California Consumer Privacy Act of 2018 - Privacy

PRIVACY NOTICE FOR CALIFORNIA RESIDENTS

Last Updated: January 1, 2023

Subject to Universal Terms of Service: The following PRIVACY NOTICE FOR CALIFORNIA RESIDENTS (“Notice”) supplements and is subject to InMotion Hosting, Inc.’s (“Company”) Universal Terms of Service (“UToS”), which are incorporated herein by this reference, and applies solely to visitors, users, Customers and others who reside in the State of California (each a “Consumer” and collectively “Consumers”). This Notice is intended to comply with the California Consumer Privacy Act of 2018, as amended (“CCPA”) and any terms defined in the CCPA have the same meaning when used in this Notice. Capitalized terms used herein and not otherwise defined herein shall have the meanings set forth in the UToS. In the event of a conflict between this Notice and the UToS, this Notice shall control.

Changes to Company Privacy Notice. Company reserves the right to amend this Notice at Company’s sole discretion and at any time. Continued use of the Websites or Products after changes constitutes acceptance of any changes to this Notice.

Information Company Collects.

The Websites and Products collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or Consumer’s device (collectively, “Personal Information”). The Websites and Products have collected or may collect the following categories of Personal Information from Consumers within the last twelve (12) months:

Category	Examples	Collected
A. Identifiers.	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.	YES
B. Personal Information categories listed in the California Customer Records statute (Cal. Civ. Code§ 1798.80(e)).	A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some Personal Information included in this category may overlap with other categories.	YES
C. Protected classification characteristics under California or federal law.	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).	NO
D. Commercial information.	Records of personal property, cloud services or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	YES
E. Biometric information.	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.	NO
F. Internet or other similar network activity.	Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.	YES
G. Geolocation data.	Physical location or movements.	NO
H. Sensory data.	Audio, electronic, visual, thermal, olfactory, or similar information.	YES
I. Professional or employment-related information.	Current or past job history or performance evaluations.	NO
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34C.F.R. Part 99)).	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	NO
K. Inferences drawn from other Personal Information.	Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Personal Information does not include:
1. Publicly available information from government records.
2. Deidentified or aggregated consumer information.
3. Information excluded from the CCPA’s scope, including but not limited to:
  1. Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data; or
  2. Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.
Company obtains the categories of Personal Information listed above from the following categories of sources:
1. Directly from Consumer (e.g., from forms Consumer completes or Products and services Consumer purchases).
2. Indirectly from Consumer (e.g., from observing Consumer’s actions on the Websites).

Use of Personal Information.
1. Company may use or disclose the Personal Information Company collected for one or more of the following business purposes:
  1. To fulfill or meet the reason Consumer provided the information (e.g., if Consumer shared Consumer’s name and contact information to request a price quote or ask a question about Company’s Products or services, Company will use that Personal Information to respond to Consumer’s inquiry; if Consumer provides Consumer’s Personal Information to purchase a product or service, Company will use that information to process Consumer’s payment and facilitate delivery; Company may also save Consumer’s information to facilitate new product orders or process returns).
  2. To provide, support, personalize, and develop the Websites, Products, and services.
  3. To create, maintain, customize, and secure Consumer’s account (i.e., Customer’s Account).
  4. To process Consumer’s requests, purchases, transactions, and payments and prevent transactional fraud.
  5. To provide Consumer with support and to respond to Consumer’s inquiries, including to investigate and address Consumer’s concerns and monitor and improve Company responses.
  6. To help maintain the safety, security, and integrity of the Websites, Products and services, databases and other technology assets, and business.
  7. For testing, research, analysis, and product development, including to develop and improve the Websites, Products, and services.
  8. To respond to law enforcement and civil requests and as required by applicable law, court order, or governmental regulations.
  9. As described to Consumer when collecting Personal Information or as otherwise set forth in the CCPA.
  10. To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Company’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by Company about the Websites’ Consumers is among the assets transferred and related transaction matters.
2. Company will not collect additional categories of Personal Information or use the Personal Information Company collected for materially different, unrelated, or incompatible purposes without providing Consumer notice.

Sharing Personal Information.
1. Company may disclose Personal Information to a third-party for a business purpose. When Company discloses Personal Information for a business purpose, Company enters into a contract that describes the purpose and requires the third-party recipient to both keep that Personal Information confidential and not use it for any purpose except performing the contract with any third-party utilized by the Company. Company may share Consumer’s Personal Information with the subprocessors.
2. Disclosures of Personal Information for a Business Purpose.
  1. In the preceding twelve (12) months, Company has disclosed the following categories of Personal Information for a business purpose:
    1. Identifiers.
    2. California Consumer Records Personal Information categories.
    3. Protected classification characteristics under federal law.
    4. Commercial information.
    5. Internet protocol address, Internet or other similar network activity.
    6. Sensory data.
    7. Professional or employment-related information.
    8. Non-public education information.
    9. Inferences drawn from other Personal Information.
  2. Company discloses Consumer’s Personal Information for a business purpose with the subprocessors.
3. Sales of Personal Information. In the preceding twelve (12) months, Company has not sold Personal Information in the following categories of Personal Information:
  1. Identifiers.
  2. California Consumer Records Personal Information categories.
  3. Protected classification characteristics under federal law.
  4. Commercial information.
  5. Biometric information.
  6. Internet or other similar network activity.
  7. Geolocation data.
  8. Sensory data.
  9. Professional or employment-related information.
  10. Non-public education information.
  11. Inferences drawn from other Personal Information.

Consumer’s Rights and Choices.
1. The CCPA provides Consumers with specific rights regarding their Personal Information. This section describes Consumer’s CCPA rights and explains how to exercise those rights.
2. Access to Specific Information and Data Portability Rights. Consumer has the right to request that Company disclose certain information about Company’s collection and use of Personal Information over the past twelve (12) months. Once Company receives and confirms a verifiable Consumer request (see Exercising Access, Data Portability, and Deletion Rights below), Company will disclose to Consumer:
  1. The categories of Personal Information Company collected about Consumer.
  2. The categories of sources for the Personal Information Company collected about Consumer.
  3. Company business or commercial purpose for collecting or selling that Personal Information.
  4. The categories of third parties with whom Company share that Personal Information.
  5. The specific pieces of Personal Information Company collected about Consumer (also called a data portability request).
  6. If Company sold or disclosed Personal Information for a business purpose, two separate lists disclosing:
    1. sales, identifying the Personal Information categories that each category of recipient purchased; and
    2. disclosures for a business purpose, identifying the Personal Information categories that each category of recipient obtained.
3. Deletion Request Rights.
  1. Consumer has the right to request that Company delete any of Personal Information that Company collected from Consumer and retained, subject to certain exceptions. Once Company receives and confirms a verifiable consumer request (see Exercising Access, Data Portability, and Deletion Rights), Company will delete (and direct service providers to delete) Personal Information from Company records, unless an exception applies.
  2. Company may deny a deletion request if retaining the information is necessary for Company or Company service provider(s) to:
    1. Complete the transaction for which Company collected the Personal Information, provide a Product or service that Consumer requested, take actions reasonably anticipated within the context of Company ongoing business relationship with Consumer, or otherwise perform Company contract with Consumer.
    2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
    3. Debug Products to identify and repair errors that impair existing intended functionality.
    4. Exercise free speech, ensure the right of another Consumer to exercise their free speech rights, or exercise another right provided for by law.
    5. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if Consumer previously provided informed consent.
    6. Enable solely internal uses that are reasonably aligned with consumer expectations based on Consumer’s relationship with Company.
    7. Comply with any legal obligation.
    8. Make other internal and lawful uses of that information that are compatible with the context in which Consumer provided it.
4. Exercising Data Portability, and Deletion Rights.
  1. To exercise the data portability and deletion rights described above, Website users, visitors and/or non-active customers and active Customers can submit a verifiable consumer request via Company’s online form, submit an email to [email protected], in writing, via postal mail to Company at InMotion Hosting, Inc.e, Attn: Data Privacy Team, 555 S. Independence Blvd. Virginia Beach, VA 23542.
  2. Only a Customer, a Consumer on behalf of the Consumer’s minor child, a natural person or a person registered with the Secretary of State, authorized by the Consumer to act on the Consumer’s behalf, may make a verifiable consumer request related to Personal Information.
  3. The verifiable consumer request must:
    1. Provide sufficient information that allows Company to reasonably verify requestor/legal representative is the person about whom Company collected Personal Information; and
    2. Describe in the request with sufficient detail to allow Company to properly understand, evaluate and respond to it.
  4. Company cannot respond to a Consumer request or provide a requestor with Personal Information if Company cannot verify identity or authority to make the request and confirm the Personal Information relates to Consumer. Making a verifiable Consumer request does not require creation of a Customer Account. Company will only use Personal Information provided in a verifiable Consumer request to verify the Consumer/requestor’s identity or authority to make the request.
  5. For instructions on exercising sale opt-out rights, see Personal Information Sales Opt-Out and Opt-In Rights below.
5. Response Timing and Format.
  1. Company shall use commercially reasonable efforts to respond to a verifiable Consumer request within forty-five (45) days of receipt but no more than ninety (90) days. Company will deliver a written response by mail or electronically, as determined in Company’s sole discretion, to Consumer/requestor. Requests that Company cannot comply with will receive an explanation, if applicable. For data portability requests, Company will select a format to provide Personal Information that is readily usable and should allow transmission of the information.
  2. Verifiable consumer requests carry no charge to process.
  3. All Consumer’s client data provided to Company is subject to data privacy laws and Consumer is responsible for obtaining the proper consent from such client(s) prior to sharing of Personal Information with Company.
6. Personal Information Sales Opt-Out and Opt-In Rights. If a Consumer is sixteen (16) years of age or older, Consumer has the right to direct Company to not sell Personal Information at any time (the “right to opt-out”). Company does not sell the Personal Information of Consumers actually know are less than sixteen (16) years of age, unless Company receives affirmative authorization (the “right to opt-in”) from either the consumer who is between thirteen (13) and sixteen (16) years of age, or the parent or guardian of a consumer less than thirteen (13) years of age. Consumers who opt-in to Personal Information sales may opt-out of future sales at any time.
7. To exercise the right to opt-out, Consumer (or Consumer’s authorized representative) may submit a request to Company. Once Consumer makes an opt-out request, Company will wait at least twelve (12) months before asking Consumer to reauthorize Personal Information sales. However, Consumer may change Consumer’s mind and opt back in to Personal Information sales at any time by completing the form and checking the box that says, “OPT-IN: I Opt-In to the “Sale” or “Sharing” of my Personal Information related to tailored advertising on this website.”
8. Consumer does not need to create a Customer Account with Company to exercise Consumer’s opt-out rights. Company will only use Personal Information provided in an opt-out request to review and comply with the request.

Non-Discrimination.
1. Company will not discriminate against Consumer for exercising any of Consumer’s CCPA rights. Unless permitted by the CCPA, Company will not:
  1. Deny Products or services.
  2. Charge different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
  3. Provide a different level or quality of Products or services.
  4. Suggest that Consumer may receive a different price or rate for Products or services or a different level or quality of Products or services.
2. Company may offer Consumer certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive offer will reasonably relate to Personal Information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires Consumer prior opt-in consent, which Consumer may revoke at any time.

Other California Privacy Rights. California’s “Shine the Light” law (Civil Code Section § 1798.83) permits visitors, users, and Customers of the Websites that are California residents to request certain information regarding Company’s disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please complete the Personal Data Request form, or send an email to [email protected] or send by postal mail at: InMotion Hosting, Inc., Attn: Data Privacy Team, 555 S. Independence Blvd., Virginia Beach, VA 23452.

Contact Information. Any questions or comments about this Notice, the ways in which Company collects and uses Personal Information described in the Privacy Policy, Consumer’s choices and/or rights regarding such use, or wish to exercise Consumer’s rights under California law may, contact Company at the address and/or email listed herein.

CALIFORNIA’S CONSUMER PRIVACY ACT OF 2018

SECTION-BY-SECTION NOTICE REQUIREMENT SUMMARY

The following chart identifies and summarizes the primary statute sections relating to the CCPA’s generalized notice or disclosure requirements.

CCPA Section	General Notice or Information Disclosure Summary
Cal. Civ. Code § 1798.100(b)	Must inform consumers, before or at the point of collection: What personal information categories a business collects. Its intended use purposes. Prohibits collection of additional personal information categories or using collected personal information for additional purposes without providing this required notice.
Cal. Civ. Code § 1798.105(b)	Must disclose the consumer’s deletion right. Cross-references Section 1798.130 for the disclosure requirement.
Cal. Civ. Code § 1798.110(c)	If a business collects personal information about a consumer, it must disclose: Personal information categories collected. Source categories for the personal information collected. Business or commercial purposes for collecting or selling personal information. Third-party categories with which the business shares personal information. The specific pieces of personal information the business has collected about that consumer. Cross-references Section 1798.130(a)(5)(B) for the disclosure requirement. NOTE: While Section 1798.110(c)(5) does list “the specific pieces of personal information the business has collected about that consumer” as a required piece of information in the online privacy disclosure, this is likely a statutory drafting error (see Practice Note, Understanding the California Consumer Privacy Act (CCPA): History of the CCPA). Businesses should probably interpret this requirement as referring to the consumer’s specific information (access) rights and not as a requirement to include individual personal information in the online privacy notice (see Practice Note, Understanding the California Consumer Privacy Act (CCPA): Specific Information Rights).
Cal. Civ. Code § 1798.115(c)	If a business sells personal information or discloses personal information for a business purpose, it must disclose the personal information categories: Sold or include a statement that it has not sold personal information. Disclosed for a business purpose or include a statement that it has not disclosed personal information. Cross-references Section 1798.130(a)(5)(C) for the disclosure requirement.
Cal. Civ. Code § 1798.115(d)	A third-party purchaser of a consumer’s personal information cannot resell that information unless the consumer receives explicit notice and an opportunity to opt- out. Cross-references Section 1798.120 establishing the consumer’s personal information sales opt-out and opt-in rights.
Cal. Civ. Code § 1798.120(b)	If a business sells personal information to third parties, it must provide notice to consumers that: It may sell their information. Consumers have the right to opt-out of these sales. Cross-references Section 1798.135(a) for notice requirements.
Cal. Civ. Code § 1798.125(b)(2) and (3)	If a business offers financial incentives for personal information collections, sales, or deletions, it must notify consumers of the financial incentives and clearly describe material terms. Cross-references Section 1798.135 for notice requirements.
Cal. Civ. Code § 1798.130	Primary section discussing both general and specific notice requirements. Cross-references: Section 1798.100 (statute introduction and general establishment of information rights). Section 1798.105 (deletion right). Section 1798.110 (disclosures for business that collects personal information). Section 1798.115 (disclosures for business that sells personal information or discloses personal information for a business purpose). Section 1798.125 (non-discrimination rights). Subsections related to general or public disclosures and notices described below.
Cal. Civ. Code § 1798.130(a)(1)	Must make available two or more designated methods for submitting verified consumer requests for information disclosures required under: Section 1798.110 (disclosures for business that collects personal information). Section 1798.115 (disclosures for business that sells personal information or discloses personal information for a business purpose). Contact methods must include, at minimum: Toll-free telephone number. Website address, if the business maintains an internet website.
Cal. Civ. Code § 1798.130(a)(5)	Must disclose the following information: A description of the following consumer rights and one or more methods for submitting consumer requests: Section 1798.110 (disclosures for business that collects personal information); Section 1798.115 (disclosures for business that sells personal information or discloses personal information for a business purpose); and Section 1798.125 (non-discrimination rights). A list of the personal information categories the business collected in the preceding 12 months. A list of the personal information categories the business sold in the preceding 12 months or a statement that no sales took place. A list of the personal information categories the business disclosed for a business purpose in the preceding 12 months or a statement that no disclosures took place. The lists must use the 11 categories enumerated in the personal information definition in Section 1798.140(o) that most closely describe the personal information. Disclosure must occur: In the business’s online privacy policy, if it exists. In any California-specific description of consumer’s privacy rights, if it exists. On its internet website, if the business does not maintain an online privacy policy or California-specific description of rights. Must update this information at least once every 12 months.