About Privacy in Oracle CRM On Demand Marketing

Oracle CRM On Demand Marketing is an application that enables your company to send emails to external recipients, deploy Web pages visible to the internet, and build Web forms that capture personal customer information. It is important that your company use the application services in an appropriate manner that adheres to international, federal, state, or local laws or regulations relating to individual privacy and the distribution of email and other digital one-to-one communications, such as the United States CAN-SPAM Act.

This topic is provided so that you are aware of what information may be collected about external parties in connection with your use of Oracle CRM On Demand Marketing and how that information may be used by your company's users of Oracle CRM On Demand Marketing and by Oracle Corporation.

Before you may use the Oracle CRM On Demand Marketing application to contact outside recipients, Oracle asks you to acknowledge that your company takes responsibility for ensuring that your email addresses are properly obtained and that you are properly contacting external parties in accordance with applicable marketing and privacy laws, rules and regulations.

How Email Messages are Identified to Recipients

Through the Oracle CRM On Demand Marketing application, your users can send email messages to external recipients. The email message content that is sent is controlled by what your users create within the email template; therefore, it is important that all your email templates clearly identify your company, including a well-formatted footer with contact information about your company and links to your privacy terms and opt-out process.

The Oracle CRM On Demand Marketing application allows Oracle to setup the application for you so that emails may be identified either with an Oracle-branded domain (for example: crmondemand.com) or a domain name controlled by your company. During the initial provisioning process for your environment, please communicate your intentions regarding this setup option to Oracle Customer Care.

What Information is Collected by Oracle About External Parties When Sending Email Messages from Oracle CRM On Demand Marketing?

When an external recipient opens an email that you send using Oracle CRM On Demand Marketing, information about the message and the recipient's response is directed to one of Oracle's servers and, in some cases, received and relayed by Oracle's email fulfillment provider.

The information collected includes: whether the email was opened, whether a recipient clicked on one of the URLs identified in that email, and whether the recipient unsubscribed from the email campaign that you sent using Oracle CRM On Demand Marketing. Further, information may be collected about whether an email sent to a recipient was bounced or otherwise undelivered.

Information about emails opened by the recipient is tracked by a Web beacon (Web beacons are small pieces of HTML code, including 1 by 1 pixel clear GIF files that are embedded in the emails that sent out by the Oracle CRM On Demand Marketing application). Information about URLs clicked-on in the email body is captured directly by Oracle's Web servers or is redirected from the Web server of Oracle's email fulfillment provider. Unsubscribe requests can be captured through: opt-out links that are relayed by Oracle's email fulfillment provider, Web forms hosted by Web pages that you deploy using Oracle CRM On Demand Marketing, and email replies that are received and relayed by Oracle's email fulfillment provider. Bounced or undelivered mail is detected by Oracle's email fulfillment provider and relayed to the Oracle CRM On Demand Marketing application.

How External Recipients Can Opt Out of Email Campaigns

At all times, a recipient should be able to opt out of an email campaign. Oracle CRM On Demand Marketing provides standard functionality to embed an opt-out link at the bottom of an email. For more information on setting up opt-in and opt-out links, see About Email Opt Outs.

A contact whose Email Permitted field is set to No does not receive any future emails. Oracle CRM On Demand Marketing provides a standard opt-out link you can embed in the footer of all your email messages that automatically sets the Email Permitted field.

If you elect to use a different email configuration to capture opt-outs through other means (for example, capturing preferences through a Web form or a custom link), you should set up your process to update the Email Permitted field so that the automatic suppression is maintained. If you are using an alternative opt-out configuration, you should also consider creating reusable Exclusion Lists that users can associate to each program to provide further guarantees that suppressions are applied. For more information on using Exclusion Lists, see Creating Lists.

Information Collected by Websites and Web Content Hosted by Oracle CRM On Demand Marketing

The Oracle CRM On Demand Marketing application may collect the following information about external parties as a result of visiting the Web site or visiting a page with embedded components from the Oracle CRM On Demand Marketing application:

Personal contact and company information
Communication preferences selected when the contact registers a profile (such as email opt-in)
Information about a Web visitor's of the Web site gathered though cookies, electronic communication protocols, and Web tracking scripts (Javascript)
Transactional information

Every time a person visits a Web site hosted by Oracle CRM On Demand Marketing, a session cookie is created and stored at the Web visitor's local computer. A session cookie is a text file that stores information specific to the visitor for use by Oracle to maintain the visitor's browser session. The cookie allows the Oracle CRM On Demand Marketing application to track the pages visited, the content items that a Web visitor downloads, and personalize the content that may be displayed to the visitor. The cookie is stored in an encrypted format that is only readable by Oracle CRM On Demand applications, so that an external party cannot extract any contact or session information from it.

Through Oracle CRM On Demand applications your users can create Web forms that can be embedded in a page hosted by Oracle or hosted by our customer. This Web form may capture personally identifiable information about an external party, depending on the questions placed on the Web form by your users. Your users control the questions that appear on a Web form.

The Oracle CRM On Demand Marketing application also sets a cookie for visitors to a Web page hosted outside Oracle CRM On Demand Marketing, where the external page has an embedded content item or Web form (for example, through an iFrame) and that content item is rendered by Oracle CRM On Demand applications.

Oracle CRM On Demand Marketing also provides a Web tracking script (javascript) that your company may add to your other company Web pages, including pages not hosted by Oracle. When this tracking script is present on a Web page, the script enables the Oracle CRM On Demand Marketing application to identify the IP address of the Web visitor, track the Web pages that a Web visitor visits on your other company Web pages, and track the referring source (what site on the internet the visitor came from) including any parameters included. Also, the Oracle CRM On Demand Marketing application sets a cookie for visitors to a Web page where the external page includes the Web tracking script, including Web pages not hosted by Oracle.

Web visitor information, including information submitted on a Web form, is treated as confidential information for your company. More information about how Oracle treats data that it collects and stores in connection with providing services to its customers is available in the Oracle Services Privacy Policy, which is available on the Web at:

http://www.oracle.com/html/services-privacy-policy.html

Why Does the Website Appear to Come from a Different Company, but the IP Address is Hosted by Oracle?

Oracle CRM On Demand Marketing allows Oracle Customer Care to setup the application so that the Web pages displayed are branded with your corporate domain or sub-domain. For example, your company may wish for Web pages hosted by Oracle to appear as a blended part of your corporate Web site. The setup for the domain name is a standard part of the initial provisioning process. Please review communications from Oracle Customer Care for details on the setup process.

What does Oracle do with the Information it Collects about External Parties?

Oracle records information collected through email campaigns and Web sites for the customer that initiated the marketing campaign. This information belongs to Oracle's customer, and personally identifiable information collected by the Oracle CRM On Demand applications is not used or shared by Oracle except as necessary to provide the service and as required for legal purposes.

For information about how Oracle's customer may use the information captured by the Oracle CRM On Demand Marketing, Oracle's policy directs all parties to refer to the privacy policy communicated by the customer that is using the Oracle service. Typically, this privacy policy would be provided by your company as a link within an email or Web page created by you.

As part of standard account activation, Oracle does obtain permission to use statistical or aggregate information derived from your use of our technology. More information about how Oracle treats data that it collects and stores in connection with providing services to its customers is available in the Oracle Services Privacy Policy, which is available on the Web at:

http://www.oracle.com/html/services-privacy-policy.html

How Does One of Your Contacts or Prospects Report Abuse?

If for any reason an email recipient wishes to decline receiving further email campaigns from you, the recipient may opt out of receiving such campaigns by clicking on the opt-out link at the bottom of the relevant email. If the recipient wishes to respond to any emails you sent using Oracle CRM On Demand Marketing, you should instruct the recipient to contact your company, rather than Oracle. Oracle recommends always including information about opt-out and your company privacy policy as part of each email message you send.

Note that the Oracle privacy policy posted on Oracle.com and CRMOnDemand.com instructs any outside parties that if an Oracle customer fails to address any privacy concerns regarding use of CRM On Demand, then the recipient can contact Oracle at privacy_ww@oracle.com. The Oracle policy also states that if an external party has concerns about an Oracle customer's use of intellectual property or other rights in connection with an Oracle hosting service (for example, if an Oracle customer puts unlicensed content into an email campaign or presentation created or distributed through an Oracle CRM On Demand application) and those concerns are not adequately addressed by the Oracle customer, the party may contact Oracle at copyright_us@oracle.com.

Where to Find Out More About Oracle's Privacy Practices

Further information about Oracle's privacy practices is available on the Web at:

http://www.oracle.com/html/privacy.html