Privacy Notice - Enhanced Engagement History

The scope of this privacy notice covers the data processed within Enhanced Engagement History app for Pardot.

We are fully committed to keeping your information safe. This privacy notice explains what personal information we collect, why we collect it and how we use it. We hope our policy is clear and transparent, but, if you have any questions, please contact us using the DPO contact information below.

Contents

  1. Who are we?
  2. What does Enhanced Engagement History do?
  3. What information is collected?
  4. How is the information collected?
  5. How is the information used, and who has access to it?
  6. Our legal basis for processing the information
  7. Where is the data stored, and how long is it kept?
  8. What are my rights?

1. Who are we?
Nebula Consulting Ltd is a certified Salesforce CRM and Pardot Marketing Automation partner, based in central London. Nebula Consulting developed and owns the Enhancement Engagement History app for Pardot.

Our registered company number is 07953371 and our registered office is at 30 Dukes Place, London EC3A 7LP.

We are also listed on the ICO data processors register under Reg.No. ZA2204074. Our external Data Protection Officer is Sphere Data Protection, who can be reached by emailing dpo@nebulaconsulting.co.uk or info@spheredataprotection.com.

2. What does Enhanced Engagement History app do?
As a user with access to multiple Pardot Business Units, it can be difficult to get an accurate and consistent view of a Prospect’s Engagement History across all Pardot Business Units in Salesforce. The standard component displays Engagement History only for the Business Unit you are currently logged in to, even if the Lead/Contact record is synced with a Prospect in a different Pardot Business Unit.

Enhanced Engagement History (EEH) is a custom Lightning Component which is added to the Contact/Lead record page. It shows the Engagement History from one or more Pardot Business Units with no need to leave the record page to log in to a specific Business Unit. Activities are combined in a single view and tagged with the Business Unit they relate to. The timeline can also be filtered by Business Unit to view a targeted subset of Prospect Activities. This closely mirrors the functionality of the Salesforce-provided Engagement History component, with the addition of supporting multiple business units. Configuration components aid the creation of the required metadata to securely authenticate and call out to Pardot from Salesforce.
Additional enhancements include a pop-up viewer which displays a preview of email content for any Email Activities.

3. What information is collected?
In order to query the Engagement History, we must first know which Business Unit that Prospect is in, and what credentials we can use to access Pardot. These are configured in Custom Metadata Type Records (CMDT) which detail the following:

  • The SObject (e.g. Contact, Lead or Custom Object) the component will work on.
  • The field from the above SObject (Contact/Lead) that indicates which Business Unit a record is in. This field will be the one used in Pardot Marketing Data Sharing Rules. It is normally a Checkbox, or maybe a Picklist Value field.
  • A value for that field which indicates that a record should be in this Business Unit.
  • The Business Unit Id to use in the callout to Pardot.
  • The Named Credential to call out to Pardot.

Prospect information will invariably contain personal data, such as names, email addresses and other contact information, dependent on the Pardot fields configured by the Licence Holder.

We also use AppExchange App Analytics to understand how subscribers interact with our application and use these details to identify attrition risks, inform feature development decisions, and improve user experience.

4. How is the information collected?
The EEH component is able to call out to multiple Pardot Business Units, using the configured Named Credentials for each callout, to collect all the Engagement History related to each Prospect across all applicable Business Units and display this in the timeline on the respective record.

5. How is the information used, and who has access to it?
The EEH component processes Prospect information as outlined for the purpose of consolidating Prospect engagement across Pardot Business Units for Pardot Licence Holders. The justification for the use of a Prospect’s information, including their personal data, will be determined by the Licence Holder who owns and operates the Pardot Business Unit. Nebula do not have access to this data within the EEH component, which is secured from outside access; the only time Nebula ever have access to personal data that may be held within a Licence Holder’s Pardot Business Unit(s) is when we are asked by the Licence Holder to provide technical support, and this access is covered both by our Data Processing Agreements with each Licence Holder and within the Licence Holder’s own privacy notice. Please refer to the relevant Licence Holder who is contacting you for more details about their processing of your personal data.

6. Our legal basis for collecting the information
The Enhanced Engagement History (EEH) collects the information in order to fulfil the contract with its Licence Holder users, as part of their Salesforce/Pardot licence agreement for these systems. Nebula acts only as data processor to these Licence Holders in order to enable the EEH to carry out the activities outlined in the above section ‘2. What does Enhanced Engagement History do?’.

7. Where is the data stored, and how long is it kept?
The EEH does not store any data. The data it processes is securely stored within the Salesforce and Pardot systems owned and managed by the Licence Holders, and which the EEH interfaces with.

8. What are my rights?
As a UK based organisation we abide by the rights and freedoms of data subjects that are outlined in the Data Protection Act 2018. These rights, dependent on or limited by the context and legal basis for the processing of your personal data, are:

  • The right to be informed of any processing we carry out on your personal data;
  • The right of access to a copy of your personal data that we process;
  • The right to have incorrect or inaccurate personal data that we hold rectified;
  • The right to request erasure of the personal data we hold about you;
  • The right to ask that we restrict some or all of the processing that we carry out on your personal data;
  • The right to data portability, where applicable;
  • The right to object to our processing of your personal data;
  • The right to withdraw any consent you may previously have given for our processing of your personal data, where consent is the basis we rely upon.

If you wish to exercise any of your rights please contact our DPO by emailing them at dpo@nebulaconsulting.co.uk or info@spheredataprotection.com.

This privacy notice is regularly reviewed and updated – the current version in use was issued on 7th February 2022.