The following are terms used by Path2Response and occur in this document when discussing our privacy and security standards:
Personally Identifiable information (PII) is any data that could potentially identify a specific individual. Any information that can be used
to distinguish one person from another and can be used for de-anonymizing anonymous data can be considered Personally Identifiable
Information Examples of Personally Identifiable Information include:
Sensitive Personal Information (SPI) is a subset of Personally Identifiable Information, which due to its nature has been classified by law or by
Path2Response policy as deserving additional privacy and security protections. Examples of Sensitive Personal Information include:
Government issued identification numbers (Social Security numbers, driver’s license numbers, and passport numbers); Financial account
numbers (credit card numbers, bank account numbers, and other information if it would permit access to a financial account); and
Credential information (account name, passwords, or encryption keys).
Client Data is information provided to Path2Response by a client that contains personal identifying information of the client’s (including
affiliated brands and titles) customers. This information typically includes, but is not limited to, customer ID, name, address, email address, and
transaction data. Client Data is provided in order for Path2Response to perform certain services requested by client and other data cooperative
members, which may include, without limitation, collecting, recording, storing, organizing, matching, aggregating, analyzing, transferring,
disclosing, manipulating, combining, and/or deleting such data.
At Path2Response, we consider the security of our clients’ data to be of the utmost importance and work diligently to protect it.
Path2Response has adopted, implemented, and maintains security procedures and practices to prevent the unauthorized and accidental access
to, modification, use, disclosure, appropriation, and destruction of our clients’ data. We have procedures and practices in place that:
Path2Response’s security encompasses physical, administrative, and technical measures designed to protect sensitive client data, including
consumer information. Path2Response’s hosting environments and security measures are continuously reviewed and assessed; routinely
performing internal security audits encompassing hardware, system software, and procedures/policies. Our role-based security and
configuration release mechanisms ensure proper governance of system configuration, so all our clients’ data is constantly
protected. Additionally, our layered security ensures that client data is highly secure and protected as it passes through the solution.
Path2Response ensures that all physical, network, application, network, and employee security are in place to continually protect client assets
in our internal and external systems.
Path2Response is a remote-first company, with no central servers or permanent physical facilities. Our entire enterprise is cloud-based,
utilizing state-of-the-art, secure and compliant infrastructure. We utilize a Managed Services Provider known as Syn Ack Fin to manage our
operations. Syn Ack Fin is SOC2 certified and its most recent report is available for review.
Client data is always encrypted when transmitted across Path2Response networks to protect against eavesdropping of network traffic by
unauthorized users. Even in cases where source and target endpoint devices are within the same protected subnet, client data transmission
is still encrypted due to the potential for high negative impact of a client data breach. The types of transmission may include client-to-server,
server to-server communication, as well as any data transfer between core systems and third party systems. Client data transferred via HTTP
is always transferred via HTTPS; this includes REST API interfaces. File transfer of data from a client to Path2Response may also occur via
HTTPS; however, it is recommended that all clients transfer files to Path2Response via SFTP.
Path2Response uses several layers of firewalls to ensure the security of their systems and the data contained within these systems. Client data
is processed within dedicated hosted systems not accessible by the public Internet. These systems are protected with software firewalls with
extremely limited port access; allowing only absolutely required ports to be opened. Surrounding these systems are hardware firewalls that
limit access via SSL/IPSec tunneling between the hosted servers and only the Path2Response office.
Access to client data is extremely limited; only Path2Response personnel with specific needs for access to client data are granted access to
data, through a secure and restricted mechanism. Access to client data is only available using secure private key files, utilizing secure tunnels
between the Path2Response office and the servers containing the client data.
Path2Response has established rigorous procedures for data recovery. These procedures are tested and validated constantly to ensure no loss
of data in the event of a system failure. Data is backed up in encrypted form and stored in an off-site facility. Depending upon the criticality,
durability, and transience of the data, backups occur upon receipt/creation or daily.
Path2Response collects, processes, and aggregates data in compliance with all applicable industry standards, best practices and self-regulation.
Specifically, we comply with standards put forth by the Direct Marketing Association. Clients are responsible for ensuring overall compliance
with their own privacy statements.
All data within the Path2Response systems are sanitized for the specific step in the process. Generally, data is anonymized and personally
unidentifiable; only attaching name and address at fulfillment.
If any client data is sent to Path2Response with Sensitive Personal Information (SPI), the file is rejected; the file is immediately destroyed, the
client is notified, and Path2Response’s senior management is notified.
Path2Response maintains a business continuity and disaster recovery plan outlining the prerequisites to be managed and the steps to be taken
in the case of an event that disrupts business operations. This plan includes protection of assets and data as outlined above as well as the steps
to recover and ensure continued operational capacity.
Path2Response utilizes a dynamic development process that allows the flexibility to adapt to business and customer needs quickly. The
software development approach enabled at Path2Response is agile in nature, utilizing a variety of methodologies based on iterative
development. These methodologies include engineering best practices intended to allow for rapid delivery of high-quality software, a business
approach that aligns development priorities with customer needs and company goals and frequent inspection and adaption of priorities and
request backlog.
Per our published Privacy Policy, we retain data for as long as necessary to fulfill the purpose of collection, including for the purposes
of satisfying any legal, accounting, or reporting requirements, to establish and defend legal claims, for fraud prevention purposes, or as
long as required to meet our legal obligations. To determine the appropriate retention period for personal information, we consider the
amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal
information, the purposes for which we process personal information and whether we can achieve those purposes through other means, and
the applicable legal requirements.
