Over the past year, VWO has been preparing to meet the requirements of the GDPR, the new data protection law that came into force on May 25, 2018. GDPR specifically affects European and non-European online businesses that store and use website visitor and app data in the European Economic Area (EEA).
If you are a VWO user in the EEA or are otherwise subject to the GDPR, please review the following information to understand how VWO tracks and handles visitors' personal data and information.
Session Recording Settings
VWO has introduced different setting configurations to ensure that the personal data of your website visitors are anonymized when capturing Session Recording data. VWO servers do not store any visitor's personal information, and all data passing through our servers is encrypted or hidden to ensure visitor privacy.
As an account administrator, you can review and update your data recording preferences. To learn more about setting recording preferences, click here.
| Key Presses | All fields that include key presses (inputs in text field) are anonymized by default |
| Hide the Entire Body | You can anonymize the entire HTML body of your website during a recording.
NOTE: Only text can be anonymized, not images.
|
| Anonymize/Whitelist by Using the CSS Selector Path |
VWO anonymizes all key presses by default to avoid storing or transmitting any personal or sensitive data to VWO servers. You can anonymize an input/non-input field and whitelist a non-input field by using the selector path of the element in VWO. To learn how to find the selector path, click here. For example, if you want to anonymize a field containing visitor information in your Order page, you can blacklist the field to hide the data in the recordings |
| DOM mutation and HTML data | All DOM mutation and HTML data tracked during session recordings are encrypted and then sent to VWO servers |
| Add the nls_protected class to anonymize elements | To anonymize an element, as applicable, add the nls_protected class to the element |
| Password fields | Always anonymized, even if data is whitelisted |
Custom Dimensions
Custom dimensions are used to collect visitor data, preferences, and personal information. If you are using Custom Dimensions to manage visitor data, it is recommended that you review the updates in our VWO settings to make sure your data is safe and protected. In cases where visitor information is unavoidable, we recommend that you use salt with a minimum hashing requirement of SHA256, with a minimum of 8 characters. To learn more about using Custom Dimensions, click here.
| Filtering |
By default, VWO filters all incoming data for any custom dimensions for the personal information of the visitors, such as email addresses and credit card numbers. To override the default settings, you can define regex rules and then add them to the specific filter in VWO custom dimensions |
| Flushing data | You can delete all data collected for any custom dimension |
Privacy Settings
VWO introduces Privacy Center to help you review or modify the visitor information collected from your website visitors. For example, you can select what location information you want to track, like countries, regions, or cities. To learn more about privacy settings, click here.
| IP Address | By default, VWO replaces the last octet of IP Address with 0 (zero) before saving location information. You can customize the setting to choose if you want more numbers to be anonymized for IP addresses. You can even disable tracking any IP address information at all |
| Location | For location data, VWO tracks the Country, Region & City information of your website visitors. You can change the preference to collect only country or region information. You can even disable storing location information |
| Detecting personal information in Query Parameters | By default, VWO filters any personal or sensitive information in query parameters and anonymizes them. You can customize the filter conditions for query parameters, |
| Adhere to Visitor’s Do Not Track Settings | All website visitors allow visitors an option to disable websites and mobile applications from tracking their visits. To honor the visitor preferences, VWO provides an option to Adhere to Do Not Track Settings of the visitor |
VWO Surveys
As a VWO administrator, you can seek your website visitors' consent before they participate in the On-page Surveys. The consent message is displayed along with a welcome message and links to our Privacy and Security Policies. To learn more about VWO on-page surveys, click here.
Handling Data Subject Rights
VWO is fully committed to upholding the data privacy, security, and rights of both our customers and their users. As a GDPR compliant organization, customer trust and data privacy remain our key focus areas. For more understanding, please refer to our Privacy, Security, and Opt-out policies.
| Right to consent |
Adhere to Do Not Track Settings VWO provides an option to account administrators to honor the visitors' browser DNT settings. To learn more about Privacy settings, click here |
| Right to access data |
Providing data to a data subject |
| Right to erasure |
Deleting Data of a Data Subject As a VWO account admin, you can delete the website and mobile app data for specific data subjects using their UUID.
NOTE: Removing a specific UUID data record is not possible for some campaigns like AB test or personalization. To completely remove UUID data from a test, you must flush the entire test data and start it again. To learn more about managing UUID data access, click here
|