Karen, Strategy Specialist at GBC, 4 min read
We spend a lot of time thinking about how to use data responsibly, particularly when it comes to privacy. There’s tremendous value to be found by analysing data, but the only way we will continue to have data to analyse is if we are responsible in how we use it.
As a company, GBC strives to have the respect for user privacy that we’d like in every service we personally use.
I could talk about the things that we do relating to privacy:
We have a plain English privacy policy and expect to be GDPR compliant by the deadline.
We use encryption for all communications between GBC and your browser, and we encrypt our backend services as much as is practical.
When you cancel, we delete your account and all your data.
We purge log data and database backups after 30 days.
But I think our privacy philosophy is better defined by the things that we don’t do.
We don’t access customer accounts unless they ask.
The only time we’ll ever put ourselves into a position to see a customer’s account is if they grant explicit permission to do so as part of a support Service. We log and audit all such access.
We don’t look at customer identities.
Many companies, especially startups, review every signup manually and reach out to interesting looking customers. We get lots of these emails, and every one leaves us unsettled.
Tons of companies will also use the fact that you signed up as permission to identify you as a customer for marketing purposes. Over the years, we’ve had to ask no fewer than a dozen companies to remove GBC from their marketing material.
We find both of these practices to be distasteful. There’s no reason anyone at GBC, needs to know anything more of people who are signing up for StratPlan or Partnership. It’s unnecessary.
We don’t share customer data.
There are a few aspects to this, but our basic premise is that it’s your data, and not ours, so we shouldn’t be sharing it.
We get lots of people writing us from big companies asking “does anyone else at Acme use StratPlan?” or people asking “can you tell me any companies in our industry that use StratPlan?”. Just like we don’t look at identities ourselves, we also don’t disclose them to people who ask.
We’ll only provide customer data to law enforcement agencies in response to court orders. Unless specifically prohibited from doing so, we’ll always inform the customer of the request.
It should go without saying, but we don’t sell customer lists or any other data to anyone.
We don’t look at identifiable usage data.
To make StratPlan better, we do analyse usage patterns, and we have instrumentation to enable us to do that. This inherently requires us to in some form look at what people are doing when they’re using StratPlan. But we do this by asking users a series of questions in a survey.
We built StratPlan as a desktop application which means that nobody including GBC can access StratPlan data. It’s that simple!
We don’t send customer data to third party services.
As much as possible, we avoid the use of third party services that require any customer data to pass through them. There are many cases of such tools capturing too much, and we can’t control what happens with data once it reaches them.
There are a few cases where we do use third party services, which I’m happy to disclose:
We use Payloadz and PayPal to host our applications for purchase and deployment. In those cases, we use available encryption options to prevent the platform provider from having access to the underlying customer data.
We use third party analytics tools (currently Google Analytics) on public facing websites only. They capture IP addresses, etc., but are not put in any place where they could capture user provided content.
We use a third party helpdesk tool for answering support cases (HubSpot). This mean that HubSpot has any data that gets sent in a support ticket.
We use third party tools for sending some emails (MailChimp and Customer.io), which have access to customer email addresses and metadata required to know when to send an email. We don’t send any customer provided data to either service.
We don’t want you to feel creeped out.
At the end of the day, this is the bottom line. We don’t want to do anything that feels creepy or that we wouldn’t want done with our data.
We know that you’re putting your trust in us when you use StratPlan or our Partnership services, and we want to do everything we can to honour and live up to that trust.
