Request or delete records for EU General Data Protection Regulation (GDPR) or California Consumer Privacy Act (CCPA)

You can respond to a European Union (EU) or California data subject’s request for access, rectification, erasure, or portability of their personal data.

To learn more about the data Optimizely processes, review Privacy@Optimizely FAQ.

To learn more about your role as a data controller or for more details about meeting your privacy and data protection obligations for other Optimizely Experimentation products, see Compliance.

Access and deletion obligations

Under the EU's General Data Protection Regulation (GDPR), each EU citizen has a right of access to their personal data. Upon request, you (as the data controller) have an obligation, with certain exceptions, to inform the individual (often referred to as data subjects under GDPR) where their personal data is being held and for what purposes. Additionally, each EU citizen has a right to erasure (sometimes known as the right to be forgotten). Upon request, you have an obligation, with certain exceptions, to delete the personal data of a data subject.

The California Consumer Privacy Act (CCPA) provides similar access and deletion rights to California residents.

To make the process easy for customers, Optimizely offers the following options for customers who receive a request to begin the deletion or access process:

• An easy-to-use user interface for a small number of access or deletion requests.
• A REST API to automatically submit access or deletion requests to Optimizely.

Submit a GDPR or CCPA access or deletion request

You can submit a GDPR or CCPA access or deletion request directly from the Optimizely application. 

1. Go to Account Settings > Access or Deletion Requests.
2. Click Create New Request.
3. Fill in the following information:
   • Request type – You can submit two types of requests: 
     • Delete – Removes all data within an account associated with the identifier defined in the identifier field.
     • Access – Finds all data stored in Optimizely systems associated with the identifier defined in the identifier field and exports it to an AWS S3 bucket for you to access.
   • Data type – Any access or deletion request applies to one of two data types:
     • User data – End-users (also known as collaborators) who are added to customer accounts. A user can be a collaborator on multiple accounts.
     • Visitor data – Individuals who visit or use customer websites, apps, and other digital products. Optimizely stores visitor data to calculate experiment results and to tailor content.
   • Identifier type – User data is identified by the email address used to create the end-user account. The form does not display the Identifier type field (see below) if you selected User data as your data type in the previous step. If you selected Visitor data, the form displays five options for personal identifier types:
     • DCP ID – Any ID used to identify targeting records in Optimizely.
     • Email Address – The email address of a visitor.
     • Full Stack ID – The unique identifier used for Full Stack experiments.
     • optimizely_end_user_id – An Optimizely-generated user cookie.
     • Other – Any other identifier that was uploaded to Optimizely.
   • Identifier – The identifier value you want Optimizely to use when searching. If you selected User in the previous step, the identifier is the email address for the user.
     If you use DCP or list attributes, submit the primary keys to identify records in DCP data sources and list attributes. Optimizely uses these keys to identify relevant records in these data sources; they cannot be searched using other identifiers. You may submit these keys using the DCP ID or Other data type.

     Under Optimizely terms, email addresses and similar personally identifiable information (PII) should not be uploaded into DCP. For information, see Personally identifiable information in Optimizely Experimentation.

4. Click Submit Request.

Automate GDPR or CCPA requests

You can automate the requests using the REST API. These API endpoints are documented in the Web Experimentation developer documentation and Feature Experimentation developer documentation.

The same considerations apply when using the API:

• Data cannot be retrieved once it is deleted.
• Data exports Optimizely provides may contain information that your company considers confidential, such as the change history for a particular project.
• DCP users must provide the DCP ID to identify the applicable record. Optimizely cannot search these records with other identifier types.

The endpoints that Optimizely offers are:

• List subject access requests

  GET https://api.optimizely.com/v2/subject-access-requests

• Get a subject access request

  GET https://api.optimizely.com/v2/subject-access-requests/{request_id}

• Create a subject access request

  POST https://api.optimizely.com/v2/subject-access-requests

Retrieve data from a completed access request

Where Optimizely receives a data access request, Optimizely searches the records for the identifiers you provide and places matching records in an Amazon S3 bucket. When an access request is completed, you can call the list subject access requests API described in the previous Automate GDPR or CCPA requests section. Alternatively, you can log into your account to view and download one or more existing requests.

Confirm data deletion

Where Optimizely receives a data deletion request, Optimizely searches the records for the identifiers you provide and overwrites any matching data. When the request is completed, you can get the status of your request in the UI or with the REST API.

Optimizely may retain some user data in change history logs and for other security purposes to ensure you have an audit trail of significant changes that may have been made to your account.

Rectification Requests

You may correct your own data by signing into http://app.optimizely.com and editing the data in User Settings.

Rectification is not applicable for visitor data because the nature of the requests—records of events for users’ interactions with websites and apps, such as clicking on a button—is not compatible with the rectification process.