CCPA Privacy Notice: Addendum for California Residents
If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), requires us to provide you with the following additional information about: (1) the purpose for which we use each category of "personal information" we collect; and (2) the categories of third parties to which we (a) disclose such personal information for a business purpose, (b) "share" personal information for "cross-context behavioral advertising," and/or (c) "sell" such personal information. Under the CCPA, "sharing" is defined as the targeting of advertising to a consumer based on that consumer's personal information obtained from the consumer's activity across websites, and "selling" is defined as the disclosure of personal information to third parties in exchange for monetary or other valuable consideration. As discussed in our Privacy Policy, our use of third-party analytics services and online advertising services may result in the sharing of online identifiers (e.g., cookie data, IP addresses, device identifiers, and usage information) in a way that may be considered a "sale" or "sharing" under the CCPA.
In the sections below, we describe (as required by the CCPA):
- Our Collection of Personal Information: the types of personal information (which the CCPA defines broadly) that we collect, and the types of sources we collect it from.
- Our Disclosure, Sharing, and Sale of Personal Information: the types of recipients to whom we disclose, share, or sell personal information.
- Our Business Purposes: our business purposes for (a) collecting and (b) sharing personal information, which are generally the same.
- Your California Privacy Rights and Choices: what rights you have under the CCPA, for instance, to request that we opt you out of, delete, or correct your information in our marketing database (also called "do not sell" rights), or to request the categories and personal information that we may have collected about you.
Our Collection and Disclosure of Personal Information
Depending on how you interact with us, we may collect the categories of information summarized below. The table also describes how we collect and disclose such categories of information for purposes of our Services. The data types listed within each category are provided solely as examples: we do not necessarily collect or use each of them about each individual.
| Category of Personal Information | Sources | Categories of Third Parties With Which We "Share" or to Which We "Sell" |
|---|---|---|
| Identifiers, such as name, postal address (which may be expressed as latitude and longitude coordinates), device ID, telephone numbers, IP address, mobile ad identifiers, email address, alias, or similar identifiers. | Data compilers and consumer data resellers, publicly available sources, clients, social networks, advertising networks, and data analytics providers. | Clients, advertising networks, and data analytics providers. Clients may include a range of businesses and non-profits, including retailers, business services, content creators, personal and educational services, and consumer packaged goods and hardware sellers. |
| Characteristics of protected classifications under California or US law, such as race, color, religion, sex/gender, marital status, military or veteran status, national origin, or ancestry. | Same as above. | Same as above. |
| Commercial or transactions information, such as products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. | Same as above. | Same as above. |
| Internet or other electronic network activity information, such as email interactions, website interactions, and online interests. | Same as above. | Same as above. |
| Professional or employment-related information. | Same as above. | Same as above. |
| Inferences. | Same as above. | Same as above. |
We also may disclose any of the personal information as follows:
- To vendors who help us deliver the services you request or we provide. For instance, we share the information with tech and customer support providers, marketing and advertising providers, other data providers (such as to enhance or verify our information), security and data hygiene vendors, payment vendors (as to our business-to-business information), and other companies that may help us deliver or develop Services.
- To communicate with you and market to you, including through email, direct mail, or display media.
- If we believe in good faith that we are required to do so by law, regulation, or other government authority, or to protect the rights, safety, or property of ourselves or any person or entity. We may also cooperate with law enforcement agencies in any official investigation and may disclose any information to the requesting agency in doing so.
- If all or substantially all of our assets are purchased by another company (such as in a merger, consolidation, restructuring, the sale of stock and/or assets, or other corporate change or financing transaction), the information in our possession will likely be transferred to the successor entity. We also may share the information during the course of any due diligence process leading up to any such transaction.
Our Business Purposes for Collecting and Disclosing Personal Information
Generally speaking, we collect and disclose personal information as part of our Services and to operate our Services, as also described in our Privacy Policy:
As Part of Our Services
Data Marketing Services. Our Services include licensing or otherwise making available marketing information and insights (which may include personal information, as defined under applicable law) to our clients to help them identify audiences, improve outreach, and better understand customer interests and engagement. We also help our clients understand their customers better.
Audience Segments. We may create groups of individuals or devices we believe are interested in particular types of products or services or have other common interests or characteristics ("Audience Segments"). We may license them to our clients as part of our Services. We also may link, or work with other platforms that link, those Audience Segments to other identifiers or personal information that are then used to help target and advertise in a relevant way to those groups of individuals.
Additional Marketing Services. Other Services we may make available may involve (a) assisting clients to target and optimize email campaigns, display, or other marketing; (b) measuring the effectiveness or performance of marketing campaigns, by determining which messages are most likely to be seen or opened by which types of consumers, or which types of ads are most likely to lead to purchases; (c) analyzing and optimizing our clients' proprietary databases; and (d) helping clients detect and prevent fraud and provide "validation" or data hygiene services, e.g., by verifying, removing, or correcting old, incorrect, or outdated information or evaluating whether an email address recently has been active.
To Operate Our Services
We also use information for our own internal purposes, such as to improve, test, update, and verify our own database; develop new products; and operate, analyze, improve, and secure our Services and our databases and servers. We may aggregate and/or de-identify any information collected for or through the Services so that such information can no longer be linked to you or your device. We may use such information for any purpose, including without limitation for research and marketing purposes, and may also disclose such data to any third parties in our discretion.
Your California Rights and Choices
California residents have the right to request that we disclose what personal information we collect about them, to delete that information, and to opt out of the sale of their personal information, subject to certain restrictions. You also have the right to designate an agent to exercise these rights on your behalf. This section describes how to exercise those rights and our process for handling those requests. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request. Please note that we sometimes act as a "service provider" for our clients, in which case we receive and act on instructions from the client(s) as to the client data provided: any requests to exercise rights with respect to data we handle on behalf of a client should be directed to that client.
a. Right to request access to your personal information
California residents have the right to request that we disclose what categories of your personal information we collect, use, or sell. You may also request the specific pieces of personal information that we have collected about you. However, we may withhold some personal information where the risk to you or our business is too great to disclose the information. You may submit an access request by emailing privacy@3pdata.io.
b. Right to request deletion or correction of your personal information
California residents may also request that we delete or correct any personal information that we collected from them, such as if you have been a client of ours. (Note that this is different from your right to opt out of us selling your personal information, which is described below; also note that we do not generally collect personal information directly from consumers.) However, we may retain personal information for certain important purposes, such as (a) to protect our business, systems, and users from fraudulent activity, (b) to address technical issues that impair existing functionality (such as debugging purposes), (c) as necessary for us, or others, to exercise their free speech or other rights, (d) to comply with law enforcement requests pursuant to lawful process, (e) for scientific or historical research, or (f) for our own internal purposes reasonably related to your relationship with us, or to comply with legal obligations. Additionally, we need certain types of information so that we can provide our Services to you. If you ask us to delete it, you may no longer be able to access or use our Services.
c. Right to opt out of the sale or "sharing" of your personal information
California residents may opt out of the "sale" of their personal information. California law broadly defines what constitutes a "sale," including making available a wide variety of information in exchange for "valuable consideration."
Depending on what information we have about you, and whether we have included any of it in our marketing products and services, we may have sold (as defined by California law) certain categories of information about you in the last 12 months, as described in the table above.
If you would like to opt out, you may do so through our opt-out page. You may also opt out of "sharing" as defined in the CPRA, also known as "targeted" or "personalized" advertising, using the methods in Section 4 of our Privacy Policy.
d. How to exercise your privacy rights
You can submit requests to exercise your right to information/know, access, correction, or deletion, or to limit the processing of your sensitive personal information (to the extent we collect such information), by emailing privacy@3pdata.io. You can opt out of tracking for targeted advertising purposes or other sales of personal information through our opt-out page, or by broadcasting the Global Privacy Control signal. If our website detects that your browser is transmitting an opt-out preference signal, such as the GPC signal, we will opt that browser out of cookies on our website that result in a "sale" or "sharing" of your personal information. To download and use a browser supporting the GPC signal, visit globalprivacycontrol.org/orgs. If you choose to use the GPC signal, you will need to turn it on for each supported browser or browser extension you use to visit our websites.
For security purposes (and as required under California law), we will verify your identity, in part by requesting certain information from you, when you request to exercise certain California privacy rights. For instance, if you request specific pieces of personal information we have received about you, you may need to confirm your possession of an identifier (such as an email address) or your residence at a home address in order to confirm you are the person you claim to be.
Once we have verified your identity, we will respond to your request as appropriate:
- Where you have requested the categories of personal information that we have collected about you, we will provide a list of those categories.
- Where you have requested specific pieces of personal information, we will provide the information you have requested, to the extent required under the CCPA and provided we do not believe there is an overriding privacy or security concern in doing so.
- Where you have requested that we delete personal information that we have collected from you, we may seek to confirm whether your request is for an "opt out" or a "deletion." Because "opt out" or "do not sell" rights enable us to maintain your information for "suppression" purposes (i.e., to prevent us from selling information about you in the future, which is what many consumers requesting deletion actually want), we try to explain this to ensure we are meeting your preferences. (In addition, deletion rights only apply to information that we have collected "from" consumers, which does not apply to much of the information in our databases.)
Upon completion of the above process, we will send you a notice that explains the categories of personal information we were able to locate about you, and whether we (1) deleted, (2) de-identified, or (3) retained the information we collected from you. Certain information may be exempt from such requests under applicable law. If we are unable to complete your request fully for any of the reasons above, we will provide you additional information about the reasons that we could not comply with your request.
e. Right to nondiscrimination
We will not deny, charge different prices for, or provide a different level of quality of goods or services if you choose to exercise these rights.
f. Information about persons under 16 years of age
We do not knowingly collect personal information from minors under 16 years of age in California unless we have received legal consent to do so. If we learn that personal information from such California residents has been collected, we will take reasonable steps to remove their information from our database (or to obtain legally required consent).
g. Authorized agents
You may designate an agent to make requests to exercise your rights under the CCPA as described above. When we receive such a request, we may (as appropriate) take steps both to verify the identity of the person seeking to exercise their rights and to verify that your agent has been authorized to make a request on your behalf, through a signed written authorization or a copy of a power of attorney.
h. Data retention
We will keep your information only for as long as necessary to fulfill the purposes described in our Privacy Policy, unless a longer retention period is required or permitted by law. We may delete or de-identify your information sooner if we receive a verifiable deletion request, subject to exemptions under applicable law. The retention period that applies to your information may vary depending on the information we have, the Services you use, or how you interact with us. We may retain cached or archived copies of your information.
Contact
Questions about this notice or your California privacy rights can be sent to privacy@3pdata.io. 3P Data will respond as required by applicable law.