Supplemental privacy policy: rights of California residents

This Supplemental Policy (the “Supplement”) is part of our Privacy Policy and is directed to you if you are a California resident and therefore have certain rights under the California Consumer Protection Act of 2018 (“CCPA”).  The Supplement applies to personal information we collect when we operate as a “business” as defined under the CCPA.   This Supplement describes what those rights are and how you may exercise them when we act as a business.  If there is any term in this Supplement that conflicts with a term in our Privacy Policy, the term in this Supplement shall control.

When we operate as a “service provider” (as defined under the CCPA) for our customers and they provide us with your personal information for business purposes under a service contract, the CCPA applies primarily to those customers, not to us.  In such cases, we will direct any requests you send us to exercise your rights under the CCPA to the applicable customer. 

Information we collect as a business

We collect the following categories of personal information as defined under the CCPA:

Personal information does not include: (i) information publicly available from government records, (ii) deidentified or aggregated information, or (iii) information addressed by certain state and federal data privacy laws (e.g., personal health information subject to federal health privacy law).

Categories of sources of information we collect

We obtain the categories of information described in this Supplement from the same categories of sources as described in Section 3 of our Privacy Policy.

Our use of personal information

We use the personal information we collect, as described in this Supplement, for the same purposes identified in Sections 3 of our Privacy Policy.

Our disclosure of personal information

We may disclose the personal information we collect, as described in this Supplement, for any of the same purposes and to the same categories of persons and entities as identified in Sections 9 (excluding the last sentence) of our Privacy Policy.

Your rights regarding your personal information

The CCPA gives certain rights to California residents regarding their personal information.  We summarize below what those rights are and how you may exercise them.  You do not need to have an account with us to exercise these rights.

The CCPA also gives California residents the right to opt out of (or for minors under 16, the ability to opt in to) sales of their personal information.  However, we do not and will not sell your personal information.  If, in the future, we decide to sell personal information, we will provide you with notice and the right to opt-out of (or for minors, opt-in to) such sales.

• Right to Know About the Collection, Use, Disclosure and Sale of Personal Information
  • Upon providing us with a verified consumer request, you may ask us to disclose certain types of your personal information we have collected and used over the 12-month period prior to the date of your request. You may make this request only twice within any 12-month period.  You may request:
    • The categories of personal information we collected about you
    • The categories of sources of the personal information we collected about you
    • The business or commercial purpose for collecting that personal information
    • The categories of third parties with whom we shared that information
    • The specific pieces of personal information we collected about you (except to the extent prohibited under CCPA including, for example, disclosure of Social Security numbers or other government, health insurance or medical identification numbers, account passwords)
    • If we disclosed your personal information for a business purpose, a list identifying the personal information we disclosed to each category of recipient.
• Right to Request Deletion of Personal Information
  • You have the right to submit a verified consumer request at any time that we delete any of your personal information collected and retained by us, unless an exception under the CCPA applies.
  • If no exception applies, and if we have been able to verify your consumer request, we will delete, aggregate or de-identify your personal information from our records in accordance with the CCPA. We will also direct third parties to whom we have disclosed your personal information to delete it, although we cannot guarantee that such third parties will comply with our direction. 

Please note that we may deny your deletion request if your personal information based on certain provisions of the CCPA, including where it is necessary for us or our service providers to carry out certain business functions, comply with laws or to engage in other internal and lawful uses of the information within the context in which you provided it to us.

Making a verified consumer request to us

To make a request to exercise your rights under CCPA described above, please submit a verifiable request to us by either:

• Emailing us at compliance@docuware.com, or
• Completing and submitting the form available on our website.

A verifiable consumer request must be made by you or a person registered with the California Secretary of State whom you have authorized to make the request on your behalf.  (A representative must be authorized by you in writing or have a valid power of attorney under California probate law.)  You may also make a verifiable request to us on behalf of your minor child. 

To be considered a proper verified request, your request must:

1. provide us with sufficient information allowing us to reasonably verify that you are the same person about whom we collected the personal information or the authorized representative, and
2. describe your request in reasonable detail so we can correctly understand, evaluate and respond to the request. 

We may ask you for additional information if needed in order to verify your request, but if we do, we will use such additional information only to verify your identity (or the authority of the representative) and for security and fraud-prevention purposes.

We will also ask you to separately confirm, by email or using the web form available on our website to confirm any request to delete personal information.

Responding to your verifiable consumer request

We will use reasonable efforts to respond to your verifiable consumer request within 45 days of receiving it.  If some cases, we may require more time (up to 90 days). If that is the case, we will communicate to you in writing (by postal mail or electronically, at your option) the reason and the length of anticipated delay.  We will not be able to fulfill your request if we cannot verify your identity (or the authority of your representative) and confirm that the personal information subject to the request relates to you. 

Disclosures we provide in response to a verified consumer request will cover only the 12-month period before we received the request.  If your request involves the porting of your personal information, we will use a format that is reasonably designed to allow you to transmit the information to another entity.  If we deny part or all of a verified consumer request, we will provide a reasonable explanation for the denial.

We do not charge fees for responding to verifiable consumer request unless they are excessive, repetitive or manifestly unfounded.  If we determine that a fee is appropriate, we will provide you with an explanation and a cost estimate before we complete your request.

We will keep records of consumer requests and our responses as required under the CCPA.

Non-Discrimination

We will not discriminate against you for exercising any of your rights under the CCPA.  This means that, except where permitted under the CCPA, if you make a request for disclosure or to delete your personal information, we will not (i) deny you goods or services, (ii) charge you different prices for goods or services (e.g., through penalties or withholding of otherwise available discounts), (iii) giving you a different level of goods or services,  or (iv) suggesting to you we will take any of the actions in (i) through (iii).

How to contact us to exercise your California rights

If you have questions about our Privacy Policy or this Supplement to the policy, please feel free to contact us at: compliance@docuware.com.

This Supplement was last updated on February 25, 2020.

14717\1\4817-5376-2995.v1