Legal Center

Topsort Legal

Our policies, terms, and data practices — written clearly for customers, partners, and the people we work with.

Policy OwnerFrancisco Larrain
Effective DateNovember 1, 2021
Last UpdatedMay 19, 2026
Questions?dpo@topsort.com

Purpose

To ensure that personal information is collected, protected, used, disclosed and retained in accordance with applicable privacy laws and regulations, and to provide transparency to individuals about how Topsort handles their personal information in connection with our advertising technology services for marketplaces.

Scope

This Privacy Policy applies to all personal information processed by Topsort Inc. (doing business as Topsort) ("Topsort", "we", "us") in connection with our advertising technology platform for marketplaces, websites, applications, and business operations.

Important Note for Marketplace Customers

As our services are provided to marketplaces who act as data controllers for their end users, our marketplace customers are responsible for obtaining appropriate consents and providing privacy notices to their users. This Privacy Policy primarily covers our direct relationships and does not replace the privacy obligations of our marketplace customers toward their end users.

Policy

Overview

At Topsort, we take the protection of personal information seriously. Personal information means information that identifies you as an individual or from which you can be reasonably identified.

This Privacy Policy applies to Topsort Inc. and provides information about the personal information we collect and handle about our customers, platform users, website visitors, employees, and business partners.

Topsort has a longstanding commitment to privacy and data security in our advertising technology services. We use pseudonymised information to serve interest-based advertisements while protecting individual privacy and complying with applicable privacy laws.

Topsort may update this privacy policy from time to time, with the most up-to-date policy always available at our website.

Why do we collect and handle your personal information?

We collect, hold, use and disclose your personal information so that we can provide our advertising technology services, improve and personalize our platform and communications, and operate our business effectively. This includes, but is not limited to:

Service Provision:

  • Managing your account and providing access to our SaaS platform
  • Processing transactions and managing billing in accordance with our SaaS Master Service Agreement
  • Delivering advertising campaigns using pseudonymised information
  • Providing platform analytics and performance reporting
  • Offering customer support and technical assistance
  • Responding to inquiries and feedback

Business Operations:

  • Conducting risk assessments and security monitoring in accordance with our Information Security Management System
  • Preventing fraud and ensuring platform security
  • Complying with legal obligations under GDPR, ePrivacy Directive, Australian Privacy Act, Brazilian LGPD, and other applicable regulations
  • Managing relationships with vendors and business partners per our Third-Party Management Policy
  • Conducting internal audits and quality assurance

Communications and Marketing:

  • Communicating about our services and platform updates
  • Providing marketing materials and promotional information (with appropriate consent)
  • Conducting surveys and research to improve our services
  • Managing event participation and business development

Legal and Compliance:

  • Meeting regulatory requirements and responding to legal process
  • Protecting our rights and interests
  • Supporting business continuity and disaster recovery
  • Complying with export/import regulations applicable to our software

Where you provide us with personal information about someone else, you must have their consent to provide their personal information to us and advise them of this Privacy Policy.

Types of personal information collected

The types of personal information we collect are classified according to our Data Management Policy into Confidential, Restricted, and Public categories:

Confidential Data (Highest Sensitivity):

  • Customer Data and Personally Identifiable Information (PII)
  • Company financial and banking data
  • Salary, compensation and payroll information
  • Strategic plans and business information
  • Authentication credentials and access keys
  • Technical vulnerability reports and incident data
  • Source code and proprietary algorithms

Customer and Platform Data:

  • Identity and contact details: name, business name, email address, phone number, business address
  • Account information: login credentials, user preferences, platform settings
  • Financial information: billing details, payment processing data, transaction history
  • Platform usage data: interactions, feature usage, campaign performance metrics (using pseudonymised identifiers where possible)

Technical and Analytics Data:

  • Technical information: IP addresses, browser information, device identifiers (using opaque identifiers where possible)
  • Log data: access logs, error logs, security event logs
  • Location information: general geographic location for service delivery
  • Aggregated and anonymized data for service improvement and statistical analysis

Employee and Business Data:

  • HR information: employment records, performance evaluations, training records
  • Professional information: job titles, company information, industry sector
  • Access credentials: system permissions, security clearances
  • Background check information as required by our Human Resource Security Policy

Communications and Marketing Data:

  • Support interactions: customer service tickets, email communications, chat logs
  • Marketing preferences: communication preferences, engagement metrics
  • Survey responses and research participation data

How do we collect personal information

We collect your personal information when you interact or transact with us. This includes, but is not limited to, when you:

  • Register for and use our advertising technology platform
  • Create an account or subscribe to our SaaS services
  • Contact us for customer support or sales inquiries
  • Participate in surveys, research, or marketing activities
  • Visit our websites or use our applications
  • Attend events or engage with us on social media
  • Enter into contracts or business relationships with us
  • Apply for employment with Topsort

We may also collect personal information from third parties including:

Business and Public Sources: Public sources and business directories; professional networking platforms; industry events and trade publications; referral partners and business associates.

Service Providers: Cloud infrastructure providers (AWS and other platforms); customer support platforms; business intelligence and analytics platforms; security monitoring service providers; payment processing providers.

Legal and Regulatory Sources: Regulatory bodies and government agencies as required by law; credit reporting agencies for financial services; background check providers for employment screening.

How do we protect the personal information we hold

We hold personal information electronically, at our facilities and with trusted service providers. We implement comprehensive administrative, technical, and organizational security measures in accordance with our Information Security Management System (ISO 27001), including:

Technical Safeguards:

  • Encryption of data in transit and at rest for all Confidential data
  • Multi-factor authentication and role-based access controls
  • Network firewalls and intrusion detection systems
  • Regular security assessments and vulnerability testing
  • Secure development practices and code review
  • Pseudonymization and anonymization techniques for advertising services

Administrative Safeguards:

  • Information security policies and procedures
  • Employee security training and background checks
  • Incident response and breach notification procedures
  • Regular security audits and compliance reviews
  • Data classification and handling requirements per our Data Management Policy

Organizational Safeguards:

  • Need-to-know access principles and documented approval processes
  • Vendor security assessments per our Third-Party Management Policy
  • Business continuity and disaster recovery planning
  • Mobile device security requirements including encryption and screen lock after 15 minutes
  • Prohibition of storing Confidential data on personal devices or removable media

Device and Data Security:

  • Mobile devices with Confidential data must be encrypted and password protected
  • Backups are encrypted for all Confidential information
  • Secure disposal procedures including data wiping or physical destruction
  • Certificate retention for professional destruction services

Sharing of personal information

We may share personal information within the Topsort organization and with trusted third parties to provide our services and conduct business operations, subject to our data classification requirements:

Technology and Infrastructure:

  • Cloud hosting and data processing providers
  • Application development and technical support services
  • Security monitoring and threat detection services
  • Backup and disaster recovery service providers

Business Operations:

  • Customer support and communication platforms
  • Payment processing and financial services
  • Marketing and business development platforms
  • Professional services (legal, accounting, consulting)

Regulatory and Legal:

  • With your representatives and authorized parties
  • With regulatory authorities and law enforcement as required by law
  • In connection with business transfers or corporate transactions
  • To protect our rights, property, or safety, or that of others

We use systems and service providers located in various countries, and we ensure appropriate safeguards are in place for international data transfers.

Data Sharing Restrictions
  • Transfer of Confidential data requires explicit written permission from management or data owner
  • All sharing must comply with legal contracts or arrangements
  • Third-party vendors must meet our security requirements for data disposal and processing
  • Restricted data sharing requires management approval and need-to-know basis

International Data Transfers

We may transfer personal information internationally for processing by our service providers, cloud infrastructure, and business partners. For transfers subject to GDPR, Australian Privacy Act, and Brazilian LGPD requirements, we use Standard Contractual Clauses (SCCs) and adequacy decisions where applicable, and we ensure overseas recipients provide substantially similar data protections.

Transfer Safeguards:

  • We implement additional safeguards including encryption, access controls, and contractual protections
  • Cross-border data transfer protections comply with applicable international requirements
Brazilian LGPD

For transfers involving Brazilian personal data, we ensure compliance with LGPD international transfer provisions through contractual clauses or adequacy decisions recognized by ANPD. Cross-border processing is limited to countries or organizations providing adequate protection levels.

Data Retention

Retention Principles: We retain personal information only as long as necessary for the purposes for which it was collected, to meet legal and regulatory requirements, and for legitimate business needs.

Specific Retention Periods: As documented in our Data Management Policy and Data Retention Matrix:

  • Customer platform data: Customer accounts and data deleted within 30 business days of contract termination
  • Support communications: Retained for service improvement purposes
  • Employee records: As required by employment law and business needs
  • Security and audit logs: Varying periods based on type and regulatory requirements
  • Financial records: As required by applicable accounting standards and tax laws

Legal Hold Exceptions: Data subject to legal proceedings is retained as required by legal counsel and reviewed annually for continuing requirements and scope.

Secure Disposal: Data classified as Restricted or Confidential is securely deleted, and hard drives/devices are securely wiped or physically destroyed before disposal.

Your Privacy Rights

🇪🇺
GDPR
EU & EEA Residents
Access: Request copies of your personal information
Rectification: Correct inaccurate or incomplete information
Erasure: Request deletion of your personal information
Restriction: Limit processing of your information
Portability: Receive your data in a portable format
Objection: Object to processing based on legitimate interests
Automated Decision-Making: Object to solely automated processing
🇧🇷
LGPD
Brazilian Residents
Confirmation & Access: Confirm processing and access your data
Correction: Correct incomplete, inaccurate, or outdated information
Anonymization/Deletion: Request anonymization, blocking, or deletion
Portability: Request transfer of your data to another provider
Information about Sharing: Learn how your data has been shared
Consent Withdrawal: Withdraw consent for consent-based processing
Review of Automated Decisions: Request review of automated processing
🇺🇸
CCPA / CPRA
California Residents
Know: Disclose categories and specific pieces of personal information collected
Erasure: Delete personal information we have collected from you
Correction: Correct inaccurate personal information we maintain
Opt Out: Opt out of cross-context behavioral advertising
Limit Use: Limit use of sensitive personal information
Non-Discrimination: We will not discriminate for exercising your rights
🇦🇺
Australian Privacy Act
Australian Residents
Request access to information held
Request correction of inaccurate data
Lodge complaints with us or the OAIC

Rights Under Other Jurisdictions: We comply with applicable privacy rights under other relevant privacy laws in jurisdictions where we operate.

Exercising Your Rights

To exercise your privacy rights:

  • Contact us using the contact information in the "Contact Information and Complaints" section
  • Provide sufficient information to verify your identity
  • Specify the right you wish to exercise and relevant details
  • We will respond within applicable timeframes (typically 30 days)

We may be unable to fulfill certain requests where they conflict with legal retention requirements or legitimate business interests.

Marketing Communications, Digital Technologies, and Cookie Consent

Marketing Practices: We may send marketing communications about our platform, services, industry insights, and business opportunities. You can opt out of marketing communications through:

  • Unsubscribe links in emails
  • Contacting us directly using the contact information in the "Contact Information and Complaints" section
  • Managing your account preferences in our platform

Digital Technologies and Cookie Consent: We use cookies and similar technologies across our website (www.topsort.com) and our application platform (app.topsort.com). On our public website, we use cookies for necessary functions (such as privacy preference management and form submissions), analytics to understand how visitors engage with the site, advertising to personalize content and measure ad performance, and functionality features to enhance your experience. For analytics, advertising, and functionality cookies, you may manage your preferences via the cookie consent banner on our public website.

On our application platform, cookies are used to manage authenticated user sessions, maintain your workspace settings, and collect product analytics. Necessary cookies are always active.

Automated Decision-Making and Pseudonymisation

We may use automated systems for fraud detection and security monitoring, advertising optimization using pseudonymised information, platform performance improvement, customer support routing, and business analytics on anonymized datasets. Our advertising services use pseudonymised information and aggregation methods that protect individual privacy. Statistical analysis is performed on anonymized datasets.

When automated decision-making significantly affects you, we provide: information about the logic involved; the right to request human review; the ability to challenge decisions and request explanations; and appropriate safeguards and oversight measures.

Children's Privacy

Our advertising technology services are not directed to children under 16 years of age (or under 13 in Brazil). We do not knowingly collect personal information from children without appropriate parental consent. For Brazilian children's data, our customer must obtain "specific and highlighted consent" from parents or legal guardians before processing personal information of individuals under 18 years of age. If you believe we have collected information about a child, please contact us immediately using the contact information in the "Contact Information and Complaints" section.

Marketplace Customer Responsibilities: Our marketplace customers are responsible for ensuring they have appropriate consents and age verification measures for their end users, including compliance with children's privacy requirements in their respective jurisdictions.

Third-Party Services and Links

Our platform may integrate with or link to third-party services. We are not responsible for the privacy practices of these external services. We encourage you to review their privacy policies. When working with third-party service providers, we ensure they meet our security requirements for data processing and disposal in accordance with our Third-Party Management Policy.

Data Controller vs. Processor Activities

When We Act as Data Controller:

  • Our own customer and business data
  • Employee information and HR data
  • Marketing and business development activities
  • Website visitor information
  • Internal business operations and analytics

When We Act as Data Processor:

  • Customer advertising campaign data processed according to customer instructions
  • Platform user behavior data processed on behalf of customers using pseudonymised information
  • Analytics and reporting data generated for customers
  • Technical support data processed under customer direction
Marketplace Customer Responsibilities as Data Controllers

When we act as a processor for marketplace customers, they are responsible for:

  • Providing clear and lawful processing instructions for their users' data
  • Ensuring legal basis for processing exists under applicable privacy laws
  • Obtaining appropriate consents from their end users for advertising and analytics processing
  • Handling individual rights requests from their users (access, deletion, correction, etc.)
  • Maintaining appropriate data processing agreements with us
  • Providing privacy notices to their end users that adequately describe our processing activities
  • Ensuring compliance with children's privacy requirements for their platforms
  • Managing cross-border data transfer requirements for their user base

Breach Notification

In the event of a personal data breach that poses a risk to individuals, we will assess the risk, take immediate containment measures, notify supervisory authorities within 72 hours where required by law, and inform affected individuals without undue delay if high risk exists. For customer data processed as a processor, we will notify customers promptly to assist with their breach response obligations.

Brazilian LGPD: We will notify ANPD within 3 working days of becoming aware of any breach affecting Brazilian personal data, inform affected Brazilian individuals in accordance with ANPD guidelines when the breach poses significant risks, and document the breach and response measures taken.

Contact Information and Complaints

For questions about this Privacy Policy or to exercise your privacy rights:

Data Protection Officer
2459 Greer Road, Palo Alto, California 94303
+1 (650) 530-0012
Supervisory Authorities
🇦🇺 Australia — OAIC · www.oaic.gov.au · 1300 363 992
🇪🇺 European Union — Your local data protection authority
🇺🇸 United States — Federal Trade Commission or relevant state authorities
🇧🇷 Brazil — ANPD · www.gov.br/anpd

Complaint Process

If you have concerns about our handling of your personal information:

  • Contact us using the contact information above
  • We will acknowledge your complaint and investigate promptly
  • We will respond within 30 days with our findings and any corrective actions
  • If you are not satisfied, you may contact the relevant supervisory authority

Data Protection Officer

In accordance with applicable privacy laws including GDPR and Brazilian LGPD, we have appointed a Data Protection Officer (DPO) who serves as:

  • Primary contact for privacy-related inquiries and rights requests
  • Monitor for compliance with data protection laws and regulations
  • Point of contact for supervisory authorities on data protection matters
DPO Contact Information

Email: dpo@topsort.com
Address: 2459 Greer Road, Palo Alto, California 94303

Our DPO is available to assist with privacy questions, rights requests, and compliance matters for all jurisdictions where we operate.

Policy Updates

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or business operations. Material changes will be communicated through:

  • Email notification to registered users
  • Prominent notice on our website
  • Direct communication to affected customers
  • Updated effective date and last updated information

Continued use of our services after policy changes constitutes acceptance of the updated terms, unless stronger consent requirements apply under applicable law.

Policy Compliance

Topsort will measure and verify compliance with this policy through various methods, including but not limited to business tool reports, internal and external audits, and regular policy reviews in accordance with our Information Security Management System.

Exceptions

Requests for an exception to this policy must be submitted to the Chief Technology Officer or the Chief Executive Officer for approval.

Violations & Enforcement

Any known violations of this policy should be reported to legal@topsort.com or to the Chief Executive Officer. Violations of this policy can result in immediate withdrawal or suspension of system and network privileges and/or disciplinary action in accordance with company procedures up to and including termination of employment.

Fair Use Policy

This Acceptable Use Policy ("Policy") sets forth required actions, as well as prohibited activities and content, that apply to your use of products or services supplied by Topsort Inc. ("we", "us"), including its affiliates and third-party suppliers (collectively, "software and services").

If you violate the Policy or authorize or help others to do so, we may immediately suspend or terminate your use of the software and services. We reserve the right to remove any content or restrict or terminate the use of the software and services without prior notice for activities or content that, in our reasonable judgment, violate this policy or any agreement that grants you the right to use the services.

We may change this Policy from time to time by posting the updated policy on our website (https://www.topsort.com and all related sites operated by or for us) and informing our customers in email updates. You are deemed to accept a change to this Policy upon your continued use of the software and services following any such change. If you do not accept this Policy, you may not access or use the software and services.

Prohibited Activities

You may not use the software and services or permit others to use the software and services to:

  • Violate any applicable law or regulation, including, without limitation, laws governing antitrust, encryption, export/import control, intellectual property, obscenity, privacy, securities, gambling, and telecommunications;
  • Post, send, receive, use, encourage, promote, facilitate or instruct others to use defamatory, harassing, libelous, obscene, abusive, deceptive, false, misleading, fraudulent, pornographic or threatening materials, or private information without the consent of the individual(s) involved;
  • Post, send or receive any content, including, without limitation, text, graphics, images, computer programs, links and "meta tags," that violates any copyright, patent, trademark, trade secret, or other intellectual property right of a third party;
  • Obtain or attempt to obtain unauthorized access to any server, system, network or account;
  • Interfere or attempt to interfere with the provision of software and services to any user, host, or network by use of any program, script or otherwise;
  • Interfere or attempt to interfere with security-related features of the software and services, or features that limit or restrict (a) use of the software and services or (b) use or copying of any content accessible through use of the software and services;
  • Avoid any use limitations placed on the software and services, such as access and storage restrictions;
  • Monitor data or traffic on a system without permission;
  • Send unsolicited bulk and/or commercial messages over the Internet (known as "spamming");
  • Send, receive, or use malware, spyware, adware, key loggers, viruses, worms, harmful code and/or Trojan horses, or Internet Relay Chat "bots";
  • Engage in "hacking", "cracking", mail bombing, port scanning, denial of service, or other malicious or destructive activities, whether lawful or unlawful, that Topsort determines to be harmful to its Subscribers, operations, reputation, goodwill, or customer relations;
  • Resell the software and services, in whole or in part, to any third party without our express prior written consent;
  • Violate the terms of any applicable software license or service agreements or the Terms of Use posted on this website;
  • Use automation software to interact with our software and services without our express prior written permission.
Enforcement

When we become aware of harmful activities, we may take action to stop the harmful activity, which may include, but is not limited to, removing information, shutting down services in whole or in part, blocking offending transmissions, and denying access to the Internet.

SaaS Master Service Agreement

These SaaS Terms of Service ("Agreement") are a legal agreement between the entity subscribing to the Service (as defined below) ("Customer") and Topsort Inc. ("Company") and govern the use of the Services. Unless otherwise set out in the Order (as defined below), this Agreement commences as of the date that the Services are first subscribed to by Customer (the "Effective Date").

Customer's use of the Services is also subject to the Company's policies and procedures set out on https://www.topsort.com/legals or otherwise made available to Customer through the Services (the "Policies").

By accessing, accepting or using the Services, Customer agrees to be legally bound by this Agreement and the Policies. If Customer does not agree to the terms of this Agreement and the Policies, then Customer may not access or use the Services.

If Customer is using the Services on behalf of a company or other entity then "Customer" includes Customer and that entity and Customer represents and warrants that (a) they are an authorized representative of the entity with the authority to bind the entity to this Agreement and (b) Customer agrees to this Agreement on the entity's behalf.

Data Management Policy

Purpose

To ensure that information is classified, protected, retained and securely disposed of in accordance with its importance to the organization.

Scope

All Topsort, Inc data, information and information systems.

Policy

Topsort, Inc classifies data and information systems in accordance with legal requirements, sensitivity, and business criticality in order to ensure that information is given the appropriate level of protection. Data owners are responsible for identifying any additional requirements for specific data or exceptions to standard handling requirements. Information systems and applications shall be classified according to the highest classification of data that they store or process.

Data Classification

To help Topsort, Inc and its employees easily understand requirements associated with different kinds of information, the company has created three classes of data.

Confidential

Highly sensitive data requiring the highest levels of protection; access is restricted to specific employees or departments, and these records can only be passed to others with approval from the data owner, or a company executive. Examples include:

  • Customer Data
  • Personally identifiable information (PII)
  • Company financial and banking data
  • Salary, compensation and payroll information
  • Strategic plans
  • Incident reports
  • Risk assessment reports
  • Technical vulnerability reports
  • Authentication credentials
  • Secrets and private keys
  • Source code
  • Litigation data
Restricted

Topsort, Inc proprietary information requiring thorough protection; access is restricted to employees with a "need-to-know" based on business requirements. This data can only be distributed outside the company with approval. This is the default for all company information unless stated otherwise. Examples include:

  • Internal policies
  • Legal documents
  • Meeting minutes and internal presentations
  • Contracts; internal reports
  • Slack messages
  • Email
Public

Documents intended for public consumption which can be freely distributed outside Topsort, Inc. Examples include:

  • Marketing materials
  • Product descriptions
  • Release notes
  • External facing policies
Labeling

Confidential data should be labeled "confidential" whenever paper copies are produced for distribution.

Confidential Data Handling

Confidential data is subject to the following protection and handling requirements:

  • Access for non-pre-approved roles requires documented approval from the data owner
  • Access is restricted to specific employees, roles and/or departments
  • Confidential systems shall not allow unauthenticated or anonymous access
  • Confidential Customer Data shall not be used or stored in non-production systems/environments
  • Confidential data shall be encrypted in transit over public networks
  • Mobile device hard drives containing confidential data, including laptops, shall be encrypted
  • Mobile devices storing or accessing confidential data shall be protected by a log-on password or passcode and shall be configured to lock the screen after 5 minutes of non-use
  • Backups shall be encrypted
  • Confidential data shall not be stored on personal phones or devices or removable media including USB drives, CDs, or DVDs
  • Paper records shall be labeled "confidential" and securely stored and disposed
  • Hard drives and mobile devices used to store confidential information must be securely wiped prior to disposal or physically destroyed
  • Transfer of confidential data to people or entities outside the company shall only be done in accordance with a legal contract or arrangement, and the explicit written permission of management or the data owner
Restricted Data Handling

Restricted data is subject to the following protection and handling requirements:

  • Access is restricted to users with a need-to-know based on business requirements
  • Restricted systems shall not allow unauthenticated or anonymous access
  • Transfer of restricted data to people or entities outside the company or authorized users shall require management approval and shall only be done in accordance with a legal contract or arrangement, or the permission of the data owner
  • Paper records shall be securely stored and disposed
  • Hard drives and mobile devices used to store restricted information must be securely wiped prior to disposal or physically destroyed
  • Removable devices are not permitted for data storage
Public Data Handling

No special protection or handling controls are required for public data. Public data may be freely distributed.

Data Retention

Topsort, Inc shall retain data as long as the company has a need for its use, or to meet regulatory or contractual requirements. Once data is no longer needed, it shall be securely disposed of or archived. Data owners, in consultation with legal counsel, may determine retention periods for their data. Retention periods shall be documented in the Data Retention Matrix in Appendix B to this policy.

Data & Device Disposal

Data classified as restricted or confidential shall be securely deleted when no longer needed. Topsort, Inc shall assess the data and disposal practices of third-party vendors in accordance with the Third-Party Management Policy. Only third-parties who meet Topsort, Inc requirements for secure data disposal shall be used for store and process restricted or confidential data. Topsort, Inc shall ensure that all restricted and confidential data is securely deleted from company devices prior to, or at the time of disposal.

Annual Data Review

Management shall review data retention requirements during the annual review of this policy. Data shall be disposed of in accordance with this policy.

Legal Requirements

Under certain circumstances, Topsort, Inc may become subject to legal proceedings requiring retention of data associated with legal holds, lawsuits, or other matters as stipulated by Topsort, Inc legal counsel. Such records and information are exempt from any other requirements specified within this Data Management Policy and are to be retained in accordance with requirements identified by the Legal department. All such holds and special retention requirements are subject to annual review with Topsort, Inc's legal counsel to evaluate continuing requirements and scope.

Policy Compliance

Topsort, Inc will measure and verify compliance to this policy through various methods, including but not limited to, business tool reports, and both internal and external audits.

Exceptions

Requests for an exception to this policy must be submitted to the Chief Executive Officer for approval.

Violations & Enforcement

Any known violations of this policy should be reported to the Chief Executive Officer. Violations of this policy can result in immediate withdrawal or suspension of system and network privileges and/or disciplinary action in accordance with company procedures up to and including termination of employment.


Appendix A
Internal Retention and Disposal Procedure

Topsort, Inc's Data Science team is responsible for setting and enforcing the data retention and disposal procedures for Topsort, Inc managed accounts and devices.

Customer Accounts

  • Customer accounts and data shall be deleted within ninety (90) days of contract termination through manual data deletion processes.

Devices

  • Employee devices will be collected promptly upon an employee's termination. Remote employees will be sent a shipping label and the return of their device shall be monitored.
  • Collected devices will be cleared to be re-provisioned — or removed from stock, Topsort, Inc will securely erase the device.
  • Device images may be retained at the discretion of management for business purposes.

Destroying Devices or Electronic Media

In cases where a device is damaged in a way that Topsort, Inc cannot access the Recovery Partition to erase the drive, Topsort, Inc may optionally decide to use an E-Waste service that includes data destruction with a certificate. Topsort, Inc will keep certificates of destructions on record for one year. Physical destruction can be optional if it is verified that the device is encrypted with Full Disk Encryption, which would negate the risk of data recovery. Management will review this procedure at least annually.


Appendix B
Data Retention Matrix
System or Application Data Description Retention Period
Topsort, Inc SaaS Products (AWS) Customer Data Up to 60 days after contract termination
Topsort, Inc Elasticsearch Customer instance and metadata, debugging data Up to 45 days after contract termination
Topsort, Inc Customer Support Tickets (Intercom) Support Tickets and Cases Indefinite
Topsort, Inc Customer Slack Channels Support Phone Conversations Per channel settings
Topsort, Inc Vulnerability Scan Data (Qualys) Vulnerability scan results and detection data 6 months; host (asset) data retained until removed and purged from Qualys
Topsort, Inc Customer Sales (Hubspot) Opportunity and Sales Data Indefinite

Glossary

Key definitions for terms used in this Privacy Policy. For legal advice or specific data protection questions, please consult qualified legal counsel or contact our Data Protection Officer.

A
Adequacy Decision

A formal determination by a regulatory authority (such as the European Commission or ANPD) that a third country provides an adequate level of data protection, allowing personal data to be transferred without additional safeguards.

Aggregated Data

Data combined from multiple sources and presented in summary form, typically preventing the identification of individual persons.

Anonymization

The process of removing or altering personal information so that individuals cannot be identified, either directly or indirectly.

ANPD (Autoridade Nacional de Proteção de Dados)

Brazil's National Data Protection Authority responsible for enforcing the LGPD and handling privacy complaints from Brazilian residents.

Australian Privacy Principles (APPs)

Thirteen principles under the Australian Privacy Act 1988 that govern how personal information should be collected, used, disclosed, and managed.

Automated Decision-Making

Processing of personal data using automated means (without human intervention) that produces legal effects or similarly significant effects for individuals.

B
Breach Notification

The legal requirement to notify supervisory authorities and affected individuals when a personal data breach occurs that poses risks to individual rights and freedoms.

Business Transfer

Corporate transactions such as mergers, acquisitions, or asset sales that may involve the transfer of personal information.

C
CCPA (California Consumer Privacy Act)

A California state law that provides privacy rights and consumer protection for California residents.

Confidential Data

Topsort's highest classification level for highly sensitive information requiring the strictest protection measures.

Consent

A freely given, specific, informed, and unambiguous agreement by an individual to the processing of their personal data.

Controller (Data Controller)

The entity that determines the purposes and means of processing personal data. Marketplace customers typically act as controllers for their end users.

Cross-Border Data Transfer

The transmission of personal data from one country to another, subject to specific legal safeguards and requirements.

D
Data Classification

Topsort's system for categorizing information based on sensitivity: Confidential (highest), Restricted (internal), and Public (freely distributable).

Data Minimization

The principle that personal data collection should be adequate, relevant, and limited to what is necessary for the specified purposes.

Data Processor

An entity that processes personal data on behalf of a data controller. Topsort typically acts as a processor for marketplace customers.

Data Protection Impact Assessment (DPIA)

A systematic process for evaluating the privacy risks of processing activities likely to result in high risk to individuals, required under GDPR for high-risk processing operations.

Data Protection Officer (DPO)

A designated person responsible for monitoring compliance with data protection laws and serving as a point of contact for privacy matters.

Data Retention Matrix

A structured reference document defining the retention periods and disposal requirements for different categories of Topsort data, as referenced in the Data Management Policy.

Data Subject

An individual whose personal data is being processed, including marketplace end users and Topsort's direct customers.

E
Encryption

The process of encoding data so that only authorized parties can access and read it, protecting information during storage and transmission.

ePrivacy Directive

European Union legislation governing privacy in electronic communications, including requirements for cookies and marketing communications.

F
Fair Use Policy

Topsort's Acceptable Use Policy that specifies required actions and prohibited activities for users of Topsort's software and services.

G
GDPR (General Data Protection Regulation)

European Union regulation that governs data protection and privacy for individuals within the EU and European Economic Area.

I
Information Security Management System (ISMS)

Topsort's systematic approach to managing sensitive information based on ISO 27001 standards.

International Data Transfer

The transmission of personal data to a recipient located in a country other than the country of origin, subject to applicable legal safeguards such as Standard Contractual Clauses or adequacy decisions. See also: Standard Contractual Clauses, Adequacy Decision.

ISO 27001

International standard for information security management systems that Topsort follows to protect personal and business information.

L
Legal Basis

The lawful justification for processing personal data under privacy laws (e.g., consent, contract performance, legitimate interests, legal obligation).

Legal Hold

The preservation of data beyond normal retention periods due to litigation, regulatory investigations, or other legal requirements.

Legitimate Interests

A legal basis for processing personal data where the processing is necessary for legitimate business purposes that don't override individual privacy rights.

LGPD (Lei Geral de Proteção de Dados)

Brazil's General Data Protection Law that governs the processing of personal data of individuals in Brazil, providing comprehensive privacy rights and obligations for organizations.

M – O
Marketplace Customer

A business that uses Topsort's advertising technology platform and typically acts as a data controller for their end users' personal data.

OAIC (Office of the Australian Information Commissioner)

Australia's privacy regulator responsible for enforcing the Privacy Act and handling privacy complaints.

Opaque Identifiers

Technical identifiers that cannot be easily traced back to specific individuals, used to protect privacy in advertising technology.

P – R
Personal Data / Personal Information

Information that identifies or can reasonably be used to identify an individual person, including names, contact details, and online identifiers.

Pseudonymization

The processing of personal data so that it can no longer be attributed to a specific person without additional information that is kept separately.

Rectification

The right to have inaccurate or incomplete personal data corrected without undue delay.

Restricted Data

Topsort's middle classification level for proprietary information requiring protection but allowing need-to-know access within the organization.

Retention Period

The defined length of time personal data or organizational information is kept before being deleted, anonymized, or archived, as documented in the Data Retention Matrix.

Right of Access

The right of individuals to obtain confirmation of whether their personal data is being processed and, where applicable, to receive a copy of that data.

Right of Erasure

The right of individuals to request deletion of their personal data in certain circumstances (also known as the "right to be forgotten").

Right of Portability

The right to receive personal data in a structured, commonly used, machine-readable format, and to request its transmission to another controller.

Risk Assessment

An evaluation of potential privacy and security risks associated with data processing activities, used to identify and implement appropriate safeguards.

S – V
SaaS (Software as a Service)

A cloud-based software delivery model where Topsort provides its advertising technology platform to customers via subscription over the internet.

Standard Contractual Clauses (SCCs)

Legal mechanisms approved by regulatory authorities to provide appropriate safeguards for international data transfers.

Supervisory Authority

Government bodies responsible for monitoring and enforcing compliance with data protection laws (e.g., OAIC, ANPD, EU data protection authorities).

Third-Party Management Policy

Topsort's internal policy governing security and compliance requirements for external vendors and service providers who access or process Topsort data.

Transparency

The principle that individuals should be clearly informed about how their personal data is collected, used, and shared.

User Data

Personal information belonging to end users of marketplace customers' platforms, processed by Topsort on behalf of marketplace customers acting as data controllers.

Vulnerability Assessment

Regular evaluation of security weaknesses in systems and processes that could affect the protection of personal data.