Adding BCR Compliance page to the Privacy docs [DOC-460] #2570

forstisabella · 2022-03-07T21:08:22Z

Proposed changes

Added page explaining what Binding Corporate Rules (BCRs) are, including the new workspace deletion policy designed to bring Segment in line with Twilio's BCRs.

Merge timing

On/before March 31st, when the tiered rollout ends.

Related issues (optional)

DOC-460

netlify · 2022-03-07T21:25:33Z

✔️ Deploy Preview for segment-docs ready!

🔨 Explore the source changes: 9d9c3a7

🔍 Inspect the deploy log: https://app.netlify.com/sites/segment-docs/deploys/623213a0b71a8c0008c58f5b

😎 Browse the preview: https://deploy-preview-2570--segment-docs.netlify.app/utils/env

src/privacy/bcr-compliance.md

pwseg

Some super small (optional) suggestions. Great job on this.

src/privacy/bcr-compliance.md

Co-authored-by: pwseg <86626706+pwseg@users.noreply.github.com>

briemcnally · 2022-03-08T19:27:14Z

src/privacy/bcr-compliance.md

+---
+
+In response to the passage of the General Data Protection Regulation (GDPR) policy in the European Union, Twilio implemented a set of [Binding Corporate Rules (BCRs)](https://www.twilio.com/legal/binding-corporate-rules) that inform how Segment stores, processes, and deletes personal data. To align with Twilio's BCRs, Segment introduced a new data deletion process that allows customers to remove all of their workspace data within 30 days of deleting their workspace. 
+


Can we change final sentence to be "To align with Twilio's BCRs, Segment introduced a new data deletion process that allows customers to remove all of their users' personal data associated with their workspace 30 days of workspace deletion or written request. "

briemcnally · 2022-03-08T19:28:57Z

src/privacy/bcr-compliance.md

+### What do Twilio's Binding Corporate Rules mean for my data?
+
+Twilio's BCRs inform the way your user data must be stored, processed, and deleted. While the ways Segment stores and processes user data are already in compliance with Twilio's BCRs, [additional data deletion methods](#how-can-i-delete-data-from-my-workspace) were added to comply with the ["Storage limitation"](https://www.twilio.com/legal/bcr/processor#part-ii-our-obligations) section of the Processor policy. These data deletion methods now allow you to delete the data associated with [individual users](#delete-individual-user-data), [sources](#delete-data-from-a-source), and your [workspace](#delete-your-workspace-data). 
+


Only the BCR deletion for bulk deletion is new. We may want to update this to mention we now support of the following (source and user deletions is legacy behavior)

briemcnally · 2022-03-08T19:34:11Z

src/privacy/bcr-compliance.md

+To delete the data for an individual user from you workspace, follow the instructions on the [User Deletion and Suppression](/docs/privacy/user-deletion-and-suppression) page.
+
+### Delete data from a source
+To delete the data for an entire source, email the Customer Success team [(friends@segment.com)](mailto:friends@segment.com) to create a support ticket. In your email to Customer Success, include your workplace slug, the source you'd like to delete data from, and the time frame for the data you'd like to delete. 


This type of source level deletions only removes the data from our S3 archive buckets, we may want to call that out explicitly.

One thing we will usually have to flag whenever a customer wants to do a source-level deletion is the following:

"Due to the way in which we store data internally, source-level deletions can only be scoped as small as one day in granularity. Requests for smaller timeframes are not supported."

One thing we will usually have to flag whenever a customer wants to do a source-level deletion is the following:

"Due to the way in which we store data internally, source-level deletions can only be scoped as small as one day in granularity. Requests for smaller timeframes are not supported."

Good callout - I've updated the docs accordingly!

briemcnally · 2022-03-08T19:34:39Z

src/privacy/bcr-compliance.md

+
+1. Open the Segment app, and select **Settings.**
+2. On the General Settings page, click the **Delete Workspace** button. 
+3. Follow the prompts on the pop-up to delete your workspace. 


Should we add that only workspace Admins can do this?

briemcnally · 2022-03-08T19:35:18Z

src/privacy/bcr-compliance.md

+
+After you delete your workspace, Segment removes all data associated with your workspace within 30 days in a process called a [complete data purge](#what-is-a-complete-data-purge). For a data purge status update, email the Customer Success team [(friends@segment.com)](mailto:friends@segment.com) to create a support ticket.
+
+If you do not delete your workspace after you stop using Segment, **your data remains in Segment's internal servers until you submit a written deletion request**.


Suggested change

If you do not delete your workspace after you stop using Segment, **your data remains in Segment's internal servers until you submit a written deletion request**.

If you do not delete your workspace after you stop using Segment, **your data remains in Segment's internal servers until you delete your workspace or submit a written deletion request**.

briemcnally · 2022-03-08T19:36:34Z

src/privacy/bcr-compliance.md

+
+### What is a complete data purge?
+
+A complete data purge is the mechanism Segment uses to completely remove all workspace and customer data from internal Segment servers. To trigger a complete data purge, either [delete your workspace](#how-can-i-delete-data-from-my-workspace) or raise a support ticket with the Customer Success team [(friends@segment.com)](mailto:friends@segment.com) that contains either the slug or the ID of the workspace that you'd like to delete.


Suggested change

A complete data purge is the mechanism Segment uses to completely remove all workspace and customer data from internal Segment servers. To trigger a complete data purge, either [delete your workspace](#how-can-i-delete-data-from-my-workspace) or raise a support ticket with the Customer Success team [(friends@segment.com)](mailto:friends@segment.com) that contains either the slug or the ID of the workspace that you'd like to delete.

A complete data purge is the mechanism Segment uses to completely remove all workspace and customer data from internal Segment servers across all of our product areas. To trigger a complete data purge, either [delete your workspace](#how-can-i-delete-data-from-my-workspace) or raise a support ticket with the Customer Success team [(friends@segment.com)](mailto:friends@segment.com) that contains either the slug or the ID of the workspace that you'd like to delete. Data purge deletions will not be forwarded to your connected 3rd party destinations or raw data destinations.

One other thing we may want to message is we wait 5 days after a workspace is deleted to kick off data purge of user data. This is to safeguard against malicious attackers. If customers notice their workspace has been deleted maliciously they should contact friends@segment.com immediately for them to file a request with engineering to cancel the request. After this 5 day grace period the data purge deletion will be irreversible.

@briemcnally Is the grace period five business days or five calendar days?

calendar days

briemcnally · 2022-03-08T19:41:07Z

src/privacy/bcr-compliance.md

+
+1. Open the Segment app, and select **Settings.**
+2. On the General Settings page, click the **Delete Workspace** button. 
+3. Follow the prompts on the pop-up to delete your workspace. 


There is also an account deletion button that will delete all workspaces associated with an account which will trigger the data purge across all those workspaces. Once logged into Segment they navigate to https://app.segment.com/settings/user, scroll to the bottom and click delete account.

This would delete data for all workspaces that someone was a workspace admin in, correct? Or all workspaces associated with a user? @briemcnally

Correct all workspaces that someone was a workspace admin in

github-actions · 2022-03-31T15:37:07Z

Thank you for your contribution! Your pull request is merged, but may take a day or two to appear on the site.

forstisabella added 8 commits March 1, 2022 16:03

Basic first draft of BCR compliance docs

6888604

DOC-460 Content updates

afb5c20

DOC-360 Forgot to save

2d34465

DOC-460 Updating BCR page with info from meeting with PM

3842fb6

DOC-460 added status update note, removed weasel words

cf6648d

DOC-460 updating an answer, minor grammar edits

1c2afee

DOC-460 Editing pass

01c3011

DOC-460 More edits

9b592c0

forstisabella requested a review from a team as a code owner March 7, 2022 21:08

forstisabella requested review from pwseg and removed request for a team March 7, 2022 21:08

[netlify-build]

dc3696c

pwseg reviewed Mar 8, 2022

View reviewed changes

src/privacy/bcr-compliance.md Outdated Show resolved Hide resolved

pwseg approved these changes Mar 8, 2022

View reviewed changes

src/privacy/bcr-compliance.md Outdated Show resolved Hide resolved

Apply suggestions from code review!

5b419ac

Co-authored-by: pwseg <86626706+pwseg@users.noreply.github.com>

briemcnally reviewed Mar 8, 2022

View reviewed changes

forstisabella added 7 commits March 9, 2022 12:14

Separating account deletion and BCR pages [netlify-build]

ff502c7

DOC-460 Editing pass [netlify-build]

1969a05

[netlify-build]

63deeb6

Merge branch 'develop' into DOC-460-IF

2507c34

Editing pass [netlify-build]

086c295

Removing BCR compliance page, as per legal [netlify-build]

01f21c3

Removing BCR from main nav [netlify-build]

b8ea3db

Fixing side nav [netlify-build]

528e5d5

forstisabella added the enhancement label Mar 15, 2022

forstisabella added 8 commits March 15, 2022 16:00

DOC-460 Small change requested by Legal

f5457fa

[netlify-build]

1e5cd2c

[netlify-build]

d56882d

Merge branch 'develop' into DOC-460-IF

6bf462e

[netlify-build]

f55d84c

DOC-460 netlify troubleshooting [netlify-build]

62a605b

Fixing changes [netlify-build]

9d9c3a7

Merge branch 'develop' into DOC-460-IF

1974dd2

forstisabella merged commit 72ab43e into develop Mar 31, 2022

forstisabella deleted the DOC-460-IF branch March 31, 2022 15:36

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Adding BCR Compliance page to the Privacy docs [DOC-460] #2570

Adding BCR Compliance page to the Privacy docs [DOC-460] #2570

forstisabella commented Mar 7, 2022 •

edited

Loading

netlify bot commented Mar 7, 2022 •

edited

Loading

pwseg left a comment

briemcnally Mar 8, 2022

briemcnally Mar 8, 2022

briemcnally Mar 8, 2022

tcgilbert Mar 8, 2022

forstisabella Mar 9, 2022

briemcnally Mar 8, 2022

briemcnally Mar 8, 2022

briemcnally Mar 8, 2022

briemcnally Mar 8, 2022

forstisabella Mar 9, 2022

briemcnally Mar 9, 2022

briemcnally Mar 8, 2022

forstisabella Mar 9, 2022

briemcnally Mar 9, 2022

github-actions bot commented Mar 31, 2022

		---

		In response to the passage of the General Data Protection Regulation (GDPR) policy in the European Union, Twilio implemented a set of [Binding Corporate Rules (BCRs)](https://www.twilio.com/legal/binding-corporate-rules) that inform how Segment stores, processes, and deletes personal data. To align with Twilio's BCRs, Segment introduced a new data deletion process that allows customers to remove all of their workspace data within 30 days of deleting their workspace.

		### What do Twilio's Binding Corporate Rules mean for my data?

		Twilio's BCRs inform the way your user data must be stored, processed, and deleted. While the ways Segment stores and processes user data are already in compliance with Twilio's BCRs, [additional data deletion methods](#how-can-i-delete-data-from-my-workspace) were added to comply with the ["Storage limitation"](https://www.twilio.com/legal/bcr/processor#part-ii-our-obligations) section of the Processor policy. These data deletion methods now allow you to delete the data associated with [individual users](#delete-individual-user-data), [sources](#delete-data-from-a-source), and your [workspace](#delete-your-workspace-data).


		After you delete your workspace, Segment removes all data associated with your workspace within 30 days in a process called a [complete data purge](#what-is-a-complete-data-purge). For a data purge status update, email the Customer Success team [(friends@segment.com)](mailto:friends@segment.com) to create a support ticket.

		If you do not delete your workspace after you stop using Segment, your data remains in Segment's internal servers until you submit a written deletion request.


		### What is a complete data purge?

		A complete data purge is the mechanism Segment uses to completely remove all workspace and customer data from internal Segment servers. To trigger a complete data purge, either [delete your workspace](#how-can-i-delete-data-from-my-workspace) or raise a support ticket with the Customer Success team [(friends@segment.com)](mailto:friends@segment.com) that contains either the slug or the ID of the workspace that you'd like to delete.

Adding BCR Compliance page to the Privacy docs [DOC-460] #2570

Adding BCR Compliance page to the Privacy docs [DOC-460] #2570

Conversation

forstisabella commented Mar 7, 2022 • edited Loading

Proposed changes

Merge timing

Related issues (optional)

netlify bot commented Mar 7, 2022 • edited Loading

pwseg left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented Mar 31, 2022

forstisabella commented Mar 7, 2022 •

edited

Loading

netlify bot commented Mar 7, 2022 •

edited

Loading