Effective: February 1, 2021
TYPES OF INFORMATION WE COLLECT
We collect Personal Information (defined below) and information that is not Personal Information (“Non-Personal Information,” together with Personal Information, “Information”). “Personal Information” means the information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to a person or a household. We may combine Non-Personal Information with Personal Information, and in those circumstances, we will treat the combined information as Personal Information.
We have collected the following categories of Personal Information from you within the last twelve (12) months:
Personal Information Collected
|A. Identifiers||A first and last name, log-in details, unique personal identifier, online identifier, Internet Protocol address, email address, phone number, account name, postal address|
|B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))||A first and last name, log-in details, unique personal identifier, online identifier, Internet Protocol address, email address, phone number, account name, postal address|
|C. Commercial Information||Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.|
|D. Internet or other similar network activity||Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.|
We do not collect Personal Information related to protected classification characteristics under California or federal law, biometric information, sensory data, professional or employment-related information from the users of our Website, Stores, or Services, non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)), and inferences drawn from other information.
HOW WE COLLECT PERSONAL INFORMATION THAT YOU PROVIDE TO US
We collect Personal Information when you:
- Establish an account with us;
- Use our Services;
- Pay for our Services; or
- Choose to correspond with us through email, we may retain the content of your email messages together with your email address and our responses, unless it is a request for deletion, in which case we will delete all your Personal Information in your request after completion of the same.
HOW WE COLLECT INFORMATION FROM YOUR BROWSER OR DEVICE
- Your Browser or Device. Information collected automatically as a result of your interaction with us and your use of the Service. The information that we automatically collect, include your IP Address, geolocation information (which may include specific longitude and latitude), time zone, usage times and volume, and information about the device you are using (for example, device type, device ID, characteristics and status, browser type, operating system and application version and information about how our Site is used), language preference, URL click stream, or information that we collect through our marketing activities, We use Google Analytics to collect such data. Terms of Service for Google Analytics are available here: https://www.google.com/analytics/terms/us.html.
We may use the following types of cookies:
- Analytical/performance cookies. These cookies allow us and our third-party service providers to recognize and count the number of visitors and to see how visitors move around our website when they are using it. This helps us improve how our website works by, for example, ensuring that users can easily find what they need on our website. These cookies generate aggregate statistics that are not associated with an individualized profile, and are session cookies that generally last until your session is over and persistent cookies that generally last up to two years.
- Functionality cookies. These cookies enable helpful but non-essential website functions that improve your website experience. By recognizing you when you return to our website, they may, for example, allow us to personalize our content for you, greet you by name, or remember your preferences. These are session cookies that last until your session is over and persistent cookies that generally last six months.
Except for strictly necessary cookies, all first-party cookies set by this site will expire when the browsing session ends. Third-party cookie expiration periods are set by their respective owners.
SHARING INFORMATION WITH THIRD PARTIES
We may share your Personal Information, may be processed with, or stored on the following third-party service providers.
- Cloud storage
- Web-form Providers
- Data analytics
- Document repository services
- Internet (e.g. ISPs)
- Network infrastructure
We may also share your Personal Information in the following circumstances:
- With companies or other entities that we plan to merge with or be acquired by. You will receive prior notice of any change in applicable policies.
- With companies or other entities that purchase Norcal’s assets pursuant to a court-approved sale or where we are required to share your information pursuant to insolvency law in any applicable jurisdiction.
- With our professional advisors who provide banking, legal, compliance, insurance, accounting, or other consulting services in order to complete third party financial, technical, compliance and legal audits of our operations or otherwise comply with our legal obligations.
- With law enforcement, officials, or other third parties when we are compelled to do so by a subpoena, court order, or similar legal procedure, or when we believe in good faith that the disclosure of Personal Information is necessary to prevent physical harm or financial loss, to report suspected illegal activity, or to investigate violations of any other applicable policies.
ANONYMIZED AND AGGREGATED DATA
Anonymization is a data processing technique that removes or modifies personal information so that it cannot be associated with a specific individual. We may use anonymized or aggregate data for any business purpose, such as to better understand the needs and behaviors of our users, improve our Services, conduct business intelligence and marketing, and detect security threats. We may perform our analytics on anonymized data or enable analytics provided by third-parties.
USE OF INFORMATION
We may use or disclose the Personal Information we collect for one or more of the following purposes:
- To fulfill or meet the reason you provided the Personal Information.
- To provide, support, personalize, and develop our Website, maintain inventory in our Stores, and Services.
- To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
- For testing, research, analysis, and product development, including to develop and improve our Website, Stores, and Services.
- To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
- As described to you when collecting your Personal Information or as otherwise set forth in the California Consumer Privacy Act of 2018, as amended from time to time, and all implementing regulations and promulgated by the California Attorney General to date (“CCPA”).
- To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information is held by us.
We will not collect additional categories of Personal Information or use the Personal Information we have collected for materially different, unrelated, or incompatible purposes without providing you notice.
PROTECTING YOUR INFORMATION
We take reasonable measures to help protect information about you from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction.
We may disclose your Personal Information if required to do so by law or subpoena or if we believe that such action is necessary to (a) conform to the law or comply with legal process served on us or affiliated parties; (b) protect and defend our rights and property, the Website, Store, and our Services; and (c) act under circumstances to protect the safety of users of the Website, Store, our Services, or third parties.
What About Other Website Through Which Our Services Are Available?
We are not responsible for the practices employed by any other website that may/may not link or provide access to our Services.
We do not knowingly collect any Personal Information from children under the age of 13. Our Services and Websites are directed to people who are at least 13 years old or older.
CALIFORNIA RESIDENTS’ RIGHTS AND CHOICES
Access to Specific Information and Data Portability Rights
You have the right to request that we disclose certain information to you about our collection and use of your Personal Information over the past 12 months. Once we receive and confirm that you are the one who made the verifiable consumer request, as defined in the CCPA, (“VCR”), we will disclose to you the following:
- The categories of Personal Information we collected about you.
- The categories of sources for the Personal Information we collected about you.
- Our business or commercial purpose for collecting or selling that Personal Information.
- The categories of third parties with whom we share that Personal Information.
- The specific pieces of Personal Information we collected about you (also called a data portability request).
- If we sold or disclosed your Personal Information for a business purpose, two separate lists disclosing:
- sales, identifying the Personal Information categories that each category of recipient purchased; and
- disclosures for a business purpose, identifying the Personal Information categories that each category of recipient obtained.
We do not provide these access and data portability rights for B2B information.
You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your VCR, we will delete your Personal Information from our records, unless an exception applies.
We may deny your deletion request if retaining the Information is necessary for us or our service provider(s) to:
- Complete the transaction for which we collected the Personal Information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform our contract with you.
- Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
- Debug products to identify and repair errors that impair existing intended functionality.
- Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
- Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
- Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
- Enable solely internal uses that are reasonably aligned with Consumer expectations based on your relationship with us.
Comply with a legal obligation.
- Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
We do not provide these deletion rights for B2B Information.
Exercising Access, Data Portability, and Deletion Rights
To exercise the access, data portability, and deletion rights described above, please submit a VCR to us by either:
- Emailing us at firstname.lastname@example.org
- Phone No: 925-594-5250
Only you, or someone legally authorized to act on your behalf, may make a VCR related to your Personal Information. You may also make a VCR on behalf of your minor child.
You may designate an authorized agent to make a request to access or a request to delete on your behalf. A response will be furnished to your authorized agent’s request if they submit proof that they are registered with the California Secretary of State to be able to act on your behalf, or submit evidence you have provided them with power of attorney pursuant to California Probate Code section 4000 to 4465. Authorized agents may not be provided with the response pertaining to the request if the authorized agents fail to submit a proof of authorization or are unable to verify their identity.
You may only make a VCR for access or data portability twice within a 12-month period.
We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you.
Making a VCR does not require you to create an account with us.
We will only use Personal Information provided in a VCR to verify the requestor’s identity or authority to make the request.
Response Timing and Format
We endeavor to respond to a VCR within forty-five (45) days of its receipt. If we require more time, we will inform you of the reason and extension period in writing.
We will deliver our written response by mail or electronically, at your option.
Any disclosures we provide will only cover the 12-month period preceding the VCR’s request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
We do not charge a fee to process or respond to your VCR.
We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:
- Deny you goods or services.
- Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
- Provide you a different level or quality of goods or services.
- Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
- However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your Personal Information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.
OTHER CALIFORNIA RESIDENTS RIGHTS
Under California’s “Shine the Light” law, California residents who provide Personal Information in obtaining products or services for personal, family, or household use are entitled to request and obtain from us once a calendar year information about the information we shared, if any, with other businesses for their own direct marketing uses. If applicable, this information would include the categories of such data, the names and addresses of those businesses with which we shared for the immediately prior calendar year. To request a notice, please email your request to email@example.com. Please be aware that not all information sharing is covered by the “Shine the Light” requirements and only information on covered sharing will be included in our response. Please also note that we do not share your Personal Information with any other business for that business’s marketing use.