Acquia Campaign Studio

Last revision of this Product Notice: [v1.1 – 17 May 2021 – hyperlinks updated]

Prior version(s) of this Product Notice: [v1.0 – 04 March2021 – initial version]

This Product Notices describes the privacy relevant aspects of the above-mentioned Acquia product/services.

About the Product

Acquia Campaign Studio is a marketing automation platform where Customers can build email campaigns, personalize messages, execute A/B tests, and measure results. Customers may add any data about the recipients of such email campaigns and personalize messages based on such data. Customers identify in their sole discretion what Personal Data of their recipients is used for the personalization of the respective email campaign. In its own discretion, Customer can connect Campaign Studio with its third-party tools (such as CRM) by using connectors supplied by Acquia.

For details about this Product, visit the Product Description available online at Acquia Products and Services Guide.

1. Processing Operation(s)

   The objective of Processing of Personal Data by data importer is the performance of the Services pursuant to the Agreement.

   • Processing of Personal Data to deliver its core functionalities required: ☒ yes  ☐ no
   • Optional features processing Personal Data:  ☒ yes  ☐ no
     • The optional features are deactivated by default:  ☒ yes  ☐ no ☐ n/a*
   • Processing of sensitive Personal Data: ☒ yes **   ☐no ☐ n/a*
   • Profiling of individuals based on personal characteristics: ☒ yes ** ☐ no ☐ n/a*
   • Automated decision making that produces legal or other significant impacts on individuals:  ☒ yes  ☐ no ☐ n/a*

   • Processing via an AI tool available with the Product ☒ yes ☐ no

     • The AI feature is deactivated by default: ☒ yes ☐ no
     • The AI feature processes Personal Data: ☐ yes ☒ no
     • The AI feature processes sensitive Personal Data ☐ yes ☒ no
     • The Customer can control what data the AI tool processes: ☒ yes ☐ no

     * (n/a = not applicable)

     **(optional; depends on the Customer’s configuration of the system, the connection to other systems, and the categories chosen by the Customer to be collected from Third Party Users)

2. Details of Personal Data being processed

   Categories of Personal Data	Categories of Data Subjects	Purpose of Processing	Categories of Data Recipients	Needed for Core Features	Processing Location	Acquia Inc. acts as Processor
   Through the configuration, design, and administration of their own Acquia Campaign Studio instance, Customer in its sole discretion determines and controls the categories of Personal Data collected by their Acquia Campaign Studio instance. Customer has full access and autonomy over what types of data are tracked and has access to this data and can manipulate it in various ways. The categories of Personal Data could be any category the Customer chooses, such as commercial information, purchasing tendencies, records of personal properties, contact  information including home address, personal email, phone numbers, geolocation, age, date of birth, first name, gender, height, last name, marital status, nationality, racial or ethnic origin, religion / religious beliefs, sexual orientation, or other unique personal identifiers, including sensitive Personal Data.	Through the configuration, design, and administration of their own Acquia Campaign Studio instance, Customer in its sole discretion determines and controls the categories of data subjects collected by their Acquia Campaign Studio instance. Customer has full access and autonomy over what types of data are tracked and has access to this data and can manipulate it in various ways. Primarily, the categories of Data Subjects are the recipients and addressees of Customer’s email marketing campaigns.	Provision of the Services by Acquia to Customer. Data collected is processed by Acquia Campaign Studio only for the purposes of delivering tailored email marketing to the Customer's  marketing campaign recipients. Any usage of the data beyond is in the sole discretion of the Customer.

3. Privacy Enhancements

   Objective	Technology / Measure	Data at Rest	Data in Transit
   Anonymization and Pseudonymization	Data anonymization at Customer level optional for Customer	No	No
   Data confidentiality	Encryption at customer level Encryption at Acquia level Encryption at Acquia Sub-processor level (see Security Annex and Product Description)	Yes N/A* N/A* Yes	Yes Yes Yes Yes
   Data integrity	Ant-tampering technology (see Security Annex)	Yes	Yes
   Data availability including restoring availability, restoring access to personal data, and data resilience	Business continuity and disaster recovery measures (see Security Annex)	Yes	Yes

4. Data Subject Rights

   N/A

5. (Personal) Data Retention Cycles

   Profile data can be deleted and updated at any time during the Term of the Service by the Customer. Profile data and application/configuration is retained latest until the end of the subscription term.

6. Sub-Processing

   The specific list of sub-processors is available from: Acquia Sub-processors.

   Any current Acquia customer with a data processing agreement in place with Acquia may subscribe to receive notifications of new or changed sub-processors through above website.

7. Description of the technical and organisational security measures implemented by the data importer in accordance with Clauses 4(d) and 5(c) (or document/legislation attached)

   Data importer has implemented and will maintain appropriate administrative, physical, and technical safeguards for the protection of the security, confidentiality and integrity of Personal Data uploaded to the Services, as described in the Acquia Security Annex, applicable to the specific Services purchased by data exporter, as updated from time to time, and made available by data importer upon request. The data exporter is wholly responsible for implementing and maintaining security and data administration within any data exporter applications, configuration settings, or log settings used by data exporter in conjunction with the Services.

Campaign Studio Product Privacy Notice

Regular testing, assessing and evaluating of TOMs

*(N/A = not applicable) Encryption at sub-processor level used.

Regular testing, assessing and evaluating of TOMs

*(N/A = not applicable) Encryption at sub-processor level used.