MadKudu Privacy Notice (Controller)

Effective on: 2023-10-04

1. Introduction and Scope

1.1. Introduction

MadKudu Inc. and its affiliate entities listed below under “Entities Covered by This Privacy Notice” (referred to collectively as "MadKudu", "we," "us," "our") take the protection of personal data ("Personal Data") very seriously. Please read this privacy notice (the “Notice”) to learn what we are doing with your Personal Data, how we protect it, and what privacy rights you may have under applicable data protection and privacy laws, such as the European Union General Data Protection Regulation (“GDPR”).

1.2. What Is Covered by this Privacy Notice?

This Notice addresses data subjects (which includes both individuals and households) whose Personal Data we:

• receive from our customers (“Customers”) who share data with us through our web-based software application, the MadKudu Platform, (the “Services”), when the Customers are subject to the MadKudu Data Processing Addendum Controller Terms;
• collect from Customers’ use of the Services, when the Customers are subject to the MadKudu Data Processing Addendum Controller Terms;
• collect from our Customers’ websites through the MadKudu cookie, when the Customers are subject to the MadKudu Data Processing Addendum Controller Terms;
• receive from the data subjects when we provide customer support services;
• receive directly through our website (for example, via webform submissions);
• obtain through trackers on our website;
• receive from our business partners; or
• process to promote our Services.

1.3. What Is not Covered by this Privacy Notice?

This Notice does not apply to

• Human Resources Personal Data: Personal Data of employees, job applicants, contractors, business owners, directors and officers of MadKudu. 
• The Use of Personal Data by MadKudu’s Customers: processing of Personal Data by MadKudu’s Customers using the Services. Please read the privacy notices of our Customers.
• Information Which Does Not Constitute Personal Data: If we do not maintain information in a manner that identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular individual or household, such information is not considered Personal Data and this Notice does not apply to our processing of that information.

1.4. What Can You Find in this Notice?

This Notice tells you, among other things:

• What Personal Data we collect about you and how we obtain it
• The legal bases for processing your Personal Data
• For what purposes we use that Personal Data
• How long we keep your Personal Data
• With whom we share your Personal Data
• Your rights about the Personal Data we collect about you and how you can exercise those rights
• How we protect your Personal Data
• How to contact us

1.4. Our Role With Respect to Your Personal Data

Within the scope of this Notice, MadKudu acts as a data controller or “business” for the Personal Data we process. This means that we decide whether, what, whose, how and why Personal Data is collected and further processed. If you want to learn about how MadKudu processes Personal Data on behalf of its Customers, read the MadKudu (Processor) Privacy Notice.

1.5. Entities Covered by this Privacy Notice

This Notice covers MadKudu and the following affiliate entities (the “Affiliates”):

1.6 Lawful Bases for Processing

We must have a valid reason to use your Personal Data. This is called the "lawful basis for processing". We may process your Personal Data based on:

• Your consent: We may rely on your consent when you visit our website and agree to the use of cookies and other trackers. By accepting cookies and other trackers, you allow MadKudu and other third parties to track your browsing behavior and collect data for various purposes such as analytics, personalization, and targeted advertising.
• Our legitimate interests or those of a third party: MadKudu may rely on its legitimate interests or those of a third party if these legitimate interests are not overridden by the data subject’s rights and interests. Read more about legitimate interests below.

We may process your Personal Data based on the following legitimate interests:

• Legitimate interests of MadKudu Customers: Our Customers have a genuine interest in gaining business intelligence through our Services. These Services enable them to obtain valuable insights into their prospects and customers to optimize their sales and marketing strategies by leveraging data-driven insights and predictive analytics. This ultimately leads to a better experience for their prospects and customers
• Legitimate interests of MadKudu: (a) enhancing our Services and deliver comprehensive and up-to-date information to benefit our Customers' business intelligence needs (b) sending marketing communications to promote our Services to existing Customers and business contacts, and to some business representatives, where the applicable laws do not require the recipient’s consent. (c) contacting our business contacts associated with our Customers, prospects, or business partners.
  

When we rely on legitimate interests as a lawful basis of processing, you have the right to ask us more about how we decided to choose this legal basis. To do so, please use the contact details provided here.

1.7 What Personal Data do we process and how we obtain it?

The table below describes the categories of Personal Data we have collected about you in the last twelve months. 

We will not collect additional categories of Personal Data without informing you.

1.8 Cookies and other trackers

A “cookie” is a small file stored on your device that contains information about your device. We may use cookies to provide basic relevant ads, website functionality, authentication (session management), usage analytics (web analytics), to remember your settings, and to improve our website and Services. We use session and persistent cookies. Session cookies are deleted when you close your browser. Persistent cookies may remain even after you close your browser, but always have an expiration date. Most of the cookies placed on your device through our Services are first-party cookies which are placed directly by us. Other parties, such as Google or LinkedIn, also set their own (third-party) cookies on our websites. Please refer to the policies of these third parties to learn more about the way in which they collect and process information about you:

1. Google’s Privacy Policy
2. Segment
3. HubSpot

If you would prefer not to accept cookies, you can change the setup of your browser to reject all or some cookies. Note, if you reject certain cookies, you may not be able to use all features of our Services. For more information, please visit https://www.aboutcookies.org/.You may also use a browser that sends Global Privacy Control (GPC) signals. For more information, please visit https://allaboutdnt.com/ and https://globalprivacycontrol.org/.  Some browsers have incorporated “Do Not Track” (DNT) features. MadKudu does not respond to DNT signals. For more information about our use of cookies, please see our cookie notice.

1.9. For What Purposes Do We Use Your Personal Data? 

We may process your Personal Data for the following purposes:

• For providing and improving our services: Our Customers have a genuine interest in gaining business intelligence through our Services. These Services enable them to obtain valuable insights into their prospects and customers to optimize their sales and marketing strategies by leveraging data-driven insights and predictive analytics. This ultimately leads to a better experience for their prospects and customers
• Providing customer support: Processing Personal Data (such as your name, your job title, the company you work for and your email address) is necessary to address you and resolve your user inquiries or issues effectively. It allows us to fulfill our contractual obligations with our Customers to ensure that their users receive proper assistance from MadKudu when using the Services.
  
• Improve our business: Processing Personal Data (such as your name, your job title, the company you work for and your email address) is necessary to address you and resolve your user inquiries or issues effectively. It allows us to fulfill our contractual obligations with our Customers to ensure that their users receive proper assistance from MadKudu when using the Services.
  
• Sending marketing communications: We use Personal Data (such as your name, email address, job title and company) to send promotional communications about our Services to existing Customers and business contacts, where permitted by applicable laws.
  
• Complying with laws: We may process Personal Data to comply with laws applicable to MadKudu outside the European Union or the United Kingdom.
  

1.10. How Long do We Keep Your Personal Data

We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

Generally, we retain usage data for a shorter period, except when this data is used to strengthen the security or to improve the functionality of our services, or we are legally obligated to retain this data for longer time periods. We will retain Personal Data:

• Processed in our Services’ databases until we receive a valid request to delete personal data from the individual (unless the MadKudu Data Processing Addendum Processor Terms apply)
• Obtained by MadKudu through cookies for the duration of each tracker
  
• Personal Data processed for customer support purposes is stored for a period required or permitted by applicable laws
  
• Reporting data from Google Analytics is stored for 14 months
  
• Reporting data from Google Ads is stored for 14 months
  

If your Personal Data is used for more than one purpose, we will retain it until the purpose with the longest retention period expires; but we will stop using it for the purpose with a shorter retention period once that period expires. Our retention periods are also based on our business needs and good practice.

Your Personal Data may need to be retained in our backup systems and will only be deleted or overwritten later, normally one month after the data is deleted from the production environment. This may be the case even when you or a Supervisory Authority has validly asked us to delete your Personal Data or when we do not no longer have a legal basis for processing such Personal Data.

1.11. Sharing Personal Data with Third Parties

The following table describes, in the last twelve months, the categories of information we have disclosed to third parties for business purposes, and the categories of those third parties.

These are the specific service providers we are referring to:

Infrastructure services providers:
AWS (Amazon Web Services, Inc.) (USA)
MongoDB, Inc. (USA)
Datadog, Inc. (USA)
Customer relationship management software providers:
Zendesk, Inc. (USA)
HubSpot, Inc. (USA)
Salesforce.com, Inc. (USA)
Incident management and response platform providers:
PagerDuty, Inc. (USA)
Payment software or processing providers:
Bill.com, Inc. (USA)
Stripe, Inc. (USA)
B2B marketing data engines:
APIHub, Inc. doing business as Clearbit (USA)
Web analytics providers:
Google LLC (USA)
Collaboration tool providers:
Slack Technologies, Inc. (USA)
Google LLC (USA)
Osano, Inc. (USA)
Analytics providers:
Segment.io, Inc. (USA)
Scheduling assistance software providers:
Calendly, Inc. (USA)
Intrusion detection and prevention providers:
Sqreen SAS (France)

The following table describes the categories of information we sell to third parties, and the categories of those third parties.
‍

When the Personal Data is protected by the GDPR, before transferring your Personal Data to these third parties, we will either ask for your explicit consent or require the third party to maintain at least the same level of privacy and security for your Personal Data that we do. Also, in some cases, the European Commission may have determined that in some countries, their data protection laws provide a level of protection equivalent to European Union law. You can see here the list of countries that the European Commission has recognized as providing an adequate level of protection to Personal Data. We remain liable for the protection of your Personal Data that we transfer or have transferred to third parties through our designated data transfer mechanism, such as Standard Contractual Clauses (“SCCs”) as approved by the European Commission under Article 46.2 of the GDPR, except to the extent that we are not responsible for the event that leads to any unauthorized or improper processing.

1.12. Other Disclosure of Personal Data

We may disclose Personal Data:

1. To the extent required by law or if we have a good-faith belief that such disclosure is necessary in order to comply with official investigations or legal proceedings initiated by governmental and/or law enforcement officials, or private parties) If we must disclose your Personal Data to governmental/law enforcement officials, we may not be able to ensure that those officials will maintain the privacy and security of your Personal Data.
2. if we sell or transfer all or some of our company's business interests, assets, or both, or in connection with a corporate merger, consolidation, restructuring, or other company change; or
3. to our subsidiaries or affiliates only if necessary for business and operational purposes as described in the section above.

We reserve the right to use, transfer, sell, and share aggregated, anonymous data, which does not include any Personal Data for any legal business purpose, such as analyzing usage trends and seeking compatible advertisers, sponsors, clients, and Customers.

2.What Privacy Rights do you have?

Certain privacy laws give you specific rights regarding your Personal Data that we collect and process. Please note that you can only exercise these rights with respect to Personal Data that we process about you when we act as a data controller. To exercise your rights with respect to information processed by us on behalf of one of our Customers, please read the privacy notice of that Customer and contact the Customer.

3. How Can You Exercise Your Privacy Rights?

To exercise any of the rights described above, please submit a request by either:

• Calling us at +1 (203) 216-9872
• Contacting us by email at privacy@madkudu.com;
• Writing to us at: MadKudu Inc. 333 W Maude Ave., Suite 207, Sunnyvale CA 94085 USA (to the attention of Francis Brero); or 
• (RECOMMENDED) Filling out this online form.

To exercise the right to opt out of disclosures and sales of Personal Data happening through cookies and other trackers, clean your browser cookies and reject cookies on our website.

Verification of your Identity: To correctly respond to your privacy rights requests (except requests to stop the sale and share of your Personal Data), we need to confirm that YOU made the request. Consequently, we may require additional information to confirm that you are who you say you are.For changes to your Personal Data submitted via password-protected accounts, your identity is already verified. For requests sent by other means, we may request additional information from you to verify your identity.We will only use the Personal Data you provide us with in a request to verify your identity or authority to make the request.

Verification of Authority: If you are submitting a request on behalf of somebody else, we will need to verify your authority to act on behalf of that individual. When contacting us, please provide us with proof that the individual gave you signed permission to submit this request, a valid power of attorney on behalf of the individual, or proof of parental responsibility or legal guardianship. Alternatively, you may ask the individual to directly contact us by using the contact details above to verify their identity with MadKudu and confirm with us that they gave you permission to submit this request.

Response Timing and Format of Our Responses: We will confirm the receipt of your request within ten (10) business days and, in that communication, we will also describe our identity verification process (if needed) and when you should expect a response, unless we have already granted or denied the request.
Please allow us up to a month to reply to your requests (except requests to stop selling your Personal Data) from the day we received your request. If we need more time (up to 90 days in total), we will inform you of the reason why and the extension period in writing.
We will act upon your request to opt out from selling your Personal Data within fifteen (15) business days. We will also notify the third parties to whom we sold your Personal Data of your request and instruct them not to further sell your Personal Data. We will inform you about this in ninety (90) days from the receipt of your request.
If we cannot satisfy a request, we will explain why in our response. For data portability requests, we will choose a format to provide your Personal Data that is readily usable and should allow you to transmit the information from one entity to another entity without difficulty.

4. Privacy of Children

The Services are not directed at, or intended for use by, children under the age of 13.

5. Data Integrity & Security

MadKudu has implemented and will maintain technical, administrative, and physical measures that are reasonably designed to help protect Personal Data from unauthorized processing, such as unauthorized access, disclosure, alteration, or destruction. 

6. EU-U.S. DPF, UK Extension to the EU-U.s. DPF, and Swiss-U.S. Data Privacy Frameworks

For Personal Data processed in the scope of this Notice, MadKudu complies with the principles of the EU-U.S. Data Privacy Framework (EU-U.S. DPF) the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF), as adopted and set forth by the U.S. Department of Commerce regarding the processing of Personal Data transferred under the DPF from the European Union, the European Economic Area, the United Kingdom, or Switzerland to the United States, or otherwise received in reliance on the DPF. 

We commit to continue to adhere to the DPF Principles and have certified to the Department of Commerce that we will continue to adhere to the DPF Principles with regard to Personal Data received in reliance on DPF. MadKudu does not currently use the DPF as its data transfer mechanism from the EEA and uses the Standard Contractual Clauses as its primary data transfer mechanism for Personal Data governed by the GDPR, the UK GDPR and the Swiss data protection laws.

To learn more about the Data Privacy Framework (DPF) Program, and to view our certification, please visit https://www.dataprivacyframework.gov/

7. Dispute Resolution

Where a privacy complaint or dispute relating to Personal Data received by MadKudu in reliance on the DPF cannot be resolved through our internal processes, we have agreed to participate in the VeraSafe DPF Dispute Resolution Procedure. Subject to the terms of the VeraSafe DPF Dispute Resolution Procedure, VeraSafe will provide appropriate recourse free of charge to you. To file a complaint with VeraSafe and participate in the VeraSafe DPF Dispute Resolution Procedure, please submit the required information here: https://www.verasafe.com/privacy-services/dispute-resolution/submit-dispute/

8. Binding Arbitration

If your dispute or complaint related to your Personal Data that we received in reliance on DPF cannot be resolved by us, nor through the dispute resolution program established by VeraSafe, you may have the right to require that we enter into binding arbitration with you under the DPF’s “Recourse, Enforcement and Liability Principle” and Annex I of the DPF.

9. U.S. Regulatory Oversight

MadKudu is subject to the investigatory and enforcement powers of the United States Federal Trade Commission.

10. Changes to this Privacy Notice

If we make any material change to this Notice, we will post the revised Notice to this web page. We will also update the “Effective” date. By continuing to use our Services after we post any of these changes, you accept the modified Notice.

11. Contact Us

If you have any questions about this Notice or our processing of Personal Data, or want to submit a verifiable consumer request, please contact us by email at privacy@madkudu.com, by phone at +1 (203) 216-9872, or by postal mail at:

MadKudu Inc.
MadKudu Controller Privacy Notice
Attn: Francis Brero 333 W Maude Ave., Suite 207, Sunnyvale, CA 94085 USA

Please allow up to four weeks for us to reply.

11.1. European Union Representative

We have appointed VeraSafe as our representative in the EU for data protection matters. While you may also contact us, VeraSafe can be contacted on matters related to the processing of Personal Data. To contact VeraSafe, please use this contact form: https://www.verasafe.com/privacy-services/contact-article-27-representative/

Alternatively, VeraSafe can be contacted at:

VeraSafe Czech Republic s.r.o. Klimentská 46, Prague 1, 11002, Czech Republic

11.2. United Kingdom Representative

We have appointed VeraSafe as our representative in the UK for data protection matters. While you may also contact us, VeraSafe can be contacted on matters related to the processing of Personal Data. To contact VeraSafe, please use this contact form:

https://www.verasafe.com/privacy-services/contact-article-27-representative/ or via telephone at: +44 (20) 4532 2003.

VeraSafe United Kingdom Ltd. 

37 Albert Embankment

London

SE1 7TL

United Kingdom