The security of your data is important to us. This page lists out our ongoing efforts to maintain compliance with the EU’s General Data Protection Regulation (GDPR).
Kevin Yun
| Status | Task | Description |
| Completed | Conduct an information audit to determine what information you process and who has access to it. | Organizations that have at least 250 employees or conduct higher-risk data processing are required to keep an up-to-date and detailed list of their processing activities and be prepared to show that list to regulators upon request. The best way to demonstrate GDPR compliance is using a data protection impact assessment Organizations with fewer than 250 employees should also conduct an assessment because it will make complying with the GDPR's other requirements easier. In your list, you should include: the purposes of the processing, what kind of data you process, who has access to it in your organization, any third parties (and where they are located) that have access, what you're doing to protect the data (e.g. encryption), and when you plan to erase it (if possible). |
| Completed | Have a legal justification for your data processing activities. | Processing of data is illegal under the GDPR unless you can justify it according to one of six conditions listed in Article 6. There are other provisions related to children and special categories of personal data in Articles 7-11. Review these provisions, choose a lawful basis for processing, and document your rationale. Note that if you choose "consent" as your lawful basis, there are extra obligations, including giving data subjects the ongoing opportunity to revoke consent. If "legitimate interests" is your lawful basis, you must be able to demonstrate you have conducted a privacy impact assessment. |
| Completed | Provide clear information about your data processing and legal justification in your privacy policy. | You need to tell people that you're collecting their data and why (Article 12). You should explain how the data is processed, who has access to it, and how you're keeping it safe. This information should be included in your privacy policy and provided to data subjects at the time you collect their data. It must be presented "in a concise, transparent, intelligible and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child." |
| Status | Task | Description |
| Completed | Take data protection into account at all times, from the moment you begin developing a product to each time you process data. | You must follow the principles of "data protection by design and by default," including implementing "appropriate technical and organizational measures" to protect data. In other words, data protection is something you now have to consider whenever you do anything with other people's personal data. You also need to make sure any processing of personal data adheres to the data protection principles outlined in Article 5. Technical measures include encryption, and organizational measures are things like limiting the amount of personal data you collect or deleting data you no longer need. The point is that it needs to be something you and your employees are always aware of. |
| Completed | Have a process in place to notify the authorities and your data subjects in the event of a data breach. | If there's a data breach and personal data is exposed, you are required to notify the supervisory authority in your jurisdiction within 72 hours. A list of many of the EU member states supervisory authorities can be found here. The GDPR does not specify whom you should notify if you are not an EU-based organization. For those in English-speaking non-EU countries, you may find it easiest to notify the Office of the Data Protection Commissioner in Ireland. You are also required to quickly communicate data breaches to your data subjects unless the breach is unlikely to put them at risk (for instance, if the stolen data is encrypted). |
| Completed | Encrypt, pseudonymize, or anonymize personal data wherever possible. | Most of the productivity tools used by businesses are now available with end-to-end encryption built in, including email, messaging, notes, and cloud storage. The GDPR requires organizations to use encryption or pseudeonymization whenever feasible. |
| Completed | Create an internal security policy for your team members, and build awareness about data protection. | Even if your technical security is strong, operational security can still be a weak link. Create a security policy that ensures your team members are knowledgeable about data security. It should include guidance about email security, passwords, two-factor authentication, device encryption, and VPNs. Employees who have access to personal data and non-technical employees should receive extra training in the requirements of the GDPR. |
| Completed | Know when to conduct a data protection impact assessment, and have a process in place to carry it out. | A data protection impact assessment (aka privacy impact assessment) is a way to help you understand how your product or service could jeopardize your customers' data, as well as how to minimize those risks. The UK Information Commissioner's Office (ICO) has a data protection impact assessment checklist on its website. The GDPR requires organizations to carry out this kind of analysis whenever they plan to use people's data in such a way that it's "likely to result in a high risk to [their] rights and freedoms." The ICO recommends just doing it anytime you're about to process personal data. |
| Status | Task | Description |
| Completed | Designate someone responsible for ensuring GDPR compliance across your organization. | Another part of "data protection by design and by default" is making sure someone in your organization is accountable for GDPR compliance. This person should be empowered to evaluate data protection policies and the implementation of those policies. |
| Completed | Sign a data processing agreement between your organization and any third parties that process personal data on your behalf. | This includes any third-party services that handle the personal data of your data subjects, including analytics software, email services, cloud servers, etc. The vast majority of services have a standard data processing agreement available on their websites for you to review. They spell out the rights and obligations of each party for GDPR compliance. You should only use third parties that are reliable and can make sufficient data protection guarantees. |
| Status | Task | Description |
| Completed | It's easy for your customers to request and receive all the information you have about them. | People have the right to see what personal data you have about them and how you're using it. They also have a right to know how long you plan to store their information and the reason for keeping it that length of time. You have to send them the first copy of this information for free but can charge a reasonable fee for subsequent copies. Make sure you can verify the identity of the person requesting the data. You should be able to comply with such requests within a month. |
| Completed | It's easy for your customers to correct or update inaccurate or incomplete information. | Do your best to keep data up to date by putting a data quality process in place, and make it easy for your customers to view (Article 15) and update their personal information for accuracy and completeness. Make sure you can verify the identity of the person requesting the data. You should be able to comply with requests under Article 16 within a month. |
| Completed | It's easy for your customers to request to have their personal data deleted. | People generally have the right to ask you to delete all the personal data you have about them, and you have to honor their request within about a month. There are a five grounds on which you can deny the request, such as the exercise of freedom of speech or compliance with a legal obligation. You must also try to verify the identity of the person making the request. |
| Completed | It's easy for your customers to ask you to stop processing their data. | Your data subjects can request to restrict or stop processing of their data if certain grounds apply, mainly if there's some dispute about the lawfulness of the processing or the accuracy of the data. You are required to honor their request within about a month. While processing is restricted, you're still allowed to keep storing their data. You must notify the data subject before you begin processing their data again. |
| Completed | It's easy for your customers to receive a copy of their personal data in a format that can be easily transferred to another company. | This means that you should be able to send their personal data in a commonly readable format (e.g. a spreadsheet) either to them or to a third party they designate. This may seem unfair from a business standpoint in that you may have to turn over your customers' data to a competitor. But from privacy standpoint, the idea is that people own their data, not you. |
| Completed | It's easy for your customers to object to you processing their data. | If you're processing their data for the purposes of direct marketing, you have to stop processing it immediately for that purpose. Otherwise, you may be able to challenge their objection if you can demonstrate "compelling legitimate grounds." |
| Completed | If you make decisions about people based on automated processes, you have a procedure to protect their rights. | Some types of organizations use automated processes to help them make decisions about people that have legal or "similarly significant" effects. If you think that applies to you, you'll need to set up a procedure to ensure you are protecting their rights, freedoms, and legitimate interests. You need to make it easy for people to request human intervention, to weigh in on decisions, and to challenge decisions you've already made. |
In order to provide its services, GrowSurf may engage third parties or other members of the GrowSurf corporate group (affiliates) to carry out data-processing activities that involve access to customer data. These organizations, called “subprocessors,” are identified below with their locations and the types of services they provide to GrowSurf.
| Name | Country | Description | Type of Service | Mandatory |
| Digital Ocean | United States | Server and database hosting | Cloud hosting provider | Required |
| Versoly | United Kingdom | Marketing forms and website analytics | Website hosting provider | Required |
| Cloudflare | United States | Automatically optimizes the delivery of your web pages so your visitors get the fastest page load times and best performance. | DNS provider | Required |
| instant.page | United States | Make your site’s pages instant in 1 minute and improve your conversion rate noticeably. | Open source script | Required |
| Rewardful | United States | Affiliate | Affiliate software | Required |
| Google Fonts | United States | Fonts | Font hosting | Required |
| Amazon AWS | United States | Serve images and static content | Image storage and asset hosting | Required |
| GrowSurf | United States | Track user signups coming from referral links | Customer referral software | Required |
| Atlassian (Trello) | United States | Project management and bug tracking | Project management software | Required |
| Typekit | United States | Typekit is the easiest way to use real fonts on the web. It's a subscription-based service for linking to high-quality Open Type fonts from some of the worlds best type foundries. | Font hosting provider | Required |
| MailerLite | United States | Marketing email and automation forms. | Email service provider | Not Required |
| Help Scout | United States | Customer support and sales communication | Customer support software | Optional |
| Google Tag Manager | United States | Tag management that lets you add and update website tags without changes to underlying website code. Google's primary tag for Google Measurement/Conversion Tracking, Adwords and DoubleClick. | Tag manager | Required |
| Google Analytics | United States | The analytics.js JavaScript snippet is a new way to measure how users interact with your website. It is similar to the previous Google tracking code, ga.js, but offers more flexibility for developers to customize their implementations. | Analytics provider | Required |
| ProfitWell | United States | Revenue analysis and dunning software | Revenue software | Required |
| Cloudinary | United States | Serve user-hosted images | Image hosting provider | Required |
| Stripe | United States | Stripe makes it easy for developers to accept credit cards on the web. | Payment processor | Required |
| HubSpot | United States | Hubspot provides marketing information and leads via inbounding marketing software. | CRM software | Not Required |
| HubSpot Forms | United States | Marketing automation form feedback into Hubspot tool. | Form hosting service | Not Required |
| Customer.io | United States | With Customer.io, send targeted emails, push notifications, and SMS to lower churn, create stronger relationships, and drive subscriptions. | Email service provider | Required |
| Headway | United States | Changelog | Changelog service | Required |
| Cohere.so | United States | Screenshare and debugging | Screen recording software | Required |
| Gravatar | United States | Avatar for users | Avatar service | Required |
| Cal.com | United States | Calendar scheduling software | Calendar scheduling software | Not Required |
| DataDog | United States | Logging (errors and monitoring) and application monitoring. | APM and logging service | Required |
| ChartMogul | United States | Revenue analysis | Revenue analysis software | Required |
| Elastic.co | United States | Managed Elasticsearch hosting | Hosted Elasticsearch provider | Required |
| Facebook Conversion Tracking | United States | Conversion tracking functionality from Facebook, allows a user to track advertisement clicks. | Ad tracking | Not Required |
| Facebook Pixel | United States | Facebook Pixel is Facebooks conversion tracking system for ads on Facebook to websites. | Ad tracking | Not Required |
| Firebase | United States | Managed authentication and database hosting | Cloud hosting provider | Required |
| Google Apps for Business | United States | Web-based email, calendar, and documents for teams. Renamed to Google Apps for Work, but now known as G Suite From Google Cloud. | Business app software | Required |
| Google Cloud Platform | United States | Storage of key development services | Cloud hosting provider | Required |
| GStatic Google Static Content | United States | Google has off-loaded static content (Javascript/Images/CSS) to a different domain name in an effort to reduce bandwidth usage and increase network performance for the end user. | CDN | Required |
| Heap | United States | Heap automatically captures every user action in your web app and lets you measure it all. | User analytics software | Required |
| Heroku | United States | Application hosting | Cloud hosting provider | Optional |
| Postmark | United States | For sending transactional emails to users and participants. | Email service provider | Required |
| Sendgrid | United States | For sending transactional emails to users | Email service provider | Required |
| Slack | United States | Real-time team communication | Team chat software | Required |
| Tango Card | United States | Gift card rewarding | Reward platform | Required |
| Zapier | United States | Business automation platform | Automation software | Required |
| ComplyDog | Germany | Manage DPAs, data subject requests, and GDPR compliance. | Compliance portal service | Required |
| Posthog | United States | Product analytics | Analytics provider | Required |
| Clearbit | United States | B2B Marketing intelligence for identifying website visitors | Marketing technology | Required |
| Counter | United States | a web analytics service that tracks website traffic. | Web analytics | Required |
| Vector.co | United States | Reveal the most interested buyers on & off your site — turn them into revenue with hyper-targeted campaigns & ad audiences | Marketing technology | Required |
Please see our frequently asked questions below. Please keep in mind that this is not legal advice and we recommend consulting with your internal compliance team or privacy attorney for guidance on compliance matters. GrowSurf is committed to helping our customers comply with applicable laws, but we cannot guarantee that your use of our products will be fully compliant. As always, we recommend seeking professional legal counsel for any specific questions or concerns.
| Should I get consent from a customer to collect their personal data? | While it is always good practice to receive explicit consent from your customer, certain laws and regulations (such as the GDPR) require consent prior to collecting personal data of certain individuals (such as those in the EU). It is also important to note that under GDPR, consent is one of a number of legitimate interests for processing data. Others include the need to process for the performance of a contract, the need to process in order to comply with a legal obligation, and the need to process in order to protect the vital interests of the data subject or another natural person. Full details can be found in Article 6 of GDPR. |
| Can I modify a customer’s personal data? | Yes, you can modify all data to correct personal data as required by GDPR when you receive a Subject Access Request, or for other reasons. Simply contact us and we will work with you to make the adjustments. |
| Can I delete personal data? | Yes, you can delete any data, including data that contains personal data, as required by GDPR. You can also remove all other requested customer data by sending us a data request. |
| Is personal data permanently deleted when I remove it? | A deleted data or person is initially flagged for deletion, and may be recovered by our team upon request. After 90 days, the deletion becomes permanent and unrecoverable. |
| How long is personal data retained in GrowSurf if I don’t delete it? | GrowSurf’s philosophy is that customers own and control all the data they collect. Any retention period required by law or your company policy is controlled by you. You should ensure that all people and personal data are deleted prior to stopping your usage of GrowSurf, especially if required by policy, law, or regulation. |
| Does my data get included in backups, and if so, for how long? | Yes. GrowSurf backs up all customer data, and retains the backups for 90 days. After 90 days, the backup is deleted. |
| Can I delete customer’s personal data from GrowSurf backups? | No. The backup dataset contains all customer data, and is used for disaster recovery purposes only. This is required for legal and compliance reasons related to availability obligations. Any personal data in these backups will be permanently deleted after 90 days. |
| If my data centre is located in the EU, does GrowSurf transfer my personal data outside the EU at any point? | Our data centers are with Digital Ocean in the United States. However, data transfer is covered by the EU-US Privacy Shield framework, of which we are a member, and allowed by GDPR as providing adequate safeguards. |
| Does GrowSurf ensure that my data is accessed only by employees with reasonable justification for doing so? | As required by GDPR, only qualified GrowSurf employees with a specific need are permitted to access your account. The typical reason for accessing your account would be upon your specific request for support. |
| Does GrowSurf use sub-processors that process my data? | GrowSurf presently uses sub-processors to provide the service. As required by GDPR, GrowSurf maintains a list of those sub-processors here. |
| If a data breach occurs with the GrowSurf platform that affects my data, how and when will I be notified? | If a confirmed data breach occurs that is caused by GrowSurf’s actions or inactions, we will, without undue delay, notify the account owner. Information about the breach will be released as it becomes available, as allowed by GDPR. The account owner will be the main point of contact for all notifications, and will be kept aware of the investigation and remediation efforts as they progress. |
| How can I comply with a Subject Access Request and portability as required by GDPR? | As you know about the data you are collecting, you are responsible for handling any Subject Access Request (SAR). GrowSurf only provides the platform and wouldn’t know the details about your customizations, properties, or your customers. A SAR means that a customer is asking about information being collected about him or her. If you collected personal data of an EU citizen or a person residing in the EU, you may have a legal obligation to respond to a SAR. Data may be downloaded in industry-standard formats for data portability to comply with GDPR. If GrowSurf receives a SAR, it will do its best to contact the owner. It may not always be possible to know what who the rightful owner is. |
| How do I comply with a Subject Access Request to “be forgotten?” | Similar to the above, you know what data you have. If you collected personal data of an EU citizen or a person residing in the EU, you may have a legal obligation to respond and comply with a request to delete all identifiable data. As previously stated, you have the ability to delete a customer's data. |
| How does GrowSurf comply with its GDPR obligations to return or destroy all EU personal data? | GrowSurf provide easy ways to download all your data in industry-standard formats. And, as previously described, you may easily delete data, and entire histories for a customer. |
| How does GrowSurf comply with its GDPR obligations to encrypt personal data? | All pertinent and sensitive data stored in our primary databases and backups are encrypted using an industry standard strong cipher. All data transmitted to the GrowSurf platform are encrypted using the industry standard TLS protocol. |
| How can I ensure my customers that GrowSurf security meets applicable law and the GDPR (Article 32)? | GrowSurf is committed to safeguarding your data. We use sophisticated controls during processing to maintain the confidentiality, integrity, availability, and resilience of your data. Our Security page outlines the details of our application security, network security, policies, and more. As related to Article 28 in the GDPR, GrowSurf will only process personal data according to your instructions. In other words, the commands you use in the product are the “instructions,” and GrowSurf does not use personal data for any other means. In addition, it does not transfer personal data to a third party without your consent. If personal data is transferred from the EU to a third country, then adequate safeguards will apply to the transfer (such as the EU-US Privacy Shield Framework). GrowSurf has developed recovery procedures to minimize downtime related to a disaster, with the ability to restore access to personal data in a timely manner in the event of a physical or technical incident. We regularly test, assess and evaluate the effectiveness of our technical and organizational measures to ensure the security of the processing. |
| Can I have more information regarding the tracking functionality of the GrowSurf Universal Code? |
Is GrowSurf processing personal data only on behalf of the GrowSurf customer OR is GrowSurf using the GrowSurf customer’s personal data for its own commercial benefit, including to benefit its other customers? GrowSurf only processes personal data on behalf of the GrowSurf customer (we do not sell participant data). Does this involve placing electronic tracking technologies (e.g., cookies, tags, web beacons, pixels) on the GrowSurf customer's website(s)? Yes, GrowSurf's referral tracking involves the use of website cookies through pasting a snippet of JavaScript code. What is the duration of the tracker? (e.g., session or persistent) Cookies are stored persistently in the browser for up to 365 days. Describe what the tracker does and why it is being used. List all multiple uses and list all data collected by the tracker. The GrowSurf Universal Code is what allows referrals to be tracked and credited properly through detecting referral codes and storing cookies. It's also what powers the GrowSurf window and embeddable elements to be displayed to your participants so that they can get their unique share link, click social share buttons, and check their referral stats and/or the leaderboard. The GrowSurf Universal Code is a snippet of JavaScript that you paste into the HEAD of your website. Participant data collected are the following: First name (optional), last name (optional), email address, IP address, browser fingerprint, and any custom data called metadata (optional). Is the GrowSurf customer itself configuring what this tracker collects and shares? Yes, GrowSurf allows customization of what is stored. If you enable the GDPR toggle for your campaign, GrowSurf will only store the bare minimum data -- email address is the bare minimum requirement (IP address and browser fingerprint will not be stored). Is the tracker letting third parties unknown to the GrowSurf also collect data from the GrowSurf users on the GrowSurf customer's website(s)? No, we do not have any third-party scripts or vendors that collect participant data from the GrowSurf Universal Code. Does the tracker contain a session replay tracker? No, the GrowSurf Universal Code does not contain a session replay tracker. Does the tracker collecting or sharing information that could disclose information about the videos a user watches on the GrowSurf customer's website(s)? No, the GrowSurf Universal Code does not collect nor share information that could disclose information about the videos a user watches on the GrowSurf customer's website(s). |
| How do I report a security issue? | We take all security reports seriously. Please email our security contact (information listed above) with any information you have regarding any potential data breaches, vulnerabilities or concerns. |
| How do I request a DPA? | In order to use our products and services, you need to accept our Data Processing Agreement (DPA). By agreeing to our Terms of Service, you are automatically accepting our DPA and do not need to sign a separate document. |
| How does GrowSurf enable me to be GDPR compliant? | GrowSurf enables customers to be GDPR compliant. Briefly stated, that means GrowSurf:
|