Source: https://mapp.com/privacy/
Timestamp: 2019-04-23 00:09:13+00:00

Document:
Each time this Site and other web-based Services are accessed, our web servers automatically collect Information from the user’s system. This includes Information about the browser type and the version used, the operating system of the user’s terminal device, the Internet Service Provider of the user, the IP address of the user, date and time of access, and the previous website from which the user accesses our Site. Functional cookies may be placed on your computer or device to allow our Sites to remember you during your visit.
Processing this Information is necessary for Mapp to be able to provide an Internet presence and to ensure its security, and is therefore based on our “Legitimate Interest” to be “visible” to the market in accordance with Art. 6.1(f) of the GDPR.
The above-mentioned Information will be deleted as soon as it is no longer required for the purpose of its collection. When storing data in the log file for security purposes, this is generally the case after no more than 7 days. Functional cookies will be deleted once your session ended.
If you contact us via contact form, support ticket or e-mail, the Data you provide will be used to process your request. Your Contact Data may be transferred to our CRM system. The Data you provide is necessary for processing and answering your enquiry – we cannot answer your enquiry without providing it, or we can only answer it to a limited extent.
Mapp has the “Legitimate Interest” as per Art. 6.1(f) of the GDPR to provide ways to be contacted and to process the Data transmitted in the course of sending a request. If the purpose of the request is to conclude a service contract or process a technical support request, the additional legal basis of the processing is “Performance of a Contract” in accordance with Art. 6.1(b) of the GDPR.
When you contact us via the website form, request a demo, register for a webinar, contests or promotions, want to download content or register for and attend events, we will ask for your “opt-in” to be contacted by Mapp. Some offerings such as whitepapers or promotions are funded based on marketing use cases, i.e. you get something for “free” in exchange for the Personal Information needed by us to follow-up with you as a potential future Client. The processing of this Information is based on your “Consent” in accordance with Art. 6.1(a) of the GDPR.
Data processed in this context will be deleted when no longer necessary to achieve the original purpose and defined retention periods expired.
You have the possibility to object to the data processing or withdraw your consent at any time. The objection must be sent to our Data Protection Officer, preferably via the following email address: privacy@mapp.com. In this case, all Personal Information stored in the course of establishing contact will be deleted unless there are any storage obligations to the contrary.
We use our newsletter to keep you up to date on all the latest news connected with our business- but only if you opted in to receive such newsletters. You will have to provide us with a valid email address and basic Personal Information for personalization purposes, including at least your first name, last name, and title. When you register for our newsletters, we will also store your IP address with a time stamp to be able to prove your registration in accordance with the Double Opt-In procedure. We also use so-called pixel tracking to collect certain events when marketing emails are sent (e.g. emails received; emails opened; clicks on links) to create aggregated statistics and reports on the effectiveness of our email marketing campaigns.
Legal basis of the processing of your Information for email marketing is your “Consent” in accordance with Art. 6.1(a) of the GDPR. We do not send you newsletters unless you have affirmatively opted in to receive newsletters.
If you are an existing Client, based on our “Legitimate Interest” per Art. 6.1(f) of the GDPR to advertise our products and to maintain a good relationship with you, you may receive marketing emails from us informing you about offerings related to Services you already purchased.
You can unsubscribe from our marketing emails at any time using the link within the newsletter, or object to the data processing. The objection must be sent to our Data Protection Officer, preferably via the following email address: privacy@mapp.com.
Marketing and email contacts, including newsletter recipients, are deleted when such users become inactive, click an “unsubscribe” button, or otherwise opt out of communications unless there are any storage obligations to the contrary.
We use the tool Google Analytics on our Site to create analyses of the use of our web pages in order to optimize our Site. This is a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, (“Google”). Google is certified under the EU-US Privacy Shield, which guarantees that the EU’s data protection requirements will also be met when Google processes data in the US. In Google Analytics, interactions between users of our website are primarily recorded and systematically evaluated using cookies. When details of our website are accessed, the following Information is stored: Anonymized IP address, the website accessed, the website from which the user accessed the accessed website, the subpages that are called from the page that is called, the time spent on the website, and the frequency of calling the site. We base the use of Google Analytics on our “Legitimate Interest” as per Art. 6.1(f) of the GDPR to better understand how people interact with our website.
The Data stored through tracking will be deleted as soon as they are no longer needed for our purposes, in this case, after 14 months.
Mapp uses the Google Tag Manager (which does not have access to your Personal Information) to implement our own Mapp Acquire Cookie on our Site. This cookie allows us to understand your web-browsing behavior and show you online ads that are better tailored to your needs. Mapp Acquire may collect the following types of information: IP address of the user, timestamp, unique identifier assigned to a device, information about the browser type and the version used, the operating system of the user’s terminal device, the previous website from which the user accesses our website, geographic location, and actions performed within a web page.
The processing of this Information is based on your “Consent” in accordance with Art. 6.1(a) of the GDPR given when you first visited the Site.
In this case, a persistent opt-out cookie (name: “opt-out”) will be set in your browser, preventing your Information from being collected by Mapp Acquire in the future when you visit our Site with this browser. If you use a different browser, this service is generally enabled unless the opt-out cookie is also set in that browser. Please note that the respective service will be reactivated if you delete the corresponding opt-out cookie from your browser.
If you do not agree with this processing, you have the possibility to prevent the installation of cookies by the appropriate settings in your Internet browser.
The above-mentioned Data will be deleted as soon as they are no longer required for the purpose of their collection which is generally after 1 year.
We use Google Maps on our Site to display the locations of our offices and to create route descriptions. This is a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, (“Google”). Google is certified under the EU-US Privacy Shield, which guarantees that the EU’s data protection requirements will also be met when Google processes data in the US.
If you call the Google Maps component integrated in our Site, Google will save a cookie on your device via your Internet browser. Your user settings and data are processed in order to display our location and create a route description. We cannot exclude the possibility that Google may use servers in the USA.
Legal basis for this processing is our “Legitimate Interest” as per Art. 6.1(f) of the GDPR to optimize our Site.
Our Site uses Google Fonts to present fonts. This is a service of Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA, (“Google”). Google is certified under the EU-US Privacy Shield, which guarantees that the EU’s data protection requirements will also be met when Google processes data in the US. Google Fonts is used without authentication and no cookies are sent to the Google Fonts API. If you have an account with Google, none of your Google Account information will be transmitted to Google while using Google Fonts. Google only records the use of CSS and the fonts used and stores this information securely.
Legal basis for this processing is our “Legitimate Interest” in accordance with Art. 6.1(f) of the GDPR to optimize our Site.
We maintain publicly accessible profiles on the social media platforms Facebook, Twitter, YouTube, Instagram, Xing and LinkedIn (‘social media pages’ or ‘fan pages’).
If you visit one of our social media pages when you are logged in to the respective social media network, the social media provider can analyze your usage behavior and associate the Information collected with your social media account, where it may also be enriched. Even if you are not logged in or if you do not have an account with the respective social media network, the social media provider may collect your Personal Information, such as your IP address or data generated by a cookie. The operators of social media platforms can use this Data to create user profiles. Your user profile can then be used to show you ads related to your interests on social media sites as well as other websites.
We can provide you with information about the appropriate guarantees for Data transfers to third countries in accordance with Art. 46 of the GDPR at any time on request.
You are able to assert your rights under Chapter 3 of the GDPR (right to information, rectification, erasure, restriction of processing, data portability, etc.) both against us and against the relevant social media provider. In this context and with regard to our social media pages, we would like to point out that we can only control the processing of Personal Information and the implementation of Data Subjects’ rights within the scope of the options presented to us by the respective provider.
The legal basis for our use of social media pages is our “Legitimate Interest” according to Art. 6.1(f) of the GDPR to run marketing of our events and Services on the Internet.
During the registration process basic user profile data is collected including the user’s name, business email address (used as user identifier), password (stored in hashed format), and permissions. During login you’ll be required to provide your business email address and your password. While you’re using the system, we create logs of your actions including what you accessed, from which IP address and at which time. To better understand how you use our products and to continuously improve our product offerings, we may use additional analytic tools. Additional Data may be shared when you use technical integrations of Mapp Cloud with other solutions. When you are a registered user of one of our Cloud Services, we may automatically register you in our support system, which simplifies the process for you to contact our technical support team. Furthermore, we use relevant Information for billing purposes. Without a registered user account, you cannot use our Cloud Services.
The legal basis for the processing is the “Performance of a Contract” (Art. 6.1(b) of the GDPR). The processing of any Personal Information serves the provision, maintenance and improvement of our software services, as well as the security.
The above-mentioned Data will be deleted after they are no longer necessary to achieve the purpose for which they were collected, generally upon the expiration of the underlying service contract, considering retention periods under tax and commercial law.
Embedded into this Site, you’ll find our online application tool which allows you to apply for a job at Mapp.
We process the Personal Information you have sent us in connection with your application in order to assess your suitability for the position (or any other open positions in our company) and to complete the application process. Once you received and accepted an offer from Mapp, a background verification process will be initiated, which is necessary due to market requirements. Goals of the background verification check are to verify your identity and criminal record clearance, and to confirm claimed qualifications and employments within the last 5 years (as far as relevant). Candidates for financial roles may also be subject to a credit review.
The processing of your Personal Information in this application procedure is necessary for the establishment of an employment relationship, i.e. we can only hire you when you provide the Personal Information we need. Legal basis for the processing of Applicant Data is therefore “Performance of a Contract” as per Art. 6.1(b) of the GDPR. Should the Data be necessary for legal prosecution after completion of the application procedure, further processing will be based on our “Legitimate Interest” in the assertion or defense of claims as per Art. 6.1(f) of the GDPR.
In the event of rejection, your Applicant Data will be deleted 6 months after the assignment of the respective position unless you agreed on further storage in our applicant data pool and consideration for open positions in the future. These Data will be checked annually to see whether there is a need for further storage; otherwise the Data will be deleted. If you have been awarded a position as part of the application process, the data will be transferred from the applicant data system to our personnel information system.
Your Applicant Data will be viewed by the personnel department after receipt of your application. Suitable applications will then be forwarded internally to the department managers responsible for the respective open position. The rest of the process is then coordinated. Within Mapp, only those persons have access to your Personal Information who need it for the proper course of our application procedure. Furthermore, we use specialized service providers for the application process which may involve the processing of your Personal Information outside of the European Economic Area (“EEA”).
Mapp applies effective security safeguards to protect your Personal Information and therefore complies with and is partly certified against ISO 27001.
ISO 27001 is the international standard for information security management and defines the requirements for the introduction, operation, monitoring, and continual improvement of an effective information security management system (ISMS). It systematically ensures that an organization implements and maintains commercially reasonable and industry standard technical and organizational safeguards to preserve the security of (Personal) Information.
Though we do everything we can to prevent a security breach from happening, there are no guarantees. In the case we learn of a security breach, we may attempt to notify you electronically so that you can take appropriate protective steps, by posting a notice on the Site if a security and/or sending an email to you at the email address you have previously provided to us. Depending on where you live, you may have a legal right to receive notice of a security breach in writing. To receive a free written notice of a security breach, or to withdraw your consent from receiving electronic notice, you should notify us.
Mapp is registered under the EU-U.S. Privacy Shield Framework (“Privacy Shield”), and accordingly is committed to the EU-U.S. Privacy Shield Principles. For a list of all companies participating in Privacy Shield, see here: www.privacyshield.gov/list. Mapp is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).
Mapp shall remain liable under the EU-U.S. Privacy Shield Principle of Accountability for Onward Transfer if its sub-processors process your Personal Information in a manner inconsistent with the Privacy Shield Principles, unless we prove we are not responsible for the event giving rise to the damage.
If you are visiting this website from a country other than the country in which our servers are located, your communications with us will result in the transfer of information across international boundaries. By visiting this website and communicating electronically with us, you consent to such cross-border transfers. In the case of data transfers from the European Economic Area (“EEA”) the EU-U.S. Privacy Shield Framework applies.
Your Information may be transferred to and maintained on servers located outside of your country where the privacy/data protection laws may not provide the same protection level as those in your jurisdiction. If you are located outside the United States and choose to provide Information to us, we might transfer Personal Information to the United States and process it there. To ensure the safety of this transfer and the compliance with the applicable European data law, we utilize Standard Contractual Clauses, the EU-U.S. Privacy Shield (if applicable) and express consents (Data Transfer Agreements) in relation to Personal Information originating the European Union or the United States.
If Personal Information about you is processed, you are the Data Subject in the sense of the GDPR. Therefore, you are entitled to the following rights against us as Controller: Right to information, right to rectification, right to limitation of processing, right to deletion, right to data transferability, right of appeal, right to revoke the declaration of consent under data protection law. Some data processing procedures are only possible with your express consent. You can withdraw your consent under data protection law at any time, but this does not affect the legality of the consent until revocation.
Please note that in the event of such a request, we are required to collect additional personal information that will enable us (a) to verify your identity before providing you with information and (b) to retain evidence of your request and how we have responded to it.
Mapp has further committed to refer unresolved privacy complaints under the EU-U.S. Privacy Shield Principles to JAMS, an alternative dispute resolution provider located in the United States. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit JAMS’s Privacy Shield websitefor more information and to file a complaint. These dispute resolution services are provided at no cost to you.
We do not carry out automated decision-making using profiling methods.
We are the Controller of Personal Information related to our Services within the meaning of the General Data Protection Regulation (GDPR) and other data protection regulations. Comprehensive information about our company can be found in the imprint.

References: Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 46
 Art. 6
 Art. 6
 Art. 6