Who is Datastruct?

Datastruct Limited and its affiliated companies (together "Datastruct", "we", "us") provide the Datastruct platform and data libraries (collectively referred to herein as the "Platform"), a Software as a Service solution enabling organizations to solve business problems through high-quality external data and best-in-class infrastructure.

Datastruct is committed to protecting the privacy and security of your Personal Information. We have implemented technical and organizational controls and procedures to handle Personal Information in accordance with all applicable data protection and privacy laws ("Privacy Laws"), including the EU General Data Protection Regulation ("GDPR"), California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"/"CPRA"), as well as additional US, international, and state privacy requirements.

This Privacy Notice applies to Datastruct's practices when acting as a data controller (or equivalent role as defined in Privacy Laws in our regions of operation) and describes the categories of Personal Information we collect and the sources of such information, how we use Personal Information, to whom it may be disclosed or sold (if any), as well as your rights regarding your Personal Information. This Privacy Notice does not apply when Datastruct processes Personal Information strictly as a service provider or data processor on behalf of a customer (e.g., information that customers submit to us for processing via the Platform). In such cases, our customer's privacy statement and applicable contract will govern our processing of Personal Information.

Scope of Privacy Notice

This Privacy Notice covers our data practices as they relate to (a) our corporate website, (b) operation of the Platform, (c) direct interactions with individuals and corporate entities, and (d) Personal Information obtained from third-party sources and made available through our Platform.

Personal Information

For purposes of this Privacy Notice, "Personal Information" means information directly or indirectly relating to an identified or identifiable natural person, including identifiers such as names, identification numbers, location data, online identifiers, biometric or genetic data, sensitive preferences, or factors specific to identity (one or more factors specific to the physical, physiological, mental, economic, cultural or social identity of a natural person), as defined under applicable Privacy Laws. Personal Information may also include professional/business information (such as your title, company, or role) if recognized as personal data in your jurisdiction. Personal Information includes information referred to as "personal data," "personal information," "personally identifiable information" ("PII"), and such similar references as codified in applicable Privacy Laws.

The Platform

The Datastruct Platform is a technology that, through a single connection, enables our customers to connect, integrate, analyze, and act upon diverse data sets acquired from disparate sources. We source both publicly available and non-publicly available data via contracts with data providers, which we make available for use by our customers. In some cases, our customers license data directly from third-party sources and use our Platform for processing and hosting. Most of the information we collect from third party data sources pertains to businesses and persons associated with such businesses. Please note, however, that our customers utilize the data processed through our Platform to make decisions regarding businesses, not individual consumers.

Under most U.S. Privacy Laws, the information described in the foregoing paragraph is not considered "Personal Information." Nonetheless, certain jurisdictions (such as the European Union, California, and others) define business contact details and professional roles as Personal Information. As a result, we consider information about an individual, in their professional capacity, to be Personal Information for purposes of this Privacy Notice. Note, however, that your rights with respect to Personal Information are determined by the Privacy Law of the jurisdiction in which you reside.

How We Collect and Use Personal Information

We collect Personal Information in the following ways: (1) Directly from customers when establishing, managing, or servicing an account and Platform access; (2) from visitors to our website via forms, cookies, or similar technologies; (3) in interactions with vendors, customers, and other individuals in person, via phone, email, meetings, or other communication channels; and (4) from third-party data brokers and publicly available sources.

The categories of Personal Information collected include, but are not limited to the following:

• Personal identifiers such as name, business or personal address, phone number, email, job title, and company;
• Electronic network activity such as IP address, device identifiers, operating system and browser version, usage and feature interaction data, logs, and ad tracking;
• Commercial information about the services purchased or considered;
• Professional or employment information; and
• Other data as required by law or contract.

We collect this Personal Information to operate and secure the Platform, establish and maintain business relationships, provide account services, analyze engagement and Platform usage, fulfill legal and regulatory obligations, enhance and customize product offerings, support compliance (including KYC/AML requirements), and, where permitted by law, for marketing and communications. Where required, we obtain affirmative consent for the use of Personal Information, especially for processing precise geolocation, sensitive data, or when required under children's privacy law.

We use processors and/or sub-processors to process the data collected and you can access our page listing the processors/sub-processors we use by clicking here.

For a full recitation of the categories of Personal Information we collect, the sources of such information, and the purpose for collection, please see the Table 1 at the end of this Privacy Notice.

Data Collection Through Cookies

When you visit our website or use the Platform, our goal is to make the experience simple and effective. To that end, we utilize cookies to enhance your user experience, analyze performance, and provide tailored content. A cookie is a text file that a website stores on a visitor's computer to enable recognition of that visitor's computer each time he/she/they return. As you navigate through and interact with our website and Platform, we will automatically collect certain information about your equipment, browsing actions and patterns using these cookies. This may include information about your connectivity, your IP address and browser information, location data, logs and other communication data, and the resources that you access and use on the website. Cookies help us recognize you across sessions, improve website functionality, estimate audience size, and deliver content relevant to your use.

Most browsers allow you to control cookie settings and choose to accept, reject, or delete cookies—please note that restricting cookies may impact Platform performance. For further details on the cookies used, your choices, and required consents, please consult our Cookie Policy.

Datastruct's Disclosure and Sale of Personal Information

Datastruct may disclose Personal Information to trusted providers (such as Platform hosting, technology vendors, and business partners) solely for business purposes, including fulfilling contractual obligations, Platform functionality, analytics, and regulatory compliance. Categories of Personal Information disclosed, the purposes, and the classes of recipients are reflected in detailed records available to you upon request and disclosed in our charts, consistent with the obligations of U.S. and global privacy laws.

Datastruct does not "sell" Personal Information as defined under current privacy laws, except for limited cases involving our license or purchase of data directly from third-party data sources. We do not share Personal Information with third parties for their independent marketing. Any sharing of Personal Information for profiling or targeted advertising is strictly in accordance with legal requirements and includes opt-out rights, as required by applicable privacy laws (including rights related to targeted advertising, profiling, and broader opt-outs).

We require all service providers and other partners to process Personal Information only as permitted by contract and applicable laws, subject to confidentiality and data protection obligations consistent with this Privacy Notice and current legal standards.

Please see Table 2 and Table 3 at the end of this Privacy Notice for additional information on the types of Personal Information we disclose or sell.

How We Protect Personal Information

The security of your Personal Information is critically important to Datastruct. We maintain industry-standard physical, technical, and administrative safeguards designed to protect your Personal Information from unauthorized access, use, disclosure, loss and destruction. These controls include, but are not limited to, encryption, access control, regular vulnerability testing, and engagement with independent auditors. We also train our personnel about the importance of confidentiality, security and consumer privacy and limit our personnel's access to Personal Information to those who need such information in order to perform their job. We update and assess our security controls regularly and notify affected individuals and regulators in the event of any breach as required by law.

Electronic Personal Information, including the Personal Information about visitors to our company website and Personal Information submitted by our Platform users regarding their account and log-in information, is stored on restricted database servers housed with a third-party cloud provider in the United States.

With respect to the data that our Platform users upload to the Platform for processing, Datastruct offers cloud instances in the United States, Singapore, Frankfurt, Dublin, Sydney and Hong Kong. Our Platform customers have the option to store the data that they upload to the Platform for processing in any of these instances.

How Long Do We Retain Personal Information?

Information about our customers, vendors and web site visitors:

Customer Information:

Datastruct retains Personal Information collected from our Platform users (defined as those who sign up for Platform access and have the ability to access the various data offerings) until such time as the authorized user and/or customer expressly requests the deletion of his/her/their profile via the functionality provided in the Platform. When a customer requests the deletion of his/her/their profile, to the extent Datastruct acts as a data controller, Datastruct will delete the individual's Personal Information from our system. A customer may also contact us and request that his/her/their Personal Information be deleted. Customer information associated with a contract is retained for approximately two (2) years after a contract is complete.

Website Visitor Information:

We retain personal information about those who visit our website for a period of approximately one year from the date of collection or as long as we may otherwise need it to fulfill our legal obligations.

Vendor Information:

We retain personal information obtained from our vendors for as long as our company retains a relationship with such vendors and for a period of time afterwards in order to satisfy legal, accounting, and policy obligations.

Information from third party data sources:

Datastruct retains Personal Information contained in the information we obtain directly from third party data sources (other than our Customers) for as long as our contract with that third party source allows or until the Information is no longer desired by the company, whichever occurs later.

A Note About Children's Personal Information

The Platform and website are not marketed to or intended for use by children. Datastruct does not knowingly collect Personal Information from anyone under the age of 18. Where required under state law or the federal Children's Online Privacy Protection Act (COPPA), we implement additional age estimation, parental notice, and consent controls on any services likely to be accessed by minors, including the enhanced standards from the California Age-Appropriate Design Code, Maryland Kids Code, Connecticut, and Delaware. If we learn that we have collected information from a child under the applicable age threshold, we will promptly delete the information and remediate as required. If you know or believe that such information has been provided to us, please contact us at [email protected].

Your Rights to Access

You have the right, subject to local law, to access, correct, or delete your Personal Information, and to submit reasonable requests for such actions. We will provide you with access to your Personal Information unless the burden or expense of providing access would be disproportionate to the risk to your privacy, or where doing so would impair the rights or freedoms of others or violate laws. You may contact us at [email protected] to exercise your rights or submit a privacy request. Residents of U.S. states with new privacy laws (including California, Virginia, Colorado, Connecticut, Utah, Delaware, and others) have additional rights to opt out of targeted advertising, profiling, and data sales, and the right to limit use and disclosure of sensitive Personal Information. We honor Global Privacy Control signals and other recognized browser-based opt-outs where required by law.

If You Are a California Resident (and additional state rights)

California residents and residents of other states with similar comprehensive privacy laws, have additional rights, including:

Right to Know:

You may request, twice in a 12-month period, disclosure of the (a) categories and specific pieces of Personal Information collected; (b) sources of such information; (c) business or commercial purposes for collection, sale, or disclosure (including the categories of Personal Information sold or disclosed for a business purpose); (d) categories of third parties to whom information is disclosed or sold. California law also grants each of its residents the right to know about each of the aforementioned practices as it relates to California consumers generally.

Right to Delete:

You may request deletion of Personal Information that Datastruct has directly collected from you, including through a single opt-out as supported under the California Delete Act and similar legislation. We provide designated mechanisms to process such requests. The obligation to delete Personal information upon request is not absolute; the law allows businesses to retain Personal Information for certain purposes. Datastruct collects Personal Information directly from consumers as described in the Section titled "How We Collect and Use Personal Information" above.

Right to Correct:

You may request correction of inaccurate Personal Information.

Right to Opt Out:

You may opt out of the sale or sharing of your Personal Information and of targeted advertising or profiling activities with significant effects, as now required in many U.S. states. This includes the right to limit processing of sensitive Personal Information and to opt out of automated decision-making, where applicable. You may submit a request to opt-out by emailing us at [email protected].

Right to Non-Discrimination:

We will not discriminate against individuals for exercising any of these rights.

Appeals:

Where we reject a request, you will be provided instructions for appeal as mandated under new state laws.

To exercise these rights or receive details tailored to your jurisdiction (including Colorado, Connecticut, Virginia, Utah, Delaware, Iowa, Tennessee, Minnesota, Maryland, Texas, Oregon, New Hampshire, New Jersey, Nebraska, and others), please contact us as indicated below.

Method to Submit Requests

If you wish to submit a request to invoke one of the above rights, please contact us via email at [email protected] or by using our online request form. In order to verify your request and locate the relevant information, please provide your name, address, phone number and any other identifiers that you believe helpful. All information provided to Datastruct will be held in strict confidence and only be used to verify your identity and process your request per applicable law and regulatory requirements.

California law allows you to designate an agent to submit a request to exercise any of the above rights on your behalf. To have an authorized agent submit a request on your behalf, the authorized agent must provide Datastruct with proof with a signed authorization of your permission to submit the request. We may also require you to verify your identity or confirm that you provided the authorized agent with power of attorney under the Probate Code.

If You Live in the European Economic Area, The United Kingdom or Switzerland (collectively, "Europe")

Though we operate internationally, many of our computer systems are based in the United States, which means we may collect and process Personal Information in the U.S., where data protection and privacy regulations may not offer the same level of protection as in the European Union or other parts of the world. If you use or visit our website and/or use our Platform from outside the United States, you consent to the collection and/or processing in the United States of Personal Information we collect from you. The same is true with respect to Personal Information that we collect via email, snail mail, and other communication methods.

Customers who use the Platform to process Personal Information derived from outside the United States may elect to utilize an instance of the Platform that is housed in Frankfurt, Singapore, Dublin, Australia, or Hong Kong. In such instances, the data that the Customer uploads to the Platform for processing will remain in the country where the cloud instance is located.

Datastruct complies with the EU General Data Protection Regulation 2016/679, the UK Data Protection Act of 2018 and the Swiss Data Protection Act of 2020 (collectively, "GDPR") with respect to the protection of individuals with regard to the processing of Personal Information and the free movement of such Personal Information.

Under the GDPR, you have the following rights:

Right of Access:

You have the right to ask us for copies of your Personal Information. The law provides for some exemptions, which means you may not always receive all the Personal Information we process.

Right to Rectification:

You have the right to ask us to rectify Personal Information you think is inaccurate. You also have the right to ask us to complete Personal Information you think is incomplete.

Right to Restrict Processing:

You have the right to ask us to restrict the processing of your Personal Information in certain circumstances.

Right to Withdraw Consent:

You have the right to revoke your consent to our processing of your Personal Information at any time by contacting us at [email protected]. Withdrawing consent will not affect the lawfulness of the process performed based on your consent before its withdrawal.

Right to Erasure:

You have the right to ask us to erase your Personal Information in certain circumstances.

Right to Data Portability:

This only applies to Personal Information you have given to us and that is held electronically. You have the right to ask that we transfer this information from Datastruct to another organization or give it to you.

Changes to This Privacy Notice

As we evolve, we may update this Privacy Notice to align with changes in the Platform, our business and/or Privacy Laws. The Effective Date at the beginning of this Privacy Notice will reflect the last date on which the Privacy Notice was updated. We recommend that you periodically review the Privacy Notice to stay informed of changes. We will ask for your consent to such changes if required by Privacy Laws. In other cases, please note that your continued use of the Platform and your continued use of the website, after any change, means that you agree to the terms of the updated Privacy Notice. The same is true with respect to Personal Information that we collect via email, snail mail, and other communication methods. If you disagree with the Privacy Notice, please email us at [email protected] and cease use of the Platform and website.

Contact Us

For privacy-related questions or requests:
[email protected]

Further details, including state-specific supplements and our most current policy, are available at https://datastruct.co/privacy.

Written inquiries can be sent to:

Datastruct, Ltd.
The Privacy Team
℅ Legal Department
149 E. 23rd Street, Suite 2035
New York, NY 10010
USA