BritePool CCPA Privacy Notice
Privacy Notice For California Residents
Effective Date: January 1, 2020 (last updated 3/26/2020)
The California Consumer Protection Act of 2018 (“CCPA”) provides numerous rights to help consumers gain control over their personal information. BritePool, Inc. (“BritePool”, “we”, “us”, “our”) of course complies with this new law and our hope is to make it easy for you to benefit from its protections. Below, we outline in detail how we comply with the law, its implications for you and the like. As you might expect, it is long, but the goal is to give every consumer a clear understanding of their rights. This Notice supplements and should be read in conjunction with BritePool’s other Privacy Notices. This link and the interactive Table of Contents below can help you navigate through it all. If our information practices change, we will post these changes on this page, and we encourage you to visit it periodically to learn of any updates.
The CCPA is aimed at protecting the personal information (“PI”) of California residents (“consumer”, “you”, “yours”). PI is defined very broadly under the CCPA and includes information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a consumer or household. The CCPA groups PI by category type, of which there are eleven. These include identifiers, sensitive records, protected classifications, commercial information, biometrics, Internet activity, geolocation, sensory data, employment and inferences.
BritePool is an identity resolution services company. What this means is that we provide a proprietary technology platform that utilizes our database of unique identifiers (“BPIDs”), rather than third-party cookies, to aid marketers in delivering effective advertising across the open Web, while at the same time providing you with greater transparency and control over your data (collectively, “Service” or “Services”). We pride ourselves on collecting, using and sharing minimal amounts of consumers’ PI to do what we do; however, to the extent those activities are necessary to make our website accessible and otherwise provide our Services, this California Privacy Notice will provide you with all you need to know.
The CCPA provides you with five fundamental rights: 1) be informed about the collection, use, disclosure and sale of your PI (“Right to Know”); 2) access your PI (“Right to Access”); 3) request it be deleted (“Right to Delete”); 4) object to its sale (“Right to Opt-Out”); and 5) not be discriminated against for exercising these rights (“Right Against Discrimination”).
RIGHT TO KNOW
Collection, Purposes of Use and Sharing of PI
Of the eleven enumerated categories of PI, BritePool collects only a few, many of which are provided directly by you. We do not collect any information related to sensitive records, protected classifications, commercial data, biometrics, sensory data or employment. Generally speaking, BritePool uses the PI we collect for the purpose of operating, delivering, improving and personalizing our Site and Services, and we will not use it for any materially different purpose without providing you notice. BritePool primarily uses the information to create and/or “match” BPIDs for consumers. This “matching” or verification process (“Verification”) makes it possible for our advertising clients to more effectively serve personalized ads to you without the use of third-party cookies. It also makes it possible for our online, ad-supported publishing partners to continue to offer you the content you love for free. You in turn benefit from greater personalization, transparency, control and incentives. If you want more details about what we collect, where we get it, and how we use it, please see below.
From You. BritePool collects a limited amount of PI from you when you visit our Site and/or use our Services. For instance, when you create an account with BritePool, you voluntarily share certain identifiers, including your first name and email address. You may also share inferential information such as ad preferences, and any other information you choose to provide. During your visits, we also use analytics, cookies and other technology to collect technical information relating to those interactions, including browser type, IP address, device type, pages visited, activities performed, time/date of visit and other similar information. BritePool uses this information to create your BPID. We may also use it to send surveys, promotions and marketing materials that we think you may like and otherwise communicate with you and/or respond to your inquiries; maintain security; and comply with the law. Except for your BPID, BritePool does not share your name, email address or any other information described herein with any third parties.
From Third-Party Data Providers. BritePool collects PI from third-party data providers. This information is restricted to forms that are not directly identifying in nature (e.g. MAIDS, other unique identifiers), and encrypted both at rest and in transit. We use it to enhance its pool of BPIDs. Except for your BPID, BritePool does not share any PI from third-party data providers with any other third parties.
From BritePool Clients and Partners. BritePool also collects consumers’ PI in the form of hashed emails, MAIDS or unique identifiers from some of our advertising clients and online publishing partners. BritePool uses this information for Verification purposes. In some instances, we serve as a service provider for our clients/partners, in which case our processing of the data is done at the direction of, and via written contract, with each respective client/partner. During Verification, if we find any BPIDs that match, we provide those BPIDs to our client/partner. For any data that does not have matching BPIDs, we create a new BPID and provide it to our client/partner. As a Service Provider, we do not retain the information, use it for any purpose other than described herein, use it for our own benefit, or further share it.
From DSPs and/or SSPs. Publishers make their ad impressions available through marketplaces called ad exchanges or Supply Side Platforms (“SSPs”), and Demand Side Platforms (“DSPs”) automatically decide which of those impressions makes the most sense for an advertiser to buy. When our advertising clients and publishing partners use BPIDs to enable better personalization of advertising to you, we may receive transactional information from DSPs or SSPs regarding the same. We do not share this information with anyone; rather we will only use it to provide you with information related to advertising targeted to you.
From Service Providers. We may collect from/share with service providers that process data on our behalf, such as email services.
When Sharing PI Is a Sale Under CCPA
“Sale” is very broadly defined under the CCPA to mean any “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s PI to another business or third party for monetary or other valuable consideration.” As described above, we share BPIDs (identifiers) with advertising clients, online publishing partners, DSPs and SSPs. We also share information about internet activity with analytics providers. Because the definition of “sale” is so broad, sharing of PI with third parties is generally considered selling of PI unless one or more of the exceptions outlined below applies.
When Sharing Is Not a Sale Under CCPA
Business Purpose. When BritePool shares PI we collect with third parties for the business purposes outlined below, it does not constitute a sale.
Auditing Interactions (i.e. counting ad impressions and other performance metrics);
Security (i.e. fraud detection and prevention);
Debugging/Repair of Impairments to Functionality;
Short-Term Uses. (i.e. transient uses whereby PI is not disclosed to a third party, and not used to build a consumer profile, or alter an individual’s experience outside the current transaction (including contextual ads as part of the same interaction);
Performing Services (i.e. account maintenance and servicing, customer service, verification of information, advertising, marketing and analytics);
Internal Research for Tech Development;
Quality and Safety Maintenance and Verification (i.e. improvement, upgrade or enhancement of the service, and maintenance and verification of the service’s safety).
Service Provider Purposes. Service providers, which are prohibited from retaining, using or disclosing PI except for very limited purposes, are exempted from CCPA rights and obligations related to third-party disclosures. As such, disclosures made in this context do not constitute a sale. BritePool both receives and shares PI in the context of a business – service provider relationship. As a business BritePool shares PI with service providers which provide web hosting, content delivery, data management, ad serving, email service providers, reward program management, operations, analytics, targeting, reporting, customer support, compliance and other services that make it possible to offer and improve our services. At other times we may serve in the capacity of service provider and receive, handle and process PI on behalf of our publishing partners and advertising clients in the provision of our identity resolution services.
Communicating Opt-Out Preference Purposes. It is not a sale if we use or share your PI for the purposes of alerting third parties to an opt-out request.
Corporate Transaction Purposes. We may share PI as part of a corporate sale, merger, or acquisition, or other transfer of all or part of our assets, including as part of a bankruptcy proceeding. This does not constitute a “sale” under CCPA.
Legal Purposes. The CCPA does not restrict our ability to comply with federal, state or local laws. We may share PI with third parties pursuant to a subpoena, court order, governmental inquiry or other legal process, or as otherwise required by law, or to protect our rights or the rights of third parties.
RIGHT TO ACCESS/DELETE
You have the right to request access to the categories and specific pieces of PI collected, disclosed or sold for a business purpose. You also have the right to request deletion of PI collected. The CCPA limits the number of times you may make such requests in any 12-month period. For all such requests, BritePool will respond within the timeframe and otherwise as required by law.
Verification of Identity
Before responding to any request to access or delete, BritePool will attempt to verify that you are who you say you are to a reasonable degree of certainty. To do this, we may need to collect personal information from you; however, we will not use it for any purpose other than verifying your identity. If you request specific pieces of your information, responses to which the law imposes a higher degree of certainty, we may require you to provide more information than if your request is limited to categories of information. If you’re an account holder, we will attempt to match the information we collect with the information you provided when you set up your account. If you do not have an account with us, the verification process may require additional pieces of information from you. If the request relates to household information, we may attempt to verify each member of your household if required by law to do so. For requests to delete, we may use a multi-tiered approach to reauthenticate your identity if the law permits or requires the same. We will use reasonable security measures to detect fraudulent identity verification procedures and prevent the unauthorized access to or deletion of your personal information. If we believe that there is fraudulent or malicious activity on a password-protected account, we may require additional verification procedures to confirm your request is authentic. BritePool may use a 3rd party service to perform any and all verification functions. The verification process will be free of charge to you.
Acceptance of Request
If we are able to verify your identity, we will act upon your request as applicable and as required by law. In the case of verified requests for access to PI, we will provide the information unless the risk to you or BritePool is too great. In the case of verified requests to delete, we will either permanently and completely erase your PI from our existing systems or deidentify or aggregate the PI such that the data is anonymized. We will request our service providers do the same. In the event one of our service providers receives a request to access or delete PI directly from you, the law allows the service provider to respond on our behalf or inform you that it cannot respond because the request was made to a service provider.
Denial of Request
BritePool may deny a request to access or delete if we cannot verify your identity. In that case we will offer you the option of requesting an opt-out. We may also deny a request to delete if an exception applies. In that case, any continued use of PI by us will be limited to that exception.
We will handle the processing of your complaint within the timeframe required by law. Upon completion of the processing of your request, we will notify you of the same along with any applicable details. We will maintain a record of any request and our handling of the same for at least twenty-four months.
Exercise of Right to Access/Delete
To exercise your right to access your PI, please click Request My Personal Information. To exercise your right to delete, please click Delete My Personal Data. You may also send requests to access and delete via email to firstname.lastname@example.org or via mail to BritePool, Inc., 444 New England Ave. Winter Park FL, 3278, Attn.: CCPA Access/Delete Request. You may request to review, change, or update your contact information by emailing us at email@example.com.
You can authorize another person registered to conduct business in California to make a request under the CCPA on your behalf. You will have to provide written authorization to your Authorized Agent and directly confirm with BritePool that you provided the authorized agent with written and signed permission to submit the request on your behalf.
RIGHT TO OPT-OUT
The CCPA was not designed to prevent the collection, use and sharing of PI, as those activities are an integral part of the manner in which companies do business and how they provide you with the information, products and services that are important to your daily life. Rather, it was designed to prevent your PI from being sold without your permission. As such you have the right, at any time, to refuse or “opt-out” of the sale of PI to third parties. When exercising a request to opt-out, we may present you with the choice to opt-out of certain categories of PI along with a global option to opt-out of the sale of all PI. The CCPA does not require identity verification in the case of opt-out requests. Upon receipt of your submission, BritePool will acknowledge the same and notify any third parties with whom we shared your PI if required by law. We will handle the processing of your opt-out, provide appropriate notification and maintain applicable records related to your request within any relevant timeframes and as otherwise required by law. To exercise your right to opt-out, please complete and submit the webform available at Do Not Sell My Personal Information. We may reach out to you after one year to invite you to opt back in. We may reach out to you after one year to invite you to opt back in.
RIGHT AGAINST DISCRIMINATION
You have a right not to be discriminated against. BritePool will not discriminate against you because you exercise privacy rights under the CCPA. For example, we will not deny you nor provide you with any less quality of services. However, we may choose, and the law permits us, to reward you for allowing us to collect and/or sell your PI for the purposes mentioned herein. We may offer you financial incentives including payments. We may also offer you a better level of services provided the difference is directly related to the value provided to you by your data. If we offer any such reward program, all material terms will be disclosed, and you will understand how we value your PI. Your consent is required for participation in any such program. You will be able to withdraw your consent to participate at any time and be provided a method to opt-out.
HOW TO CONTACT US
If you have questions about your rights under the CCPA, BritePool’s collection, use, sharing or sale of PI, or our privacy policies, please contact us by emailing firstname.lastname@example.org, or writing us at 444 New England Ave. Winter Park FL, 3278, Attn.: CCPA.