Privacy Policy
Last updated
This Privacy Policy explains what personal data Kartblue and its subsidiary Zuruni collect, why we collect it, and the choices you have. It covers every Kartblue website that links here and all of the products and services contained on those websites. Kartblue has never sold your information for advertising, and we never will.
Our privacy commitment
Kartblue has never sold your information to someone else for advertising, or made money by showing you other people's ads, and we never will. We ask for only the least amount of information necessary, gathering only what we believe is essential for doing business or for the specific transaction at hand. This policy tells you what information we collect from you, what we do with it, who can access it, and what you can do about it.
Scope of this policy
This Privacy Policy applies to all Kartblue websites that link to it, including Zuruni. It also applies to the products and services provided by Kartblue through these websites, our mobile applications, and applications posted on online marketplaces. This policy does not apply to any of our websites, products or services that have a separate privacy policy.
Information you provide to us
When you sign up for an account, we ask for your name, contact number, email address, company name and country. You also choose a unique username and password. When you register for events, subscribe to newsletters, download materials, participate in contests or surveys, or request customer support, we record the information you submit. When you buy something from us, we collect your name, contact information and credit card details — we do not store the actual credit card number, only the name and address of the cardholder, the expiry date and the last four digits. If you authorise us, we may store your payment information in encrypted form with our payment gateway service providers. We may also record and analyse your interactions with us, including email, telephone and chat conversations with our sales and support teams, to improve our services.
Information we collect automatically
When you visit our websites, we collect information that web browsers, mobile devices and servers make available, such as IP address, browser type, language preference, time zone, referring URL, date and time of access, operating system, mobile device manufacturer and mobile network information. We use cookies, beacons, tags, scripts and similar technologies to identify visitors, track website navigation and understand email campaign effectiveness. We mostly use first-party cookies and do not use third-party cookies for non-essential or intrusive tracking. We also collect information from application logs and in-house analytics tools about your use of our products — including clicks, scrolls, features accessed, access time and frequency, errors, performance data, storage utilised and device settings.
Information from third parties
If you sign in through a federated authentication service provider such as LinkedIn, Microsoft or Google, they will share your name and email address with us. If someone refers our products to you through a referral program, they may provide us your name and email address. Our reselling partners may pass your name, email address, company name and other information to us if you express interest in our products through them. When you engage with us on social media platforms such as Facebook, Twitter, LinkedIn and Instagram through posts, comments and other interactions, we may collect that publicly available information, including profile information.
How we use your information
We use your information to provide the services you have requested, create and maintain your accounts, and monitor for unauthorised activity. We communicate with you about the products you use, your customer support requests, new products you may like, opportunities for feedback, and policy updates. We analyse collected information to understand user needs and improve our services. We may also use your information to detect and prevent fraudulent transactions and other illegal activities, to report spam, and to protect the rights and interests of Kartblue, our users, third parties and the public.
Legal basis for processing
If you are in the European Economic Area (EEA), our legal basis for collecting and processing your information depends on the personal information concerned and the context. Most of our collection and processing activities are based on (i) contractual necessity, (ii) one or more legitimate interests of Kartblue or a third party that are not overridden by your data protection interests, or (iii) your consent. Where we rely on your consent, you have the right to withdraw it at any time. Where we rely on legitimate interests, we will clearly explain what those interests are at the time we collect your information.
Your choices
You may opt out of receiving newsletters and other non-essential messages by using the unsubscribe function included in all such messages. However, you will continue to receive essential notices such as account notification emails, security incident alerts and transactional payment emails. You can disable browser cookies before visiting our websites, but certain features may not work properly. You can choose not to provide optional profile information such as your photo, and you may delete or change it at any time. You can always choose not to fill in non-mandatory fields when you submit any form linked to our websites.
Who we share your information with
We do not sell any personal information. Employees and independent contractors of Kartblue group entities have access to information on a need-to-know basis. We share your information with third-party service providers such as marketing partners, event organisers, web analytics providers and payment processors, who are authorised to use your personal information only as necessary to provide their services. When you register a domain through Kartblue, we share your name and contact information with domain name registrars as per ICANN rules. We may share your personal information with authorised reselling partners solely for contacting you about products you have used, and we give you an option to opt out. When you install or purchase an application developed using Kartblue's APIs, your name and email address will be shared with the developer of that application.
Your rights
If you are in the European Economic Area, you have the right to access and obtain a copy of the personal information we hold about you, to rectify any inaccuracies, and to request erasure of your information in certain circumstances. You also have the right to request restriction of processing, to receive your information in a structured, commonly used and machine-readable format (data portability), and to object to the use of your information for direct marketing. You have the right to complain to the appropriate supervisory authority if you have any grievance against the way we collect, use or share your information. Kartblue undertakes to provide you the same rights no matter where you choose to live.
Data retention
We retain your personal information for as long as it is required for the purposes stated in this Privacy Policy. Sometimes we may retain your information for longer periods as permitted or required by law, such as to maintain suppression lists, prevent abuse, comply with legal obligations, or enforce our agreements. When we no longer have a legitimate need to process your information, we will delete or anonymise it from our active databases. Your data will be securely stored and isolated from further processing on backup discs until deletion is possible.
Information you entrust to us (service data)
If you handle other people's data using our apps — such as information about your customers or employees — or if you use a mobile app and give it access to your contacts and photo library, you are entrusting that data to us for processing. You own your service data. We protect it, limit access to it, and only process it according to your instructions. You may access it, share it through third-party integrations, and request that we export or delete it. We hold the data in your account as long as you choose to use our services. After you terminate your account, your data will be automatically deleted from our active database within 6 months and from our backups within 3 months after that.
Children's privacy
Our products and services are not directed to individuals under 16. Kartblue does not knowingly collect personal information from children under 16 years of age for its own purposes. If we become aware that a child under 16 has provided us with personal information, we will take steps to delete such information. If you believe that a child under 16 has provided personal information to us, please write to [email protected] with the details.
Security
At Kartblue, we take data security very seriously. We have implemented appropriate administrative, technical and physical safeguards to prevent unauthorised access, use, modification, disclosure or destruction of the information you entrust to us.
International transfers
We share your personal information and service data within the Kartblue Group and with third parties engaged for the purposes described in this policy. By accessing or using our products and services, you understand that the processing, transfer and storage of your personal information may occur in the United States, the European Economic Area and other countries where Kartblue operates. Such transfers are subject to appropriate data protection agreements based on EU Commission's Model Contractual Clauses. You can write to [email protected] for a copy of these agreements.
Changes to this policy
We may modify this Privacy Policy at any time. If we make significant changes that affect your rights, we will notify you through a service announcement or by email to your primary email address with at least 30 days advance notice. If you think the updated policy affects your rights with respect to your use of our products or services, you may terminate your use by sending us an email within 30 days. Your continued use after the effective date of changes will be deemed your agreement to the modified policy. You will not receive email notification of minor changes, so you should check back at zuruni.io/privacy-policy periodically.
Contact us
You can always contact us to ask questions about our privacy practices, request a GDPR-compliant Data Processing Addendum, alert us if you believe we have collected personal data from a minor, or ask to have your personal information removed from our blogs or forums. For privacy-related enquiries, write to [email protected]. For legal enquiries, write to [email protected].