Privacy, policy, guidance

Overview

Creating effective privacy controls is essential for compliance with various state and national privacy laws. It is also required for meeting customer privacy expectations. Optimizely has implemented a variety of privacy controls, but recognizes that privacy is a shared responsibility with customers.

The purpose of this document is to provide guidance on drafting a compliant and effective privacy policy for use with Optimizely's products and services.

What is a Privacy Policy?

A privacy policy formalizes and communicates how an organization gathers, uses, discloses and manages the data it stores and processes as part of customer-related services. The ultimate goal of a privacy policy is to legally disclose and define how an organization protects its customers' data from improper disclosure and modification, while still meeting applicable laws and regulations.

Basic components of a privacy policy include:

• Data collection use and sharing disclosure Communicates the data types collected, how the organization uses the data and any third parties with whom the organization shares data.
• Method of contact Provides a channel for customers to contact the organization about privacy-related questions or concerns.
• Individual rights Gives customers a list of options for reviewing, opting-out or removing their data from an organization s storage or processes.
• Laws and regulations Provides a list of in-scope privacy laws and regulations by which the organization must abide.
• Privacy policy updates Indicates how the organization implements privacy policy changes and how it notifies customers about these changes.

Optimizely's Privacy Policy

As a service provider of B2B solutions, Optimizely's strategy is to build privacy controls, processes and technologies that both meet our privacy requirements and enable you to meet your own unique requirements. We accomplish this strategy by including privacy information in the following:

• A published privacy policy that communicates general privacy statements, https://www.insitesoft.com/privacy-policy/.
• The Services and Support Agreement (SSA) that customers sign when purchasing Optimizely services.
• A variety of General Data Protection Regulation (GDPR) processes and a Data Processing Agreement (DPA) for customers who require one, such as customers that are in scope for GDPR.

Laws and Regulations

Below is a list of the laws and regulations you should consider when determining your organization s privacy requirements. Each includes a scope that depends on the type of data you collect and the region or nation in which your customer resides.

Law/Regulation	Country of Origin
Health Insurance Portability and Accountability Act (HIPAA)	US
US Privacy Shield	US
Children's Online Privacy Protection Act (COPA)	US
Gramm-Leach-Bliley Act (GLBA)	US
California Online Privacy Protection Act (CalOPPA)	California
General Data Protection Regulation (GDPR)	EU
Personal Information Protection and Electronic Documents Act (PIPEDA)	Canada

Mobile

Apple and Google require all submitted mobile applications to link to a defined privacy policy containing the following elements:

• Identification of all data collected, how it is collected and how you use it.
• Indication that you take due diligence with data you share with third parties, which ensures that the same or equal protections of the data exist.
• Description of data retention/deletion policies and how customers can revoke consent and/or request deletion of their data.

References

For more general information on privacy policies, see:

• Sample Privacy Policy from the Better Business Bureau
• Privacy Shield Framework