CCPA and State Law Privacy Notice
PRIVACY ADDENDUM FOR RESIDENTS OF CALIFORNIA AND OTHER APPLICABLE STATES
Last Modified: Jan 24, 2023
NOTICE TO RESIDENTS OF CALIFORNIA AND OTHER APPLICABLE STATES – CALIFORNIA CONSUMER PRIVACY PROTECTION ACT
The California Consumer Privacy Act of 2018 and the California Privacy Rights Act (together, the “CCPA”) provide certain privacy choices and related rights to residents of California. Other states’ statutes (“Other Applicable States”) provide their residents with similar rights and choices, with certain variations. Those states are Colorado, Connecticut, Utah and Virginia, whose privacy statutes go into effect at various times during 2023.
This section of the Privacy Policy applies if you are a natural person who is a resident of California (“California Consumer”) or Other Applicable States, and uses our Services. This Addendum supplements the information in the Privacy Policy. However, this Addendum is intended solely for, and is applicable only as to residents of those states.
In the below tables and sections, we describe (as required by the CCPA):
- Our Collection of Personal Information (sometimes called “Personal Data”)– the types of Personal Information (which the CCPA defines broadly) that we collect, the types of sources we collect it from,
- Our Disclosure and Sale of Personal Information– the types of recipients to whom we disclose or sell Personal Information.
- Our Business Purposes– our business purposes for (a) collecting and (b) sharing Personal Information, which are generally the same.
- Your Privacy Rights and Choices– what statutory privacy rights you may have, such as under the CCPA in California, for instance, to request that we “opt out” your information from our marketing database (also called “do not sell” rights), or to request categories and personal information that we may have collected about you.
The following sets forth the categories of information we collect and purposes for which we may use consumers’ personal information:
We also may share any of the personal information we collect as follows:
Sharing for Legal Purposes: In addition, we may share personal information with third parties in order to: (a) comply with legal process or a regulatory investigation (e.g. a subpoena or court order); (b) enforce our Terms of Service, this Privacy Policy, or other contracts with you, including investigation of potential violations thereof; (c) respond to claims that any content violates the rights of third parties; and/or (d) protect the rights, property or personal safety of us, our platform, our customers, our agents and affiliates, its users and/or the public.
We likewise may provide information to other companies and organizations (including law enforcement) for fraud protection, and spam/malware prevention, and similar purposes.
Sharing In Event of a Corporate Transaction: We may also share personal information in the event of a major corporate transaction, including for example a merger, investment, acquisition, reorganization, consolidation, bankruptcy, liquidation, or sale of some or all of our assets, or for purposes of due diligence connected with any such transaction.
Sharing With Service Providers: We share any personal information we collect with our service providers, which may include (for instance) providers involved in tech or customer support, operations, web or data hosting, billing, accounting, security, marketing, data management, validation, enhancement or hygiene, or otherwise assisting us to provide, develop, maintain and improve our services.
Sharing of Aggregate Information: We may aggregate and/or de-identify any information collected so that such information can no longer be linked to you or your device (“Aggregate/De-Identified Information”). We may use Aggregate/De-Identified Information for any purpose, including without limitation for research and marketing purposes, and may also share such data with any third parties, including advertisers, promotional partners, and sponsors, in our discretion.
3. OUR BUSINESS PURPOSES FOR COLLECTING AND SHARING PERSONAL INFORMATION
Generally speaking, we collect and share the Personal Information that we collect for the following purposes, as we also have described in our Privacy Policy:
Our Purposes for collecting, using and sharing Personal Information
Online targeting, for example:
- Assisting advertisers, agencies and the platforms that they access (a) to deliver advertising and marketing to send, tailor, optimize and analyze advertising, in mobile apps and across other advertising channels and platforms and (b) to measure and analyze such advertising and marketing.
- Create “audience segments” based on inferences about consumer preferences, products and activities for purposes of online and mobile advertising.
- Assisting Clients by creating “identity” graphs, to help locate users across various channels, such as connecting identities based on common personal, device-based, or network-based identifiers (e.g., IP address, email address).
- Certain of these activities constitute a “share” under California privacy law, and a use for purposes of targeted advertising, under the law of Other Applicable States.
Research and analysis about population movement:
Providing information for research purposes related to foot and vehicle traffic patterns, including for purposes of market, public health, financial, or consumer research.
Operating our Services, for example:
- Improving, testing, updating and verifying our own data and data services.
- Developing new products.
- Operating, analyzing, improving, and securing our Services.
Other data and research purposes, for example:
For internal research, internal operations, auditing, detecting security incidents, debugging, short-term and transient use, quality control, and legal compliance. We use the information collected from our own website, from social networks, from other “business to business” interaction (such as at trade shows) or from data compilers for the above, as well as for our own marketing purposes.
We retain personal information to the extent it is useful for our services and products, such as to help customers to evaluate increases or decreases of population movements over time, to and from certain places or across certain routes, and provided that we have not received a deletion request, in which cases we remove information from our active databases (but may retain for permitted business purposes, including for legal or compliance purposes).
4. YOUR CALIFORNIA RIGHTS AND CHOICES
Without being discriminated against for exercising these rights, Residents of California and Other Applicable States have the right to request that we disclose what personal information we collect from you, to delete that information, and to opt-out of the sale of your personal information, subject to certain restrictions. You also have the right to designate an agent to exercise these rights on your behalf. This section describes how to exercise those rights and our process for handling those requests, to the extent as act as a “business” (as opposed to a “service provider”) for purposes of handling personal information. (To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.
a. Right to Opt-out of the sale of your personal information.
Residents of California and Other Applicable States may opt out of the “sale” of their personal information. Certain of these laws broadly define what constitutes a “sale” – including in the definition making available a wide variety of information in exchange for “valuable consideration.” We may act as a “business” or a “service provider” under the CCPA. When we act as a business under the CCPA, you may “opt out” of our “sale” of your personal information (as those terms are defined by the CCPA) by following the directions set forth in our Privacy Policy addressing how consumers may opt out of cross-app advertising through their device settings.
b. Right to request deletion of your personal information
You may also request that we delete any personal information that we collected from you, such as if you have been a customer of ours. To make such a request, please send an email to privacy@veraset.com. (Note that this is different from your right to “opt out” of us selling your personal information, which is described below; also note that we do not generally collect personal information directly from consumers, in which case “deletion” rights generally do not apply.)
However, we may retain personal information for certain important purposes, such as (a) to protect our business, systems, and users from fraudulent activity, (b) to address technical issues that impair existing functionality (such as de-bugging purposes), (c) as necessary for us, or others, to exercise their free speech or other rights, (d) to comply with law enforcement requests pursuant to lawful process, (e) for scientific or historical research, (f) for our own internal purposes reasonably related to your relationship with us, or to comply with legal obligations. Additionally, we need certain types of information so that we can provide our Services to you. If you ask us to delete it, you may no longer be able to access or use our Services.
c. Right to request access to or correction of your personal information
Residents of California and Other Applicable States also have the right to request that we disclose what categories of your personal information we collect, use, or sell. As a California resident, you may request access to the specific pieces of personal information that we have collected from you.
Residents of California and Other Applicable States may learn more how to exercise these rights of information access by sending an email to privacy@veraset.com, submitting a request to Request Information, or by contacting us at (855) 856-3404.
We will then request certain information about you, including your device identifier. We may request a screenshot of that identifier.
Residents of California and Other Applicable States likewise may have a right to request and in some cases to receive access to the specific pieces of personal information that has been collected about them, upon making a verifiable request. We are not able to provide (or, ultimately, to correct) such specific pieces of personal information, beyond basic device information and identifiers, because we are not able to verify to a reasonably high degree that the personal information we have pertains to the person who has submitted the request, or whether either the person in possession of a device or the person requesting the information is the actual device owner. (Certain studies have concluded that many people do not, or do not sufficiently, password-protect their mobile devices.)
Moreover, because we do not collect information such as name, address or email address (which we avoid, to protect consumer privacy), we do not have other, more conventional ways to verify the identify of an actual device owner.
If you are uncomfortable with your device information being used in the ways described above, we recommend that you request an “opt out” your information as described above.
We will, however, provide categories and certain device information once we have verified your identity, and at that time we will respond to your request as appropriate:
We encourage you to review and, as desired, employ the industry tools listed in our privacy policy addressing how consumers may opt out of cross-app advertising. as we believe they may be more efficient, immediate and uniform – and easier to instantly access – than a more manual “opt out” process.
d. How to exercise your access, opt-out and (if applicable) deletion rights
Residents of California and Other Applicable States may exercise their California privacy rights by sending an email to privacy@veraset.com, submitting your request to Optout, or by contacting us at (855) 856-3404.
For security purposes (and as required under California law), we will verify your identity – in part by requesting certain information from you — when you request to exercise the privacy rights described in this Addendum. For instance, if you request categories or specific pieces of personal information we have received about you, you may need to confirm your possession of an identifier (such as an email address) or to provide a piece of identification that confirms you are the person you claim to be.
Once we have verified your identity, we will respond to your request as appropriate:
- Where you have requested the categories of personal information that we have collected about you, we will provide a list of those categories.
- Where you have requested that we delete personal information that we have collected from you, we will seek to confirm whether your request is for an “opt out” or a “deletion”: because “opt out” or “do not sell” rights enable us to maintain your information for “suppression” purposes – i.e., to prevent us from selling information about you in the future (which is what many consumers requesting “deletion” actually desire to occur), we try to explain this in order to ensure we are meeting consumers’ preferences. (In addition, “deletion” rights only apply to information that we have collected “from” consumers – which does not apply to much of the information in our databases.)
- Upon completion of the above process, we will send you a notice that explains the categories of personal information we were able to locate about you, whether we (1) deleted, (2) de identified, or (3) retained the information we collected from you. Certain information may be exempt from such requests under applicable law.
If we are unable to complete your requests fully for any of the reasons above, we will provide you additional information about the reasons that we could not comply with your request. If you disagree with a determination we have made, or feel that we have not sufficiently honored your valid requests, you may appeal to us by describing your concerns in an email to privacy@veraset.com.
e. Right to nondiscrimination.
We do not deny, charge different prices for, or provide a different level of quality of goods or services if you choose to exercise these rights.
f. Information About Persons Under 16 Years of Age
We do not knowingly collect personal information from minors under 16 years of age in California unless we have received legal consent to do so. If we learn that personal information from such Residents of California and Other Applicable States has been collected, we will take reasonable steps to remove their information from our database (or to obtain legally required consent).
g. Authorized Agents
You may also designate an agent to make requests to exercise your rights under CCPA as described above. We will take steps both to verify the identity of the person seeking to exercise their rights as listed above, and to verify that your agent has been authorized to make a request on your behalf through providing us with a signed written authorization or a copy of a power of attorney.
