PixieBrix Privacy Policy

PixieBrix, Inc. (“PixieBrix”, “we”, “us” or “our”) is a browser extension that lets you customize and automate tasks on your favorite websites. We understand that your privacy is important to you and that you care about how your Personal Data is used. We respect your privacy and are committed to protecting your Personal Data.

This Privacy Policy applies to our collection, use, and sharing of your Personal Data when making available our websites that link to this Privacy Policy (together, the “Site”), as well as associated marketing activities, and any other activities described in this Privacy Policy. Where the GDPR applies, we are a ‘controller’ for the activities covered by this Privacy Policy.

The Site is designed for business customers and their representatives. Our services, including our web application and our web browser extension (together, “Services”), are designed for business customers. We do not offer products or services for use by individuals for their personal, family, or household purposes. Accordingly, we treat all Personal Data (as defined below) we collect as pertaining to individuals in their capacities as representatives of the relevant business and not their individual capacities. If you have any questions about any of our business customer’s use of your Personal Data when they use our Services, you can either review such customer’s own privacy policy(ies) and/or you can contact them directly.

For more information on how we process Personal Data via the Services on behalf of our business customers, see our Product Privacy Description.

‍Personal Data. For reference, when we refer to “Personal Data”, we mean any information which identifies you as an individual or which otherwise renders you identifiable.

GDPR and European Users.‍

The Personal Data we typically collect about you is outlined in the table below.
‍

No obligation to provide Personal Data. You do not have to provide Personal Data to us. However, where we need to process your Personal Data either to comply with applicable law or to deliver our Site and/or Services, and you fail to provide that Personal Data when requested, we may not be able to provide some or all parts of our Site and/or Services. We will notify you if this is the case at the time.

‍Don’t give us sensitive information. We ask that you do not provide us with any sensitive types of Personal Data (e.g., health-related information, information related to racial or ethnic origin, political opinions, religion or other beliefs, criminal convictions information etc.,) – whether through the Site, Services or otherwise. For example, please do not input any of these types of sensitive information in any free-text ‘message’ fields via which you can communicate with us on the Site (e.g., using any ‘Contact Us’ functionality or similar).

We use your Personal Data for the purposes listed below and any associated sharing of Personal Data (see the section called How we share your Personal Data, below).

Where the GDPR applies, it requires us to establish a ‘legal basis’ for that use. As and when the GDPR applies, our legal bases for processing your Personal Data described in this Privacy Policy are listed below.

We also use cookies and other similar technologies on our Site and/or Services. For further information on how and why we use such technologies, please see our Cookie Policy.

We may share your Personal Data with the following categories of recipient and as otherwise described in this Privacy Policy, in other applicable notices, or at the time of collection.  

‍Service providers. Third parties that provide services on our behalf or help us operate parts of the Site and/or Services, or our business (such as our hosting providers, information technology/security providers, customer support, email delivery, marketing, consumer research, and website analytics).

‍Business customers. We may share certain Personal Data we collect about authorized users of the Services with the relevant business customer on whose behalf they use the Services (e.g., where needed to perform our agreement with that customer).

‍Linked third-party services. If you link your account to a social media or other third-party service (e.g., Google, Microsoft), we may share your Personal Data with that third-party service. The third party’s use of the shared information will be governed by its privacy policy and the settings associated with your account with the third-party service.

‍Professional advisors. Professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services that they render to us.

‍Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate in the circumstances.

‍Parties to corporate events. We may disclose Personal Data in the context of actual or prospective corporate events (e.g., investments in PixieBrix, financing of PixieBrix, or the sale, transfer or merger of all or part of our business, assets or shares), for example, we may need to share certain Personal Data with prospective counterparties and their advisers.

We may also disclose your Personal Data to an acquirer, successor, or assignee of PixieBrix as part of any acquisition, sale of assets, or similar transaction, and/or in the event of an insolvency, bankruptcy, or receivership in which Personal Data is transferred to one or more third parties as one of our business assets.

Our headquarters are in the United States. Your Personal Data will be transferred to the United States and may be transferred to other locations where privacy laws may not be as protective as those in your state, province, or country.

Where the GDPR applies, where we share your Personal Data with third parties who are based outside Europe, we try to ensure a similar degree of protection is afforded to it by implementing one of the following mechanisms:

You may contact us using the details below if you want further information on the specific mechanism used by us when transferring your Personal Data outside of Europe.

‍EU-U.S. Data Privacy Framework with UK Extension and Swiss-U.S. Data Privacy Framework

PixieBrix, Inc. complies with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce. PixieBrix has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the processing of Personal Data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. PixieBrix has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”) with regard to the processing of Personal Data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the EU-U.S. DPF Principles shall govern. To learn more about the Data Privacy Framework (“DPF”) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

As described in the EU-U.S. DPF Principles and the Swiss-U.S. DPF Principles, PixieBrix is accountable for Personal Data that it receives and subsequently transfers to third parties. If third parties to whom PixieBrix has disclosed Personal Data process it in a manner that does not comply with the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, PixieBrix will be accountable, unless PixieBrix proves that PixieBrix is not responsible for the event giving rise to the damage. The types of third parties with which PixieBrix may share your Personal Data and for which purposes are set out in the section of this Privacy Policy entitled How we share your Personal Data. The categories of Personal Data PixieBrix may receive, as well as the purposes for which PixieBrix collects and uses the Personal Data, are set out in other sections of this Privacy Policy, including in those entitled What Personal Data we collect and How we use your Personal Data and why.

With respect to Personal Data received or transferred pursuant to the DPF, the U.S. Federal Trade Commission has jurisdiction over PixieBrix’s compliance with the DPF.

In certain situations, PixieBrix may be required to disclose Personal Data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Depending upon the context in which PixieBrix processes Personal Data received in reliance upon the DPF, relevant individuals may have rights to access Personal Data about them, and choices to limit the use and disclosure of their Personal Data. Please submit a written request to exercise your rights or choices to the contact information provided in this Privacy Policy (see the section entitled Contact details). We may request specific information from you to confirm your identity.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, PixieBrix commits to resolve DPF-related complaints about our collection and use of your Personal Data. EU, UK, and Swiss individuals with inquiries or complaints regarding our handling of Personal Data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF should first contact us the contact information provided in this Privacy Policy (see the section entitled Contact details).

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, PixieBrix commits to refer unresolved complaints concerning our handling of Personal Data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF-related complaint from us, or if we have not addressed your DPF-related complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.

Additionally, under certain conditions, you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted. For more information on this option, please see the DPF website: https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction

We may amend this section from time to time consistent with DPF requirements.

We employ technical, organizational, and physical safeguards designed to protect your Personal Data (including to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed). For example, we limit access to your Personal Data to only those employees and other staff who have a business need to have such access. All such people are subject to a duty of confidentiality.In addition, we have put in place procedures to deal with potential Personal Data breaches affecting your Personal Data. In the event of any such breach, we have systems in place to notify and work with applicable regulators where required.

In addition, in certain circumstances (e.g., where we are legally required to do so) we may notify you of more serious Personal Data breaches affecting your Personal Data.

Please note that despite the efforts described above, as our Site and Services are hosted electronically, we can make no guarantees as to the security or privacy of your information.

We are committed to only keeping your Personal Data for so long as we reasonably need to use it for the purposes set out above. This general rule applies unless a longer retention period is required by law.

To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.

When we no longer require the Personal Data that we have collected about you, we will either delete or anonymize it or, if this is not possible (for example, because your Personal Data has been stored in backup archives), then we will securely store your Personal Data and isolate it from any further processing until deletion is possible.

This Site and the Services may include links to third-party websites, platforms, plug-ins, and applications (including to access and integrate your accounts on those other services). Clicking on those links or enabling those connections may allow third parties to collect or share your Personal Data.

We do not control these third-party websites and are not responsible for their privacy statements or practices. When you leave our Site or Services, we encourage you to read the privacy policy of every site you visit.

If you would like to make a complaint regarding this Privacy Policy or our practices in relation to your Personal Data, please contact us using the contact details shown below. We will reply to your complaint as soon as we can.

Where the GDPR applies, if you feel that your complaint has not been adequately addressed, please note that data protection laws give you the right to contact the regulator directly:

Any changes will be made available here (or another page we notify to you at a later date) and where applicable we might also notify you via email and/or on our Site.
‍