Privacy Policy

Scope of this policy

This policy applies to personal information that Control processes in connection with:

• our website and any page, form or scheduling link we operate;
• our communications with prospective and existing customers;
• the outbound campaigns we run on behalf of our customers, including the business contact information of the individuals those campaigns reach; and
• the customer systems we connect to in order to deliver the service, such as calendars, customer relationship management ("CRM") systems and messaging tools.

"Personal information" means information that identifies, relates to, or could reasonably be linked with a particular individual. Where a term such as "personal data", "controller", "processor", "business" or "service provider" is used, it carries the meaning given to it by the applicable data protection law.

This policy does not apply to the practices of our customers, of the companies whose websites you reach through links on our site, or of any third party we do not control.

Who we are and how to contact us

Control8 Inc. is a Delaware corporation with its principal place of business at 169 Madison Ave, Ste 13918, New York, NY 10016, United States.

The fastest way to reach us about privacy, to object to processing, or to make a rights request is the privacy@controlgtm.com route on this site.

Our two roles: controller and processor

Control plays two distinct roles, and the role determines who you should direct a request to. This distinction matters, so we state it plainly.

We are a controller for prospect data

When we build a total addressable market list, source and enrich business contact information, decide which individuals to contact, and design the outreach, we determine the purposes and means of that processing. For that activity we act as a controller (a "business" under US state privacy laws). If you received an email from us and want to object, be suppressed, or exercise a right in relation to your business contact information, we are the right party to ask. See section 09.

We are a processor for customer data

When we connect to a customer's CRM, calendar or messaging tool, or otherwise handle data a customer supplies to us, we process that data on the customer's documented instructions and for the customer's purposes. For that activity we act as a processor (a "service provider" under US state privacy laws), and the customer is the controller. If your data sits in one of our customers' systems and you want it accessed, corrected or deleted, your request should go to that customer. If you send such a request to us, we will pass it to the relevant customer and support them in responding.

If you are unsure which role applies to a specific set of facts, contact us and we will tell you.

Information we collect

Information you give us

• Contact and business details: name, work email address, phone number, job title, employer, company size and location, submitted through a form, a scheduling link, an email reply, or a conversation with our team.
• Account and engagement information: the information a customer provides to set up and run a program, including ideal customer profile criteria, target account lists, exclusion and suppression lists, approved messaging, and the names and calendar availability of the account executives who will take booked calls.
• Communications: the content of emails, messages, support tickets and meeting notes you exchange with us, and, where you are told in advance and where the law permits, recordings or transcripts of calls.
• Billing information: billing contact, billing address and tax details. Card and bank details are handled by our payment processor and are not stored by us.

Information we collect automatically

When you visit our website or open an email from us, we and our service providers may collect the following by automated means. Assume the full stack below is capable of being in use; we disclose it broadly so that this policy stays accurate as tools are added or removed.

• Server logs and device data: IP address, user agent, operating system, browser type and version, device type, screen size, language, time zone, and the date and time of each request.
• Usage and web analytics: pages viewed, time on page, scroll depth, clicks, referring URL, exit pages, and the campaign parameters attached to a link (for example utm_source, utm_medium, utm_campaign, gclid, fbclid, li_fat_id).
• Product analytics and session recording: event-level records of interactions with our site or application and, where enabled, session replay that reconstructs mouse movement, scrolling and clicks. Where session recording is used we configure it to mask text entered into form fields.
• Visitor identification and IP resolution: services that attempt to resolve an IP address, a device identifier or a cookie to a company, and in some cases to a named business contact, so that we can understand which organizations are interested in Control. See section 06.
• Advertising and conversion pixels: tags placed by advertising platforms that record that you visited a page or completed an action, and that allow us to measure and retarget advertising.
• Email tracking: pixels and instrumented links in emails we send that record whether a message was opened or rendered, when, on what device, and which links were clicked. This applies both to our own marketing email and to campaign email we send on behalf of customers.
• Cookies and local storage: HTTP cookies, HTML5 local storage, session storage and similar technologies.

Information we receive from other sources

• third-party data providers and enrichment vendors, as described in section 05;
• publicly available sources, including company websites, public professional profiles, press coverage, filings and registries;
• our customers, when they supply target lists, exclusion lists or CRM records;
• integration partners, when a customer authorizes a connection; and
• advertising, event and referral partners, and platforms where you engaged with our content.

Business contact data and how we obtain it

Building and processing business contact data is central to what Control does, and it is the part of our processing most likely to concern someone who has not chosen to deal with us. We describe it in full here.

To run an outbound program we assemble a list of the businesses that fit a customer's ideal customer profile, and of the individuals at those businesses whose role suggests they are responsible for, or influence, the purchase in question. To do that we collect, generate and maintain business contact information, which typically includes:

• first and last name;
• work email address;
• job title, function, seniority and department;
• employer name, industry, headcount, revenue band and location;
• a business phone number or a link to a public professional profile; and
• inferences we draw from the above, such as whether a role is likely to hold buying authority, or whether an account matches a customer's profile.

We obtain this information from licensed third-party data providers and enrichment vendors, from publicly accessible sources, from information supplied by our customers, and from our own records of prior interactions. We do not seek out personal email addresses, home addresses or personal phone numbers for outbound campaigns, and we do not knowingly build lists from consumer sources.

We take reasonable steps to verify that contact information is current and deliverable, to remove duplicates, and to remove records that appear on a suppression list, a do-not-contact list, or a customer's exclusion list before any message is sent.

We do not sell business contact data as a product. We do not license our contact database to third parties for their own marketing. We use it to operate campaigns for our customers, and we disclose to a customer only the records relevant to that customer's program and the outcome of the outreach.

Cookies, analytics and tracking technologies

We and our service providers use cookies and similar technologies on our website. We do not currently present a cookie consent banner. Where the law of your jurisdiction requires consent before non-essential cookies are set, you should assume that non-essential technologies may be active and use the browser and platform controls described below to limit them, until we implement a consent mechanism.

Categories in use

• Strictly necessary: required to serve the site, balance load, secure it against abuse, and remember a session.
• Analytics and performance: to count visitors, understand which pages and campaigns work, and diagnose errors.
• Product analytics and session replay: to reconstruct how the site is used so we can improve it.
• Identification and firmographic resolution: to resolve a visit to an organization, and in some cases to an individual business contact, so we can follow up with companies that show interest.
• Advertising and retargeting: to measure the effect of advertising and to show Control advertising to you on other sites and platforms.

Visitor identification, stated plainly

Some of the technologies above are designed to identify a website visitor who has not filled out a form. They work by matching an IP address, a device signal or a third-party cookie against a vendor's own database. If a match is made, we may learn the company you are visiting from and, in some cases, your name, job title and work email address. We use that information only for business-to-business sales and marketing, and only in the ways described in this policy. If you would rather we did not, contact us and we will suppress you, or opt out at the vendor level using the controls below.

Your controls

• Browser settings. Every major browser lets you block or delete cookies, block third-party cookies, and clear local storage. Blocking strictly necessary cookies may break parts of the site.
• Global Privacy Control. Where required by law, we treat a Global Privacy Control ("GPC") signal transmitted by your browser or extension as a valid request to opt out of the sale or sharing of personal information for that browser.
• Do Not Track. There is no common standard for responding to a browser "Do Not Track" signal, and we do not currently respond to it. We do honor GPC as described above.
• Advertising opt-outs. You can limit interest-based advertising through the Digital Advertising Alliance (optout.aboutads.info), the Network Advertising Initiative (optout.networkadvertising.org), and, in Europe, Your Online Choices (youronlinechoices.eu), as well as through the ad settings of the individual platforms.
• Email tracking. Configuring your mail client to block remote images will stop most open tracking.
• Ask us. Contact us and we will suppress your information from our systems, as described in section 09.

How we use personal information

Where we act as a controller, we use personal information to:

• build, verify, enrich, de-duplicate and maintain target lists for outbound campaigns;
• send business-to-business outreach and follow-up on behalf of our customers, and to qualify replies;
• schedule qualified calls with a customer's account executives and manage rescheduling and no-shows;
• write the outcome of outreach back into a customer's CRM;
• operate, secure, monitor, troubleshoot and improve our website, systems and models, including deliverability and targeting;
• market Control to businesses, including advertising, retargeting, events and newsletters;
• identify organizations that visit our website so we can follow up with them;
• measure the performance of campaigns and report on it;
• manage our relationship with customers, including billing, support and contract administration;
• maintain suppression and do-not-contact records, which requires that we retain the minimum information needed to recognize and honor an opt-out; and
• detect and prevent fraud and abuse, enforce our terms, establish, exercise or defend legal claims, and comply with law.

We may derive aggregated or de-identified information from personal information and use it without restriction, including to improve our targeting and deliverability models. Where we de-identify information, we maintain it in de-identified form and do not attempt to re-identify it, except to test that the de-identification holds.

Legal bases for processing

If you are in the European Economic Area, the United Kingdom or Switzerland, we process personal information only where a legal basis applies. The bases we rely on are:

Legitimate interests

For business-to-business outreach, list building and enrichment, website analytics and visitor identification, marketing of our own services, security, fraud prevention, and improving our products. Our legitimate interest is in promoting and growing a business-to-business service. We balance that interest against your rights and expectations, we limit outreach to work contact details and to roles plausibly connected with the subject of the message, we keep volumes and follow-ups reasonable, and we stop on request. You may object at any time.

Performance of a contract

To provide the service to a customer, to administer an account, and to bill for it.

Consent

Where consent is required, for example for certain electronic marketing, for certain cookies, or for call recording. You may withdraw consent at any time, without affecting processing carried out before withdrawal.

Legal obligation

To meet tax, accounting, record-keeping and other legal requirements, and to respond to lawful requests.

Legal claims

To establish, exercise or defend legal claims, and to enforce our agreements.

You may request a summary of our legitimate interests assessment for outbound outreach by contacting us.

Outbound email and your right to opt out

If you received a message from Control, this section is for you.

What happens when you opt out

• We stop sending you campaign email, and we stop attempting to contact you for the customer whose campaign reached you.
• Unless you tell us otherwise, we apply the suppression across every campaign we run, for every customer, not just the one that reached you.
• We retain the minimum information needed to recognize you and keep you suppressed, which generally means a hashed or plain record of your email address and domain. Deleting that record entirely would allow you to be re-added by a later data refresh, so we keep it unless you specifically ask us to delete it instead and accept that consequence.
• Suppression applies to Control's systems. It cannot remove you from the databases of the third-party data providers we license from, or from a customer's own systems. We will tell you which provider a record came from where we are able to.

Compliance commitments

• CAN-SPAM. Commercial email we send identifies the sender, does not use deceptive headers or subject lines, includes a valid physical postal address, includes a working opt-out mechanism, and honors opt-outs promptly and in any event within ten business days.
• CASL. For recipients in Canada, we send commercial electronic messages only where an applicable consent or exemption applies, we identify ourselves and provide contact information, and we include a functioning unsubscribe mechanism that we honor within ten business days.
• Do-not-contact and internal suppression. We maintain and apply suppression lists, customer exclusion lists, and known do-not-contact records before every send.
• Telephone contact. Where a program involves telephone contact, we and our customers are responsible for applicable do-not-call and telemarketing requirements, including the US Telephone Consumer Protection Act and applicable state equivalents.
• Sending in a customer's name. Campaign email is generally sent on behalf of, and in the name of, our customer. The message will identify the sending party, and both Control and the customer are reachable through the routes given in that message.

How we share personal information

We disclose personal information in the following circumstances.

• Service providers and sub-processors. Companies that perform functions on our behalf under contract, including cloud hosting and storage, email sending and deliverability infrastructure, data enrichment and verification, analytics and session recording, CRM and marketing automation, scheduling, communications and messaging, customer support, payment processing, and security and logging. They may use personal information only to provide the service to us.
• Our customers. Where a campaign we run for a customer produces a reply, a qualified call or an outcome, we disclose the relevant contact record and the context of the interaction to that customer, and we may write it into their CRM. From that point the customer handles it as its own controller under its own privacy policy.
• Integration partners you or your organization authorize. Including Salesforce, HubSpot, Google Calendar, Microsoft 365 and Slack. We access only the scopes granted, and use the data only to deliver the service.
• Advertising and measurement partners. As described in section 11.
• Professional advisers. Lawyers, auditors, accountants and insurers, under duties of confidentiality.
• Legal and safety. Where we believe disclosure is required by law or legal process, or is reasonably necessary to enforce our terms, to investigate suspected fraud or abuse, or to protect the rights, property or safety of Control, our customers or the public. Where we are permitted to do so, we will notify a customer before disclosing its data in response to legal process.
• Corporate transactions. In connection with a merger, acquisition, financing, reorganization or sale of assets, in which case personal information may be transferred to the counterparty subject to this policy or a successor policy.
• Aggregated or de-identified information. Without restriction, where it cannot reasonably be used to identify you.

Advertising and cross-context behavioral advertising

We use advertising and analytics tools that set cookies or receive identifiers, and that may combine what they learn about your visit to our site with information they hold from other sites. Under some US state privacy laws, this kind of disclosure counts as "sharing" personal information for cross-context behavioral advertising, and some arrangements with data and advertising partners can count as a "sale", even where no money changes hands.

We do not sell personal information in the ordinary sense of the phrase, and we do not sell or share the personal information of anyone we know to be under 16. To the extent our use of advertising and identification technologies constitutes a sale or sharing under applicable law, you may opt out by:

• enabling a Global Privacy Control signal in your browser;
• using the industry opt-outs listed in section 06; or
• contacting us and asking to opt out.

International data transfers

Control is based in the United States and our systems and service providers are principally located in the United States. If you are located outside the United States, personal information about you will be transferred to and processed in the United States and in other countries whose data protection laws may differ from those of your country.

Where we transfer personal information out of the European Economic Area, the United Kingdom or Switzerland, we rely on an appropriate transfer mechanism, which will generally be the European Commission's Standard Contractual Clauses together with the UK International Data Transfer Addendum, supplemented where necessary by additional technical and organizational measures. You may request a copy of the relevant safeguards by contacting us.

How long we keep information

We keep personal information for as long as it serves the purpose it was collected for, and then delete or de-identify it. In practice:

• Customer account and contract records are kept for the term of the agreement and for a period afterwards to meet legal, tax, audit and defense-of-claims needs.
• Customer data we process as a processor is kept according to the customer's instructions and our Data Processing Addendum, and is deleted or returned on termination subject to the retention periods stated there.
• Prospect and campaign records are kept while the record remains useful for an active or foreseeable campaign, and are reviewed and refreshed periodically. Records that go stale are removed.
• Suppression and do-not-contact records are kept indefinitely, because their whole purpose is to keep you out of future campaigns. They are kept separately, and are used for suppression only.
• Website, analytics and log data is kept for a limited period consistent with the retention settings of the tools we use, and then deleted or aggregated.
• Backups may retain information for a further period after deletion from live systems, after which they expire on their normal cycle.

We may keep information for longer where we are required to by law, or where it is needed to resolve a dispute, investigate abuse, or establish, exercise or defend a legal claim.

Security

We maintain administrative, technical and physical safeguards designed to protect personal information against loss, misuse, and unauthorized access, disclosure, alteration and destruction. These include encryption of data in transit and at rest, role-based access control and least-privilege access, logging and monitoring, environment separation, vendor security review, and internal policies and training.

No method of transmission over the internet and no method of electronic storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us promptly of any suspected unauthorized use.

Your privacy rights

Depending on where you live, you may have some or all of the following rights in relation to personal information for which we are the controller:

• Access a copy of the personal information we hold about you, and information about how we process it;
• Correct inaccurate or incomplete information;
• Delete personal information, subject to exceptions;
• Object to processing carried out on the basis of legitimate interests, including an absolute right to object to direct marketing at any time;
• Restrict processing in certain circumstances;
• Portability of information you provided to us, in a structured, commonly used, machine-readable format;
• Withdraw consent where we rely on it;
• Opt out of the sale or sharing of personal information, of targeted advertising, and of certain profiling;
• Non-discrimination for exercising any of these rights; and
• Appeal a decision we make on a request, where applicable law provides for an appeal.

How to exercise a right

Use the privacy@controlgtm.com route on this site and tell us what you want. We will acknowledge your request and respond within the period required by applicable law, generally within 30 days for US state requests and within one month under the GDPR, with an extension where the request is complex and where we tell you why.

We will take reasonable steps to verify your identity before acting, which may mean asking you to confirm from the email address in question or to provide information that matches our records. We will not use verification information for any other purpose. An authorized agent may submit a request on your behalf with proof of authority.

If we act as a processor rather than a controller, we will refer your request to the relevant customer, as described in section 03.

Notice to residents of US states

If you are a resident of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana or another state with a comprehensive privacy law, this section supplements the rest of this policy.

Categories of information and disclosure

Over the preceding twelve months we have collected the categories of personal information described in section 04 and section 05: identifiers, professional or employment-related information, commercial information, internet or other electronic network activity information, approximate geolocation derived from IP address, audio or visual information where a call is recorded with notice, and inferences drawn from the foregoing. We collected it from the sources described in section 04, for the purposes described in section 07, and we disclosed each of those categories for a business purpose to the recipients described in section 10. We retain each category as described in section 13.

We do not collect or process sensitive personal information for the purpose of inferring characteristics about you. We do not knowingly sell or share the personal information of consumers under 16 years of age.

Your rights

You have the rights listed in section 15, including the right to know, the right to delete, the right to correct, the right to opt out of sale or sharing and of targeted advertising, and the right not to be discriminated against for exercising them. Submit a request through the privacy@controlgtm.com route on this site. If we deny your request you may appeal by replying to our decision, and, if the appeal is denied, you may complain to your state attorney general.

Shine the Light. California residents may request information about disclosures of personal information to third parties for their direct marketing purposes. We do not make such disclosures.

Notice to individuals in the EEA, UK and Switzerland

Control8 Inc. is the controller of the personal information described in section 03 as controller data.

Where we did not obtain your information from you

Much of the business contact information we process was not provided by you. As required by Article 14 of the GDPR, we tell you here that: the categories of information concerned are set out in section 05; the sources are licensed third-party data providers, publicly accessible sources, our customers and our own records; the purposes and legal bases are set out in section 07 and section 08; the recipients are set out in section 10; retention is set out in section 13; and your rights, including the right to object, are set out in section 15. On request we will tell you the specific source of a record where we hold that information.

Right to object

You have the right to object at any time to processing based on our legitimate interests. Where you object to direct marketing, we will stop without exception. Where you object to other legitimate-interest processing, we will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or unless we need the information for legal claims.

Automated decision-making

We use scoring and models to prioritize which accounts and roles to contact and which messages to send. These do not produce legal effects concerning you or similarly significantly affect you, and a person remains in the loop for the decisions that matter.

Complaints and representatives

You may lodge a complaint with your local supervisory authority, or with the UK Information Commissioner's Office. We would appreciate the chance to address your concern first.

Children, third-party sites and changes

Children

Our website and services are intended for businesses and for individuals acting in a professional capacity. They are not directed to children, and we do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact us and we will delete it.

Third-party sites

Our site and our emails may link to sites we do not operate. We are not responsible for their content or their privacy practices, and this policy does not apply to them.

Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top of this page. If a change is material, we will provide a more prominent notice, which may include emailing customers. Your continued use of the site or the services after an update takes effect means you accept the revised policy.

Contact us

Questions, objections, suppression requests and rights requests should go through the privacy@controlgtm.com route on this site.

Entity

Control8 Inc.

Postal address

169 Madison Ave, Ste 13918, New York, NY 10016, United States

Privacy contact

privacy@controlgtm.com