Hootsuite

A full privacy policy replaced the archive index; six changes are reported across data use, sharing, transfers, retention, security, and privacy rights.

• The policy now sets out the categories of information Hootsuite collects and the purposes for each, covering account, billing, content, chat, log, usage, support, survey, event, marketing, website, cookie, and chatbot data (Section 2).
• The policy now restricts sharing to listed circumstances and, within those, allows sharing with employees and contractors, service providers and Subprocessors, resellers and partners, social networks, third-party services, customer organizations, affiliates, government authorities, and professional advisors, subject to confidentiality and security conditions (Section 3).
• The policy now provides for transfers of personal data from the EEA to Canada on adequacy grounds and to the US or onward countries under the DPF or standard contractual clauses, with supplementary measures for SCCs, and lists service providers that process Content (Section 7).
• The policy now commits Hootsuite to retaining information only as long as necessary, disposing of or anonymizing it afterward, and retaining aggregated data for analysis and product improvement (Section 5).
• The policy now commits Hootsuite to industry-standard safeguards, encryption in transit and at rest, access controls, confidentiality obligations, and data protection agreements with service providers (Section 4).
• The policy now gives individuals rights to access, correct, delete, port, object, restrict, withdraw consent, and opt out of sharing for targeted advertising, and commits Hootsuite to handle requests within 30 days unless the request is extensive or complex (Section 6).

8 further changes add the children’s privacy restriction, government-request notification, GDPR/UK controller-processor roles, California privacy rights, DPA availability, contact details, the May 2, 2025 effective date, and the policy-change notice.