Get the weekly research letter
Companies change their terms quietly. We read every version and catch what actually changed. One email a week on the changes that matter and what they mean. No account.
The agreement places an affirmative technical obligation on Customer to prevent the transfer of any visitor Personal Data beyond the defined Permitted Personal Data categories (IP address, cookie ID, behavioral data, technical data) to Contentsquare, using blocking Scripts or other available tools across all relevant areas of Customer Sites and Apps.
This analysis describes what Heap's agreement states, permits, or reserves. It does not constitute a legal determination about enforceability. Regulatory applicability and practical outcomes may vary by jurisdiction, enforcement context, and individual circumstances. Read our methodology
This provision places the technical and operational responsibility for data minimization on the Customer rather than Contentsquare, covering keystroke data, prefilled form data, HTML-displayed data, and API error logs. Failure to implement blocking mechanisms creates both contractual liability under Section 9.2 and potential regulatory exposure under applicable data protection laws.
Under this clause, Customer bears the affirmative obligation to configure and maintain technical controls that prevent Contentsquare from receiving visitor Personal Data beyond IP addresses, cookie identifiers, and behavioral data. The agreement states that if non-Permitted Personal Data is processed, Contentsquare may delete broader Visitor Data in the remediation process.
Cross-platform context
See how other platforms handle Customer Obligation to Block Non-Permitted Personal Data and similar clauses.
Compare across platforms →Monitoring
Heap has changed this document before.
Receive same-day alerts, structured change summaries, and monitoring for up to 25 platforms.
"Customer agrees and acknowledges that the CS Service is not intended for the processing of any Personal Data of Visitors other than the Permitted Personal Data. Therefore, Customer shall prevent the transfer of any Personal Data of Visitors (other than the Permitted Personal Data) to Contentsquare, including, but not limited to, by implementing the appropriate blocking Scripts as stated in the CS Documentation or by using other available tools and methods, on such relevant areas of the Customer Site(s) and browser back-end where Personal Data of Visitors (other than the Permitted Personal Data) may be: (a) collected through Customer's use of the CS Service (e.g., via cookies, JS or API Error logs or other network communication);(b) inputted by a Visitor (e.g., through keystrokes); or (c) displayed (e.g., prefilled, data within the HTML).Excerpt from Heap's Terms of Service
1) REGULATORY LANDSCAPE: This provision directly engages GDPR data minimization obligations (Article 5(1)(c)) and purpose limitation requirements, as well as the e-Privacy Directive's requirements regarding cookies and similar technologies. The UK GDPR, Singapore PDPA, and Japan APPI impose analogous obligations. Enforcement authorities include EU data protection authorities, the UK ICO, and their counterparts in Singapore and Japan. The allocation of technical compliance responsibility to Customer may affect joint or separate controllership analysis under GDPR. 2) GOVERNANCE EXPOSURE: High. The obligation to implement blocking Scripts on all relevant areas of Customer Sites and Apps (including form fields, keylogged areas, and prefilled data zones) requires ongoing technical maintenance. The document specifies that if non-Permitted Personal Data is inadvertently processed and cannot be selectively deleted, broader Visitor Data may be deleted, creating operational data loss risk. 3) JURISDICTION FLAGS: EU and UK customers face the highest exposure given GDPR and UK GDPR data minimization enforcement posture. Session replay and behavioral analytics tools have attracted regulatory scrutiny from EU data protection authorities regarding inadvertent capture of sensitive personal data (including health information, financial data, and authentication credentials entered into web forms). Customers in regulated sectors (healthcare, financial services) should assess sector-specific obligations. 4) CONTRACT AND VENDOR IMPLICATIONS: Implementation teams must review all Customer Sites and Apps against the blocking Script requirements in the CS Documentation prior to deployment. Ongoing site changes (new form fields, new pages, updated APIs) require reassessment of blocking configurations. The contract allocates liability to Customer under Section 9.2 for claims arising from the nature, origin, or content of Customer Data processed by the CS Service. 5) COMPLIANCE CONSIDERATIONS: Compliance teams should establish a deployment checklist referencing the CS Documentation blocking requirements, and implement a change management process to reassess blocking configurations when Customer Sites or Apps are modified. Data protection impact assessments (DPIAs) may be warranted for deployments involving sensitive data categories or vulnerable user populations. Customer-facing privacy notices should accurately describe the data collection and processing that occurs through Contentsquare's Scripts.
Full institutional analysis
Regulatory citations, enforcement risk, and due diligence action items.
Monitor: same-day alerts on the platforms you choose. Analyst: full institutional analysis.
Compliance Governance Intelligence
Need to monitor specific governance provisions?
Compliance includes provision-level monitoring, governance timelines, regulatory mapping, and audit-ready analysis.
Built from archived source documents, structured governance mappings, and historical version tracking.
This provision places the technical and operational responsibility for data minimization on the Customer rather than Contentsquare, covering keystroke data, prefilled form data, HTML-displayed data, and API error logs. Failure to implement blocking mechanisms creates both contractual liability under Section 9.2 and potential regulatory exposure under applicable data protection laws.
Under this clause, Customer bears the affirmative obligation to configure and maintain technical controls that prevent Contentsquare from receiving visitor Personal Data beyond IP addresses, cookie identifiers, and behavioral data. The agreement states that if non-Permitted Personal Data is processed, Contentsquare may delete broader Visitor Data in the remediation process.
No. ConductAtlas is an independent monitoring service. We are not affiliated with, endorsed by, or sponsored by Heap.