EngageRocket Privacy Policy

EngageRocket is trusted by people and organizations with survey responses, and it’s our responsibility to protect this data and keep it private. We value building trusting relationships with our clients and thus we have developed this privacy policy in order for you to understand how we collect, use, communicate, disclose and otherwise make use of personal information. 

The policy is structured so you can quickly find answers to the questions which interest you the most.

This privacy policy applies to all the products, services and websites offered by EngageRocket Pte. Ltd. We refer to those products, services and websites collectively as the “Services” in this policy.

Outline of Privacy Policy

  • What information do we collect about customers and how
  • How do we use this information 
  • Who do we share this information with
  • What policy do we have on retaining data
  • What to do if you have questions

For further questions regarding our security measures or practices, contact EngageRocket below by entering your email address so we can send you a copy of our latest security whitepaper.

 

Collecting Customer Information

Customer information is collected through various mediums to improve the accuracy of our product. This personal information is collected by lawful and fair means and, where appropriate, with the knowledge or consent of the individual concerned. We will collect and use personal information solely for fulfilling those purposes specified by us and for other ancillary purposes, unless we obtain the consent of the individual concerned or as required by law.

We are committed to conducting our business in accordance with these principles in order to ensure that the confidentiality of personal information is protected and maintained. EngageRocket may change this privacy policy from time to time at EngageRocket's sole discretion.

 

Direct Information We Collect

• Contact details: When you contact us or subscribe to our content, such as our blog, we collect your contact details, including your name and email address.

• Registration details: When you register an account we collect your name, company name, email address, password and other information.

• Billing details: If you use a credit card for billing, we may collect information such as the cardholder's name, billing address, email address, credit card number, expiry date and credit card security code.

• Account settings: You can set or update various preferences and personal details on your account settings page or your profile. For example, your name, email address, default language or timezone.

• Survey data: We collect and store the survey responses that you submit If you have any questions about a survey you are taking, please contact your organization’s manager who signed up for the service.

• Employee data: We may collect employee data that you submit based on the attributes you have created. For example, performance grade, date of birth etc.

• Other data you intentionally share. We may collect your personal information or data if you submit it to us in other contexts. For example, if you provide us with a testimonial, participate in a TINYhr contest, or send us an email with comments or suggestions.

 

Are your responses anonymous? 

By default, yes. EngageRocket does not reveal which responses were associated with which email or IP address. If you think a survey violates our Terms of Use or may be engaging in illegal activity, please email hello@engagerocket.co.

Information we collect from other sources

We collect usage data about you whenever you interact with our Services. This may include which web pages you visit, what you click on, when you performed those actions, and other activities. Our web servers also keep log files that record data each time a device accesses our servers. The log files contain data about the nature of each access, including the originating IP address. 

We may combine this automatically collected log information with other information we collect about you. We do this to improve our Services, to improve our marketing activities, for system analytics, or to monitor or improve functionality. We also use referral data, which is collected when you navigate to our website from an external source (such as a link on another website or via an email), we record information about the source that referred you to us.

Tracking Technologies

We also collect information from our customers with use of tracking technologies such as cookies, beacons, tags and scripts. Here are a few brief explanations of how they work.

Cookies are alphanumeric identifiers that travel through your Web Browser to enable websites to recognise the browser and to enable additional features, such as signalling when your account is logged on amongst others. We use cookies to remember users’ settings and preferences, and for session management. Users can control the use of cookies at the individual browser level. If you reject cookies, you may still use our website, but your ability to use some features or areas of our website may be limited.

Beacons and tags are embedded objects, found in either emails or web pages, to allow for checking if a user has accessed content. 

Scripts are programs written specifically to automate tasks, and can be found in various forms on the web. 

Using these tracking technologies, we analyze trends, administer the website, track users’ movements around the website, and gather demographic information about our user base as a whole. We may receive reports based on the use of these technologies by these companies on an individual and aggregated basis.

Billing Information

EngageRocket uses Stripe for processing payment online. Stripe has been audited by a PCI-certified auditor and is certified to PCI Service Provider Level 1. This is the most stringent level of certification available in the payments industry. To accomplish this, we make use of best-in-class security tools and practices to maintain a high level of security at Stripe. You can read more at https://stripe.com/docs/security/stripe.

 

what we do with your information

Security of your information

The security of your information is important to us. All of your data is private and confidential and we take all reasonable steps to ensure that your information is handled securely and in accordance with this Privacy Policy. We follow generally accepted standards to protect the personal information submitted to us, both during transmission and once it is received. 

However, please note that transmitting information over the Internet is never completely secure. Although we do our best to protect your personal information, we cannot guarantee that your information is absolutely secure in all situations. Security is a collaborative effort, so we also recommend that you create a sophisticated password for logging in to our services, and keep that password secret. If you suspect there has been any unauthorized access or misuse of your personal information, please contact us at hello@engagerocket.co immediately.

Where your information is located

We use Amazon Web Services (AWS) cloud services for EngageRocket. You can read more on AWS security here: https://aws.amazon.com/security/.

How do we use the information we collect?

We use your personal information for a variety of purposes. In all such instances, we will not disclose any identifiable information about you, your respondents, or your company. In each case, the information we collect and hold is reasonably necessary for our business, including providing you with the services you would expect from us. We use your personal information to:

• Create an account with us: We need to collect and use your personal information to allow you to create an account and log in to that account.

• Provide you with our Services: This includes providing you with access and use of the EngageRocket platform and customer support, which may require us to access your information so that we can assist you with survey design or technical issues.

• Create de-identified aggregated benchmark data: To provide you with a better understanding of your survey results, we use your survey data in a de-identified aggregated form to compare your results to the results of other surveys. We also use your survey data to continually improve our survey benchmarks. None of your survey data will be disclosed to other unrelated customers in a non-aggregated or identifiable form. We may disclose aggregated, anonymous, or anonymized data to third parties for market research, academic research, benchmarking, or any other purpose. In all such instances, we will not disclose any identifiable information about you, your respondents, or your company.

• Manage our Services: We use your information internally to measure and analyze user behaviour so we can provide our Services and improve those Services. Some of these purposes include:

  • To monitor, maintain and improve our Services and features.
  • To personalize or customize your experience when you use our Services (including presenting our website in the best format for you or a device you use to access our website).
  • To create new services or features.
  • To enforce our Terms when we are made aware of potential breaches.
  • To prevent potentially illegal, undesirable or abusive activities.
  • To investigate complaints about you, or made by you.
  • Contact you about services or your account: At times we may need to contact you via email, mail or telephone to tell you about matters, such as changes to our Services, terms or policies.
  • Contact you for marketing purposes: We may also send you news and information about our products or Services if you have requested so from us. In most cases, we will contact you via email.
  • Respond to legal requests and prevent harm: If we receive a legal request or are informed of a situation that may cause harm, or potential harm, to someone, we may need to inspect your personal information or data to respond appropriately to that request or threat. 

 

Who has access to your information?

We will share your personal information with third parties only in the ways that are described in this privacy statement. To provide you with our Services we will often need to disclose your personal information to our staff or service providers that we use to operate our business. Examples of our service providers include: hosting services; project management software; email service providers; system monitoring services; customer support services; and website analytics. These companies are only authorized to use your personal information only as necessary to provide these services to us.

 

Anonymity and pseudonyms

In most cases, it will be very difficult for us to provide you with our Services if you do not provide us with your real name and contact details (primarily email). If lawful and practicable, you may use a pseudonym (or simply not identify yourself) when dealing with us. For example, if you have a complaint or concern about our site, or a general question about our Services or this Privacy Policy, you are welcome to contact us without identifying yourself. In some cases, however, if you do not provide us with information, we may not be able to provide you with our products or Services, or respond adequately to you.

In most cases, the personal information that we disclose to our staff or service providers will be directly necessary to provide our services to you. However, there may be occasions where we may need to disclose your personal information to other people or organizations, including to:

• Our staff: We may need to disclose your personal information to people who work for us. These disclosures may be related to activities such as filling orders, processing payments and mail-outs, storing and managing documents, research, or providing professional advice.

• Enforce or apply our Terms: If you engage in or threaten any unlawful activity, we may reasonably believe that it is necessary to disclose your information to the police, a relevant authority or enforcement body, or your internet service provider, employer, supervisor or network administrator.

• Keep other entities associated with us informed: In some cases we may need to disclose your information to our agents, business affiliates, joint venture entities, partners, investors or any applicable subsidiaries or holding companies. The need to disclose your information to these entities may arise from a legal obligation we owe that entity, or to assist our or their legitimate business interests.

• Fulfill requests from you: You may specifically authorize us to disclose your personal information to a third party. For example, to resolve a dispute regarding our Privacy Policy or to integrate a third party service.

• Comply with legal requests: In some situations we may be compelled to disclose your information to third parties such as law enforcement officials or to comply with court orders, such as subpoenas.

• Merger: If EngageRocket is involved in a merger, acquisition, or sale of all or a portion of its assets, you will be notified via email and/or a prominent notice on our website, of any change in ownership, uses of your personal information, and choices you may have regarding your personal information. We may also disclose your personal information to any other third party with your prior consent.

We also implement reasonable steps to ensure that any personal information we disclose is subject to a privacy policy comparable to our Privacy Policy, or contractual obligations that will provide a comparable level of protection to our Privacy Policy.

 

What are your rights to information?

We will respond to requests to access and correct (if necessary) your personal information as soon as possible. You have the following options regarding accessing, correcting or limiting the use or disclosure of your personal information:

• Update your account details: You can update your registration and other account information on your account setting page or your profile. Information is updated immediately.

• Limiting use or disclosure: If you want to limit our use or the disclosure of your information to third parties, please contact us at hello@engagerocket.co. However, please note that by limiting the use of your personal information by us, or its disclosure to third parties, you may also limit our ability to provide you with our Services.

• Retention: We will retain your information for as long as your account is active or as needed to provide you our Services. We will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

• Blog: If you subscribe to our blog, we will use your name and email address to send you the newsletter. You may choose to stop receiving our newsletter or marketing emails by following the unsubscribe instructions included in these emails.

 

Information for Users of the EngageRocket Platform

If you are a user of the EngageRocket platform (for example a company administrator or respondent), we also collect, hold and process information about you on behalf of the Customer. This information includes data uploaded to the EngageRocket platform by the Customer (for example, your name, email address, employment and demographic data) and your survey responses and comments submitted using the EngageRocket platform.

To help us provide our Services to you and the Customer, we may transfer some of your personal information to our service providers (for example, support services or email service providers). Any transfers to our service providers are covered by our agreement with the Customer. Because we collect, hold and process your information on behalf of the Customer, you will need to contact the Customer if you want to:

• Access, correct, amend or delete any information we hold about you; or

• Stop receiving emails sent to you by the Customer using the EngageRocket platform.

 

Additional Information

Social media widgets

Our websites may include social media features or widgets, such as the Facebook Like or Share buttons. Use of these features may collect your IP address, detect which page you are visiting on our website, and set a cookie to enable the feature to function properly. Your interactions with these features are governed by the privacy policy of the third party providing these features.

Links to other websites

Our website includes links to other websites. The privacy practices of those other websites may differ from EngageRocket’s privacy practices. If you submit personal information to any of those websites, your information is governed by their privacy policy. We encourage you to carefully read the privacy policy of any website you visit.

Testimonials

We display Customer or User testimonials and other endorsements on our website. With your consent, we may post your testimonial along with your name. If you wish to update or delete your testimonial or any other endorsement, please contact us at hello@engagerocket.co.

Blog and Forums

Our website offers publicly accessible blogs. You should be aware that any information you provide in these areas may be read, collected, and used by others who access them. To remove your personal information from our blog or community forum, please contact us at hello@engagerocket.co. In some cases, we may not be able to remove your personal information, in such cases we notify you and explain why we are unable to fulfil your request.

 

Data Retention

EngageRocket collects de-identified aggregated benchmark data from its clients for the calculation of benchmark indexes. A benchmark index allows EngageRocket to highlight industry engagement standards, so Users can compare their own companies with others across similar industries or similar company sizes. By using our Services, by default you agree to provide your User data for our usage, even after termination of contract. We offer an opt-out system, where we delete our local backups of data if the customer does not wish to have the data used. However, our databases retain the data by default as it helps us create better and more accurate predictions for our Users. For any enquiries on opting out, please contact hello@engagerocket.co

 

Changes to this privacy policy

We may modify this privacy policy at any time, but if we do so, we will notify you by publishing the changes on this website. If we determine the changes are material, we will provide you with additional, prominent notice as is appropriate under the circumstances, such as via email.

 

 


Update on Personal Data Protection Act of Singapore

The Personal Data Protection Act of Singapore (the “PDPA”) establishes data protection laws that govern the collection, use and disclosure of Personal Data and came into effect on July 2, 2014. EngageRocket is a recognized Infocomm Development Authority of Singapore (IDA) Data Intermediary as a Software-as-a-Service (SaaS) Service Provider (IDA Cloud Booklet 2015). As a Data Intermediary EngageRocket complies with the Protection and Retention Limitation Obligations of the Act. Details are set out below.

 

Background of the PDPA

The following is a brief summary of how we comply with and/or relate to the specific laws and privacy protection principles established by the government of Singapore. The PDPA establishes data protection laws which govern the collection, use and disclosure of Personal Data (the “Data Protection Provisions”). Defined terms not defined herein shall have the meaning set for in our Privacy Policy.

Whether and to what extent the obligations imposed by the Data Protection Provisions apply depends on (i) whether we are operating in the capacity of a data principal or a data intermediary when Processing Personal Data in the provision of the EngageRocket Service. “Processing” in relation to Personal Data under the PDPA means the carrying out of any operation or set of operations in relation to Personal Data, and includes recording, holding, organisation, adaptation or alteration, retrieval, combination, transmission, erasure or destruction.

 

Obligations imposed by the data protection provisions

The Data Protection Provisions generally require an organization (which term includes any individual, company, association or body of persons, corporate or unincorporated) to be responsible for Personal Data of individuals in its possession or under its control, and to develop and implement policies that are necessary to meet the following obligations:

1. The obligation to obtain, on or before the collection, the individual’s consent to the collection, use and disclosure of the individual’s Personal Data (the “Consent Obligation”).

2. The obligation to ensure that Personal Data is collected, used and disclosed only for purposes which consent was given or which a reasonable person would consider appropriate in the circumstances (the “Purpose Limitation Obligation”).

3. The obligation to notify the individual, on or before collection, use or disclosure, the purposes for which it is collecting, using and/or disclosing the individual’s Personal Data (the “Notification Obligation”).

4. The obligation to provide, upon the request of the individual, information about the ways in which the individual’s Personal Data has been or may have been used or disclosed in the year before the request, and allow the individual to correct his/her Personal Data (the “Access and Correction Obligation”).

5. The obligation to use reasonable effort to ensure that the Personal Data collected by or on its behalf is accurate and complete (the “Accuracy Obligation”).

6. The obligation to make reasonable security arrangements to protect the Personal Data and prevent unauthorised access, collection, use disclosure or similar risks (the “Protection Obligation”).

7. The obligation to cease retaining Personal Data or remove the means by which the Personal Data can be associated with an individual when the personal data is no longer necessary for business or legal purpose (“Retention Limitation Obligation”).

8. The obligation not to transfer Personal Data to a country or territory outside of Singapore except in accordance with the requirements under PDPA (“Transfer Limitation Obligation”).

9. The obligation to make information about its data protection policies, practices and complaints process available on request, and designating one or more individuals as its data protection officer to ensure that the organisation complies with the PDPA (“Openness Obligation”).

The PDPA applies only to Personal Data of individuals given in a personal capacity, for personal purposes and does not apply to “business contact information” which is defined in the PDPA as “an individual’s name, position name or title, business telephone number, business address, business electronic mail address or business fax number and any other similar information about the individual, not provided by the individual solely for his personal purposes”. An organization is not required to obtain consent or otherwise comply with the PDPA in collecting, using or disclosing any business contact information disclosed in the course of a commercial transaction.

 

Personal data provided by subscribers to us

Personal Data is collected when an Account is created by a Subscriber or when Agents are registered to use the Service. This information constitutes business contact information for purposes of the PDPA. In this regard, we are not required to obtain consent or comply with the Data Protection Provisions in relation to such Personal Data. We do, however as a matter of good business practices describe how we collect, use, disclose and Process this Personal Data in our Privacy Policy.

 

How we comply with the PDPA as a data intermediary with regards to personal data in the service

We act as a data intermediary in connection with the use of the Service by our Subscribers and their Agents. Data intermediaries who process Personal Data on behalf of other organisations are only required to comply with two obligations under the PDPA when Processing this Personal Data:

•    the Protection Obligation; and

•    the Retention Limitation Obligation

The Protection Obligation requires us to put in place appropriate administrative, physical and technical measures to prevent unauthorized access, collection, use, disclosure, copying, modification, disposal or similar risks to the Personal Data in our possession or under our control, regardless whether the Personal Data is stored in a central server, or on local storage media, or at facilities operated by a third party vendor. We utilize robust precautions to protect the confidentiality and security of the Personal Data within the Service, by employing technological, physical and administrative security safeguards, such as firewalls and carefully developed security procedures. These technologies, procedures and other measures are used in an effort to ensure that Personal Data is safe, secure, and only available to Subscribers and to those authorized to access such Personal Data. However, no internet, e-mail or other electronic transmission is ever fully secure or error free, so Subscribers should take care in deciding what information is transmitted, stored or hosted through the Service.

The Retention Limitation Obligation requires us to cease to retain Personal Data which is Processed or remove the means by which the Personal Data can be associated with particular individuals, as soon as it is reasonable to assume that the purpose for which the Personal Data was collected is no longer being served by retention of the Personal Data; and, the retention of the Personal Data is no longer necessary for legal or business purposes.

If you wish to make a complaint about the way we have handled your Personal Data (including if you think we have breached any applicable privacy laws), you may do so to our Privacy Officer (cheetung@engagerocket.co) in writing, by mail or email to the address or email address set out in the ‘Contact Us’ section of our Privacy Policy. Please include your full name, contact details and a detailed description of your complaint. Our Privacy Officer will acknowledge your complaint and respond to you regarding your complaint within a reasonable period of time. If you consider that we have failed to resolve the complaint satisfactorily, we will provide you with information about the further steps you can take.