Last updated on 16 August 2022 by William Blesch (Legal and data protection research writer at TermsFeed)
More and more people use software as a service (SaaS) products in today's world. These products offer many advantages to the end user, including convenience and ease of use.
However, there is often a trade-off between what these services can provide and their ability to protect customer data. Although Facebook isn't a SaaS company, a good example of the kind of trade-off between delivering a service and protecting user data is a huge Facebook scandal which took place in 2013.
During that shocking incident, Cambridge Analytica, a British consulting firm, improperly gained access to millions of Facebook users' personal information without their consent or knowledge.
Privacy is a fundamental human right. With the advent of the internet, people share large amounts of their personal information online, sometimes unknowingly.
For example, the European Union's General Data Protection Regulation (GDPR) went into effect in 2016. The GDPR is applicable to companies that process data of individuals in the EU, regardless of whether the company is based inside the EU.
The United States has no single federal law that governs data privacy, but several states have adopted their own rules. For example, the California Consumer Privacy Act (CCPA) applies to any company that does business in California and collects personal information about California residents.
In addition to government regulations, many industry-specific standards apply to collecting and using personal data. For instance, the Payment Card Industry Data Security Standard (PCI DSS) applies to any company that "that accepts, transmits or stores any cardholder data."
Let's take a look at some of the required, most important clauses.
An essential clause that you must include lets users know what type of personal information you collect.
For example, perhaps you collect information like:
Any or all of that data might be collected:
Note how Adobe is transparent about all the types of data it collects from Cloud users:
SaaS businesses generally collect three types of personal data:
This clause informs users about what happens after they have provided their personal data. Within it, you must describe every method you use to collect information about users, whether it's online or through automated backend procedures.
You should also explain your reasons for collecting this data. Users want to know why you're collecting it as well as how you will use it.
When explaining why you collect personal information, you should also provide information about the legal grounds you rely on to process that data, your retention schedule (how long you keep a user's personal data), and how users can request their data or have it deleted.
Salesforce discusses the methods it uses to collect data including the types of technology used in the process:
You need to explain why it's necessary for your service to process personal data. It may be to contact users, deliver the service, or improve the service offered to them.
Your users should know about the people with whom you'll be sharing personal data. For the purposes of transparency, it's good practice to include an explanation of what data you share with third parties and why.
For instance, most SaaS companies use third-party software to perform certain services. This is typically done through a website or mobile app. Google Adsense is an example of a third party that provides analytics services.
Here's all the third-parties that Square (now Block) shares user data with:
Polte, a location system SaaS, sets out eight specific ways in which it may share user data with a third party:
As you can see, the list of bases on which you may share user data should be exhaustive and detailed.
Any personal data collected from an individual should be kept safe and accessible only by authorized personnel. Whether you store that information locally or in the cloud, keep in mind that it's your responsibility to keep it secure.
With that in mind, you must be as transparent as possible about the security measures you've put in place to ensure data safety and what steps you'll take if a data breach ever occurs.
Providing users with this information is crucial when it comes to maintaining trust. Remember that many data breaches have taken place over the last few years, and those companies that had significant losses of information ended up facing severe financial and legal consequences.
Here's Datadog's statement on how it ensures the protection of personal information:
It is essential to have a data retention clause, especially for account management and subscriptions. This clause will outline users' rights regarding managing their own data and your rights to retain personal information to process it.
You should pay attention to that last sentence. You have a right to keep personal data, but according to the GDPR, it's literally "for no longer than is necessary for the purposes for which the personal data are processed."
That means you can't keep it forever. So, you need to be as upfront and forthcoming as possible when letting users know how long you actually need to keep each type of data you store.
Specifics you can mention in this clause include things like:
Here's an example from Datadog:
In its Privacy Statement, Intuit explains it retains data for legitimate business or legal purposes. It also identifies how personal data is stored, in the event it cannot be deleted or de-identified:
Users need to be aware of how long you retain their data and what happens to their data upon termination of their account.
However, if you do, you'll need to ensure you let users know that you're in compliance with the Health Insurance Portability and Accountability Act of 1996 (HIPAA).
Here's how Commonwealth Care Alliance, one of the top medical SaaS companies lets users know it is in compliance with HIPAA:
Credit and financial information is very sensitive information. As previously noted, many laws govern how companies can protect their customers from identity theft or fraud, such as the Payment Card Industry Data Security Standard (PCI DSS).
The financial data clause is where you have the opportunity to make a statement about collecting credit card data and how you ensure compliance.
When it comes to Privacy Policies for SaaS companies specifically, the main question is what type of information is stored in these cookies?
It's critical to note that there are two types of cookies: session cookies (which only last until a user leaves your site) and persistent/tracking cookies (that help identify users across multiple sessions). Session Cookies expire when the browser window closes, whereas persistent/tracking cookies remain on the device for future visits or sometimes even indefinitely.
The point here is that cookies are now a tool commonly used by SaaS businesses to track how users interact with their mobile apps and websites.
Cookies can be privacy-invasive, and due to that fact, they are also a legal risk. Because of that, many companies have a completely separate Cookies Policy, which is displayed on its own landing page.
Cloudflare does exactly that:
SailPoint, a SaaS that facilitates secure user access to business IT networks, does this very clearly in its Privacy Statement. In simple, easy-to-understand language, it explains what cookies are and how it uses them and provides a comprehensive list of their purposes:
Because SaaS businesses are bought and sold regularly, users have a right to know what happens to their personal data if a new company buys them out. You can use a business transfer clause to provide them with relevant details.
Cloudflare doesn't create a separate clause for this issue, but instead incorporates that information into its section on sharing data with third parties. This is also acceptable as long as you, in fact, are transparent about what might happen in the case of a merger, etc.:
Zoom goes further and lets users know that it doesn't allow anyone under the age of 16 to sign up for its services:
A contact information clause is used to give users a way to contact you primarily about any privacy concerns they might have.
It is good to make sure that any methods of communication you provide are simple and effective. For example, you might list a specific phone number or email address. Whatever you do, ensure that you have someone who will address user concerns ready to receive the communications.
Transparency, openness, and customer service are key here.
Here's Zoom's contact information clause:
Again, think about customer service. If a user has concerns about how their data is being used or what changes have been made to the policy, they need to be able to contact you and get an answer.
Including all of this information in one place makes it easy for users and demonstrates that you take your responsibility seriously when safeguarding people's privacy.
For example, T-Mobile's website footer clearly displays a link to its Privacy Notice:
Privacy Policies are a necessity for any SaaS company.
More specific Privacy Templates are available on our blog.
This article is not a substitute for professional legal advice. This article does not create an attorney-client relationship, nor is it a solicitation to offer legal advice.
16 August 2022