PRIVACY POLICY - United States and Canada

Introduction

1. Information We Collect

   We collect information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or device (“personal information”). However, personal information does not include:

   • Publicly available information from government records;

   • Deidentified or aggregated consumer information;

   • Information excluded from the scope of the California Consumer Privacy Act of 2018 (“CCPA”), like:

   • health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;

   • personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.

   • In particular, we have collected the following categories of personal information from our customers within the last twelve (12) months:

   • Identifiers: A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number and other similar identifiers.

   • Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)): A name, signature, social security number, physical characteristics or description, address and telephone number. Some personal information included in this category may overlap with other categories.

   • Protected classification characteristics under California or federal law: Age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability or sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions).

   • Commercial information: Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

   • Internet or other similar network activity: Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.

   • Geolocation data: Physical location.

   We collect this information:

   • Automatically as you navigate through our website or use the App (as defined below), which information may include usage details, IP addresses, and other information collected through cookies, web beacons, and other tracking technologies described in the Section titled “Information We Collect Through Automatic Data Collection Technologies” below;

   • When you purchase, order, return, exchange or request information about our products and services;

   • When you participate in any interactive features of the Service;

   • When you sign up for our emails, mobile messages, or social media notifications as described in the section titled “Information We Collect Through Our App or Social Media” below;

   • When you enter a contest or sweepstakes, respond to one of our surveys, or participate in one of our focus groups;

   • When you provide us with comments, suggestions, or other input;

   • Directly from you when you otherwise provide it to us.

   Information We Collect Through Automatic Data Collection Technologies

   As you navigate through and interact with website included within the Service (our “website”), we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including:

   • Details of your visits to the website, such as traffic data, location data, logs, and other communication data and the resources that you access and use;

   • Information about your computer and internet connection, including your IP address, operating system, and browser type.

   We also may use these technologies to collect information about your online activities over time and across third-party websites or other online services (e.g., behavioral tracking).

   The information we collect automatically is only statistical data. It helps us to improve the Service and to deliver a better and more personalized service, including by enabling us to:

   • Estimate our audience size and usage patterns;

   • Store information about your preferences;

   • Speed up your searches;

   • Recognize you when you return to our website or otherwise use our Service.

   Information We Collect Through Our App or Social Media

   To enable our push notification and other mobile communication services, we may collect and store device IDs to identify each unique mobile device that registers for our Service, including for example, device tokens from iOS devices, Live IDs from Windows devices, and other similar identifications from devices running on other platforms. These IDs cannot be tracked back to you, but are tied to a specific device which may only be used by one person. We may collect information including location-related information, internet protocol addresses, mobile device models, carrier information, the operating system of your mobile devices and other non-personally identifiable information.

   Information You Provide to Us

   If you contact us on or through the Service, the information we collect may include personal information such as name, e-mail address, telephone number, and any other information you provide to us, including records and copies of your correspondence.

2. How We Use Your Information

   If you contact us on or through the Service, the information we collect may include personal information such as name, e-mail address, telephone number, and any other information you provide to us, including records and copies of your correspondence.

   • Fulfill or meet the reason you provided the information. For example, if you share your name and contact information to request a price quote or ask a question about our products or services, we will use that personal information to respond to your inquiry. If you provide your personal information to purchase a product or service, we will use that information to process your payment and facilitate delivery. We may also save your information to facilitate new product orders or process returns;

   • Fulfill and manage purchases, orders, payments, returns, exchanges and requests for information;

   • Provide, support, personalize, and develop our website, products, and services;

   • Create, maintain, customize, and secure your account with us;

   • Send marketing communications and other information regarding products, services and promotions;

   • Improve the effectiveness of the Service, website, stores, mobile experience and marketing efforts;

   • Conduct research and analysis, including focus groups and surveys;

   • Process your requests, purchases, transactions, and payments and prevent transactional fraud;

   • Respond to law enforcement requests and as required by applicable law, court order, or governmental regulations;

   • For any other purpose with your consent.

   In addition, we may use the User-ID feature of Google Analytics to help us enhance your user experience. User-ID lets us associate a persistent ID for you with your engagement data from one or more sessions initiated from one or more devices. This ability to connect your contacts with us into a single thread also provides us with a more unified, holistic story about your relationship with our business. We will use information received through our use of User-ID in the manner described above.

3. Disclosure of Your Information

   We may disclose aggregated information about you and our other users, and information that does not identify any individual, without restriction.

   We may disclose personal information that we collect or you provide as described in this privacy policy:

   • To our affiliates, in which case we will require our affiliates to honor this or a similar privacy policy;

   • To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which the Service, including personal information held by us used in or relating to the Service, is among the assets transferred;

   • With certain business partners to provide requested services that we do not provide directly;

   • To fulfill the purpose for which you provide it;

   • With your consent.

   In addition, we may also disclose your personal information:

   • To comply with any court order, law, or legal process, including to respond to any government or regulatory request;

   • To enforce or apply our terms of use agreement;

   • If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of us, our customers or others.

   In the preceding twelve (12) months, the Company has not disclosed or sold personal information.

4. Privacy of Mobile Applications

   With respect to your use of the mobile application portion of our Service (the “App”), the App may collect certain information automatically, such as the type of mobile device you use, the temporary or persistent unique device identifiers (sometimes called UDID) placed by us or our service providers, the unique identifier assigned by us to your device, the IP address of your mobile device, your mobile operating system, the type of mobile Internet browsers you use, and information about the way you use the App.

   Additionally, the App collects precise information about the location of your device. You must first provide permission through your device before our App obtains such location information from technologies like GPS, Wi-Fi, or cell tower proximity (or a combination of these technologies). We, and our service providers, may use and store this information, in combination with other location-based information such as the IP address and billing or postal code provided by you at time of your App registration, to provide enhanced location based services, such as store specific services, search results, and other content. You can stop all collection of information by the App easily by uninstalling the App. Also, you may at any time opt-out from further allowing us to have access to your location data by adjusting the permissions in your mobile device.

5. Our Use of Tracking Technologies

   The technologies we use for this automatic data collection may include:

   • Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting you may be unable to access certain parts of the Service. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to any website used as part of the Service.

   • Flash Cookies. Certain features of the Service may use local stored objects (or Flash cookies) to collect and store information about your preferences and navigation to, from, and on the Service. Flash cookies are not managed by the same browser settings as are used for browser cookies. For information about managing your privacy and security settings for Flash cookies, see “Your Privacy Rights” below.

   • Web Beacons. Pages of the Service may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us, for example, to count users who have visited those pages and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity).

   When you use the Service, we may place one or more cookies in your browser. These are required to enable you to hold session information as you navigate from page to page within the Service. In addition, we use cookies through the Service to understand visitor and user preferences, improve their experience, and track and analyze usage, navigational and other statistical information.

   Most web browsers are set to accept cookies by default. If you prefer, you can usually choose to set your browser to remove cookies and to reject cookies. If you choose to remove cookies or reject cookies, this could affect certain features of our Service.

6. Our Retention of Your Information

   We will only keep your personal information for as long as it is necessary for the purposes set out in this privacy policy, unless a longer retention period is required or permitted by law (such as tax, accounting or other legal requirements). When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it, or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

7. Our Protection of Your Information

   We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process. However, please also remember that we cannot guarantee that the internet itself is 100% secure. Although, while we will attempt to protect your personal information, transmission of personal information to and from the Service is at your own risk. You should only access the Service within a secure environment.

8. Children

   Parents should always supervise their children while online. The Service is not designed nor intended to collect personal information from children under the age of thirteen. So that we may comply with the Children’s Online Privacy Protection Act, we ask that children under the age of thirteen not provide any personal information through the Service. If a child under the age of thirteen has provided us with personal information, we ask that a parent or guardian contact us at the email address provided below.

9. Your Privacy Rights

   If you are resident in the European Economic Area and you believe we are unlawfully processing your personal information, you also have the right to object to your local data protection supervisory authority. You can find their contact details here: http://ec.europa.eu/justice/data­ protection/bodies/authorities/index_en.htm.

   Based on the laws of some countries, you may have the right to request access to the personal information we collect from you, change that information, or delete it in some circumstances. To request to review, update, or delete your personal information, please submit a request through the contact information provided below. When required to comply with such laws, we will respond to your request within 30 days.

   Upon your request to delete information we have stored about you, we will delete your information. However, some information may be retained in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our Terms of Use and/or comply with legal requirements.

10. International Transfers of Your Information

    If you are located in the European Union, your personal information will be transferred to and processed by our personnel located in the United States under the terms of the EU Commission’s model contracts for the transfer of personal data to third countries (i.e., the standard contractual clauses), pursuant to Decision 2004/915/EC. Please contact us through the contact information provided below if you are located in the European Union and you would like to see a copy of the model contracts.

11. Do Not Track Features

    Most web browsers and some mobile operating systems and mobile applications include a Do­Not­Track (“DNT”) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. No uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy policy

12. Notices for California Residents

    This Section 12 applies to all visitors, users, and others who reside in the State of California and is adopted to comply with laws governing residents of the State of California, including the CCPA. This Section does not apply to employment-related personal information collected from California-based employees, job applicants, contractors, or similar individuals.

    The CCPA provides consumers (California residents) with specific rights regarding their personal information. This section describes the rights of California residents and explains how to exercise those rights.

    Access to Specific Information and Data Portability Rights

    You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request (see Exercising Access, Data Portability, and Deletion Rights below), we will disclose to you:

    • The categories of personal information we collected about you;

    • The categories of sources for the personal information we collected about you;

    • Our business or commercial purpose for collecting or selling that personal information;

    • The categories of third parties with whom we share that personal information;

    • The specific pieces of personal information we collected about you (also called a data portability request);

    • If we sold or disclosed your personal information for a business purpose, two separate lists disclosing:

      • sales, identifying the personal information categories that each category of recipient purchased;

      • disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.

    Deletion Request Rights

    You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (see Exercising Access, Data Portability, and Deletion Rights below), we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.

    We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

    • Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;

    • Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform our contract with you;

    • Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.);

    • Debug products to identify and repair errors that impair existing intended functionality;

    • Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent;

    • Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law;

    • Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;

    • Comply with a legal obligation

    • Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

    Exercising Access, Data Portability, and Deletion Rights

    To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to us by either:

    • Calling us at the number provided below;

    • Sending us an email at the address provided below.

    Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. To designate an authorized agent please email us at the email address provided below and provide your name and phone number as well as the authorized agents’ name and contact information (phone number or email address) and let us know what the scope of the authorized agents’ rights are to act on your behalf. If your authorized agent requests sensitive information about you then we may ask you to provide us with a sworn declaration to further verify your identity.

    You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

    • Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative, which may include your full name, email address, phone number and zip code.

    • Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

    We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.

    Making a verifiable consumer request does not require you to create an account with us.

    We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

    Response Timing and Format

    We attempt to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 45 days), we will inform you of the reason and extension period in writing.

    If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

    Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

    We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or unreasonable. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

    Personal Information Sales Opt-Out Rights

    Because we do not sell personal information and we state in this policy that we do not sell personal information, pursuant to the CCPA we do not need to post a notice providing California residents with the right to opt-out of the sale of personal information.

    Non-Discrimination

    We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

    • Deny you goods or services.

    • Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.

    • Provide you a different level or quality of goods or services.

    • Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

    “Shine the Light” Law

    California Civil Code Section 1798.83, also known as the “Shine The Light” law, permits users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided below.

13. Updates to this Policy

    We may update this privacy policy from time to time. The updated version will be indicated by an updated “Last updated” date below and the updated version will be effective as soon as it is accessible. If we make material changes to this privacy policy, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy policy frequently to be informed of how we are protecting your information.

14. Contact Information.

    If you have questions regarding this privacy policy or wish to obtain additional information, please send an email to our Data Protection Officer at info@bnbfinder.com or at info@finderco.com, send mail to finderco, Inc., 3801 N. Capital of Texas Highway, Suite E-240-308, Austin, TX 78746, or call (212) 480-0414.

    info@bnbfinder.com.

This Privacy Policy is effective March 31, 2022