Section 10: The California Consumer Privacy Act ("CCPA")
10. YOUR RIGHTS AS A CALIFORNIA RESIDENT UNDER THE CALIFORNIA CONSUMER PRIVACY ACT (“CCPA”)California Privacy Rights
Beginning January 1, 2020, California residents may exercise certain privacy rights pursuant to the California Consumer Privacy Act of 2018 (“CCPA”). Your right to submit certain requests as a California resident are described below. Please note that when submitting a request, you will be asked to provide information to verify your identity before action is taken. You may designate an authorized agent to make the requests below on your behalf. An authorized agent must submit proof to us that he or she has been authorized by you to act on your behalf, and you will need to verify your identity directly with us.
More Information
Right To Request More Information
As a California resident, you have the right to request more information regarding the following, to the extent applicable:(1) The categories of Personal Data we have collected about you.
(2) The categories of sources from which we have collected your Personal Data.
(3) The business or commercial purpose why we collected or, if applicable, sold your Personal Data.
(4) The categories of third parties with whom we shared your Personal Data in the past 12 months.
(5) The specific pieces of Personal Data we have collected about you.
(6) The categories of Personal Data that we have shared with third parties about you for a business purpose.
Right to Request Deletion of Your Personal Data
You also have the right to request that we delete your Personal Data collected or maintained by us. Once we receive your request, we will let you know what, if any, Personal Data we can delete from our records, and we will direct any service providers with whom we shared your Personal Data also to delete your Personal Data from their records. There may be circumstances where we cannot delete your Personal Data or direct service providers to delete your Personal Data from their records. For example, if we need to: (1) retain your Personal Data to complete a transaction or provide goods or services; (2) detect security incidents; (3) protect against unlawful activities; (4) identify, debug or repair errors; or (5) comply with a legal obligation. You may submit a request to delete your Personal Data by calling us at 1-800-259-7766, emailing us at [email protected]. The Afton Group will not delete any information if it would otherwise violate law or legal protections that apply to such data, including any applicable privileges. In connection with submission of your request, we will take steps to verify your identity and you will need to verify your identity as required under California law before action is taken.Verification of Requests Upon submission of a request for information or a request to delete information, we will take reasonable steps to confirm that the person submitting the request to know or request to delete is the person to whom the information relates, and to prevent unauthorized access or deletion of information. The specific steps taken to verify the identity of the requesting person may vary based on the nature of the request, including the type, sensitivity and value of the information requested, the risk of harm posed by unauthorized access or deletion, the likelihood that fraudulent or malicious actors may seek the information, the robustness of Personal Data provided to verify your identity, the nature of our business relationship with you, and available technology for verification.
We will generally try to avoid requesting additional information from you for the purpose of verification. However, we may need to do so if we cannot verify your identity based on the information already maintained by us. If we request additional information to verify your identity, it will be for that purpose only, and will be deleted as soon as practical after processing the request, except as otherwise provided by law.
The following generally describes the verification processes we use:
- Password Protected Accounts. If you have a password-protected account with us, we may use existing authentication practices to verify your identity, but will require re-authentication before disclosing or deleting data. If we suspect fraudulent or malicious activity relating to your account, we will require further verification (as described below) before complying with a request to know or delete.
- Verification for Non-Accountholders. If you do not have, or cannot access, a password-protected account with us, we will generally verify your identity as follows:
- For requests to know categories of Personal Data, we will verify your identity to a reasonable degree of certainty by matching at least two data points provided by you with reliable data points maintained by us.
- For requests to know specific pieces of Personal Data, we will verify your identity to a reasonably high degree of certainty by matching at least three data points provided by you with reliable data points maintained by us. We will also require a declaration, signed under penalty of perjury, that the person requesting the information is the person whose information is the subject of the request. We will maintain all signed declarations as part of our records.
- For requests to delete Personal Data, we will verify your identity to a reasonable degree or a reasonably high degree of certainty depending on the sensitivity of the Personal Data and the risk of harm posed by unauthorized deletion. We will act in good faith when determining the appropriate standard to apply.
Right to Non-Discrimination for the Exercise of California Resident’s Privacy Rights
By exercising any of the above listed privacy rights conferred by the California Consumer Privacy Act of 2018, you have the right not to receive discriminatory treatment by us. This means that, consistent with California law, we will not deny providing goods or services to you, charge you different prices or provide a different level or quality of goods and services to you unless those differences are related to the value of your information.