we carry out for our legitimate organizational interests.

Please also contact us if you have any questions about the information we hold about you, or to change your contact preferences with us at the following email address: privacy@mparticle.com.

If you wish to escalate your privacy inquiry to our Data Protection Officer, Lucid Privacy Group, please contact dpo@mparticle.com.

Contacting mParticle and dispute resolution

In compliance with the EU-U.S. Data Privacy Framework (DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, you have the right to object to the disclosure of your personal data to unaffiliated third parties (i.e. organizations not acting as our vendors and agents) or to otherwise be used for purposes that are materially different from the purpose(s) for which it was originally collected or subsequently authorized by you.

You may exercise this right or other legal rights, or submit a complaint about your privacy and our collection or use of your personal data. mParticle commits to resolve valid requests and complaints in a timely manner. about your privacy and our collection or use of your personal data. European Union, UK or Swiss individuals with inquiries or complaints regarding this Policy should first contact mParticle at:

Email: privacy@mparticle.com
Postal mail: mParticle Inc., 99 Wall Street, Suite 630, New York, NY 10005, USA

For complaints that cannot be resolved between mParticle and the individual concerned, mParticle has further committed to refer unresolved privacy complaints under the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to the BBB Data Privacy Framework Program, a non-profit alternative dispute resolution provider located in the United States and operated by the Council of Better Business Bureaus. If you are an EU, UK or Swiss individual and you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers/ProcessForConsumers for more information and to file a complaint.

If your complaint is not satisfactorily addressed, and your inquiry or complaint involves human resource data, you may have your complaint considered by an independent recourse mechanism: for EU/EEA Data Subjects, a panel established by the EU data protection authorities (“DPA Panel”). To do so, you should contact the state or national data protection or labor authority in the jurisdiction where you work. mParticle agrees to cooperate with the relevant national DPAs and to comply with the decisions of the DPA Panel.

Should your complaint remain fully or partially unresolved after a review by mParticle, BBB Data Privacy Framework Program and the relevant DPA, you may be able to, under certain conditions, seek binding arbitration before the Data Privacy Framework Panel. For more information, please visit https://www.dataprivacyframework.gov/s/european-individuals. mParticle is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).

Privacy inquiries

If you have any questions or concerns about this policy, please contact us:

privacy@mparticle.com

mParticle, Inc

99 Wall Street, Suite 630

New York, NY 10005, USA

EU Data Subjects

EU Data Subjects may contact the mParticle Representative in the EU, ePrivacy

UK Data Subjects

UK Data Subjects may contact the mParticle Representative in the UK

mParticle Limited

45 Broadwick Street,

Carnaby

London, W1F 9QW

United Kingdom

UKRepresentative@mparticle.com

+ Expand

Privacy Policy

Purpose of this privacy policy

Who we are

Information we may collect about you

If you fail to provide PII

Users under 16, children

How we collect your data

Information you give us

Automated technologies or interactions

How we may use your information

Purposes for which we will use your PII and other personal data

Marketing communications

Data collection and use for the Platforms

Disclosure of your details to third parties

Sharing of information, onward transfer

Security of your information

Data Localization, Onward Transfer

Data retention

Your legal rights

U.S. Data Subjects

EU, UK, Brazil and Swiss Individuals

No fee usually required

What we may need from you

Time limit to respond

Access to your personal data

Your information choices and changes

CCPA Requests received by mParticle

Notification of changes to our privacy policy

Contact details and further information

Contacting mParticle and dispute resolution

Privacy inquiries

See what’s possible with us.

Contact us

Explore the demo