Sprout Social, Inc. Privacy Policy

Sprout Social respects your right to privacy. This privacy policy (“Privacy Policy”) explains who we are, how we collect, share and use information about you and how you can exercise your privacy rights. Our Privacy Policy applies to our use of personal information when you use the Sprout Social websites and services, including but not limited to www.sproutsocial.com, app.sproutsocial.com, influencer.sproutsocial.com and advocacy.sproutsocial.com (depending on your use, the “Site” and/or the “Services”) or when you otherwise interact with Sprout Social.  For further information on the terms which govern your use of the respective Service, please see https://sproutsocial.com/terms or any service order you may have signed with us.

1. What does Sprout Social do?

1.1 Our Services

Sprout Social is a provider of software for social media management. Our core services include:

• Sprout Social – our main platform provides tools that enable our customers to manage their social media presence across third party social media applications, produce analytics to inform social media strategy, manage customer engagement and uncover data with actionable insights.

• Employee Advocacy – allow our customers' employees to become brand advocates of our customers by providing tools which facilitate brand content sharing, impact measurement and brand amplification.

• Influencer Marketing – connects brands with influencers and content creators ("Creators") to drive creator and influencer marketing strategies for our customers, facilitate partnership management and manage campaign analytics.

 For more information about Sprout Social, please see the “About Us” section of our Site at https://sproutsocial.com/about/. 

1.2 Our data processing roles

In connection with the provision of the Services to our customers, Sprout Social may act as a "data processor" or "service provider" under applicable data protection laws. In connection with these activities, Sprout Social acts on behalf of its customers, who remain responsible for personal information processing (and are considered the "data controllers" for the purposes of EU and UK data protection law). 

Sprout Social also acts as a "data controller" (or "business," as applicable) when it processes personal information for its own purposes, such as operating and improving the Site and Services, marketing, account management, security, and compliance. In connection with the Influencer Marketing Service, Sprout Social independently collects personal information about Creators and makes that information available to its customers. 

If you want to understand more about how our customers process your personal information, please refer to the relevant customer's privacy policy. You can also contact such customers directly if you have any questions or concerns about how your information is being used.

If you would like to contact Sprout Social about our use of your personal information, please use the details provided in the “How to Contact Us” section of this Privacy Policy. For more detail on how Sprout Social uses your personal information in each of these roles, please see the "Use of Information" section, below. 

If you are an applicant for roles at Sprout Social, please see Sprout Social's Global Applicant Policy here. 

2. Information Collected and Processed About You

We collect information about visitors to our Site, our customers and their users of the Services, users of our customers’ social media pages / properties, Creators who are  users of our Services, and Creators who are not users on our Services. Such information is collected from the following sources:

2.1 Information We Collect Directly from You ("Directly"):

The type of information that we collect directly from you varies based on your interaction with our Site and our Services. For example, we collect information directly from you when you register for an account with us, liaise with us on a customer service issue or complete a form or other data capture field on the Site and/or within our Services. We also collect and process information that you send us via any medium, such as when you contact us by email or phone (including but not limited to email address and phone number). In addition, we collect information about you from your social media interactions on third party social media properties, such as your social media handle, username, profile, postings, and messages you exchange with us.  

2.2 Information We Receive from (or via our relationships with) Customers ("Via Customers"):

We receive information from customers in order to provide our Services. Such information may include a user’s social media handle, username, profile picture, biography, follower counts, website URL, first and last name (if provided by user), engagement and analytics metrics, and messages or communications with our customers. We may collect this information via our customers' use of our Services, when you interact with our customers' social media accounts across various third-party social media properties. We also collect information from individuals employed by our customers (customer representatives) such as their contact information in order to provide our Service and manage the customer account and relationship. Customers may also supplement the information within the Influencer Marketing Service, with additional information about a Creator.

2.3 Information We Receive from Creators Who Are Users of the Services ("User Creators"):

We receive information from Creators who sign-up to use the Influencer Marketing Service. Such information may include their contact information, social media handle, username, profile picture, biography, follower counts, website URL, first and last name (if provided by user), authentication tokens where they choose to connect their social media accounts, engagement and analytics metrics, and messages or communications they make via the Services.

2.4 Information We Receive About Creators Who Are Not Users on the Services ("Non-user Creators"):

We receive information about Creators who are not users of the Influencer Marketing Service. Such information may include their contact information, social media handle, username, profile picture, biography, follower counts, website URL, name (if made public by the Creator on their social media accounts), and communications. We receive this information from various sources, including our customers and official social media platform APIs through which we collect publicly available social media data, posts, and metrics. We may also generate insights about creators using artificial intelligence and machine learning, such as estimated audience demographics, engagement analysis, and content categorization.

2.5 Information Collected Automatically ("Automatically"):

When you visit our Site or use our Service, we may collect certain information automatically from your device. This information may be considered personal information under applicable data protection laws. Specifically, the information we collect automatically may include information like your IP address, device type, unique device identification numbers, advertising click identifiers, campaign parameters, browser-type, broad geographic location (e.g. country or city-level location), third party webpages accessed via the Services and other technical information. We may also collect information about how your device has interacted with our Site (including the pages accessed and links clicked) or Services (including content accessed). Collecting this information enables us to better understand the visitors who come to our Site or use our Services, where they come from, and what content and functionality is of interest to them. We use this information for our internal analytics purposes and to improve the quality and relevance of our Site and/or Services to our visitors and users. 

Some of this information may be collected using cookies and similar tracking technology, as explained further under the heading “Cookies, similar tracking technology, and analytics” below and in our Cookie Notice.

2.6 Information from Other Sources ("Third Party Sources"): We also collect information from third party sources, as follows: 

• Data brokers or resellers from which we purchase data to verify and supplement the data we collect for our internal business use.

• Social networks where we are granted permission from customers to access such information on their behalf via APIs.  In connection with the Influencer Marketing platform, we also collect publicly available social media data, including profile information, posts, and metrics, through official social media platform APIs. 

• Partners that offer co-branded services, sell or distribute our products, or engage in joint marketing activities.  

2.7

The table below provides a more detailed breakdown of the categories of personal information we collect from and about you through the Site and/or Services or in our other interactions with you, along with the corresponding sources of this information.

3. Do-Not-Track

Your browser settings may allow you to automatically transmit a “Do Not Track” signal to online services you visit. Note, however, there is no industry consensus as to what site and app operators should do with regard to these signals. Accordingly, unless and until the law is interpreted to require us to do so, our systems do not recognize browser “do-not-track” requests. You may, however, disable certain tracking as discussed in this Privacy Policy (e.g., by disabling cookies, or using private browsing modes).

We honor Global Privacy Control (GPC) signals as valid requests to opt out of the sale or sharing of personal information, as required by applicable state law. For more information on how to exercise your opt-out rights, see the "Your Data Protection Rights" section below.

4. Use of Information

Sprout Social processes information for business and commercial purposes in accordance with the practices described in this Privacy Policy. Set out below is (i) a summary description of these purposes (section 4.1), and (ii) a more detailed description of the processing activities we undertake accompanied by details of the categories of personal information processed and, as applicable for the purposes of UK and EU data protection law, details of the lawful basis relied upon for such processing (section 4.2). 

4.1 Description of business purposes for collecting and using personal information (including over the last 12 months):

Our business purposes for collecting and using personal information, including in the last 12 months, include the following:

• Operate and improve the Site and Services;

• Provide the Service and other products and services that may be requested or could be of interest;

• Facilitate subscription processing, reviews and analysis;

• Evaluate user interest and needs in order to improve the Service and make available other offers, products or services;

• Record calls for quality, training and Service improvement purposes (upon receipt of consent where required by applicable law);

• Evaluate the types of offers, products or services we make available;

• Monitor use of the Service, including for troubleshooting and product improvement purposes;

• Provide customer support;

• Communicate and provide additional information that may be of interest to users through email or other means, such as special offers, announcements, and marketing materials;

• Conduct online research surveys regarding the Site and/or Service;

• Combine datasets to create aggregated data for internal evaluation and analysis;

• Share anonymized or personalized tokens across the Sprout Social, Influencer Marketing and Employee Advocacy platforms in order to provide the Service;

• Send you reminders, technical notices, updates, product announcements, security alerts and support and administrative messages, service bulletins, or marketing;

• Provide advertisements to you through email messages;

• As necessary to consider your job application for open positions, process your employment and education history, transcript, writing samples, and references;

• Manage our everyday business needs such as Site and/or Service administration, forum management, fulfillment, analytics, fraud prevention, enforcement of our corporate reporting obligations, legal terms and any other contractual agreement relating to our Service or to comply with the law; and

• Fulfill any other business or commercial purposes at your direction or with your notice and/or consent.

4.2 Additional details regarding our data processing activities 

4.2.1 Sprout Social's processing of personal information as a data processor

Sprout Social acts as a data processor on behalf of its customers in connection with the provision of the Services to its customers, as further described below. 

4.2.2 Sprout Social's processing of personal information as a data controller

In some jurisdictions, such as in the European Union and the United Kingdom, we need a "legal basis" to process your personal information. Our legal basis will be one of the following:

• Contract - we require certain personal information for the performance of our contract with you and to provide and support the Services you request from us;

• Consent - In certain circumstances, we may ask for your consent for a specific processing activity, before we collect, use, or disclose your personal information, in which case you can voluntarily choose to give or deny your consent without any negative consequences to you.
  
  If you consent through our cookie management tool, we may use your personal data for advertising measurement and optimization including by linking information you provide to us with advertising click identifiers and sharing hashed contact information and conversion data with advertising partners, including Google. We rely on your consent for this processing where required by applicable law. You may withdraw your consent at any time by adjusting your cookie preferences. Withdrawal will apply going forward and will not affect processing that occurred before your withdrawal; 

• Legitimate interests - We may use or disclose your personal information for the legitimate interests of either Sprout Social or a third party, but only when we are confident that your privacy rights will remain appropriately protected. Where we require personal information to pursue our legitimate interests or the legitimate interests of a third party, it will be in a way which is reasonable for you to expect as part of the running of our business and we will have balanced such interests against consideration of your rights and freedoms. To obtain more information , please contact us using the contact details provided under the “How to Contact Us” heading below; and 

• Legal Obligation - There are instances where we must process and retain your personal information to comply with laws or to fulfil certain legal obligations.

If you have questions about or need further information concerning the legal basis on which we collect and use your personal data, please contact us using the contact details provided under the “How to Contact Us” heading below. 

Notwithstanding the above, we may use information that does not identify you (including information that has been aggregated or de-identified) for any purpose except as prohibited by applicable law. For information on your rights and choices regarding how we use information about you, please see “Your Data Protection Rights” below. 

5. Categories of Third Parties With Whom We May Share Your Information

We share information we collect in accordance with the practices described in this Privacy Policy. 

The categories of recipients with whom personal information is shared are detailed below:

Affiliates, service providers and partners who provide data processing services to us (for example, to support the delivery of, provide functionality on, or help to enhance the security of our Site or Service), or who otherwise process information for purposes that are described in this Privacy Policy or for which we provide you notice when we collect your information. We share information with our affiliates for business and commercial purposes. We contractually prohibit our service providers from retaining, using, or disclosing information about you for any purpose other than performing the services for us, although we may permit them to use information that does not identify you (including information that has been aggregated or de-identified) for any purpose except as prohibited by applicable law.

Details of the third-party services providers we currently engage to support the Sprout Social business, Site and Services are listed in more detail below:

Our customers (including information pertaining to customer end-users as well as internal personnel and creators who may be relevant to their influencer marketing activities) in order to effectively provide our social media management, social advocacy, social analytics, influencer marketing and social listening services and to manage the customer relationship. For example, we share information with our customers in order to facilitate the processing of their orders, maintain and administer their online accounts, respond to their questions and comments, comply with their requests, help them identify and connect with creators they want to work with, market and advertise to them and otherwise comply with our contractual obligations and with applicable law.

Creators who use the Services (including information pertaining to other creators and customers who may be interested in working with them) in order to effectively provide our, influencer marketing services and to manage their account. For example, we share information with creators who use the Services in order to help them identify and connect with customers they want to work with, maintain and administer their online accounts, respond to their questions and comments, comply with their requests, market and advertise to them and otherwise comply with our terms and with applicable law.

Local information technology resellers in certain countries where permitted by applicable law. We may provide contact information of customers / potential customers to such reseller to market our Service.

Competent law enforcement bodies, regulatory, government agencies, courts or other third parties where we believe disclosure is necessary (i) as a matter of applicable law or court order or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person.

Potential buyers (and their agents, investors, and/or advisors) in connection with any proposed or actual purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your information only for the purposes disclosed in this Privacy Policy.

Vendors for business and commercial purposes, including analytics and advertising technology companies, such as Google. Vendors may act as our service providers, or in certain contexts, independently decide how to process your information. For more information on advertising and analytics, see the "Cookies, similar tracking technology, and analytics" section below.

Any other person with notice to you and your consent to the disclosure.

When you voluntarily enter a sweepstakes, contest, or other promotion, we share information as set out in the official rules that govern the promotion as well as for administrative purposes and as required by law (e.g., on a winners list). By entering a promotion, you agree to the official rules that govern that promotion, and may, except where prohibited by applicable law, allow the sponsor and/or other entities to use your name, voice and/or likeness in advertising or marketing materials.

When you make information public through the Site or Service, such as information in your profile or that you post or comment on public boards, including through Disqus and social media, your information is publicly viewable. Please think carefully before making information public as you are solely responsible for any information you make public. Once you have posted information, you may not be able to edit or delete such information, subject to additional rights set out in the “Your Data Protection Rights” section below.

When you request or direct us to share information, such as when you choose to share information with a social network or other third party platform about your activities on the Service, which may require you to accept such third party’s terms of use or privacy policy.

Please note the Services use third-party services, and if you use these third-party services through the Services, you are subject to the privacy policies of these third-party services (as applicable), including but not limited to:  

Notwithstanding the above, we may share information that does not identify you (including information that has been aggregated or de-identified) except as prohibited by applicable law. When information is de-identified (as defined by the CCPA), we maintain policies and technical procedures to avoid reidentification of such information. For information on your rights and choices regarding how we share information about you, please see the “Your Data Protection Rights” section below. In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

6. Data Retention

We retain information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a Service you have requested or to comply with applicable legal, tax or accounting requirements).

When we have no ongoing legitimate business need to process your information, we will either delete or anonymize it in accordance with our data retention policy, or, in the limited circumstances where this is not possible (for example, because your information has been stored in backup archives), then we will securely store your information and isolate it from any further processing until deletion is possible.

7. Sensitive Information

The terms that govern your use of the Services prohibit you from providing Sprout Social with Sensitive Information (as defined in our Usage Policy) .

 8. Cookies, similar tracking technology, and analytics

We use cookies and similar tracking technology (collectively, “Cookies”) to collect and use information about you, including to recognize you when you visit the Site and to serve interest-based advertising. For further information about the types of Cookies we use, why, and how you can control Cookies, please see our Cookie Policy.

We also use analytics services, such as Google Analytics, to help us understand how users access and use the Service. In addition, we also use audience matching services to reach people (or people similar to people) who have visited our Services or are identified in one or more of our databases ("Matched Ads"). This is done by us uploading a customer list to a technology service or incorporating a pixel from a technology service into our own Service, and the technology service matching common factors between our data and their data. For instance, we incorporate the Facebook pixel on our Services and may share your email address with Facebook as part of our use of Facebook Custom Audiences.

We also use advertising partners, including Google, to measure offline conversions and improve ad delivery. For example, when you click one of our ads and later submit a form or otherwise interact with us, we may use an advertising click identifier to understand whether that ad led to a later conversion, such as a qualified lead or purchase. Where enabled, we may also share hashed contact information and conversion event information with Google to improve conversion matching and campaign optimization. Google processes this information on our behalf under Google's applicable data processing terms. For more information about how Google uses information from sites and apps that use its services, please visit Google's Business Data Responsibility page at https://business.safety.google/privacy/.

Google provides tools to allow you to opt out of the use of certain information collected by Google Analytics at https://tools.google.com/dlpage/gaoptout and by Google Analytics for Display Advertising or the Google Display Network at https://www.google.com/settings/ads/onweb/.

To opt out of us using your data for Matched Ads and other audience matching, please click the “Do Not Sell or Share My Personal Information” link. You can also set your browser to send a Global Privacy Control signal that communicates to us that you would like to opt-out of these activities. Please note that opting out of these activities does not mean that you will stop seeing ads. You will still see ads related to the Services, but you will stop receiving ads that are personalized to you.

As indicated above, vendors may act on our behalf or in certain contexts, independently decide how to process your information. We encourage you to familiarize yourself with and consult their privacy policies and terms of use.

9. Social Media and Technology Integrations

We offer parts of our Services through websites, platforms, and services operated or controlled by separate entities. In addition, we integrate technologies operated or controlled by separate entities into parts of our Site and Service. Some examples include:

• Links. Our Site and Services includes links that hyperlink to websites, platforms, and other services not operated or controlled by us.

• Liking, Sharing, and Logging-In. We may embed a pixel or SDK on our Site or Services that allows you to “like” or “share” content on, or log-in to your account through social media. If you choose to engage with such integration, we may receive information from the social network that you have authorized to share with us. Please note that the social network may independently collect information, and we may transmit information, about you and your use of the Site or Services through the integration.

• Brand Pages and Chatbots. We may offer our content through social media. Any information you provide to us when you engage with our content (such as through our brand page or via our chatbot on the Site or Service) is treated in accordance with this Privacy Policy. Also, if you publicly reference our Services on social media (e.g., by using a hashtag associated with Sprout Social in a tweet or post), we may use your reference on or in connection with our Site or Services.

Please note that when you interact with other entities, including when you leave our Site or Services, those entities may independently collect information about you and solicit information from you. The information collected and stored by those entities remains subject to their own policies, terms, and practices, including what information they share with us, your rights and choices on their services and devices, and whether they store information in the U.S. or elsewhere. We encourage you to familiarize yourself with and consult their privacy policies and terms of use.

10. Your Data Protection Rights

Depending on your location, you may have certain rights with respect to personal information we collect and process about you. 

10.1. Rights Available to All Users

• Right to Access, Correct, and Delete. You may request access to, correction of, or deletion of your personal information at any time by contacting us using the details provided under the "How to Contact Us" heading below. If you submit a request to delete your information, this may limit your ability to use the Site and/or Services. If you have authorized us to access your data via the YouTube API Services, you may also revoke our access to your data via the Google security settings page at https://security.google.com/settings/security/permissions.

• Right to Opt Out of Marketing Communications. You may opt out of marketing communications at any time by clicking the "unsubscribe" or "opt-out" link in the marketing emails we send you. To opt out of other forms of marketing (such as postal marketing or telemarketing), please contact us using the contact details provided under the "How to Contact Us" heading below. Please note that your opt out is limited to the email address, device, and phone number used and will not affect subsequent subscriptions.

• Right to Withdraw Consent. If we have collected and processed your information with your consent, you may withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your information conducted in reliance on lawful processing grounds other than consent.

10.2 Additional Rights for EEA and UK Residents

If you are a resident of the European Economic Area or the United Kingdom, you may also exercise the following rights:

• Right to Object to Processing. You may object to the processing of your personal information where we rely on legitimate interests as the legal basis for processing.

• Right to Restrict Processing. You may request that we restrict the processing of your personal information in certain circumstances.

• Right to Data Portability. You may request portability of your personal information.

• Right to Lodge a Complaint with a Supervisory Authority. You have the right to complain to a data protection authority about our collection and use of your information. Contact details for data protection authorities in the EU are available here and for the UK here. Certain data protection authorities will require that you exhaust our own internal complaints process before looking into your complaint.

10.3 Additional Rights for US State Residents

If you are a resident of California, Colorado, Virginia, or another US state with applicable privacy legislation, you may also exercise the following rights:

• Right to Know. You have the right to request certain information about our data practices in the preceding 12 months, including the categories of personal information we have collected about you, the categories of sources from which the personal information was collected, the categories of personal information disclosed for a business purpose or sold, the categories of third parties to whom the personal information was disclosed, the business or commercial purpose for collecting or selling the personal information, and the specific pieces of personal information we have collected about you.

• Right to Delete. You have the right to request that we delete the personal information we have collected about you, subject to certain exemptions.

• Right to Correct. Subject to certain exceptions, you have the right to request that we correct inaccurate personal information we have collected about you. We may request additional information showing that the information you want to correct is inaccurate.

• Right to Opt Out of Sale, Sharing, and Targeted Advertising. You have the right to opt out of processing of your personal information for the purpose of (i) targeted advertising, (ii) "sale" or "sharing" of personal information, or (iii) profiling to provide you with tailored content, including suggested advertising. You may submit a request to opt out by clicking “Do Not Sell or Share My Personal Information”, by calling our toll-free number at (866) 878-3231, or by emailing us at privacy@sproutsocial.com.

• Right to Limit Use of Sensitive Personal Information. You may request that we limit the use and disclosure of your sensitive personal information to purposes authorized by applicable law. Sprout Social does not intentionally collect sensitive personal information through its platforms. If you believe we hold sensitive personal information about you, contact us at privacy@sproutsocial.com or call (866) 878-3231.

• Right to Non-Discrimination. You have the right not to receive discriminatory treatment by us for the exercise of any of your rights.

• Right to Appeal (Virginia and Colorado). If we are unable to comply with your request, you may appeal our decision by emailing privacy@sproutsocial.com with the subject line "Data Access Request Appeal." If after completing the appeal process you are still not satisfied with our response, you may contact your state Attorney General to file a complaint.

• Additional information about these rights and state specific disclosures can be found under the “California, Colorado, Virginia, and Other U.S.State Disclosures” section below. 

10.4 How to Exercise Your Rights

To exercise any of these rights, please email us at privacy@sproutsocial.com, submit a request through our online form available on our Help Center if you are a customer or user, or call our toll-free number at (866) 878-3231. In the request, please specify which right you are seeking to exercise and the scope of the request. We will confirm receipt of your request within 10 days. We may require additional information from you to help us verify your identity and process your request. The verification steps may vary depending on the sensitivity of the personal information and whether you have an account with us. If we are unable to verify your identity, we may deny your requests to know or delete.

We may deny certain requests, or fulfill a request only in part, based on our legal rights and obligations. For example, we may retain personal information as permitted by law, such as for tax or other record keeping purposes, to maintain an active account, and to process transactions and facilitate your requests.

Authorized Agent. You can designate an authorized agent to submit requests on your behalf. However, we will require written proof of the agent's permission to do so and verify your identity directly.

When we act in a data controller role, we are directly responsible for responding to data subject rights requests that we receive and individuals wishing to exercise their data protection rights in accordance with applicable data protection laws can contact us directly. Where we process your information solely on behalf of a customer in our data processor role, we may be required to forward your request directly to our customer and/or social media business partners for their review / handling. If personal information about you has been processed by us as a service provider on behalf of a customer and you wish to exercise any rights you have with such personal information, please inquire with our customer directly. If you wish to make your request directly to us, please provide the name of our customer on whose behalf we processed your personal information. We will refer your request to that customer.

Except as otherwise provided by applicable law, for purposes of these requests, personal information does not include information we have collected as a service provider to our customers.

11. Security & User ID/Password

Our Site and/or Services implements and maintains various reasonable and appropriate administrative, physical, and technical security safeguards to help protect information about you from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction. These security safeguards include, but are not limited to, network and host security controls (e.g., firewalls, intrusion detection systems, etc.), data encryption (both at rest and during transmission), and operating procedures that are designed to protect your information. You should protect your user ID and password and NOT share it with anyone. Additionally, we recommend enabling two-step verification or SSO integration where available. If you believe your user ID and password have been compromised or you have trouble changing your user ID/password on the Site or Service, please contact our technical support department (support@sproutsocial.com). Nevertheless, transmission via the internet is not completely secure and we cannot guarantee the security of information about you.

12. CAN-SPAM Compliance Notice (U.S. users only)

We may send periodic promotional or informational emails to you. You may opt-out of promotional communications by following the unsubscribe or opt-out instructions contained in the email. Please note that it may take up to 10 business days for us to process opt-out requests. If you opt-out of receiving promotional emails about recommendations or other information we think may interest you, we may still send you emails with information about your account or any Services you have requested or received from us.

13. International Transfers

Your information may be transferred to, and processed in, countries other than the country in which you are resident. For example, if you are a resident of Canada, your personal information may be transferred to the United States for processing. These countries may have data protection laws that are different to the laws of your country.

Specifically, we have servers that are located in the United States and the EEA, and our group companies and third party service providers and partners operate around the world. This means that when we collect your information we may process it in any of these countries.

However, we have taken appropriate safeguards to ensure that your information will remain protected in accordance with this Privacy Policy and applicable legal requirements. These include our use of European Commission-approved Standard Contractual Clauses (along with the UK Addendum, where appropriate) and, as applicable, our commitment (and commitments made by third party transferees) to honor the principles set forth in the Data Privacy Frameworks (defined below), to the extent each such Data Privacy Framework is accepted as a lawful mechanism under which personal data can transfer in compliance with applicable laws.

14. Transfers Outside the EEA, United Kingdom, and Switzerland

Sprout Social, Inc and its subsidiary, Tagger Media, Inc, complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce (collectively, “Data Privacy Frameworks”). Sprout Social has certified to the U.S. Department of Commerce that it adheres to (i) the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF; and (ii) the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF (collectively, the “DPF Principles”).** If there is any conflict between the terms in this privacy policy and the DPF Principles, the DPF Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

With respect to any personal information received or transferred pursuant to the EU-U.S. Data Privacy Framework, Swiss-U.S. Data Privacy Data Privacy Frameworks, Sprout Social is subject to the investigatory and enforcement authority of the U.S. Federal Trade Commission.

Where Sprout Social, Inc. transfers your personal information to a third party acting as an agent on its behalf, it shall remain liable under the DPF Principles if its agent processes such personal information in a manner inconsistent with the DPF Principles (unless Sprout Social Inc is not responsible for the event giving rise to the damage).

15. Contacting Us, Complaints and Dispute Resolution

In compliance with the DPF Principles, Sprout Social, Inc. commits to resolve complaints about your privacy and our collection or use of your information transferred to the United States pursuant to the Data Privacy Frameworks. EEA, UK, and Swiss individuals with privacy inquiries or complaints should first contact us by email at privacy@sproutsocial.com. We will work to resolve your issue and will respond within 45 days of receipt. If, however, you believe that we have not been able to assist with your complaint or concern, and you are located in the EEA, the United Kingdom, or Switzerland, you have the right to lodge a complaint with the competent supervisory authority.

Sprout Social has further committed to refer unresolved privacy complaints under the DPF Principles to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by BBB National Programs. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/dpf-complaints for more information and to file a complaint. This service is provided free of charge to you.

If your complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. 

See https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf. Sprout Social commits to cooperate with EEA, UK and Swiss data protection authorities and comply with advice given by such authorities with respect to human resources data transferred from the European Union in the context of any employment relationship with an EEA, UK or Swiss individual.

UK Data Protection Complaints (Data Use and Access Act)  

If you are located in the United Kingdom and have a concern about how we handle your personal data, please contact us first at privacy@sproutsocial.com or DPO@sproutsocial.com. We will acknowledge your complaint within 30 days and keep you informed about its progress and outcome. If you are not satisfied with our response, you may escalate your complaint to the Information Commissioner's Office (ICO) at https://ico.org.uk/make-a-complaint/.

16. Privacy Complaints in Brazil

In circumstances in which Brazil law is controlling, we commit to resolve complaints about your privacy and our collection or use of your information. We have further committed to refer unresolved privacy complaints to an independent dispute resolution mechanism.

17. Children

The Services are intended for a general audience and are not directed at children under thirteen (13) years of age.

Consistent with the federal Children’s Online Privacy Protection Act of 1998 (COPPA), we do not knowingly request personal information from anyone under the age of 13 without requiring parental consent. Any person who provides their personal information to us through our Site or Services represents that they are at least 13 years of age. If you are a parent or guardian and you believe we have collected information from your child in a manner not permitted by law, contact us at privacy@sproutsocial.com. We will remove the data to the extent required by applicable laws.

We do not knowingly “sell” or “share,” as those terms are defined under the California Consumer Privacy Act, as amended, the personal information of minors under 16 years old who are California residents.

If you are a California resident under 18 years old and registered to use the Service, you can ask us to remove any content or information you have posted on the Service. To make a request, email us at the email address set out in the “How to Contact Us” section with “California Under 18 Content Removal Request” in the subject line, and tell us what you want removed. We will make reasonable good faith efforts to remove the post from prospective public view, although we cannot ensure the complete or comprehensive removal of the content and may retain the content as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

18. Your Nevada Privacy Rights

Nevada law (SB 220), permits customers in Nevada to opt-out of the sale of certain kinds of personal information. A sale under Nevada law is the transfer of this personal information to third parties for monetary consideration. In general, Sprout Social does not sell your personal information to third parties as defined in Nevada law; however, in connection with the Influencer Marketing platform, Sprout Social may make creator personal information available to customers for monetary consideration, which may constitute a sale under Nevada Law. If you are a Nevada resident and wish to opt-out of the sale of your personal information or obtain information about our compliance with Nevada law, please contact us as at privacy@sproutsocial.com.

19. Updates to this Privacy Policy

We may update this Privacy Policy from time to time in response to changing legal, technical or business developments. When we update our Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make. We will obtain your consent to any material Privacy Policy changes if and where this is required by applicable data protection laws.

You can see when this Privacy Policy was last updated by checking the “last updated” date displayed at the top of this Privacy Policy.

20. How to Contact Us

If you have any questions about this Privacy Policy or our privacy practices, please contact us at privacy@sproutsocial.com.

If you have a disability and would like to access this Privacy Policy in an alternative format, please contact us at privacy@sproutsocial.com.

If you have a privacy concern or complaint, please contact our Data Protection Officer at DPO@sproutsocial.com. When you contact us, please indicate in which country and/or state you reside.

21. California, Colorado, Virginia, and Other U.S. State Disclosures

Unless otherwise required by applicable law, the following terms shall have the following meaning:

“Targeted advertising” or “Cross-context behavioral advertising” means displaying advertisements to a consumer where the advertisement is selected based on personal data obtained from that consumer’s activities over time and across nonaffiliated websites or online applications to predict such consumer’s preferences or interests.

“Sale” means renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for monetary or other valuable consideration.

“Profiling” means any form of automated processing of personal information to evaluate certain personal aspects relating to a natural person and in particular to analyze or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

US data protection laws grant residents of California, Colorado, Virginia, and other states with applicable privacy legislation the following data rights:

Notice of Collection. In the 12 months prior to the last update of this Privacy Policy, we have collected the following categories of personal information:

• Identifiers, including name, email address, phone number account name, IP address, and an ID or number assigned to your account.

• Customer records, billing and shipping address, and credit or debit card information.

• Commercial information, including purchases and engagement with the Service.

• Internet activity, including your interactions with our Service.

• Audio or visual data, including pictures or videos you post on our Service.

• Employment and education data, including information you provide when you apply for a job with us.

• Inferences, including information about your interests, preferences and favorites.

For more information on information we collect, including the sources we receive information from, review the “Information Collected and Processed About You” section. We collect and use these categories of personal information for the business purposes described in the Use of Information section, including to provide and manage our Service.

Sprout Social does not generally sell personal information as the term “sell” is traditionally understood. However, through our Influencer Marketing platform, Sprout Social does sell personal information about creators to our customers, as further described in the “Influencer Marketing Disclosures” section below.  Additionally, to the extent “sale” or “sharing” under the CCPA is interpreted to include advertising technology activities such as those disclosed in the Cookies, similar tracking technology, and analytics section as a “sale” or “sharing,” including the sharing of advertising identifiers, hashed contact information, and conversation information with technology partners for advertising measurement and optimization, we will comply with applicable law as to such activity.

Sprout Social discloses the following categories of personal information for commercial purposes: identifiers, demographic information, commercial information, internet activity, geolocation data and inferences. We may disclose each of the foregoing categories of personal information for the business and commercial purposes described in this Privacy Policy to the extent permitted by applicable law to the categories of third parties as described in this Privacy Policy, which may include our service providers and suppliers; our business and marketing partners, including advertising networks, data analytics providers, data brokers, and social networks; and other parties in connection with business transfers and for legal, safety, fraud prevention, and enforcement reasons. We use and partner with different types of entities to assist with our daily operations and manage our Service.

We may share your personal information with government entities when required to do so by law. Please review the Categories of Third Parties With Whom We Share Your Information section for more detail about the parties we have shared information with.

We retain the personal information we collect for as long as it is necessary to complete the commercial purposes for which it was collected. Once the information is no longer necessary, we will delete it or de-identify/anonymize this data so that it no longer identifies a particular individual.

Right to Know and Delete. Consumers who are California, Colorado, or Virginia residents have the right to request that we delete the personal information we have collected about them (subject to certain exemptions) and the right to know certain information about our data practices in the preceding 12 months. Specifically, you have the right to request the following from us:

• The categories of personal information we have collected about you;

• The categories of sources from which the personal information was collected;

• The categories of personal information about you we disclosed for a business purpose or sold;

• The categories of third parties to whom the personal information was disclosed for a business purpose or sold;

• The business or commercial purpose for collecting or selling the personal information; and

• The specific pieces of personal information we have collected about you.

To exercise any of these rights, please email us at privacy@sproutsocial.com, submit a request through our online form available on our Help Center if you are a customer or user, or call our toll free number at (866) 878-3231. In the request, please specify which right you are seeking to exercise and the scope of the request. We will confirm receipt of your request within 10 days. We may require additional information from you to help us verify your identity and process your request. The verification steps may vary depending on the sensitivity of the personal information and whether you have an account with us. If we are unable to verify your identity, we may deny your requests to know or delete.

We may deny certain requests, or fulfill a request only in part, based on our legal rights and obligations. For example, we may retain personal information as permitted by law, such as for tax or other record keeping purposes, to maintain an active account, and to process transactions and facilitate your requests. Except as otherwise provided by applicable law, for purposes of these requests under this Section, personal information does not include information we have collected as a service provider to our customers.

If personal information about you has been processed by us as a service provider on behalf of a customer and you wish to exercise any rights you have with such personal information, please inquire with our customer directly. If you wish to make your request directly to us, please provide the name of our customer on whose behalf we processed your personal information. We will refer your request to that customer.

Right to Correct. Subject to certain exceptions, you have the right to request that we correct inaccurate personal information that we have collected about you. Once we receive your request and confirm your identity, we will review your request, taking into account the nature of the personal information and the purposes of the processing of the personal information to see if we can correct the data. We may also request additional information showing that the information you want to correct is inaccurate.

Right to Opt-Out. You have the right to opt-out of processing of your Personal Information for the purpose of (i) targeted advertising, (ii) “sale” or “sharing” of Personal Information, or (iii) profiling to provide you with tailored content, including suggested advertising. You may submit a request to opt-out by clicking Do Not Sell or Share My Personal Information. You may also submit a request to opt-out by calling our toll-free number at (866) 878-3231 or by emailing us at privacy@sproutsocial.com.

Right to Limit Use of Sensitive Personal Information. You may request that we limit the use and disclosure of your sensitive personal information to purposes authorized by the CCPA. Sprout Social does not intentionally collect sensitive personal information (as defined under the CCPA) through its platforms. If you believe we hold sensitive personal information about you, please contact us at privacy@sproutsocial.com or call us at (866) 878-3231.

Authorized Agent. You can designate an authorized agent to submit requests on your behalf. However, we will require written proof of the agent’s permission to do so and verify your identity directly.

Right to Non-Discrimination. You have the right not to receive discriminatory treatment by us for the exercise of any of your rights.

22. California Shine the Light.

Pursuant to Section 1798.83 of the California Civil Code, residents of California can obtain certain information about the types of personal information that companies with whom they have an established business relationship have shared with third parties for direct marketing purposes during the preceding calendar year. In particular, the law provides that companies must inform consumers about the categories of personal information that have been shared with third parties, the names and addresses of those third parties, and examples of the types of services or products marketed by those third parties. To request a copy of the information disclosure provided by Sprout Social pursuant to Section 1798.83 of the California Civil Code, please contact us via email at privacy@sproutsocial.com.

23. U.S. State Resident Appeal Rights

If you make a request to exercise any of the above data access rights and we are unable to comply with your request, you may request to appeal our decision. To appeal any data privacy request decision, please contact us by emailing privacy@sproutsocial.com with the subject line “Data Access Request Appeal.” If after you complete the appeal process with us, you are still not satisfied with our response, you may contact your state Attorney General to file a complaint. Below is the contact information for some of the states where appeal rights are available:

Virginia residents:
Office of the Attorney General
202 North 9th Street
Richmond, Virginia 23219
Phone: (804) 786-2071
https://www.oag.state.va.us/

Colorado residents:
Office of the Attorney General
Colorado Department of Law
Ralph L. Carr Judicial Building
1300 Broadway, 10th Floor
Denver, CO 80203
(720) 508-6000
https://coag.gov/

24. Influencer Marketing Disclosures

Data Collection and Use. Through the Influencer Marketing platform, Sprout Social collects personal information about creators from various sources, including customer-enabled and authenticated social media accounts and integrations, optional customer contributions to creator profiles, creators who opt in through the platform, and publicly available social media data collected through official social media platform APIs, and makes that information available to its customers for the business purpose of helping them identify, evaluate, and connect with creators for influencer marketing campaigns, including by providing creator profiles, audience insights, and engagement analytics.

The following summarizes the categories of personal information collected and sold through the Influencer Marketing platform in the preceding 12 months, the sources from which such information was collected, and the categories of third parties to whom such information was sold.

How to Opt Out of the Sale of Your Personal Information on the Influencer Marketing Platform

To opt out, you may email us at privacy@sproutsocial.com or submit a request on our Do Not Sale or Share My Personal Information page. 

Data Retention and Deletion. 

Creator personal information collected through the Influencer Marketing platform is retained for as long as necessary to provide the Influencer Marketing Service to our customers. Creator personal information is deleted or anonymized when it is no longer necessary for this purpose, when the creator submits a valid deletion request, or as otherwise required by applicable law. When Sprout Social receives a verified deletion request related to the Influencer Marketing platform, Sprout Social will direct its service providers and contractors to delete the consumer's personal information as well. 

California residents may also submit deletion requests through the California Privacy Protection Agency's Delete Request and Opt-Out Platform (DROP) at https://privacy.ca.gov/drop/. For more information about DROP and our consumer request metrics, please visit [link to metrics page].

Consumer Request Metrics

As required by Cal. Civ. Code § 1798.99.85, Sprout Social publishes consumer request metrics related to its data brokerage activities on its Influencer Marketing platform. Metrics for the prior two calendar years are set forth below. 

25. Texas Data Broker Notice

With respect to the operation of the Influencer Marketing platform, Sprout Social is a data broker under Texas law. The entity maintaining this website is a data broker under Texas law. To conduct business in Texas, a data broker must register with the Texas Secretary of State (Texas SOS). Information about data broker registrants is available on the Texas SOS website at https://www.sos.state.tx.us/index.shtml. To exercise your rights under the Texas Data Privacy and Security Act, including your rights to access, correct, or delete your personal data, or to opt out of the sale of your personal data, targeted advertising, or profiling, please see the "Your Data Protection Rights" section above or contact us at privacy@sproutsocial.com.