Privacy Policy

Our role: data controller and data processor

Depending on how you interact with our platform, we act as either a data controller or a data processor (service provider). We act as a data controller for the personal information of our website visitors, prospective customers, and the billing and account management of our business customers. We act as a data processor when we process personal information on behalf of our business customers who use our software to manage their own operations. In these instances, our business customers control what client and employee data is collected, and we process it strictly on their behalf. Data processing agreements are available for our business customers so legal and security obligations are formally documented.

Account owner responsibilities and end-user consent

When acting as a data processor, we rely on our business customers (the account owners) to manage the personal data of their clients (end users). Account owners warrant and represent that they have obtained all legally required consents and provided all necessary notices to their end users before entering, uploading or processing that end user's data within our platform. The account owner remains solely responsible for ensuring compliance with applicable privacy and employment laws regarding the collection and use of end-user data.

End-user privacy requests

Because we act as a data processor for our business customers, we do not have a direct relationship with the end users whose personal data we process on our customers' behalf. If an end user seeks to access, correct, amend or delete data stored in our platform, they should direct their query to the account owner, who serves as the data controller. If we receive a privacy rights request directly from an end user, we will not fulfill it directly. Instead, we will route the request to the respective account owner and assist them as necessary to fulfill the request in accordance with applicable laws.

Third-party disclosure and subprocessors

We do not sell, trade or otherwise transfer your personally identifiable information to outside parties unless we provide users with advance notice. This does not include trusted website hosting partners, cloud infrastructure providers and other subprocessors who assist us in operating our website, conducting our business or serving our users, so long as those parties agree to keep this information strictly confidential and secure. We may also release information when its release is appropriate to comply with the law, enforce our site policies, or protect our rights, property or safety or those of others.

Where you have provided explicit consent, we and third-party vendors use first-party cookies and third-party cookies or other identifiers together to compile data regarding user interactions with ad impressions and other ad service functions as they relate to our website.

Mandatory legal disclosures

While we value your privacy, there are exceptional circumstances where we may be legally required to disclose your personal information without your prior consent. We reserve the right to access, preserve and disclose personal data to comply with legal obligations, including responding to subpoenas, search warrants, civil investigative demands and lawful access requests by domestic or foreign courts and law enforcement authorities. We may also disclose information to prevent or investigate fraud, security breaches or other illegal activities. In all such cases we strive to disclose only the minimum amount of information legally required.

Business transfers

If PageSmack is involved in a bankruptcy, merger, acquisition, reorganization or sale of all or a portion of its assets, your personal information may be transferred as part of that transaction to the acquiring or new controlling entity. We will ensure the acquiring entity agrees to protect your personal information in a manner consistent with this privacy policy and applicable privacy laws. You will be notified by email or a prominent notice on our website of any such change in ownership or control of your personal data.

Cross-border data transfers

Because we serve customers in both the United States and Canada, your personal information may be transferred, processed and stored across national borders for hosting, customer support and backup purposes. We ensure our vendor agreements contain appropriate confidentiality and security obligations to protect your data across jurisdictions, in compliance with frameworks such as PIPEDA, Quebec Law 25 and applicable United States laws.

Opting out and managing consent

You may withdraw or modify your cookie consent for this website at any time by using the Privacy Settings link in our website footer. You can also set preferences for how advertising is shown to you through your ad provider's settings pages, or install an analytics opt-out browser add-on. Disabling cookies may have a negative impact on the functionality, content and user experience of this site.

Updates to this policy and changing your information

You will be notified of any privacy policy changes on this page. You can change your personal information by logging in to your account.

Do Not Track signals

Some browsers contain a setting that sends a Do Not Track signal to websites. When a Do Not Track signal is sent to this website it does not respond to the signal, as doing so would significantly affect the functionality, content and user experience of this site. We do respect your privacy choices through our integrated consent management system.

Activity tracking

Certain user actions, such as the use of a platform feature, are logged to establish system performance and feature usability, and, where permitted by your expressed consent, for promotion.

Marketing restrictions

We do not market to children under the age of 13, and we ask that our customers do not intentionally collect or submit personal information regarding children to our platform.

Data breaches

Should a data breach occur, we will notify users who have provided personally identifiable information to us within one business day of the discovery of the breach. Notification will be delivered by email in alignment with our incident response procedures and applicable legal obligations.