Request or delete data under the General Data Protection Regulation (GDPR) or California Consumer Privacy Act (CCPA)
- Optimizely Web Experimentation
- Optimizely Personalization
- Optimizely Performance Edge
- Optimizely Feature Experimentation
- Optimizely Full Stack (Legacy)
Disclaimer
This document is for informational purposes only and does not constitute legal advice. Readers should always seek legal advice before taking any action with respect to the matters discussed herein.
You can respond to a European Union (EU) or California data subject’s request for access, rectification, erasure, or portability of their personal data.
Important
- Data cannot be recovered after it is deleted.
- Data exports may contain information your company considers confidential, such as a project's change history. You are responsible for reviewing this information before providing it to the requestor.
- This information in this topic covers Optimizely Experimentation and Optimizely Personalization processes on behalf of its customers as part of its online SaaS services. If you want to file a request related to personal data that Optimizely controls, email [email protected].
You are responsible for reviewing this information before providing it to the requestor.
To learn more about the data Optimizely processes, review Privacy@Optimizely FAQ.
To learn more about your role as a data controller or for more details about meeting your privacy and data protection obligations for other Optimizely Experimentation products, see Compliance.
Access and deletion obligations
Under the EU's General Data Protection Regulation (GDPR), each EU citizen has a right of access to their personal data. Upon request, you (as the data controller) have an obligation, with certain exceptions, to inform the individual (often referred to as data subjects under GDPR) where their personal data is being held and for what purposes. Additionally, each EU citizen has a right to erasure (sometimes known as the right to be forgotten). Upon request, you have an obligation, with certain exceptions, to delete the personal data of a data subject.
The California Consumer Privacy Act (CCPA) provides similar access and deletion rights to California residents.
To make the process easy for customers, Optimizely offers the following options for customers who receive a request to begin the deletion or access process:
- An easy-to-use user interface for a small number of access or deletion requests.
- A REST API to automatically submit access or deletion requests to Optimizely.
Note
You can only request if you hold a collaborator role or Administrator on your company's Optimizely Experimentation or Optimizely Personalization account.
Submit a GDPR or CCPA access or deletion request
You can submit a GDPR or CCPA access or deletion request directly from the Optimizely application.
- Go to Account Settings > Access or Deletion Requests.
- Click Create New Request.
- Fill in the following information:
- Request type – You can submit two types of requests:
- Delete – Removes all data within an account associated with the identifier defined in the identifier field.
- Access – Finds all data stored in Optimizely systems associated with the identifier defined in the identifier field and exports it to an AWS S3 bucket for you to access.
- Data type – Any access or deletion request applies to one of two data types:
- User data – End-users (also known as collaborators) who are added to customer accounts. A user can be a collaboratorcollaborator on multiple accounts.
- Visitor data – Individuals who visit or use customer websites, apps, and other digital products. Optimizely stores visitor data to calculate experiment results and to tailor content.
- Identifier type – User data is identified by the email address used to create the end-user account. The form does not display the Identifier type field (see below) if you selected User data as your data type in the previous step. If you selected Visitor data, the form displays five options for personal identifier types:
- DCP ID – Any ID used to identify targeting records in Optimizely.
- Email Address – The email address of a visitor.
- Full Stack ID – The unique identifier used for Full Stack experiments.
- optimizely_end_user_id – An Optimizely-generated user cookie.
- Other – Any other identifier that was uploaded to Optimizely.
- Identifier – The identifier value you want Optimizely to use when searching. If you selected User in the previous step, the identifier is the email address for the user.
Important
If you use DCP or list attributes, submit the primary keys to identify records in DCP data sources and list attributes. Optimizely uses these keys to identify relevant records in these data sources; they cannot be searched using other identifiers. You may submit these keys using the DCP ID or Other data type.
Under Optimizely terms, email addresses and similar personally identifiable information (PII) should not be uploaded into DCP.
- Click Submit Request.
Automate GDPR or CCPA requests
You can automate the requests using the REST API. These API endpoints are documented in the Web Experimentation developer documentationWeb Experimentation developer documentation and Feature Experimentation developer documentationFeature Experimentation developer documentation.
The same considerations apply when using the API:
- Data cannot be retrieved once it is deleted.
- Data exports Optimizely provides may contain information that your company considers confidential, such as the change history for a particular project.
- DCP users must provide the DCP ID to identify the applicable record. Optimizely cannot search these records with other identifier types.
The endpoints that Optimizely offers are:
- List subject access requestsList subject access requests
GET https://api.optimizely.com/v2/subject-access-requests- Get a subject access requestGet a subject access request
GET https://api.optimizely.com/v2/subject-access-requests/{request_id}- Create a subject access requestCreate a subject access request
POST https://api.optimizely.com/v2/subject-access-requestsRetrieve data from a completed access request
Where Optimizely receives a data access request, Optimizely searches the records for the identifiers you provide and places matching records in an Amazon S3 bucket. When an access request is completed, you can call the list subject access requestslist subject access requests API described in the previous Automate GDPR or CCPA requests section. Alternatively, you can log into your account to view and download one or more existing requests.
Confirm data deletion
Where Optimizely receives a data deletion request, Optimizely searches the records for the identifiers you provide and overwrites any matching data. When the request is completed, you can get the status of your request in the UI or with the REST API.
Optimizely may retain some user data in change history logschange history logs and for other security purposes to ensure you have an audit trail of significant changes that may have been made to your account.
Rectification Requests
You may correct your own data by signing into http://app.optimizely.com and editing the data in User Settings.
Rectification is not applicable for visitor data because the nature of the requests—records of events for users’ interactions with websites and apps, such as clicking on a button—is not compatible with the rectification process.