GDPR & Data Protection

1. Introduction

CaravelIQ LLC ("CaravelIQ," "we," "us," or "our") operates the CampanaOne mass communication platform. We handle personal data in line with the UK General Data Protection Regulation and the Data Protection Act 2018 (together, "UK GDPR"), and the EU General Data Protection Regulation ("EU GDPR") where it applies.

This page explains which personal data we are responsible for, which personal data our customers are responsible for, and how each kind is protected. It should be read together with our Privacy Policy and Cookie Policy.

2. Our Role: Processor and Controller

Under GDPR, a controller decides why and how personal data is used, and a processor handles personal data on a controller's behalf and on its instructions. CaravelIQ is a processor for some data and a controller for other data.

We are a processor for the data our customers put into CampanaOne

When an organisation uses CampanaOne, that organisation is the controller. It decides whose details are stored, which messages are sent and why. This covers:

• Contact records: names, phone numbers, SMS numbers, email addresses, postal addresses, job titles, groups and custom fields.
• Message content, attachments and voice recordings.
• Delivery records and recipients' replies, such as keypress and text responses.

We process this data only to provide the service, only on the organisation's documented instructions, and under a Data Processing Agreement with that organisation (see section 4).

We are a controller for the data we need to run our own business

• Information you give us on this website, such as a demo request or contact form.
• Account and sign-in details of people who use the CampanaOne application, and the security logs we keep to protect the service.
• Business contact and billing details of our customers and partners.

How we use this data is described in our Privacy Policy.

3. If You Received a Message Sent Through CampanaOne

The organisation that sent you the message holds your details and is responsible for them. To find out what it holds, correct it, have it deleted, or stop receiving messages, please contact that organisation directly.

If you contact us instead, we will pass your request to the organisation concerned and help it respond. To stop text messages straight away, reply STOP to any message, or see our SMS Opt-Out instructions.

4. Data Processing Agreement

Article 28 of GDPR requires a written contract between a controller and its processor. We provide a Data Processing Agreement ("DPA") to every organisation that uses CampanaOne, as part of the customer agreement. It covers:

• Processing only on the customer's documented instructions.
• Confidentiality obligations for everyone who can access the data.
• The security measures we maintain.
• The use of sub-processors, and notice before any change to them.
• Helping the customer answer data subject requests and meet its own GDPR obligations.
• Notifying the customer of a personal data breach without undue delay.
• Deleting or returning the data when the service ends.
• Making available the information needed to show compliance, including audits.

To request a copy of our DPA, email compliance@caraveliq.com.

5. Where Data Is Stored

Customer data is hosted with Amazon Web Services in the London region (eu-west-2), United Kingdom. Databases and file storage are encrypted at rest.

Some sub-processors handle data outside the UK and the European Economic Area in order to deliver messages. Where personal data is transferred internationally, we rely on recognised safeguards, such as the UK International Data Transfer Addendum, the EU Standard Contractual Clauses, or the EU–US and UK–US Data Privacy Framework.

6. Sub-processors

We use carefully selected providers to host CampanaOne and to deliver voice calls, SMS, email, WhatsApp and push notifications. Each provider's data protection terms apply to the data it handles for us.

To deliver messages worldwide, we may add or replace sub-processors, including regional messaging providers used only for traffic to or within their region.

Customers can request our current list of sub-processors at any time through their account manager. We inform customers before a new sub-processor begins handling their data, and customers may object on reasonable data protection grounds.

7. Security

We protect personal data with encryption in transit and at rest, role-based access limited to each organisation and division, multi-factor authentication for privileged accounts, and audit logging of user actions. More detail is on our Security page.

8. Personal Data Breaches

If a breach affects data we process for a customer, we notify that customer without undue delay so it can meet its own reporting duties. If a breach affects data we control, we notify the Information Commissioner's Office, or the relevant supervisory authority, within 72 hours where the law requires it, and tell the people affected where the risk to them is high.

9. Your Rights

Where we are the controller of your data, you have the right to:

• Access the data we hold about you.
• Have inaccurate data corrected.
• Have your data deleted.
• Restrict or object to how we use it.
• Receive your data in a portable format.

To make a request, email compliance@caraveliq.com. We respond within one month. Where an organisation is the controller of your data, please contact it first, as described in section 3.

You can also complain to the UK Information Commissioner's Office at ico.org.uk, or to the data protection authority in your own country.

10. Contact

For data protection questions, DPA requests or rights requests, email compliance@caraveliq.com or visit our Contact Page.

CaravelIQ LLC  |  1209 Mountain Road Pl NE, Suite R, Albuquerque, NM 87110, USA