GDPR Compliance at Manago AI (previously SALESmanago)

We care about the privacy and security of your data.

Our company always attaches the highest importance to protecting personal data processed on behalf of our clients. We know how important the security and confidentiality of the entrusted personal data are, so we take all necessary measures to guarantee their effective protection.

Our activities in the field of personal data protection are based on compliance with applicable legal provisions, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons about the processing of personal data and the free movement of such data (GDPR).

We continually strive to improve our privacy practices to meet the highest security standards.

Below are selected features and information about the Manago AI Platform.

consent management

From the platform level, you can manage the consent you have received from data subjects to process their data. The platform records the content of the consent and the date on which you obtained it, so that you can demonstrate compliance with your actions. The platform has a history of consent obtained, so you can get an overview of the changes made to the consent's content.

If a data subject withdraws consent, you can quickly and easily change the opt-in/opt-out status on the contact's card.

privacy by design & by default

The platform is developed according to privacy by design and privacy by default principles, so data processing has been tailored to the needs of the Manago AI platform.

This means, among other things, that the platform processes only the scope of personal data that is necessary to achieve the purpose of the processing, data retention periods have been established, and solutions to exercise the rights of data subjects have been implemented.

correcting and updating data

The platform allows you to edit the processed data. This means you can change basic data such as email address or phone number in your contact card anytime. If necessary, you can easily update your customers' data, for example, if they change their name or place of residence. This feature is required to execute the right to rectify personal data.

data export/import

The Manago AI platform allows you to upload your existing database, so you won't have a problem switching from the platform you used. You can also integrate the Manago AI platform with other solutions and applications, a list of which can be found here.

From the platform, you can also access your data (the entire database and individual contacts) and download it in a structured, commonly used machine-readable format for personal data, which is necessary to exercise certain rights of data subjects.

profiling and monitoring management

The Manago AI platform allows the collection of personal data of website users. Personal data collected in this way may then be subject to profiling - data obtained through profiling may then be used to conduct personalized marketing activities.

Whether profiling that takes place within the Manago AI Platform is profiling within the meaning of Article 22 GDPR depends solely on the Platform user's settings. Marketing campaigns can be set up to make decisions that are fully automated. However, the level of profiling automation depends only on the settings entered by the User (Data Controller). However, by default, fully automated decisions are not made that may have consequences for data subjects.

data center on the EU territory

The data centers where your personal data is located are located in Poland, within the European Economic Area (EEA), thus the requirements of the GDPR for data localization are met.

As a rule, we do not use third-party providers when providing services and we do not transfer the entrusted data outside the EEA, unless it is directly related to your business (e.g. when your headquarters is located outside the EEA).

Your personal data is safe in a data center that has the following ISO certifications:

ISO/IEC 27018:2019;
ISO/IEC 27017:2015;
ISO/IEC 9001:2015;
ISO/IEC 27001:2013.

data security

We have conducted a risk analysis and based on this we have selected adequate safeguards to protect your personal information. We have a specialized IT security team that takes care of the security of the Manago AI platform and the personal data it contains. Additional information on security is available here.

Q&A

Who is the data controller in the Platform?

The controller of the data displayed in a user's account is the account holder. Thus, in any case, it is the customer who has entered into a license agreement for the use of the Platform.
What data does Manago AI process?

The default scope of data processed in the Platform is: name, email address, phone number, Contact ID, IP number, online behavioral data of data subjects. The above scope of personal data applies to the following categories of persons: users of the controller's websites who are customers or potential customers of the controller.
It is also possible to process a different scope of personal data - in this case, the intention to process a wider scope of data should be notified at the moment of signing a contract or during its execution to [email protected].
What security measures are in place at Manago AI to protect personal data?
The safeguards of the Manago AI Platform have been matched on the basis of the risk analysis performed. The following safeguards can be mentioned as examples:
- general security policy for personal data and IT systems,
- a business continuity procedure (BCP)
- server infrastructure that guarantees 24/7 business continuity
- procedure for reporting emergency and potential emergency situations
- Disaster Recovery Plan (DRP),
- designated Data Protection Officer and IT Security team,
- personal data processing authorizations issued,
- training on personal data protection,
- personal data confidentiality statements,
- restricting access to the personal data processing area (physical processing sites) through, in particular, the use of access cards and access codes, locked cabinets and rooms, video monitoring (in terms of the Data Center and monitoring used by the administrator of the office where Benhauer is headquartered), an alarm system (in terms of the Data Center), the use of a security company, and restricting access to IT systems where personal data is processed and networks (use of login and passwords,
- separation of networks for third parties,
- use of automatic screen blanking and locking,
- procedure for verifying service providers for compliance with the provisions of the GDPR and the use of adequate security measures,
- use of cryptographic data protection measures,
- strong password policy,
- internal network protected by firewall software,
- antivirus software,
- logical and physical separation of data.
Can data be processed in Manago AI without the user's consent?

Not in every case personal data is processed on the basis of the user's consent. Personal data may be processed on other legal basis, such as the performance of a contract concluded with the data subject or the legitimate interest of the controller. In such cases, obtaining user consent is not required.
In accordance with the provisions of the GDPR, the purposes and legal basis for processing personal data are determined by the controller of such data.
How to manage data in accordance with the GDPR in Manago AI?

The provisions of the GDPR apply to personal data contained in the Manago AI Platform. This means that this data should be given the same protection as data that is not processed in the Platform. There are no additional obligations on the controller to manage personal data, however It is the responsibility of the data controller to ensure that processing complies with the GDPR regulations.
Is it possible to collect sensitive data in Manago AI?

Yes, the Manago AI Platform provides for the possibility of processing sensitive data, such as health information. However, the intention to collect sensitive data must be reported at the moment of signing the contract or during its execution to [email protected].
Can we use Manago AI's contact database without consents?

The consent of the data subject is one of several legal bases for processing personal data. Data can also be processed on the basis of a concluded contract or on the basis of a legitimate interest of the controller. Thus, it is possible to use contact databases without consents, e.g. when the database contains the data of customers of an online store - the data of such persons can be used to conduct abandoned shopping cart campaigns.
Is my personal data separated from the data of other customers?

Yes, the personal data of individual controllers are separated from each other logically or logically and physically (if you use a private server service).
When using Manago AI, should I make changes to the terms of service?

Using the Platform, as a rule, does not require making changes to the terms of service. However, due to the fact that the Platform obtains data about users through cookies installed on their devices, it is necessary to obtain consent for the use of these files and include relevant information in the so-called cookie banner, which is displayed on the customer's page when the page is first displayed. The content of the banner and the method of obtaining consent is an individual matter for the customer, and may depend in particular on the business profile, the regulatory environment under which the customer is subject, and may depend on the tools used by the customer (e.g., the cookie consent manager).
Regardless of the above, as a platform provider we are the recipient of the client's website user data, so this fact should be indicated in the information clause.
Did Manago AI appoint a data protection officer?

Yes, we have appointed a data protection officer. You can contact him by email ([email protected]).
Is it necessary to conclude a data processing agreement (DPA) in order to use Manago AI?

Yes, concluding a data processing agreement (DPA) is mandatory. The agreement is concluded by accepting the Main Services Agreement (MSA). The agreement is attached to the MSA and is available here.
What happens to the data stored in Manago AI after the contract is terminated?

According to the PDPA, data controllers may import and secure personal data processed in the Manago AI Platform within 7 days of termination of the agreement. Within 14 days of termination of the contract, the data processed on the Platform is permanently and completely deleted.
What scope of data is processed in the Manago AI platform?

In order to use the platform, the following personal data are entrusted: name and surname, e-mail address, telephone number, Contact ID, IP number, online behavioural data of data subjects. If there is a need, due to the profile of your business, to entrust a wider range of data, you can notify us of this fact when you sign the contract.

Explore Manago AI

Customer Support

Product Updates

Manago Family