1. California Residents’ Rights Under the California Consumer Privacy Act
If you are a California resident, you have certain rights regarding information that is treated as Personal Information under the California Consumer Privacy Act of 2018, California Civil Code sections 1798.100 et seq. (“CCPA”).
- The right to know what categories of Personal Information are being collected, sold, or disclosed and the categories of sources of that Personal Information.
You have the right to know what categories of Personal Information we collect, sell, or disclose about you, as well as the categories of third parties who purchased or received your Personal Information and the categories of sources of that Personal Information. These categories are described below in the “Categories of California Consumers’ Personal Information Collected, Sold, or Disclosed” section below. We are also required to provide to you, before or at the point of collection, with a general notice about the categories of Personal Information collected by us and how we intend to use the collected Personal Information.
- The right to access collected Personal Information
You have the right to request that we provide a copy of your Personal Information that we collected, sold, or disclosed in the preceding twelve (12) months. Only you, or someone you legally authorize to act on your behalf, may make a request related to your Personal Information. You may submit a maximum of two requests in a 12-month period.
You must provide sufficient information to enable us to reasonably verify your identity or that of your authorized agent. We will only use the Personal Information provided in your request to verify your identity or that of your authorized agent. Please note that we cannot provide any Personal Information in response to a request if we cannot verify your or your authorized agent’s identity, or your authorized agent’s authority to make the request on your behalf, and/or if we cannot confirm that the collected Personal Information relates to you.
After receiving and verifying your request, we will provide the following information (depending on your request):
- The categories of Personal Information collected about you in the preceding twelve (12) months.
- The sources of that Personal Information by category.
- The business or commercial purpose(s) for collecting or selling that Personal Information.
- The categories of third parties with whom we shared that Personal Information.
- The specific pieces of Personal Information collected about you.
If we sold your Personal Information or disclosed it for a business purpose, we will provide:
- The categories of Personal Information sold in the previous twelve (12) months and the categories of third parties to whom the Personal Information was sold; and
- The categories of Personal Information disclosed for a business purpose in the previous twelve (12) months and the categories of third parties to whom the Personal Information was disclosed.
See the “Methods for Submitting CCPA Requests to MEF, LLC” section below for information on how you can exercise your right to access collected Personal Information. For more information, see also the “Response Timing and Format” section below.
- The right to request deletion of Personal Information
With certain exceptions, you have the right to request that we and our Service Providers delete Personal Information we or our Service Provider collected or maintained. Once we receive and verify your request, we will delete and instruct any applicable Service Providers to delete your Personal Information from our records, unless an exception applies.
We and our Service Providers may deny all or part of a verified deletion request if we must maintain your Personal Information to:
- Complete the transaction or provide a good or service requested by you for which we collected the Personal Information, or otherwise perform a contract between us.
- Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for that activity.
- Debug to identify and repair errors that impair existing intended functionality of our systems.
- Exercise a legal right provided for by law, including exercising or ensuring free speech rights.
- Comply with the California Electronic Communications Privacy Act (California Penal Code sections 1546 to 1546.4).
- Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest if:
- the research adheres to all other applicable ethics and privacy laws;
- deleting the Personal Information is likely to make the research impossible or seriously impair it; and
- you provided informed consent during the initial data collection.
- Enable our internal use in a manner that you would reasonably expect based on your relationship with us.
- Comply with our legal obligations.
- Otherwise use your Personal Information internally in a lawful manner that is compatible with the context in which you provided the information.
See the “Methods for Submitting CCPA Requests to MEF, LLC” section below for information on how you can exercise your right to delete collected Personal Information.
- The right to opt-out of the sale of Personal Information
You have the right to opt-out of the “sale” of your Personal Information to other businesses or third parties. The CCPA defines “sell,” “selling, “sale”, and “sold” to include selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means.
Once we receive an opt-out request, we will act upon the request as soon as commercially reasonable, but no later than fifteen (15) days from the date we receive the request. We will also notify all third parties to whom we have sold the Personal Information within the ninety (90) days prior to receiving the request that you have exercised your opt-out right and instruct them not to resell the Personal Information.
However, if we have a good-faith, reasonable, and documented belief that the request is fraudulent, we will deny the request and provide you with an explanation of our rationale.
You may elect to opt-in to the sale of Personal Information after opting-out. In the event that a transaction requires the sale of your Personal Information as a condition of completing the transaction, we will inform you of this and provide instructions on how you can opt-in.
See the “Do Not Sell My Personal Information” section below for more on how to opt-out of the sale of Personal Information.
- The rights of California consumers who are less than 16 years of age
We do not intend to provide goods or services to, or collect information from, California consumers who are less than 16 years of age. We do not sell the personal information of consumers who we actually know are less than 16 years of age, unless we receive affirmative authorization from either the consumer who is between 13 and 16 years of age, or the parent or guardian of a consumer less than 13 years of age.
- The right to be free from discrimination
You have the right to equal service, and we will not discriminate against you if you exercise your rights under the CCPA. However, under certain circumstances, we may offer you special discounts or other incentives for the right to continue to collect, use, or sell your Personal Information. In that event, we will notify you of the relevant program’s material terms and obtain your voluntary opt-in consent to the program.