Sprout Social, Inc. Privacy Policy
Last updated: September 27, 2021
Sprout Social respects your right to privacy. This privacy policy (“Privacy Policy”) explains who we are, how we collect, share and use information about you and how you can exercise your privacy rights.
Our Privacy Policy applies to all users of Sprout Social websites and services, including but not limited to www.sproutsocial.com and www.getbambu.com (depending on your use, the “Site” and/or the “Service”). For further information on the terms which govern your use of the respective Service, please see https://sproutsocial.com/terms or any service order you may have signed with us.
Information Collected
We collect information about visitors to our Site, our customers and their users of the Service, job applicants, and users of our customers’ social media pages / properties.
Such information is collected from the following sources:
- Information We Collect Directly from You: The type of information that we collect directly from you varies based on your interaction with our Site and our Service. For example, we collect information directly from you when you register an account with us, liaise with us on a customer service issue, apply for a job, and complete an application or other forms on the Site and/or Service. We also collect information that you send us via any medium, including, but not limited to email address and phone number. In addition, we collect information about you from your social media interactions on third party social media properties, such as your social media handle, username, profile, postings, and messages you exchange with our customers.
- Information We Receive from Customers: We receive information from customers in order to provide our Service. Such information may include a user’s social media handle, username, profile picture, biography, follower counts, website URL, first and last name (if provided by user), and messages or communications with our customers. We collect information from individuals employed by our customers such as their contact information in order to provide our Service.
Information Collected Automatically
When you visit our Site or use our Service, we may collect certain information automatically from your device. In some countries, including countries in the European Economic Area, this information may be considered personal information under applicable data protection laws.
Specifically, the information we collect automatically may include information like your IP address, device type, unique device identification numbers, browser-type, broad geographic location (e.g. country or city-level location), third party webpages accessed via the Service and other technical information. We may also collect information about how your device has interacted with our Site (including the pages accessed and links clicked) or Service (including content accessed).
Collecting this information enables us to better understand the visitors who come to our Site or use our Service, where they come from, and what content and functionality is of interest to them. We use this information for our internal analytics purposes and to improve the quality and relevance of our Site and/or Service to our visitors and users.
Some of this information may be collected using cookies and similar tracking technology, as explained further under the heading “Cookies, similar tracking technology, and analytics” below and in our Cookie Notice.
Information from Other Sources
We also collect information from other sources. The following are the categories of sources we collect information from:
- Data brokers or resellers from which we purchase data to verify and supplement the data we collect.
- Social networks when you engage with our content, reference our Site or Service, or grant us permission to access information from the social networks.
- Partners that offer co-branded services, sell or distribute our products, or engage in joint marketing activities.
- Customers that provide us with information which we process as a service provider.
Do-Not-Track
Your browser settings may allow you to automatically transmit a “Do Not Track” signal to online services you visit. Note, however, there is no industry consensus as to what site and app operators should do with regard to these signals. Accordingly, unless and until the law is interpreted to require us to do so, our systems do not recognize browser “do-not-track” requests. You may, however, disable certain tracking as discussed in this Privacy Policy (e.g., by disabling cookies, or using ‘private’ browsing modes).
Use of Information
Sprout Social processes information for business and commercial purposes in accordance with the practices described in this Privacy Policy. Our business purposes for collecting and using information, including in the last 12 months, include the following:
- Operate and improve the Site and Service;
- Provide users or customers with the Service and other products and services that a user or customer may request or that a user or customer has expressed interest in;
- Facilitate subscription processing, reviews and analysis;
- Evaluate user interest and needs in order to improve the Service and make available other offers, products or services;
- Record calls with customers for quality, training and Service improvement purposes (upon receipt of consent where required by applicable law);
- Evaluate the types of offers, products or services we make available to users or customers and potential users or customers;
- Monitor use of the Service, including for troubleshooting and product improvement purposes;
- Provide customer support;
- Communicate and provide additional information that may be of interest to users through email or other means, such as special offers, announcements, and marketing materials;
- Conduct online research surveys regarding the Site and/or Service;
- Combine datasets to create aggregated data for internal evaluation and analysis;
- Share anonymised or personalised tokens across the Sprout Social and Bambu platforms in order to provide the Service;
- Send you reminders, technical notices, updates, product announcements, security alerts and support and administrative messages, service bulletins, or marketing;
- Provide advertisements to you through email messages;
- As necessary to consider your job application for open positions, process your employment and education history, transcript, writing samples, and references;
- Manage our everyday business needs such as Site and/or Service administration, forum management, fulfillment, analytics, fraud prevention, enforcement of our corporate reporting obligations, legal terms and any other contractual agreement relating to our Service or to comply with the law; and
- Fulfill any other business or commercial purposes at your direction or with your notice and/or consent.
Notwithstanding the above, we may use information that does not identify you (including information that has been aggregated or de-identified) for any purpose except as prohibited by applicable law. For information on your rights and choices regarding how we use information about you, please see “Your Data Protection Rights” below.
Legal basis for processing personal data (EEA or UK visitors / users only)
If you are a visitor or user from the European Economic Area or the UK, our legal basis for collecting and using the personal data described above will depend on the personal data concerned and the specific context in which we collect it.
However, we will normally collect personal data from you only where we have your consent to do so, where we need the personal data to perform a contract with you, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect personal data from you.
If we ask you to provide personal data to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal data is mandatory or not (as well as of the possible consequences if you do not provide your personal data).
Similarly, if we collect and use your personal data in reliance of our legitimate interests (or those of any third party), we will make clear to you at the relevant time what those legitimate interests are.
If you have questions about or need further information concerning the legal basis on which we collect and use your personal data, please contact us using the contact details provided under the “How to Contact Us” heading below.
Your Data Protection Rights
You have the following data protection rights:
- If you wish to access, correct, update or request deletion of your information, you can do so at any time by contacting us using the contact details provided under the “How to Contact Us” heading below. Note that if you submit a request to delete your information, this may prohibit you from using the Site and/or Service. If you have authorized us to access your data via the YouTube API Services, then in addition to our normal procedure for deleting stored data, you may revoke our access to your data via the Google security settings page, located at https://security.google.com/settings/security/permissions.
- In addition, if you are a resident of the European Union, you can object to processing of your personal data, ask us to restrict processing of your personal data, or request portability of your personal data. Again, you can exercise these rights by contacting us using the contact details provided under the “How to Contact Us” heading below. Note that if you submit such a request, this may prohibit you from using the Site and/or Service.
- You have the right to opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing emails we send you. To opt-out of other forms of marketing (such as postal marketing or telemarketing), then please contact us using the contact details provided under the “How to Contact Us” heading below. Please note that your opt out is limited to the email address, device, and phone number used and will not affect subsequent subscriptions.
- Similarly, if we have collected and processed your information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your information conducted in reliance on lawful processing grounds other than consent.
- You have the right to complain to a data protection authority about our collection and use of your information. For more information, please contact your local data protection authority.
We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws. Where we process your information solely on behalf of a customer, we may be legally required to forward your request directly to our customer and/or social media business partners for their review / handling. California residents may have additional rights as set out in Section 23 (“Additional Disclosures for California Residents”) below.
Security & User ID/Password
Our Site and/or Service implements and maintains various reasonable and appropriate administrative, physical, and technical security safeguards to help protect information about you from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction. These security safeguards include, but are not limited to, network and host security controls (e.g., firewalls, intrusion detection systems, etc.), data encryption (both at rest and during transmission), and operating procedures that are designed to protect your information. You should protect your user ID and password and NOT share it with anyone. Additionally, enabling two-step verification or SSO integration, where available, is also recommended. If you believe your user ID and password have been compromised or you have trouble changing your user ID/password on the Site or Service, please contact our technical support department ([email protected]). Nevertheless, transmission via the internet is not completely secure and we cannot guarantee the security of information about you.
Data retention
We retain information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements).
When we have no ongoing legitimate business need to process your information, we will either delete or anonymise it in accordance with our data retention policy, or, in the limited circumstances where this is not possible (for example, because your information has been stored in backup archives), then we will securely store your information and isolate it from any further processing until deletion is possible.
CAN-SPAM Compliance Notice (U.S. users only)
We may send periodic promotional or informational emails to you. You may opt-out of promotional communications by following the unsubscribe or opt-out instructions contained in the email. Please note that it may take up to 10 business days for us to process opt-out requests. If you opt-out of receiving promotional emails about recommendations or other information we think may interest you, we may still send you emails about your account or any Service you have requested or received from us.
International Transfers
Your information may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different to the laws of your country.
Specifically, our servers are located in the United States, and our group companies and third party service providers and partners operate around the world. This means that when we collect your information we may process it in any of these countries.
However, we have taken appropriate safeguards to ensure that your information will remain protected in accordance with this Privacy Policy. These include our use of European Commission-approved Standard Contractual Clauses or using or disclosing personal information transferred from the European Union and our continued commitment to honoring principles set forth in the EU – U.S. Privacy Shield Framework, additional details of which are set out below.
Transfers Outside of the EEA and Switzerland
Sprout Social has certified that it adheres to the principles of the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework (“Privacy Shield Principles”) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal data from the European Economic Area and Switzerland transferred to the United States.
While Sprout Social does not rely on the Privacy Shield Principles as the legal basis for the transfer of personal information from the EEA, United Kingdom, or Switzerland, Sprout Social is committed to protecting personal data from the EEA, United Kingdom, and Switzerland in compliance with those principles. If there is any conflict between the policies in this Privacy Policy and data subject rights under the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification page, please visit https://www.privacyshield.gov/.
With respect to personal data received or transferred pursuant to the Privacy Shield Frameworks, Sprout Social is subject to the investigatory and enforcement authority of the U.S. Federal Trade Commission.
Contacting Us, Complaints and Dispute Resolution
In compliance with the Privacy Shield Principles, Sprout Social, Inc. commits to resolve complaints about your privacy and our collection or use of your information transferred to the United States pursuant to Privacy Shield. European Union and Swiss individuals with privacy inquiries or complaints should first contact us by email at [email protected]. We will work to resolve your issue and will respond within 45 days of receipt. If, however, you believe that we have not been able to assist with your complaint or concern, and you are located in the EEA, the United Kingdom, or Switzerland, you have the right to lodge a complaint with the competent supervisory authority.
Sprout Social has further committed to refer unresolved privacy complaints under the Privacy Shield Principles to an independent dispute resolution mechanism, the BBB EU Privacy Shield, operated by BBB National Programs. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/privacy-shield-complaints/ for more information and to file a complaint. This service is provided free of charge to you.
If your Privacy Shield complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See Privacy Shield Annex 1 at https://www.privacyshield.gov/article?id=ANNEX-I-introduction.
Sprout Social commits to cooperate with EU data protection authorities and comply with advice given by such authorities with respect to human resources data transferred from the European Union in the context of any employment relationship with a European Union individual.
Privacy Complaints in Brazil
In circumstances in which Brazil law is controlling, we commit to resolve complaints about your privacy and our collection or use of your information. We have further committed to refer unresolved privacy complaints to an independent dispute resolution mechanism.
Children
This Service is intended for a general audience, and is not directed at children under thirteen (13) years of age.
Consistent with the federal Children’s Online Privacy Protection Act of 1998 (COPPA), we do not knowingly request personal information from anyone under the age of 13 without requiring parental consent. Any person who provides their personal information to us through our Site or Service represents that they are at least 13 years of age. If you are a parent or guardian and you believe we have collected information from your child in a manner not permitted by law, contact us at [email protected]. We will remove the data to the extent required by applicable laws.
We do not knowingly “sell,” as that term is defined under the CCPA, the personal information of minors under 16 years old who are California residents.
If you are a California resident under 18 years old and registered to use the Service, you can ask us to remove any content or information you have posted on the Service. To make a request, email us at the email address set out in the “How to Contact Us” section with “California Under 18 Content Removal Request” in the subject line, and tell us what you want removed. We will make reasonable good faith efforts to remove the post from prospective public view, although we cannot ensure the complete or comprehensive removal of the content and may retain the content as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.
Your Nevada Privacy Rights
Nevada law (SB 220), permits customers in Nevada to opt-out of the sale of certain kinds of personal information. A sale under Nevada law is the transfer of this personal information to third parties for monetary consideration. Sprout Social does not sell your personal information to third parties as defined in Nevada law. If you are a Nevada resident and wish to obtain information about our compliance with Nevada law, please contact us as at [email protected].
Updates to this Privacy Policy
We may update this Privacy Policy from time to time in response to changing legal, technical or business developments. When we update our Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Policy changes if and where this is required by applicable data protection laws.
You can see when this Privacy Policy was last updated by checking the “last updated” date displayed at the top of this Privacy Policy.
How to Contact Us
If you have any questions about this Privacy Policy or our privacy practices, please contact us at [email protected].
If you have a disability and would like to access this Privacy Policy in an alternative format, please contact us at [email protected].
If you have a privacy concern or complaint, please contact our Data Protection Officer at [email protected]. When you contact us, please indicate in which country and/or state you reside.
Additional Disclosures for California Residents
These additional disclosures for California residents apply only to individuals who reside in California. The California Consumer Privacy Act of 2018 (“CCPA”) provides additional rights to know, delete and opt out, and requires businesses collecting or disclosing personal information to provide notices and means to exercise rights.
Notice of Collection.
In the 12 months prior to the last update of this Privacy Policy, we have collected the following categories of personal information enumerated in the CCPA:
- Identifiers, including name, email address, phone number account name, IP address, and an ID or number assigned to your account.
- Customer records, billing and shipping address, and credit or debit card information.
- Commercial information, including purchases and engagement with the Service.
- Internet activity, including your interactions with our Service.
- Audio or visual data, including pictures or videos you post on our Service.
- Employment and education data, including information you provide when you apply for a job with us.
- Inferences, including information about your interests, preferences and favorites.
For more information on information we collect, including the sources we receive information from, review the Information Collected and Information Collected Automatically sections. We collect and use these categories of personal information for the business purposes described in the Use of Information section, including to provide and manage our Service.
Sprout Social does not generally sell information as the term “sell” is traditionally understood. However, to the extent “sale” under the CCPA is interpreted to include advertising technology activities such as those disclosed in the Cookies, similar tracking technology, and analytics section as a “sale,” we will comply with applicable law as to such activity.
Sprout Social discloses the following categories of personal information for commercial purposes: identifiers, demographic information, commercial information, internet activity, geolocation data and inferences. We may disclose each of the foregoing categories of personal information for the business and commercial purposes described in this Privacy Policy to the extent permitted by applicable law to the categories of third parties as described in this Privacy Policy, which may include our service providers and suppliers; our business and marketing partners, including advertising networks, data analytics providers, data brokers, and social networks; and other parties in connection with business transfers and for legal, safety, fraud prevention, and enforcement reasons. We use and partner with different types of entities to assist with our daily operations and manage our Service.
We may share your personal information with government entities when required to do so by law. Please review the To Whom We Share Your Information section for more detail about the parties we have shared information with.
Right to Know and Delete.
Consumers who are California residents (and not representatives of businesses, whether those businesses are our customers or others) have the right to request that we delete the personal information we have collected from you (subject to certain exemptions) and the right to know certain information about our data practices in the preceding 12 months. In particular, you have the right to request the following from us:
- The categories of personal information we have collected about you;
- The categories of sources from which the personal information was collected;
- The categories of personal information about you we disclosed for a business purpose or sold;
- The categories of third parties to whom the personal information was disclosed for a business purpose or sold;
- The business or commercial purpose for collecting or selling the personal information; and
- The specific pieces of personal information we have collected about you.
To exercise any of these rights, please email us at [email protected], submit a request through our online form available on our Help Center if you are a customer or user, or call our toll free number at (866) 878-3231. In the request, please specify which right you are seeking to exercise and the scope of the request. We will confirm receipt of your request within 10 days. We may require additional information from you to help us verify your identity and process your request. The verification steps may vary depending on the sensitivity of the personal information and whether you have an account with us. If we are unable to verify your identity, we may deny your requests to know or delete.
We may deny certain requests, or fulfill a request only in part, based on our legal rights and obligations. For example, we may retain personal information as permitted by law, such as for tax or other record keeping purposes, to maintain an active account, and to process transactions and facilitate your requests. Except as otherwise provided by applicable California law, for purposes of these requests under this Section, personal information does not include information about job applicants, employees and other of our personnel; information about employees and other representatives of third-party entities we may interact with; or information we have collected as a service provider to our customers.
If personal information about you has been processed by us as a service provider on behalf of a customer and you wish to exercise any rights you have with such personal information, please inquire with our customer directly. If you wish to make your request directly to us, please provide the name of our customer on whose behalf we processed your personal information. We will refer your request to that customer, and will support them to the extent required by applicable law in responding to your request.
Right to Opt-Out.
To the extent Social Sprout sells your personal information as the term “sell” is defined under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information by us to third parties at any time. You may submit a request to opt-out by clicking Do Not Sell My Personal Information. You may also submit a request to opt-out by calling our toll-free number at (866) 878-3231, or emailing us at [email protected].
Authorized Agent.
You can designate an authorized agent to submit requests on your behalf. However, we will require written proof of the agent’s permission to do so and verify your identity directly.
Right to Non-Discrimination.
You have the right not to receive discriminatory treatment by us for the exercise of any of your rights.
Shine the Light.
Pursuant to Section 1798.83 of the California Civil Code, residents of California can obtain certain information about the types of personal information that companies with whom they have an established business relationship have shared with third parties for direct marketing purposes during the preceding calendar year. In particular, the law provides that companies must inform consumers about the categories of personal information that have been shared with third parties, the names and addresses of those third parties, and examples of the types of services or products marketed by those third parties. To request a copy of the information disclosure provided by Sprout Social pursuant to Section 1798.83 of the California Civil Code, please contact us via email at [email protected].