ShareThis Privacy Notice

20210201_rev01 · COMPARED WITH 20201201_rev01 · ARCHIVE SNAPSHOT, DATE APPROXIMATE

Full text changes — 20201201_rev01 to 20210201_rev01

1Privacy (2020)
1Privacy (2021)
22
33**Please click the following links to read our Privacy Policy in other languages:** **[Confidentialité](https://pcdn.sharethis.com/wp-content/uploads/2020/04/Privacy-Policy-3.30.20-French-v1.pdf) (Français), [Privacidad](https://pcdn.sharethis.com/wp-content/uploads/2020/04/Privacy-Policy-3.30.20-Spanish-v1.pdf) (Español), [Privacy](https://pcdn.sharethis.com/wp-content/uploads/2020/04/Privacy-Policy-3.30.20-Italian-v1.pdf) (Italiano), [Privacidade](https://pcdn.sharethis.com/wp-content/uploads/2020/04/Privacy-Policy-3.30.20-Portuguese-V1.pdf) (Português), [Datenschutz](https://pcdn.sharethis.com/wp-content/uploads/2020/04/Privacy-Policy-3.30.20-German-v1.pdf) (Deutsche), [プライバシー](https://pcdn.sharethis.com/wp-content/uploads/2020/04/Privacy-Policy-3.30.20-Japanese-V1.pdf) (日本語).**
44
5### **Updated November 18, 2020**
5### **Updated January 29, 2021**
66
77ShareThis takes privacy seriously. This Privacy Notice sets out what data we collect, how we collect it, why we process it, who we may share it with and, where the data we collect is personal data, your rights with respect to such personal data. ShareThis may change this Notice from time to time by updating this page. You should check this page from time to time to ensure that you are up to date with any changes.
88
99ShareThis is committed to processing information in accordance with applicable laws (including where applicable the European Union's General Data Protection Regulation ("**GDPR**") and the California Consumer Privacy Act ("CCPA") and as described in this Privacy Notice. For specific information about how ShareThis adheres to the GDPR and your rights as an EEA data subject please click **[here.]()** For information about how ShareThis adheres to the CCPA, please click **[here]().**
1010
1111To access information for Publishers, please visit the Publisher Information page [**here**](https://www.sharethis.com/publisher/)**.**
145145There are a number of "general" reasons that ShareThis may process data on our systems. Many of them are required by applicable law and/or to help us ensure that the Internet remains a safe space. Some of them enable us to promote and grow our business. If you'd like additional information, please email privacy@sharethis.com.
146146
147147We may also process data for the following purposes: a) as required by applicable law; b) to cooperate with competent legal authorities such as data protection regulators, the police and the FBI; c) to enforce our terms and conditions, including by obtaining advice and conducting legal proceedings; d) to protect our operations, property and interests, and those of third parties; e) to sell and promote the sale of our business and/or assets.
148148
149149Finally, ShareThis may transfer information to a successor entity in connection with a corporate merger, consolidation, sale of assets, bankruptcy, or other corporate change. If ShareThis is involved in a merger, acquisition, or sale of all or a portion of its assets, you will be notified via email and/or a prominent notice on our website of any change in ownership or uses of your information, as well as any choices you may have regarding your information.
150150
151### The GDPR, the LGPD, and Your Rights as an EU or Brazil Data Subject
151### The GDPR and Your Rights as an EU or UK Data Subject
152152
153If you are located in the European Economic Area (EEA), the General Data Protection Regulation (GDPR) applies to our processing of personal data. If you are located in Brazil, then the Brazilian GeneralLaw for the Protection of Personal Data (LGPD) applies to our processing of personal data. The GDPR and LGPD each grant those located respectively in the EEA and Brazil a set of clear privacy rights and imposes responsibilities on ShareThis as we process the personal data of data subjects located in those places. The ShareThis privacy policy outlines how and why ShareThis processes personal data. This section is designed to provide more information on how ShareThis adheres to the GDPR and LGPD and your rights as a data subject located in Brazil or the EEA.
153If you are located in the European Economic Area (EEA), the General Data Protection Regulation (GDPR) applies to our processing of personal data. If you are located in the United Kingdom, then the Data Protection Act 2018 applies to our processing of personal data. These laws each grant those located respectively in the EEA and the UK a set of clear privacy rights and imposes responsibilities on ShareThis as we process the personal data of data subjects located in those places. The ShareThis privacy policy outlines how and why ShareThis processes personal data. This section is designed to provide more information on how ShareThis adheres to the GDPR and the Data Protection Act 2018 and your rights as a data subject located in the UK or the EEA.
154154
155155Additional Information
156156
157157**Definition of Personal Data**
158158
159Both the GDPR and LGPD define personal data broadly. As such, where Usage Data and/or Profile Information relates to an individual in the EEA or Brazil, we treat it as personal data. Similarly, nearly all of the data collected from EU and Brazil data subjects in the context of our normal business operations is likely to be considered personal data. This includes: a) data collected via visits to ShareThis.com; b) data collected from Customers, Publishers and business partners; and c) data collected from employees and prospective employees.
159Both the GDPR and UK Data Protection Act define personal data broadly. As such, where Usage Data and/or Profile Information relates to an individual in the EEA or UK we treat it as personal data. Similarly, nearly all of the data collected from EEA and UK data subjects in the context of our normal business operations is likely to be considered personal data. This includes: a) data collected via visits to ShareThis.com; b) data collected from Customers, Publishers and business partners; and c) data collected from employees and prospective employees.
160160
161161**Special Categories of Personal Data**
162162
163ShareThis does not collect nor process any special categories of personal data with respect to Brazil or EU data subjects, and we do not create Profile Information of audience segments of such consumers based on special categories of personal data (i.e. data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health, or data concerning a natural person's sex life or sexual orientation).
163ShareThis does not collect nor process any special categories of personal data with respect to UK or EEA data subjects, and we do not create Profile Information of audience segments of such consumers based on special categories of personal data (i.e. data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data, data concerning health, or data concerning a natural person's sex life or sexual orientation).
164164
165165**Legal Basis for Processing**
166166
167Both the LGPD and GDPR requires entities seeking to process personal data to have a valid legal basis for doing so. The legal basis utilized by ShareThis include: a) consent; b) legitimate interest (i.e., where we believe that our need to process the data and/or the value we deliver by processing such data is not outweighed by the rights of the data subject); c) where necessary for the performance of a contract; and d) where processing is necessary to comply with our legal obligations. We will endeavor to outline our legal basis for the most common types of processing conducted by ShareThis.
167Both the UK Data Protection Act and GDPR requires entities seeking to process personal data to have a valid legal basis for doing so. The legal basis utilized by ShareThis include: a) consent; b) legitimate interest (i.e., where we believe that our need to process the data and/or the value we deliver by processing such data is not outweighed by the rights of the data subject); c) where necessary for the performance of a contract; and d) where processing is necessary to comply with our legal obligations. We will endeavor to outline our legal basis for the most common types of processing conducted by ShareThis.
168168
169169_Cookie and Similar Tracking Technologies_ - We endeavor to obtain consent for our placement of cookies, pixels and similar tracking technologies as required under the ePrivacy Directive as implemented throughout the EEA. As ShareThis does not have direct relationships with Internet users in many cases, we ask Publishers and other partners to obtain a consent on our behalf as described below. Where we directly place cookies (e.g., via ShareThis.com) we directly obtain the consent from data subjects we've identified as being from the EEA or other place where consent is required.
170170
171171_Usage Data and Profile Information_ - While we obtain a consent for our placement of cookies as described above, ShareThis processes Usage Data and Profile Information under our legitimate interest. For purposes of clarity, where this data is utilized for analytics, targeted advertising, measurement or reporting, we also process it via legitimate interest. To offer additional transparency, we endeavor to mention some of these use cases in the consents obtained for cookies and pixels.
172172
173173_Website Data_ - We collect personal data via ShareThis.com. Where that data is provided to ShareThis (e.g., via completing an online form), we consider it either Account Data and/or data collected pursuant to a Business Relationship which are described below. Where we place cookies via the website, we use consent. Where data is collected automatically (e.g., log files containing IP addresses), we process such data via our legitimate interest and in order to maintain the website and help us to a better job of personalizing the website to the interests of visitors.
174174
175_Account Data and Business Relationships_ - We require some Publishers to setup an Account with ShareThis. Similarly, we maintain accounts containing personal data with most of the vendors who provide services to ShareThis, our Customers, our employees and our business partners. If you are an employee of one of those entities, ShareThis may have your personal data including your name, your work email or your work telephone number. For data subjects located in the EEA or Brazil, we process this data under the legal basis of contractual necessity. In other words, we need to process this data in order to honor the terms of the contract between ShareThis and the Publisher, Customer, vendor, Etc. This includes maintaining an account and login credentials, billing and payment purposes, communicating with the other party, and fulfilling requests. Where we are seeking to market additional products and services to these entities, we will do so via legitimate interest unless applicable law dictates that we use consent (e.g., for email marketing).
175_Account Data and Business Relationships_ - We require some Publishers to setup an Account with ShareThis. Similarly, we maintain accounts containing personal data with most of the vendors who provide services to ShareThis, our Customers, our employees and our business partners. If you are an employee of one of those entities, ShareThis may have your personal data including your name, your work email or your work telephone number. For data subjects located in the EEA or UK, we process this data under the legal basis of contractual necessity. In other words, we need to process this data in order to honor the terms of the contract between ShareThis and the Publisher, Customer, vendor, Etc. This includes maintaining an account and login credentials, billing and payment purposes, communicating with the other party, and fulfilling requests. Where we are seeking to market additional products and services to these entities, we will do so via legitimate interest unless applicable law dictates that we use consent (e.g., for email marketing).
176176
177177_General Purposes_ - There are a number of instances where ShareThis processes personal data which are distinct from the descriptions provided above. For example:
178178
179179Legal and Regulatory Compliance - Like most companies, ShareThis will process data in order to comply with law, cooperate with requests from competent legal authorities such as the police, and to pay taxes. The legal basis for this type of processing is necessary for ShareThis to meet our legal and regulatory obligations.
180180
181181Enforcement of legal obligations - To enforce our terms and conditions, protect of our intellectual property and/or the rights of third parties, ShareThis processes personal data in these instances via our legitimate interest. This may include obtaining advice and conducting legal proceedings.
183183Sell and Promote our Business - ShareThis may choose to conduct, evaluate and/or promote the sale of our business via our legitimate interest.
184184
185185_Aggregated Data_ - Where we aggregate data and remove digital identifiers (e.g., cookie IDs), we may use this data for internal research, marketing, and statistical analysis purposes.
186186
187187**Data Controller**
188188
189ShareThis is generally a Controller of data with respect to the data processed as described above. Where the GDPR or LGPD applies to Usage Data and Profile Information and we share this data with our Customers, our Customers are independent controllers in relation to their processing of such data and they process it in accordance with their own privacy policies. ShareThis is also the controller of the data it collects via ShareThis.com.
189ShareThis is generally a Controller of data with respect to the data processed as described above. Where the GDPR or UK Data Protection Act applies to Usage Data and Profile Information and we share this data with our Customers, our Customers are independent controllers in relation to their processing of such data and they process it in accordance with their own privacy policies. ShareThis is also the controller of the data it collects via ShareThis.com.
190190
191191**Data Processors**
192192
193193ShareThis also has a number of agents and service providers who operate as processors of data on ShareThis' behalf. This agents and service providers are only able to use the data as specifically directed by ShareThis and only to provide the services requested by us. They are also contractually obligated to process the data securely and under confidentiality obligations.
194194
195Brazil and **EU Data Subject Rights**
195**UK and EU Data Subject Rights**
196196
197Where the GDPR or LGPD applies, such data subjects have certain rights, including: a) The right to be informed about the types of data being processed and the legal basis for processing; b) the right to access and see the data being processed; c) the right of rectification, to make corrections to data subject to processing; d) the right to erase data; e) the right to restrict processing of data; f) the right of data portability; g) the right to object to the processing of data and f) the right not to be subject to automated decision-making. Some of these rights apply only in certain circumstances and depend on the legal basis relied upon to process the data. As an example, the right to object applies to processing which is carried out because it is necessary for our legitimate interests and only if we cannot demonstrate compelling legitimate grounds which outweigh your rights, interests and freedoms. The same right does not apply to processing which is necessary for us to comply with our legal obligations or to perform a contract with you. Given that both the LGPD and the GDPR defines personal data broadly, these rights may extend to the personal data we place into cookies or similar tracking technologies.
197Where the GDPR or UK Data Protection Act applies, such data subjects have certain rights, including: a) The right to be informed about the types of data being processed and the legal basis for processing; b) the right to access and see the data being processed; c) the right of rectification, to make corrections to data subject to processing; d) the right to erase data; e) the right to restrict processing of data; f) the right of data portability; g) the right to object to the processing of data and f) the right not to be subject to automated decision-making. Some of these rights apply only in certain circumstances and depend on the legal basis relied upon to process the data. As an example, the right to object applies to processing which is carried out because it is necessary for our legitimate interests and only if we cannot demonstrate compelling legitimate grounds which outweigh your rights, interests and freedoms. The same right does not apply to processing which is necessary for us to comply with our legal obligations or to perform a contract with you. Given that both the UK Data Protection Act and the GDPR defines personal data broadly, these rights may extend to the personal data we place into cookies or similar tracking technologies.
198198
199Where processing is based on your consent, in accordance with the GDPR and LGPD (as applicable), you may withdraw that consent at any time, although any processing previously carried out will still be legal. In order to exercise your data subjects' rights or if you have any questions about these rights, you can write to us at [privacy@sharethis.com](mailto:privacy@sharethis.com). We will endeavor to respond to any requests to exercise your rights within one month from when they are made, although this period may be extended in some cases in which case we will inform you before the expiration of the one month period.
199Where processing is based on your consent, in accordance with the GDPR and UK Data Protection Act (as applicable), you may withdraw that consent at any time, although any processing previously carried out will still be legal. In order to exercise your data subjects' rights or if you have any questions about these rights, you can write to us at [privacy@sharethis.com](mailto:privacy@sharethis.com). We will endeavor to respond to any requests to exercise your rights within one month from when they are made, although this period may be extended in some cases in which case we will inform you before the expiration of the one month period.
200200
201201You also have the right to submit complaints to the supervisory authority in your jurisdiction. A list of supervisory authorities in the EEA can be found here: [https://edpb.europa.eu/about-edpb/board/members\_en](https://edpb.europa.eu/about-edpb/board/members_en).
202202
203**How ShareThis interacts with our Publishers on GDPR and LGPD compliance**
203**How ShareThis interacts with our Publishers on GDPR and UK Data Protection compliance**
204204
205If you are in the European Economic Area, you may be familiar with websites asking you to consent to the use of cookies and similar technologies. If you are in Brazil, you may see similar consent notices which pertain to the LGPD. Where the ShareThis Applications are used to process personal data from data subjects in places where a notice and/or consent is required, our Publishers are required to notify you about the use of the ShareThis Applications, mention ShareThis as a third party who processes your personal data and ask you to consent to such processing as well as the placement of cookies.
205If you are in the European Economic Area, you may be familiar with websites asking you to consent to the use of cookies and similar technologies. If you are in the UK, you may see similar consent notices which pertain to the UK Data Protection Act. Where the ShareThis Applications are used to process personal data from data subjects in places where a notice and/or consent is required, our Publishers are required to notify you about the use of the ShareThis Applications, mention ShareThis as a third party who processes your personal data and ask you to consent to such processing as well as the placement of cookies.
206206
207_Cross-border transfers of EU or Brazil personal data_
207_Cross-border transfers of EU or UK personal data_
208208
209209We generally process data in the United States. When we share data, we provide data to companies globally. In each case, we have safeguards in place which allow those transfers to happen in a way that ensures data is handled in accordance with the applicable law.
210210
211When we transfer personal data outside the EEA or Brazil, unless the recipient or location to which the data is transferred has been approved by the appropriate authorities as providing an adequate level of protection for personal data, we put in place measures to ensure that the transfer complies with the applicable data protection law and that the personal data which is transferred is appropriately safeguarded.
211When we transfer personal data outside the EEA or UK, unless the recipient or location to which the data is transferred has been approved by the appropriate authorities as providing an adequate level of protection for personal data, we put in place measures to ensure that the transfer complies with the applicable data protection law and that the personal data which is transferred is appropriately safeguarded.
212212
213213When we enter into business relationships which involves the transfer of EU personal data to the United States, we put in place reasonable transfer mechanisms such as the EU standard contractual clauses with the recipient. More information about international data transfers under the GDPR can be found at [https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection\_en](https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection_en). If requested, we may make available a copy of such safeguards, as required by the GDPR.
214214
215215_Data Protection Officer and Representative_
216216
217217ShareThis has appointed a data protection officer to supervise our personal data processing-related activities, and to respond to requests as required. Our DPO can be contacted as follows: Vincent Potier (ShareThis DPO): [dpo@sharethis.com](mailto:dpo@sharethis.com)
218218
219219ShareThis' representative in the EU is: ShareThis UK Limited of 10 John Street, London WC1N 2EB, UK.
220220
221### The LGPD and Your Rights as a Brazil Data Subject
222
223If you are located in Brazil, then the Brazilian General Law for the Protection of Personal Data (LGPD) applies to our processing of personal data. The LGPD grants those located Brazil a set of clear privacy rights and imposes responsibilities on ShareThis as we process the personal data of data subjects located in Brazil. The ShareThis privacy policy outlines how and why ShareThis processes personal data. This section is designed to provide more information on how ShareThis adheres to the LGPD and your rights as a data subject located in Brazil.
224
225Additional information
226
227**Definition of Personal Data**
228Like the GDPR, the LGPD defines personal data broadly. As such, where Usage Data and/or Profile Information relates to an individual in the Brazil, we treat it as personal data. Similarly, nearly all of the data collected from EEA and UK data subjects in the context of our normal business operations is likely to be considered personal data. This includes: a) data collected via visits to ShareThis.com; b) data collected from Customers, Publishers and business partners; and c) data collected from employees and prospective employees, as applicable.
229
230**Special Categories of Personal Data**
231ShareThis does not collect nor process any special categories of personal data with respect to data subjects in Brazil.
232
233**Legal Basis for Processing**
234The LGPD entities seeking to process personal data to have a valid legal basis for doing so. The legal basis utilized by ShareThis include: a) consent; b) legitimate interest (i.e., where we believe that our need to process the data and/or the value we deliver by processing such data is not outweighed by the rights of the data subject); c) where necessary for the performance of a contract; and d) where processing is necessary to comply with our legal obligations.
235
236**Brazil and Data Subject Rights**
237Where the LGPD applies, such data subjects have certain rights, including: a) The right to be informed about the types of data being processed and the legal basis for processing; b) the right to access and see the data being processed; c) the right of rectification, to make corrections to data subject to processing; d) the right to erase data; e) the right to restrict processing of data; f) the right of data portability; g) the right to object to the processing of data and f) the right not to be subject to automated decision-making. Some of these rights apply only in certain circumstances and depend on the legal basis relied upon to process the data. If you are located in Brazil and have questions about how ShareThis implements these rights, please email us at privacy@sharethis.com.
238
221239Additional Information
222240
223241Starting January 1, 2020, the California Consumer Privacy Act (CCPA) provides additional privacy protections for California data subjects and users, including:
224242
225243- the right to see what data we have about you, your computer or device (i.e., the right to know),
226244- the right to delete the data we have about you, your computer or device (i.e., the right to delete), and
423441The Federal Trade Commission has investigation and enforcement authority over our compliance with the Privacy Shield.
424442
425443If you believe we have not respected your rights or otherwise not handled data correctly, then we encourage you to contact us directly and we will do everything possible to help.
426444
427445However, where you still have a complaint, then you have the right to raise the matter with the Supervisory Authority (or data protection agency) in your country for resolution.
428446
429**Last Updated: November 18, 2020**
447**Last Updated: January 29, 2021**
430448
431449**Contact**
432450ShareThis, Inc.
4334513000 El Camino Real
4344525 Palo Alto Square, Suite 150
435453Palo Alto, CA 94306, USA