California Residents
Effective: January 1, 2023
If you are a California resident, the processing of certain personal data about you may be subject to the California Consumer Privacy Act of 2018, California Civil Code Sections 1798.100-1798.199 (“CCPA”), California Privacy Rights Act of 2020 (“CPRA”) and other applicable California state privacy laws. Beginning January 1, 2020, the CCPA gives you certain rights with respect to the processing of your personal data (known as “personal information”, as described under the CCPA). Beginning January 1, 2023, the CPRA amends CCPA and gives you certain rights with respect to the processing of your personal information as described under the CPRA.
This supplement provides additional privacy disclosures and informs you of your additional rights as a California resident, and should be read in conjunction with our PRIVACY POLICY, which describes what information we collect and how we use it.
Consumer Rights under CCPA and CPRA
- Right to Request Disclosure of Personal Information Collected (Right of Access). A consumer shall have the right to request that a business which collects a consumer's personal information disclose to that consumer the categories and specific pieces of personal information the business has collected. (CCPA 1798.100(a), 1798.110(c)(5) and 1798.130(a)(5)(A)) (CPRA)
- Right of Rectification. The right for a consumer to request that the incorrect or outdated personal information be corrected but not deleted. (CPRA)
- Right to Request Deletion. A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from the consumer unless exceptions apply. (CCPA 1798.105(a))(CPRA)
- Right of Restriction. The right for a consumer to restrict a business’s ability to process personal information (i.e., sensitive information that reveals an individual’s government ID, finances, geolocation, race, religion, and union membership, consumer’s private communications, genetics, biometrics, consumer’s health, sexual orientation ) about the consumer. (CPRA)
- Right to Request Disclosure of Personal Information Collected, Sources, Purposes for Collection or Sale and Third Parties with whom Shared (Right of Access). A consumer shall have the right to request that a business that collects personal information about the consumer disclose to the consumer the following:
- The categories of personal information it has collected about that consumer in the preceding 12 months.
- The categories of sources from which the personal information is collected.
- The business or commercial purpose for collecting or selling personal information.
- The categories of third parties with whom the business shares personal information.
- The specific pieces of personal information it has collected about that consumer.
(CCPA 1798.110(a)-(b) and 1798.130(a)(3))(CPRA)
- Right to Request Disclosure of Personal Information Collected, Sold and Disclosed and Third Parties to whom Sold (Right of Access). A consumer shall have the right to request that a business that sells the consumer's personal information, or that discloses it for a business purpose, disclose to that consumer:
- The categories of personal information that the business collected about the consumer.
- The categories of personal information that the business sold about the consumer in the preceding 12 months and the categories of third parties to whom the personal information was sold in the preceding 12 months, by category or categories of personal information for each category of third parties to whom the personal information was sold.
- The categories of personal information that the business disclosed about the consumer for a business purpose in the preceding 12 months.
(CCPA 1798.115(a)-(b) and 1798.130(a)(4))(CPRA)
- Right of Portability. The right for a consumer to request personal information about the consumer be disclosed in a common file format. (CCPA, CPRA)
- Right to opt-out of sales. The right for a consumer to opt out of the sale of personal information about the consumer to third parties. (CCPA, CPRA)
- Right Against Automated Decision making. A prohibition against a business making decisions about a consumer based solely on an automated process without human input. (CPRA)
- Private Right of Action. The right for a consumer to seek civil damages from a business for certain violations of the statute.
Business Obligations under CCPA and CPRA
- Opt-In Default (Requirement Age). A restriction placed on a business to treat consumers under a certain age (here, age 16) with an opt-in default for the sale of their personal information. (CCPA, CPRA)
- Notice/Transparency Requirement. An obligation placed on a business to provide notice to consumers about certain data practices, privacy obligations and/or privacy programs. (CCPA, CPRA).
- Risk Assessments. An obligation placed on a business to conduct formal risk assessments of privacy and/or security projects and or procedures (CPRA)
- Prohibition on Discrimination (Exercising Rights)/Right of Non-Discrimination. A business shall not discriminate against a consumer because the consumer exercised any of the consumer's rights under this title, including, but not limited to, by:
- Denying goods or services to the consumer.
- Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties.
- Providing a different level or quality of goods or services to the consumer.
- Suggesting that the consumer will receive a different price or rate for goods or services or a different level or quality of goods or services.
(CCPA 1798.125(a))(CPRA)
- Purpose/Process Limitation. Prohibits the collecting/processing of personal information except for a specific purpose (CCPA, CPRA)
To exercise your “right to know,” your “right to request deletion,” or any other right under the CCPA and CPRA, contact us as specified in Section 11 of our PRIVACY POLICY.
Please note that to protect your information and the integrity of our Service, we may need to verify your identity before processing your request. In some cases we may need to collect additional information to verify your identity, such as a government issued ID.
Under the CCPA, you may exercise these rights yourself or you may designate an authorized agent to make these requests on your behalf. We may request that your authorized agent have written permission from you to make requests on your behalf and may need to verify your authorized agent’s identity.
If you have additional questions about the supplement or how to exercise your rights under the supplement, please contact us as specified in Section 11 of our PRIVACY POLICY.