Hootsuite Privacy Policy
Last Updated: July 9, 2024
Hootsuite Inc. and its affiliates (collectively, “Hootsuite”) are committed to protecting your privacy and complying with applicable data protection laws. This Privacy Policy provides information on how we manage information about you.
1. What this Privacy Policy covers
This Privacy Policy outlines how Hootsuite collects, uses, shares, and safeguards information about you when you use our Services, visit our websites, use our mobile applications, and otherwise interact with you. We also describe the choices you have about your information. If you’re independently publishing information on social media and other websites without using our Services, please refer to our Author Privacy Policy.
Collectively, we refer to the Hootsuite, Talkwalker, Sparkcentral, and Heyday platforms as our “Services”.
Hootsuite Services
Hootsuite’s social media management platform allows you to bring together all of your social media accounts for easy access and management. Through this online platform, you can manage your social media, marketing, and advertising campaigns; engage with your audience; schedule and publish messages; manage customer care communications; monitor your brand and other brands; and analyze the results of these activities. We also offer training services through Hootsuite Academy.
Hootsuite’s affiliates also provide the following services:
Talkwalker Services
Talkwalker’s social listening and consumer intelligence services are provided by Talkwalker S.à.r.l., in Luxembourg, and its affiliates. Talkwalker gathers real-time data across social channels and the web to provide its customers with comprehensive insights and data-driven solutions to optimize their social media strategies, uncover hidden trends, discover new audiences, and be crisis-ready.
Sparkcentral Services
Sparkcentral’s social customer care solutions are provided by Sparkcentral Europe NV, in Belgium and Sparkcentral, Inc., in the US. This solution allows you to unify your customer conversations in an interactive dashboard. You can resolve customer problems more quickly, and automate, prioritize and triage conversations across multiple messaging channels or social networks.
Heyday
Heyday’s social commerce solutions are provided by Heyday Technologies Inc., in Canada. Heyday uses a conversational AI platform that connects messaging apps with e-commerce platforms, enabling brands to engage their customers and sell directly in-chat — turning more conversations into conversions. Heyday integrates with branded websites and apps, e-commerce platforms, product feeds and order tracking management systems to meet customers with always-on virtual support and personalized recommendations that boost engagement and conversions.
Our Customers’ use of the Services
When providing Services to our customers we may process personal information as a processor or service provider under the terms of the agreement we have entered into with them. In this situation, our customers are responsible for the processing of this information and individuals may reach out to those customers directly for any questions or concerns about the processing of their information.
2. Information we collect and how we use it
We collect information about you when you use our Services, visit our websites, and interact with us in a business context. Information may be collected when you provide it to us directly, or automatically when you use the Services and websites. We may also collect data from other sources, including those that are publicly available or from third-party data providers.
Using our Services
Hootsuite collects information to provide you with our Services and to improve our service offerings. We collect contact, account, and preference details for account setup, personalization, and communication. Billing, Services plan, and business data help us manage our Services. We process Content, social profile, and messaging data to facilitate your use of our Services. Lastly, logs, usage data, and support details allow us to maintain security and improve our Services.
Type of Information | Purpose |
Account Information | |
Contact and profile information E.g., Name and email address, organization name, address, language preferences, time zone, image (if you choose to provide this), preferred types of communications | Creating an account and user authentication of the Services. Communicating with you about the Services, surveys, contests, and events. |
Social Network profile information E.g., Facebook username | Creating an account or user authentication of the Services if you choose to use a social login. |
Billing, plan, and business information E.g., Credit card number, organization name | Provisioning and payment of the Services. Personalizing communications. |
Content | |
Content uploaded to, downloaded from, and visible on the Services. This includes materials curated and uploaded by users to the Services, including, messages, posts, comments, images, advertising information; messages, posts, comments, prompts and outputs from AI-Powered Services; and mentions (such as, likes) from Social Network users. E.g., Instagram posts from an organization’s account, social media posts from a LinkedIn user | Providing the Services. |
Chat and conversational data from our chatbot services E.g., Chat messages involving an individual asking about the delivery date for an order | Providing the Services. |
Social media and messaging metadata E.g., Number of social media followers, number of posts | Providing the Services. Compiling and providing social media user analytics, insights and measurement reports. |
Logs, usage, and support data | |
Log data and general location E.g., IP address, browser type and settings, device information (such as make, model, and OS), date and time of login, and cookies | Managing the performance, security and compliance of the Services. |
User settings E.g., Location and language | Enabling location-based features (if you choose to share your location on your posts). Personalizing the Services. |
Usage, session, and analytics data E.g., Frequency of login and access to different areas of the Services | Helping identify issues and to better understand how the Services are used to improve our Services. |
Customer support data E.g., Questions, issues, and general feedback | Resolving issues and helping us improve our Services. |
Surveys, events, marketing and other activities
Hootsuite collects information for surveys, events, and marketing efforts. We collect registration details to manage events and webinars, while feedback and opinions help us refine our products and services. We use recordings for quality assurance purposes and help us make improvements. Our interaction with you on social media and by email helps us evaluate and improve our marketing campaigns. Usage data from our website resources also guide us in improving these materials. We also gather employment-related information for hiring purposes through our careers site.
Type of Information | Purpose |
Event and course registration information | Administrating webinars, events, training, and courses. |
Phone, video, event and webinar recordings E.g., Recordings of these sessions (if you agree) | For training, quality assurance, and product improvement purposes. Helping improve our sales, marketing and implementation processes. |
Feedback and Opinions E.g, Survey feedback, suggestions from support interactions | Understanding your needs and to improve our services. |
Social media and email interactions E.g., Private messages, email open and click rates, clicked links | Communicating with you. |
Employment-related information E.g., Contact information, employment history, LinkedIn profile | We collect information about you when you apply for a job at Hootsuite. More information can be found here. |
Browsing our websites
Hootsuite collects and utilizes user information from website browsing, including through chatbot interactions, cookies and tracking technologies, and website usage, to operate and maintain the websites, improve user experience, provide personalized marketing and advertising, enhance usability, and ensure security.
Type of Information | Purpose |
Website and Services usage data E.g., Engagement rate, referring website, browser type, session experience and replay, mouse movements, and resources accessed | Understanding usage patterns and activities to diagnose problems and make improvements to usability, features, and security. |
Cookies and other similar tracking technologies on our websites and Services E.g., Cookies, web beacons, and pixels described in our Cookie Notice | Operate and secure our websites and Services, enhance user experience by recognizing logged in users, improve performance and deliver personalized advertising of our products and Services. More information can be found in our Cookie Notice. |
Chatbot interactions E.g., Name, email address, and questions | Responding to your inquiry or request, and improving our Services |
Children’s Privacy
We do not knowingly collect personal information from children. Our Services are not intended for use by children and should only be accessed by individuals who are at least 18 years old and are using the Services for business purposes. If you believe we may have information from a child, please contact us.
3. Who we share your information with
Hootsuite restricts access to your information to authorized employees and we do not share your information with third parties except in the circumstances explained below.
Employees and Authorized Contractors
Our employees and authorized contractors may access your information as necessary to fulfill their job responsibilities. For example, a customer support representative may access your account to validate your identity and respond to your question or request; our Marketing team may need access to your contact information to ensure information is sent correctly and unsubscribe requests are properly managed; and our Security team may need to review information related to the use of our Services to investigate suspected fraudulent account activity, or other attempts to compromise the Services.
All our employees and contractors are obligated to protect the confidentiality and privacy of your information.
Service Providers, Authorized Resellers, and Partners
We will share information about you with authorized service providers to assist us with marketing and advertising, communicating with you, managing our customer database, professional services, and providing and managing the Services (including hosting data centers, securing our Services, and payment processing).
We limit the number of service providers who are permitted to process your Content for the purpose of assisting us in providing the Services. Our AI-Powered Services leverage automated methods, including artificial intelligence and machine learning, to provide certain product features (e.g., to generate Content recommendations for your social posts, provide you with insights, and automating tasks). We refer to all of these service providers which process your Content as “Subprocessors.”
Where you have purchased Third-Party Services, or a service from an authorized reseller or partner, we may share information about you with the third party, reseller, or partner, as necessary to support your use of the service you purchased.
When sharing your information with any of the above service providers, third parties, resellers and partners, we ensure they agree to obligations consistent with this Privacy Policy and any other appropriate confidentiality and security measures.
We may also participate in and run marketing events (e.g., conferences, webinars, and provide resources) with sponsors and other organizations. Where the sponsors or other organizations wish to collect your information for their marketing purposes, we may facilitate this (e.g., information may be collected on the same registration form). However, the sponsors and other organizations will be conducting marketing activities independently under their own policies. We will provide an opportunity for you to share your information with the sponsors or other organizations for such purposes, either upon registration or during the event.
Social Networks and Third-Party Services
Social Networks
Any collection, use, and management of personal information by the social networks, including Facebook, Instagram, X, and LinkedIn (collectively, the “Social Networks”), are governed by their respective privacy policies and terms. When using Social Networks, you are required to comply with their privacy policies and terms. Subject to this Privacy Policy, Hootsuite Services may use Google API Services (including YouTube API Services) to collect data from YouTube, Google My Business ("Google Reviews"), or Google Analytics. Further information may be found in the Google Privacy Policy. We recommend you carefully review their privacy policies and terms, as Hootsuite is not responsible for the Social Networks.
Third-Party Services
Our Services enable you to customize and connect your Hootsuite account to third-party services (“Third-Party Services”), including through apps you can access in the App Directory or which may be available to you through our platform. When you choose to connect a Third-Party Service to the Services, you are agreeing to provide your information to the Third-Party Service under their respective terms and privacy policies. We recommend you carefully review their privacy policies and terms, as Hootsuite is not responsible for Third-Party Services.
Customer Organizations
Where your employer or an entity has purchased Services on your behalf, we may disclose information about you such as your name and email address, and some usage information including whether a user has logged in to the Services, frequency of login, time spent using the Services, and enrolment and completion of Hootsuite Academy courses to assist your employer or the entity in managing its use of the Services.
Successor and Affiliated Entities
We may share information about you among Hootsuite-controlled affiliates and subsidiaries to provide the Services and for our general business purposes. Our affiliates and subsidiaries will protect your information in a manner that is consistent with this Privacy Policy and where applicable, in accordance with that entity’s policies.
We may also share or transfer your information if we are part of a corporate transaction such as a merger or acquisition or sale of assets. In such an event, we will inform those entities of the requirement to handle your information in accordance with this Privacy Policy.
Government Authorities and other Legal Purposes
We may need to disclose information about you where we believe that it is reasonably necessary to comply with a law or regulation, or if we are otherwise legally required to do so, such as in response to a court order or legal process, or to establish, protect, or exercise our legal rights or to defend against legal claims or demands. For governmental data access requests concerning you or your organization, we would first attempt to redirect the request to you and/or we would first attempt to notify you unless we are legally prohibited from doing so. Refer to our Government Data Request Policy for more details.
In addition, we may disclose information about you if we believe it is necessary to investigate, prevent, or take action: (a) against illegal activities, fraud, situations involving potential threats to our rights or property (or to the rights or property of those who use our Services), or to protect the personal safety of any person; or (b) regarding situations that involve the security of our Services, abuse of the Services infrastructure, or the Internet in general (such as voluminous spamming, or denial of service attacks).
Professional Advisors
We use professional advisors, including lawyers and accountants, and may be required to disclose information about you when engaging them for their services and as necessary for audits, financial and other regulatory reviews.
4. How we safeguard your information
Hootsuite maintains industry standard security safeguards to protect your information. This includes ensuring our employees receive appropriate security and privacy training and guidance so they are aware of the measures they need to implement to protect your information.
Access controls are in place to limit access to your information to those who need it to perform their jobs. For example, information about you may be provided to our customer support representatives to help you with your requests. Individuals who are authorized to handle your information must adhere to confidentiality obligations.
We encrypt data in transit and at rest, where appropriate, to ensure that your information is kept private. We undertake security and privacy reviews of our service provider to ensure that they follow our stringent requirements to safeguard your information, and we also enter into data protection agreements with our service providers. All payment information is fully encrypted and handled only by PCI certified organizations.
More detailed information on our security practices is available in our Trust Center and the Hootsuite Security Practices webpage.
5. How long we retain your information
We retain information about you only for as long as necessary to provide and manage our Services, to manage our business, and for financial and legal purposes. For example, we retain your draft and published social media posts in our product as long as you are using the Services as you may need to reference previous posts. More information on data retention for specific products can be found in the Hootsuite Help Center.
After it is no longer necessary for us to retain information about you, or otherwise upon your request, we will dispose of your information in a secure manner or anonymize the information.
Aggregated data is retained and used by Hootsuite for analysis, product improvement, and troubleshooting purposes. In some cases, social media content may continue to exist on the Social Networks even after you or we delete it from our Services, and you will need to contact the relevant Social Network directly if you would like to remove this content.
6. Your privacy rights and choices
Your privacy rights
Depending on the data protection laws that apply to you, you may have the right to:
Access and obtain a copy of your information
Request correction of inaccurate information
Request deletion of your information
Request that we transfer your information to a third party in a machine-readable format
Object to our processing of your information, withdraw your consent, or ask us to restrict the processing of your information
Opt out of certain disclosures of your information to third parties, including for targeted advertising purposes
You also have the right not to be discriminated against for exercising any of these rights. If you would like to exercise any of your rights, such as access, correction, or deletion of your information, you may follow the steps below or email our Privacy team for assistance. We will handle your request within thirty (30) days unless it is unusually extensive or complex, in which case we will advise you of the expected timeline for handling your request. We may also ask for additional information to confirm your identity.
Your privacy choices
We explain the privacy choices available to you in the Services, when we send you marketing communications and when you browse our websites.
Services information
When using our Services, you may access, update, or correct most of your Account information by logging in to your account to edit your profile or organization records. For messaging content included in Inbox 2.0 and Sparkcentral services, you can delete information related to a contact, which is an individual who you have interacted with through these services, and it will delete the contact data along with their conversation history, attachments, and contact attributes.
If you have requests that cannot be carried out through the use of the Services, such as accessing additional information or deleting information about you, please email our privacy team. Please note that we may need to retain certain information about you for as long as you maintain an account for our Services, to provide you with our Services, for record keeping purposes, for payment processing, to comply with our legal and regulatory obligations, to resolve disputes, or to enforce the applicable Terms of Service or other agreement in place between you and Hootsuite.
If you have authorized us to access your Social Network account to provide the Services, you may revoke this access at any time by following the instructions here. For example, if you have authorized us to access your information via the YouTube API services, in addition to our normal procedure for deleting stored data, you may revoke our access to your information via the Google security settings page, located here.
You can contact our Support team for other general requests about your account using your preferred method listed here.
Marketing emails, advertising and website browsing
For marketing communications, you may opt out by clicking on the unsubscribe link in the email you receive. Please note that if you are a user of our Services, unsubscribing from marketing communications will not affect product-related emails sent in connection with your use of our Services.
For marketing communications sent by Hootsuite you may also opt out by accessing our Preference Center, or by completing the unsubscribe form.
Hootsuite participates in interest-based advertising (where you may have visited our websites or another website which allows us to display advertising relating to our Services). The Network Advertising Initiative has developed a tool that may help you understand which third parties have currently enabled cookies for your browser and how to opt out of those cookies. For more information and to opt out of interest-based advertising, you can visit this page.
For more information on how to opt out of marketing cookies, review our Cookie Notice.
7. International data transfers
Our Services are managed by Hootsuite’s headquarters in Canada. As the European Commission considers Canada to be a country which provides adequate data protection, information about you may be lawfully transferred from the European Economic Area (“EEA”) to Canada. In addition, Sparkcentral’s services are managed from Belgium, and Talkwalker’s services are managed from Luxembourg. Amongst the Hootsuite corporate entities, we have incorporated appropriate data transfer mechanisms in accordance with European data protection laws.
Hootsuite uses third-party service providers, such as managed hosting providers, credit card processors, and technology partners to provide the software, networking, infrastructure and other services required to operate the Services. These third-party service providers may process or store personal data on servers outside of the EEA, UK, and Switzerland. We rely on adequacy (if sent to Canada), and the EU-US Data Privacy Framework (“DPF”), the UK extension to the EU-US DPF, the Swiss-US DPF, or standard contractual clauses (“SCCs”), if sent to the US or onward to other countries, to ensure that information about you is lawfully transferred under European data protection laws. In the case of SCCs, we have implemented supplementary measures as outlined in the section “How we safeguard your information”. The third-party service providers we use to help us deliver the Services and which process your Content are listed on this page.
By its nature, social media data can be shared with people around the world. The Social Networks and Third-Party Services that you choose to integrate with our Services may collect, store, and process your information from various locations around the world according to their own terms and privacy policies.
8. Regional Privacy Notice
GDPR and UK data protection laws
Depending on the situation and the type of data involved, Hootsuite may act as a data controller or a data processor.
Hootsuite as a data controller
Hootsuite may act as a data controller when we are:
Collecting information from you to set up and administer your Hootsuite account (for example, account information such as your name and email address);
Monitoring usage information on our websites;
Managing your contact and other related information to send marketing, sales, Services, and other communications to you;
Responding to a support or general inquiry; and
Recruiting individuals for job opportunities.
Legal bases for processing when Hootsuite is a data controller
The legal bases for processing information about you include:
Your consent (for example, when you have provided your information to sign up for an account or for a webinar; or you have provided your employment history when applying for a job). Where we rely on your consent to process personal data, you have the right to withdraw your consent at any time.
It is necessary to perform a contract (for example, we may need your information to fulfill our obligations of providing Services to you under the terms relevant to the Services you have acquired).
Legitimate interest (for example, to provide, maintain and improve the Services for you, to maintain the security of the Services, and to attract new customers to maintain demand for the Services, all of which are described in the “Information we collect and how we use it” section above).
In some cases, we may have a legal obligation to process your personal data to comply with relevant laws (for example, processing payroll and tax information to comply with employment and tax legislation); or processing is necessary to protect your vital interests or those of another person (for example, obtaining health-related information during a medical emergency).
Hootsuite as a data processor
Where you are using our Services and making decisions about the personal data that is being processed in the Services (including selecting the Social Network accounts you wish to connect to the Services, uploading and using Content, or defining your own search queries, filters and time frames for the listening services), you are acting as a data controller and Hootsuite is acting as a data processor. We rely on you to comply with applicable privacy laws when collecting, using, or disclosing information about individuals through the Services, including obtaining any necessary consents and providing any necessary notices.
There are certain obligations under the GDPR and other data protection laws that you have as a data controller, including being responsible for managing Content on the Services. As a data processor, Hootsuite will only access and process Content to provide you with the Services in accordance with your instructions (which you provide through the Services), the Terms of Service, the Social Networks’ terms, and applicable laws. As part of delivering the Services, we may process Content to further improve the Services, such as enhancing usability and developing new features.
If you are a customer of the Services where Hootsuite acts as a data processor, you may enter into a data processing addendum (“DPA”) with us to address requirements under the GDPR and UK data protection laws.
If you are using the Services as an authorized user of a Hootsuite customer (whether that customer is your employer, another organization, or an individual), that customer determines its own policies (if any) regarding storage, access, modification, deletion, sharing, and retention of personal data and Content, which may apply to your use of the Services. Please check with that customer entity about the privacy policies it has in place.
California Privacy Rights
If you are a consumer as defined by the California Consumer Privacy Act (“CCPA”) , this section applies to you and supplements our Privacy Policy.
Information about your Personal Information
The categories and specific types of personal information collected and sources from which personal information are collected are set out here.
The business and commercial purposes for collecting personal information are set out here.
The categories of third parties with whom your information is shared are set out here.
Your Rights
We have outlined certain rights in the section “Your privacy rights and choices”
Under the CCPA, you have the following rights:
The right to know about the personal information collected about you, which we have set out under “Information we collect and how we use it”
The right to have your personal information deleted
The right to correct inaccurate personal information
The right not to be discriminated against for exercising consumer rights under the CCPA
The right to opt-out of the “sale” or “sharing” of your personal information.
You may access, update, or correct most of your Account information by logging in to your account; or you may exercise your rights by emailing our Privacy team.
While we share or disclose personal information with third parties or service providers for the purpose of providing the Services, managing our relationship with you, and for personalized advertising purposes, we do not “sell” your personal information in the traditional sense. However, the definitions of “sale” and “sharing” under the CCPA may include the disclosure of your information to our advertising and marketing partners.
You may opt out of the “sale” or “sharing” of your personal information for advertising purposes by clicking the Cookie Preferences link accessible from the Cookie Notice or at the footer of one of our main website pages and making your selection. If you require additional assistance to opt out of sharing, please email our Privacy team. We do not knowingly “sell” or “share” the personal information of individuals under 16 years of age.
If you are a customer of the Services where Hootsuite acts as your service provider, you may enter into a DPA with us to address requirements under the CCPA and other US State privacy laws.
9. How to contact us
If you have any questions, concerns or feedback, please email our Privacy team and Privacy Officer/Data Protection Officer at privacy@hootsuite.com; or send a letter to:
Hootsuite Inc.
111 East 5th Avenue
Vancouver, BC
Canada V5T 4L1
Attn: Hootsuite Privacy Team
If we are unable to resolve your concerns, you also have the right to contact your local data protection authority.
10. Changes to this Privacy Policy
We may make changes to this Privacy Policy at any time to reflect updates to our Services, applicable laws, and other factors. We will include a prominent notice on this website and/or our Services if we make any material changes, but we encourage you to stay informed by reviewing this page periodically.