PRIVACY AND DATA SECURITY STATEMENT
Thank you for visiting Company’s online and mobile resources, and for viewing this privacy and data security statement. Our privacy statement, contained in the pages that follow, serves to give notice about the types of personal information we collect, how we use it, who we share it with and why, and what we do to try to protect it. We delve into those matters in a fair amount of detail in the pages that follow. We encourage you to read them carefully. In the meantime, we provide a quick overview below. Summary of how we handle Personal Information
● What do we collect? We collect and retain certain personal information from a variety of different data subjects including our workforce, vendors, merchant- and consumercustomers, and visitors to and users of our online and mobile resources. Our privacy statement applies mostly to those who visit and use our online and mobile resources, from whom we collect very little information unless it is voluntarily submitted to us. You can read here to learn about the categories of personal information we collect from all four groups of data subjects.
● Why do we use it? We use personal information received from visitors and users of our online and mobile resources to communicate directly with them. We provide further detail about our use of personal information below under “HOW DO WE USE THE PERSONAL INFORMATION WE COLLECT?.
● When do we share it? We share personal information when needed to fulfill our legal obligations and when our vendors and business partners and affiliates need it to perform under the contracts we have with them. We provide further detail about our sharing of personal information here We do not sell or rent any personal information from any group of data subjects to third party data brokers or marketing companies.
● How do we protect it? We’ve invested in a Security Program that addresses both technical and operational matters. Our program includes incident response and management and vendor oversight components. You can read about those components here and here.
● Your Privacy Choices and Rights You do not have to provide personal information to enjoy most of the features of our online and mobile resources. Moreover, you can opt out of certain activities like newsletters and announcements. You can learn more about that here. Contacting Our Privacy Office If you have any questions about our privacy and data security policies, procedures and practices, including anything we say in this privacy statement, we encourage you to contact our Privacy Office.
● Address: 1557 W Innovation Way, Ste 200, Lehi, Utah 84043, Attn: Legal Department
● Email: firstname.lastname@example.org
This privacy statement was amended as of September 30, 2020 and is effective as of that date. The English language version of this privacy statement is the controlling version regardless of any translation you may attempt.
NAVIGATING THROUGH THIS STATEMENT
You can use the links below to navigate to areas of this statement that apply specifically to you, or which may otherwise be of interest:
Some Important VocabularyWhat Personal Information Do We Collect?How Do We Use the Personal Information We Collect?When/With Whom Do We Share Personal Information?How Do We Protect Collected Personal Information?Your Rights And OptionsChildren’s PrivacySubmitting Information From Outside the United StatesThe California Consumer Privacy Act The EU General Data Protection RegulationChanges To This Privacy StatementContacting Us
SOME IMPORTANT VOCABULARY
WHO DO WE COLLECT PERSONAL INFORMATION FROM?
We collect personal information from four groups of data subjects: ● general visitors to, and users of, our online and mobile resources ● current members of our workforce and those who apply for posted jobs ● our third party vendors and business partners and affiliates ● our consumer-customers ● our merchant-customers
“HOW DO WE USE THE PERSONAL INFORMATION WE COLLECT?.
We use the personal information we collect only in the manner and through the means allowed by applicable law. That means we determine whether we have a lawful basis/legitimate business purpose to use your personal information before doing so. As stated in applicable law, such lawful bases/legitimate business purposes include receiving express consent, operating our business, performing a contract, and complying with a legal obligation. More specifically, we use the personal information of each group of data subjects as follows, but in all cases for all data subjects, we do not sell or rent personal information. Visitors and Users of our Online and Mobile Resources We use the automatically collected personal information described here to compile generic reports about popular pages/features of our online and mobile resources, and to see how users are accessing our online and mobile resources and in some cases (such as affinity actions) send materials to you. We use the personal information you voluntarily submitted, as described here, to respond back directly to you and/or send you the information you requested or about which you inquired. We also may use any such personal information you provide to customize our programs and newsletters to make them more relevant to you. Merchant-Customers, Vendors and Business Partners We use personal information received from merchant-customers and business partners to communicate with them and satisfy our contractual obligations to them and in such other ways as our separate written contracts with them permit. Consumer-Customers We use the personal information collected from consumer-customers as may be reasonably necessary to provide, inform you about, and improve, our shipping protection service
We may share your personal information as described below. This sharing applies to the personal information of all four groups of data subjects. Affiliates We may share personal information with other corporate affiliates who will use such information in the same way as we can under this statement. In particular, we may provide certain personal information to our insurance producer affiliate, Safe Order Solutions, LLC, to ensure your purchases are covered or if you have claims. Legal Requirements We may disclose personal information to government authorities, and to other third parties when compelled to do so by such government authorities, or at our discretion or otherwise as required or permitted by law, including responding to court orders and subpoenas. To Prevent Harm We also may disclose such information when we have reason to believe that someone is causing injury to or interference with our rights or property, or harming or potentially harming other persons or property. Business Sale/Purchase If we, or any of our affiliates, sell or transfer all or substantially all of our assets, equity interests or securities, or are acquired by one or more third parties as a result of an acquisition, merger, sale, reorganization, divestiture, consolidation, or liquidation, personal information may be one of the transferred assets. Vendors and Business Partners We also share personal information with those of our vendors and business partners who need it to perform under the contracts we have with them. For instance, the insurance brokers and carriers who are involved in the issuance of the policies used in our shipping protection services may require that we share your personal information with them in order to cover your purchases. As part of our Security Program, we have adopted standards for those vendors and business partners who receive personal information from us. We attempt to bind such vendors and business partners to those standards via written contracts. Such standards include expectations that when we share personal information with our vendors and business partners, they will comply with all applicable privacy and data security laws and regulations and our Security Program, and will contractually require and cause their subcontractors and agents to do the same. For any personal information our vendors and business partners process or store at their own locations, we further expect them to use technology infrastructure meeting, at least at the facilities level, minimum recognized standards for security controls. Such recognized standards include those published by the International Standards Organization, the National Institute of Standards and Technology or any reasonably equivalent standards. Please note, however, that we cannot guarantee that all of our vendors and business partners will agree to the above-described contractual requirements; nor can we ensure that, even when they do agree, they will always fully comply.
HOW DO WE PROTECT COLLECTED PERSONAL INFORMATION?
Our Data Security Program We have adopted, implemented and maintain an enterprise-wide corporate information security and privacy program that includes technical, organizational, administrative, and other security measures designed to protect, as required by applicable law, against reasonably anticipated or actual threats to the security of your personal information (the “Security Program”). Our Security Program includes, among many other things, procedures for assessing the need for, and as appropriate, either employing encryption and multifactor authentication or using equivalent compensating controls. We therefore have every reason to believe our Security Program is reasonable and appropriate for our business and the nature of foreseeable risks to the personal information we collect. We further periodically review and update our Security Program, including as required by applicable law. Our Incident Response and Management Plan Despite the significant investment we’ve made in, and our commitment to, the Security Program including enforcement of our third party oversight procedures, we cannot guarantee that your personal information, whether during transmission or while stored on our systems, otherwise in our care, or the care of our vendors and business partners and affiliates, will be free from either failed or successful attempts at unauthorized access or that loss or accidental destruction will never occur. Except for our duty under applicable law to maintain the Security Program, we necessarily disclaim, to the maximum extent the law allows, any other liability for any such theft or loss of, unauthorized access or damage to, or interception of any data or communications including personal information. All that said, as part of our Security Program, we have specific incident response and management procedures that are activated whenever we become aware that your personal information was likely to have been compromised. Those procedures include mechanisms to provide, when circumstances and/or our legal obligations warrant, notice to all affected data subjects within the timeframes required by law, as well as to give them such other mitigation and protection services (such as the credit monitoring and ID theft insurance) as may be required by applicable law. We further require, as part of our vendor and business partner oversight procedures, that such parties notify us immediately if they have any reason to believe that an incident adversely affecting personal information we provided to them has occurred.
YOUR RIGHTS AND OPTIONS
If we are using your personal information to send you marketing materials, such as newsletters or product alerts via text or email, you may opt out by following the opt-out instructions in the email or other communication (e.g., by responding to the text with “STOP”). When we receive your request, we will take reasonable steps to remove your name from our distribution lists, but it may take time to do so. You may still receive materials for a period of time after you opt out. In addition to opting out, you have the ability to access, amend and delete your personal information by contacting us using the contact information below. Opting out of or changing affinity actions or other submissions or requests made on our external social media presence, will likely require that you do so directly on that applicable platform as we do not control their procedures. Some browsers have a “do not track” feature that lets you tell websites that you do not want to have your online activities tracked. At this time, we do not specifically respond to browser “do not track” signals.
Federal law imposes special restrictions and obligations on commercial website operators who direct their operations toward, and collect and use information from children under the age of 13. We take those agerelated requirements very seriously, and, consistent with them, do not intend for our online and mobile resources to be used by children under the age of 18, and certainly not by anyone under the age of 13. Moreover, we do not knowingly collect personal information from minors under the age of 18. If we become aware that anyone under the age of 18 has submitted personal information to us via our online and mobile resources, we will delete that information and not use it for any purpose whatsoever. We encourage parents and legal guardians to talk with their children about the potential risks of providing personal information over the Internet.
THE LAW VARIES FROM PLACE-TO-PLACE: CCPA AND THE GDPR
Privacy and data protection laws vary around the world and among the several United States. Most prominently, residents of California and data subjects whose personal information was obtained from them while they were in the European Economic Area, the United Kingdom and Switzerland, have certain additional rights in cases where the party collecting that information is governed by the applicable law.
The California Consumer Privacy Act
When we collect personal information from California residents we become subject to, and those residents have rights under, the California Consumer Privacy Act or “CCPA”. This section of our statement is used to allow us to fulfill our CCPA obligations and explain your CCPA rights. For purposes of this section, the words “you” and “your” mean only such California residents. What did we collect from California Residents? We collected the following categories of personal information within the last 12 months: ● identifiers such as name, address, IP address, and other similar identifiers ● personal information under the Customer Records provision of the California Civil Code such as a name, address, telephone number, credit card number ● characteristics of protected classifications such as race, gender, ethnicity ● commercial information such as products or services purchased ● biometric information such as fingerprints or facial or retina scans ● internet/electronic activity such as browsing history and search history ● geolocation data including geographic coordinates/physical location ● audio, video, electronic or other similar information ● professional or employment related information such as job history and performance evaluations ● education information such as grades or transcripts ● inferences drawn from the foregoing to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological traits, predispositions, behavior, attitudes, intelligence abilities and aptitudes. What Personal Information did we disclose for a business purpose? We may have disclosed the categories of personal information listed above for one or more business purposes permitted by the CCPA during the last 12 months. What Personal Information did we sell? We do not sell, and within the last 12 months have not sold, personal information to third parties. What sources did we obtain Personal Information from and why did we collect it? Please re-review this part of this privacy statement to understand the scope of purposes and the sources from which we collect it. Similarly, we urge you to re-read this part of this statement where we describe the categories of third parties with which we may share your personal information and why. Rights of California Residents You have the following rights under the CCPA. It’s important to us that you know that if you exercise these rights, we will not discriminate against you by treating you differently from other California residents who use our sites and mobile resources or purchase our services but did not exercise their rights. ● Know – the right to request that we disclose to you, specifically beyond the general statement immediately above, the categories and specific elements of personal information collected including the source of the information, our use of it and, if the information was disclosed or sold to third parties, the categories so disclosed or sold as well as the categories of third party who received or purchased it. ● Access – the right to receive a copy of the categories and specific elements of personal information we collected about you in the preceding 12 months. ● Delete – the right to request that we delete the personal information we collected about you under certain circumstances. You, or an authorized agent acting on your behalf, can exercise the Right to Know up to two different times every 12 months. To exercise these rights, contact us at email@example.com or toll free number. We may ask you to fill out a request form. The CCPA only allows us to act on your request if we can verify your identity and/or your agent’s authority to make the request, so you will also need to follow our instructions for identity verification. If you make a verifiable request per the above, we will confirm our receipt and respond in the time frames prescribed by the CCPA.
The EU General Data Protection Regulation
We do not have personnel or operations in the Economic Area Union (“EEA”), or the United Kingdom (“UK”) (collectively, the “GDPR Jurisdictions”). And while we do not actively block or prohibit consumercustomers located in GDPR Jurisdictions from downloading the English language version of the Route App; nor merchant-customers there from offering our shipping protection service as a value add to their own customers, we do not direct our sales and marketing activities toward the GDPR Jurisdictions. We therefore do not believe that, as of the effective date of this policy, we are governed by the European Union’s General Data Protection Regulation (“GDPR”). We have, however, as required by the CCPA and other applicable U.S. laws such as the New York SHIELD Act, and as a good business practice generally, adopted and implemented a data security program that includes technical, organizational and administrative measures reasonably designed to protect, in a manner consistent with accepted industry standards, the privacy of those natural persons with whom we do business and to reduce the likelihood of unauthorized access to or unauthorized use of personal information we collect. We also enter into Data Protection Agreements with those of our merchant-customers who have, or believe they have, GDPR obligations that flow-down to us. For general site visitors, consumer-customers and regulators who have questions about whether or how the GDPR or other industry- or jurisdiction-specific laws apply to us, you can contact us using the contact information found here.
CHANGES TO THIS PRIVACY STATEMENT
We reserve the right to change or update this statement from time to time. Please check our online and mobile resources periodically for such changes since all information collected is subject to the statement in place at the time of collection. Typically, we will indicate the effective/amendment date at the beginning of this statement. If we feel it is appropriate, or if the law requires, we’ll also provide a summary of changes we’ve made near the end of the new statement.
If you have questions about our privacy statement or privacy practices, please contact our Privacy Office: ● Address Email: firstname.lastname@example.org