GDPR and data protection
This page answers the data protection questions customers ask us most often. The documents your data protection, legal and IT teams will want to review are linked at the end.
What is FactFinder’s role under the GDPR?
When FactFinder runs search, recommendations and merchandising in your shop, we process personal data on your behalf. You are the controller, we are the processor under Art. 28 GDPR. Our data processing agreement (DPA) sets out how that works.
Which personal data does FactFinder process?
FactFinder processes the IP address, session ID and user ID that arrive with a request, unless you anonymise them first. We use them to answer search queries from your shop, and in log files to measure licence use and how features are used. The people concerned are your shop’s visitors and the members of your team who work with FactFinder.
Where is our data hosted?
FactFinder is hosted in the EU. Every company that processes data for us is named in our sub-processor list, with its address and its role.
Do the AI features send data to outside providers?
Vector search and Atlas AI are our own technologies. Features that use an external model, such as AI-based data enrichment or conversational commerce, run only with your explicit consent, and the sub-processor list names their providers.
How is the data protected?
Our technical and organisational measures (TOM) describe the safeguards in detail: access control for buildings, systems and data, encrypted transfer, a log of who enters or changes data, daily backups and the separation of each customer’s data. FactFinder stores no payment card data, so PCI DSS does not apply.
How do you handle sub-processors?
The current list is on our contract documents page. When we add a sub-processor, we let you know, and you can object within one month if you have a data protection reason.
What happens when a shopper asks about their data?
Requests for access, correction or deletion are yours to answer as the controller. If one reaches us, we forward it to you straight away and support you in answering it, as our DPA sets out.
What happens to our data when the contract ends?
We return it or delete it, as you prefer, unless the law requires us to keep it. On request, we confirm the deletion in writing.
Documents
Our data processing agreement (DPA), technical and organisational measures (TOM) and the sub-processor list are on the contract documents page.
Questions
Our external data protection officer is reachable at gdpr@fact-finder.com.
