Iterable

Data sourcing, advertising data use, subprocessors, international transfers, security certification and retention periods changed across the two versions across six reported changes.

• The policy moves from stating Iterable does not purchase or receive information from third parties to expressly authorising collection from data brokers and publicly available sources for prospecting. (Section 9. How We Collect Personal Data)
• The scope of advertising data use expands from promoting other businesses to creating custom and lookalike audiences on social media via hashed email matching and personalised advertising. (Section 11B. Marketing to our Customers)
• Subprocessor disclosure shifts from naming specific types of providers (IaaS, SaaS) in the policy to pointing to an external link for the subprocessor list. (Section 14. Subprocessors)
• The international transfer framework changes from a single transfer notification and conditional GDPR liability to a formalised regime under the EU-US DPF, Swiss-US DPF, UK Extension and APEC CBPR/PRP, with a commitment to binding arbitration. (Section 15. Data Transfers Outside the EEA and UK)
• The security commitment replaces a general standard of commercially reasonable measures with specific auditable certifications, including ISO 27001 and SOC 2 Type II. (Section 17. Confidentiality and Security of Your Personal Data)
• The retention framework changes from a specific three-year cookie expiry to a comprehensive purpose-based schedule covering 7 years for financial data and 24 months for prospecting data. (Section 21. How Long Do We Keep Your Personal Data?)