XYZ SystemsHub California Consumer Privacy Act Addendum
This Addendum supplements the information contained in the XYZ SystemsHub Privacy Policy and applies to Website visitors, Customers, Users, Registrants, End Users, Affiliates and other individuals (incl. households) who are residents of the State of California, USA ("consumer", "you", "your").
For avoidance of doubt, the term "data subject" used in the Privacy Policy shall correspond to the term "consumer" used herein and the term "personal data" in the Privacy Policy shall be equivalent to the term "personal information" used herein. All other terms which are not explicitly defined in this Addendum shall have the meaning as set forth in the Privacy Policy.
This Addendum is drafted in compliance with the California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 ("CCPA"), together hereinafter referred to as the "CCPA", and other relevant California privacy laws and its purpose is to provide additional privacy disclosures and to inform you of your additional rights as a California resident.
I. Categories of personal information we collect
We collect information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer ("personal information").
Section I ("Categories of data subjects and types of personal data") of the Privacy Policy describes in detail what categories of personal information we have collected from consumers within the last twelve (12) months.
Sensitive personal information
Some of the personal information we collect may be considered "sensitive" within the meaning of Section 1798.140 (ae) of the CCPA. We may collect the following sensitive personal information: social security, driver’s license, state identification card, or passport number; account log-in information; debit card or credit card number; contents of a consumer’s mail, email, and text messages unless we are the intended recipient of the communication.
II. Sources of personal information collection
Apart from you, being the main source of information we collect about you, we may also collect personal information from publicly accessible sources (e.g. companies trade register, WHOIS, local national list(s) of sanctioned persons) and/or third parties, such as our affiliates, trusted partners, including but not limited to marketing, advertising, security service providers, etc.
III. Purposes for collection of personal information, incl. sensitive personal information
The business and commercial purposes for which we collect, use and disclose personal information, incl. sensitive personal information about consumers are described in detail in Section III ("Purposes of and legal basis for data processing") of the Privacy Policy.
IV. Disclosing of personal information to third parties
We may disclose personal information to the categories of third parties and for the disclosure purposes as set forth in Section V ("Sharing of personal data") of the Privacy Policy.
V. Data retention periods
The periods for which we retain your personal information are described in Section VIII ("Retention periods") of the Privacy Policy.
VI. Sale and share of personal information
In the course of provision of our Services we do not sell any personal information related to consumers.
XYZ SystemsHub has taken substantial steps to identify whether any of our activities as well as our data sharing arrangements would constitute a “sale” or “share” under the CCPA. Due to the complexities and ambiguities in the CCPA, we evaluate some of our third-party relationships periodically.
Under the CCPA, "sell," "selling," "sale," or "sold," means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for monetary or other valuable consideration. Therefore, it does not necessarily mean money was exchanged for the transfer of personal information, but the transfer may still be considered a "sale". "Share" is defined as sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged.
VII. Consumer rights under the CCPA
The CCPA provides consumers with specific rights with respect to their personal information as follows:
1. Right to opt-out from sale or share of personal information
A consumer shall have the right, at any time, to direct XYZ SystemsHub not to sell or share the consumer’s personal information (“the right to opt-out”). Such a request of the consumer shall be respected for at least twelve (12) months before requesting that the consumer authorizes again the sale or share of the consumer’s personal information. In order to process the consumer’s request, XYZ SystemsHub may use any personal information collected from the consumer in connection with the submission of the consumer’s opt-out request solely for the purposes of complying with the opt-out request.
To exercise your right to opt-out from sale or share or any other right under the CCPA, you may submit a request at any time via email to dpo (at) systemshub.xyz. At a minimum, you must provide us with your names and email address you have used when engaging with us. We reserve the right to request additional information in order to identify you and process your request. We will keep a record of this request. Please note that we will not discriminate against you if you exercise your rights under the CCPA.
2. Right to know request. Right to access and data portability
Pursuant to the CCPA, you have a right to request information about the collection, use, and disclosure of your personal information performed by XYZ SystemsHub over the preceding twelve (12) months, as well as to ask to provide you with these specific information:
- Categories and specific pieces of personal information we have collected about you;
- Categories of sources from which we collect personal information about you;
- Purposes for collecting, using, selling or sharing personal information;
- Categories of third parties to whom we disclose personal information;
- If applicable, categories of personal information sold, shared or disclosed about you and the categories of third parties to whom the personal information was sold, shared or disclosed, by category or categories of personal information for each category of third parties to whom the personal information was sold.
3. Right to delete request
You have a right to request that we delete a part of or all your personal information, subject to certain exceptions (i.e., when the information is necessary to: complete a transition or provide a service requested by you; debug or repair expected product functionality; detect or investigate cyber threats, etc.). Once we receive and confirm your verifiable consumer request, we will delete your personal information from our records, unless an exception applies.
4. Right to correct inaccurate personal information
You have the right to request that we correct inaccuracies in the personal information we have collected about you, taking into account the nature of the personal information and the purposes of the processing of the personal information.
5. Right to limit the use and disclosure of sensitive personal information.
The CCPA grants you the right to instruct a business to limit its use or disclosure of your sensitive personal information to that use which is necessary to perform the services reasonably expected by you in your request for those services and to perform certain activities permitted by the CCPA. Please note that we do not use or disclose sensitive personal data for any purposes other than those necessary to provide you with our services or as permitted by the CCPA.
6. Right to remain non-discriminated
XYZ SystemsHub shall not discriminate against a consumer because the latter exercised any of the consumer’s rights under the CCPA, including, but not limited to, by:
- Denying any services to the consumer;
- Charging different prices or rates for services, including through the use of discounts or other benefits or imposing penalties;
- Providing a different level or quality of services to the consumer;
- Suggesting that the consumer will receive a different price or rate for services or a different level or quality of services.
VIII. Exercising your rights
If you wish to exercise any of your rights under the CCPA, please submit your request to the following email address: dpo (at) systemshub.xyz.
As per the CCPA XYZ SystemsHub shall take into consideration the following requirements when answering a consumer’s request:
- The consumer shall place a verifiable consumer request. XYZ SystemsHub is not obliged to respond to the request if it cannot verify that the consumer making the request is the consumer about whom XYZ SystemsHub has collected information or is a person authorised by the consumer to act on consumer’s behalf;
- The consumer may also designate an authorised agent to make a request on his/her behalf;
- XYZ SystemsHub shall respond to the request within 45 (forty-five) days of receiving it. The time period for response may be extended once by an additional 45 (forty-five) days when reasonably necessary, and upon notification to the consumer.
With respect to your right to know and data portability - XYZ SystemsHub is obliged to provide the required information no more than twice in 12 (twelve) months. The provision of information by XYZ SystemsHub is generally free of charge. The disclosure shall cover the 12-month period preceding the receipt of the verifiable consumer request and shall be made in writing and delivered through the consumer’s Client Area, if the consumer maintains an account with us, or by mail or electronically at the consumer’s option if the consumer does not maintain an account with us, in a readily useable format that allows the consumer to transmit this information from one entity to another without hindrance. XYZ SystemsHub may require authentication of the consumer that is reasonable in light of the nature of the personal information requested, but shall not require the consumer to create an account in order to make a verifiable consumer request. If the consumer maintains an account with XYZ SystemsHub, we may require the consumer to submit the request through its Client Area.
If you have additional questions regarding your rights under the CCPA, please refer to the XYZ SystemsHub Privacy Policy and contact us at dpo (at) systesmhub.xyz.