Last Updated: June 25, 2019
Welcome to our website (the “Site”). Narvar, Inc. (“Narvar”) offers a software as a service platform to Customers that have contracted with Narvar to help manage and improve consumers’ post-purchase experience, including order tracking, delivery notifications, management of product returns and customer support (“Services”).
Personal Data Collected
When you interact with the Site or the Services, we may collect information that, alone or in combination with other information, could be used to identify you (“Personal Data”), as described below:
1.1 Personal Data Provided Through The Site or Services. We collect Personal Data from you when you create an account, use or order products or services, request information (including a demo), ask to download content (such as a white paper or an e-book), communicate with customer service, or subscribe to emailing lists. The types of Personal Data that we collect vary based on your request, but generally include:
- First and last name
- Job title
- Company name
- Email address
- Phone number
- Mailing address
- Narvar account password
- Payment and billing information
- Country location
When you sign up for our blog, we collect your email address. If you choose to receive promotional emails from us, we will also collect your email subscription preferences.
1.2 Personal Data Obtained From Other Sources. We may supplement the information that we collected from you (such as your email address) with additional information about you and your company obtained from publicly available and third-party databases or services that provide information about business people and companies (including an individual’s name, job title, business contact information, and company information). This helps us update, expand and analyze our records, identify new customers, and provide products and services that may be of interest to you.
1.3 Personal Data We Collect On Behalf Of Customers. In providing the Services to Customers, we process on behalf of our Customers Personal Data about consumers who make a purchase for product or services on our Customers’ websites, mobile applications or other services, that our Customers or their consumers input or upload into our Services.
For example, when consumers make a purchase from one of our Customers and are the recipient of a package, they may have been provided a link to a Narvar’s tracking page in order to check the status of an order. When Customers use our shipping and order tracking, alert, or return Services, we receive name, order, and shipping information from a carrier or one of our Customers. When consumers visit our Site to track a package in transit or process a return, we collect information relating to visits to the Site, as we do with other Site visitors (for further information, please see the “Automatically Collected Data” section below).
Our Services allow Customers to ensure that their consumers can obtain information about their orders via SMS. In this case, we will use phone number and other information submitted to us to provide the text messages associated with the SMS service.
When providing the Services to our Customers, sometimes it is necessary to obtain Personal Data about consumers from publicly accessible sources (such as carriers like the United States Postal Service that match address information) or from third parties in order to ensure fulfillment of orders. We will combine this data with information we already collected on behalf of our Customers. For example, we may obtain information on consumers’ address from retailers or shipping companies to verify the address and contact information so we can properly provide information about package status.
How We Use Personal Data
2.1 To Provide The Services To Customers And Respond To Requests. We use account-related data provided by Customers to us in connection with the purchase, sign-up, use or support of Customer account (such as usernames, email address and billing information) to provide you with access to the Services and/or the Site, contact you regarding your use of the Services and/or the Site or to notify you of important changes to the Services and/or the Site. For EU Data Subjects, such use is necessary for the performance of the contract between you and us.
When you ask for information about the Services (for example, when you ask us to send you offers or price information, or to download content from the Site), we will use your contact information to respond to your requests. For EU Data Subjects, such use is necessary to respond to or implement your request prior to entering into a contract with us.
Our use of information on behalf of our Customers is governed by our contract with that Customer and the Customer’s own privacy policies.
2.2 For Marketing Purposes. For prospective customers, we may use your Personal Data to send you updates to Narvar’s services and activities or other promotions. If you wish to subscribe to our newsletter(s), we will use your name and email address to send the newsletter to you.
Where required by the applicable law (for example, if you are an EU Data Subject), we will send you such information only with your consent, which was given at the time you provided us with the Personal Data. In such case, if you do not provide us with your consent to the processing of your Personal Data for this purpose, we will not send you this information.
Out of respect for your privacy, you may choose to stop receiving our newsletter or marketing emails by following the unsubscribe instructions included in each promotional communication we send you, or you can contact us at email@example.com. If you are an EU Data Subject, please see the “EU Data Subjects” section below for information on your rights in relation to the Personal Data we hold about you.
2.3 To Analyze, Administer, Support, Improve use of the Site and the Services. We use data relating to your use of the Site and/or the Services to analyze, administer, support and improve your access to and use of the Site and the Services. We may also compile and/or aggregate your Personal Data and other data and use such aggregated data for our business purposes, including sharing such data with affiliates and business partners. For EU Data Subjects, this use of your Personal Data is necessary for our legitimate interests in understanding how the Site and the Services are being used by you and to improve your experience on it. For more information about what we mean by legitimate interests, and when we may process Personal Data for our legitimate interests, please see the “EU Data Subjects” section below.
Disclosure of Personal Data
3.1 Service Providers. We share your Personal Data with third parties who provide certain services to us to assist us in meeting business operation needs. These parties are authorized to process your Personal Data, on our behalf and pursuant to our instructions, only as necessary to provide these services to us. We share your Personal Data with our subsidiaries and the following service providers:
- Providers who help us fulfill orders payment processing
- Providers who help us fulfill customer subscriptions
- Providers of website analytics services
- Providers of cloud computing infrastructure
3.2 Narvar Subsidiaries. Our business is headquartered in the U.S. and we operate on a global scale. In order to provide the Services you request from us, our subsidiaries in London (United Kingdom) and India may access and process your Personal Data which we collect from you for customer service and relationship management purposes. Our subsidiaries will only use your Personal Data for the purposes for which we originally collected it. We have a legitimate interest in sharing Personal Data with our subsidiaries for internal administrative purposes and to support our business (for more information about what we mean by legitimate interests, please see the “EU Data Subjects” section below).
3.3 Business Transfers. If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, sale of company assets, or transition of service to another provider, your Personal Data and other information may be transferred to a successor or affiliate as part of that transaction along with other assets.
3.4 Legal Requirements. We may be also disclose your Personal Data (i) in response to lawful requests by public authorities, including meeting national security or law enforcement requirements, (ii) as required by law, such as to comply with a subpoena or other legal process, (iii) when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a government request.
EU Data Subjects
4.1 Scope. This section applies if you are an individual located in the European Union (“EU”) (“EU Data Subject”). For these purposes, reference to the EU also includes the European Economic Area countries of Iceland, Liechtenstein and Norway and, where applicable, Switzerland.
4.2 Data Controller. Narvar is the data controller for the processing of Personal Data provided to us through the Site, but we act as data processor on behalf of Customers for Personal Data that we process through the Services, as described under the “Personal Data Collected” section above. We have a subsidiary in London (Narvar UK Limited, Highlands House Basingstoke Road, Spencers Wood, Reading, United Kingdom, RG7 1NT) and a subsidiary in India, which support us with customer service, relationship management and sales.
4.3 Your Rights. As a data controller, we are required to inform you of your rights under EU data protection law, including the European Union General Data Protection Regulation 2016/679 (“GDPR”). Subject to applicable law, you have the following rights in relation to your Personal Data:
- Right of access: If you ask us, we will confirm whether we are processing your Personal Data and, if so, provide you with a copy of that Personal Data (along with certain other details). If you require additional copies, we may need to charge a reasonable fee.
- Right to rectification: If your Personal Data is inaccurate or incomplete, you are entitled to have it rectified or completed. If we have shared your Personal Data with others, we will tell them about the rectification where possible. If you ask us, where possible and lawful to do so, we will also tell you with whom we shared your Personal Data so that you can contact them directly.
- Right to erasure: You may ask us to delete or remove your Personal Data and we will do so in some circumstances, such as where we no longer need it (we may not delete your data when other interests outweigh your right to deletion). If we have shared your data with others, we will tell them about the erasure where possible. If you ask us, where possible and lawful to do so, we will also tell you with whom we shared your Personal Data so that you can contact them directly.
- Right to restrict processing: You may ask us to restrict or ‘block’ the processing of your Personal Data in certain circumstances, such as where you contest the accuracy of that Personal Data or object to us processing it. We will tell you before we lift any restriction on processing. If we have shared your Personal Data with others, we will tell them about the restriction where possible. If you ask us, where possible and lawful to do so, we will also tell you with whom we shared your Personal Data so that you can contact them directly.
- Right to data portability: Effective 25 May 2018, you have the right to obtain your Personal Data from us that you consented to give us or that is necessary to perform a contract with you. We will give you your Personal Data in a structured, commonly used and machine-readable format. You may reuse it elsewhere.
- Right to object: You may ask us at any time to stop processing your Personal Data, and we will do so:
- If we are relying on a legitimate interest to process your Personal Data — unless we demonstrate compelling legitimate grounds for the processing; or
- If we are processing your Personal Data for direct marketing.
- Right to withdraw consent: If we rely on your consent to process your Personal Data, you have the right to withdraw that consent at any time. This will not affect the lawfulness of processing based on your prior consent.
- Right to lodge a complaint with the data protection authority: If you have a concern about our privacy practices, including the way we have handled your Personal Data, you can report it to the data protection authority that is authorized to hear those concerns.
You may exercise your rights by contacting us as indicated under “Contact Us” section below.
4.4 Legitimate Interest. “Legitimate interests” means the interests of Narvar in conducting and managing our organization. As described in the “How We Use Personal Data” section, we have a legitimate interest in processing data relating to your use of the Site and/or the Services to analyze how the Site and the Services are being used by you. We have also a legitimate interest in sharing Personal Data with our subsidiaries for internal administrative purposes and to support our business. When we process your Personal Data for our legitimate interests, we make sure to consider and balance any potential impact on you, and your rights under data protection laws. Our legitimate interests do not automatically override your interests. We will not use your Personal Data for activities where our interests are overridden by the impact on you, unless we have your consent or those activities are otherwise required or permitted to by law. You have the right to object to processing that is based on our legitimate interests. For more information on your rights, please see “Your Rights” section above.
4.5 Data Transfers. We rely on the EU-U.S. and Swiss-U.S. Privacy Shield certification to transfer Personal Data and other information that we receive from the EU and Switzerland to Narvar in the U.S. and we will perform onward transfers to the service providers described in this Policy in accordance with our Privacy Shield certification. For more information, please read the Privacy Shield section below.
We rely on our Privacy Shield certification to transfer Personal Data and other information that we receive from the EU and Switzerland to Narvar in the U.S. and we process this data in accordance with the Privacy Shield Principles of Notice, Choice, Accountability for Onward Transfer, Security, Data Integrity and Purpose Limitation, Access, and Recourse, Enforcement and Liability (“Privacy Shield Principles”), as described below.
5.2 Accountability for Onward Transfers: Narvar is responsible for the processing of Personal Data it receives from the EU and Switzerland, under the Privacy Shield Frameworks, and subsequently transfers to third-party service providers (as described in the “Disclosure Of Personal Data” section above) if they process Personal Data in a manner inconsistent with the Privacy Shield Principles and Narvar is responsible if they do so and for the harm caused. We will only disclose Personal Data collected through the Services on behalf of our Customers to third parties where permitted or required by the Customer, and in accordance with the Privacy Shield Principles.
5.4 Data Integrity and Purpose Limitation: We will take reasonable steps to ensure that Personal Data is reliable for its intended use, and that it is accurate, complete and current for as long as long as we retain it. We will keep your Personal Data only for as long as your account is active or as needed to provide you the Services (whichever is the longer), or for as long as necessary to resolve disputes and enforce our agreements or for the duration required by law or our Customer agreement.
5.5 Access: You have certain rights to access, correct, amend, or delete Personal Data where it is inaccurate, or has been processed in violation of the Privacy Shield Principles. When we process Personal Data on behalf of our Customers, the Customer will be responsible to respond to requests for exercising your rights. We honor all Customers’ requests from their consumers to access, correct, amend, or delete Personal Data.
5.6 Recourse, Enforcement, Liability: In compliance with the Privacy Shield Principles, Narvar commits to resolve complaints about our processing of your Personal Data. Individuals with inquiries or complaints regarding this Private Shield Policy should first contact Narvar as follows:
- Email: firstname.lastname@example.org
- Postal Mail:
Attn: Narvar Legal
50 Beale Street, 7th Floor
San Francisco, CA 94105
Narvar has further committed to refer unresolved Privacy Shield complaints to our U.S.-based third party dispute resolution provider (free of charge) that you may contact at https://feedback-form.truste.com/watchdog/request.
If your complaint is not resolved through these channels, under certain conditions a binding arbitration option may be available before a Privacy Shield Panel. For additional information, please visit here.
With respect to Personal Data received or transferred pursuant to the Privacy Shield Frameworks, Narvar is subject to the investigatory and regulatory enforcement powers of the U.S. Federal Trade Commission.
The security of your Personal Data is important to us. We follow generally accepted standards to protect the Personal Data submitted to us, both during transmission and once it is received. If you have any questions about the security of your Personal Data, you can contact us at email@example.com.