California Consumer Privacy Act (CCPA)

What is the California Consumer Privacy Act (CCPA)?

The California Consumer Privacy Act (CCPA) was passed by the state’s legislature in 2018 and will be effective on January 1, 2020. The CCPA enhances data privacy rights for California residents and requires businesses to be transparent about how they collect, share and use consumers’ personal data.  

• The CCPA applies to most businesses if one or more of the following apply:
  • Conducts business in California
  • Collects consumers' personal information
  • Has annual gross revenues in excess of $25 million
  • Derives 50% or more of its annual revenues from selling consumers' personal information
  • Determines the purposes and means of the processing of consumers' personal information
  • Alone, or in combination, annually buys, receives for the business's commercial purposes, sells, or shares for commercial purposes the personal information of 50,000 or more consumers, households, or devices
     
• There are limitations in the CCPA as it relates to employment applications, worker information of employees, consultants and similar workers.
• The CCPA is intended to supplement federal and state law, if permissible, but shall not apply if the application is pre-empted by, or conflicts with, federal law or the U.S. or California Constitution. There are limitations in the CCPA for consumer- and certain business-related information held by financial institutions that are regulated by federal laws and regulations.

California Consumer Rights under the CCPA

Disclosure. A business must disclose the personal information collected, sold, or disclosed for a business purpose about a consumer.

• A business that collects personal information needs to disclose the following in response to a verified consumer request:
  • Categories of personal information the business has collected about the consumer
  • Categories of sources from which the personal information is collected
  • Business or commercial purpose for collecting personal information
  • Categories of third parties with which the business shares personal information
  • Specific personal information the business has collected about the consumer
     
• A business that sells a consumer's personal information or discloses a consumer's personal information for a business purpose needs to disclose the following in response to a verified consumer request:
  • Categories of personal information the business has collected about the consumer
  • Categories of personal information the business has sold about the consumer
  • Categories of third parties to which the personal information was sold
  • Categories of personal information sold to each third party (if the business has not sold consumers' personal information, it shall disclose that fact)
  • Categories of personal information the business has disclosed about the consumer for a business purpose (if the business has not disclosed consumers' personal information for a business purpose, it shall disclose that fact)

Access. A business that collects a consumer's personal information must, at or before the point of collection, inform the consumer of the categories of personal information to be collected and how the categories of personal information shall be used. A business must disclose and deliver the personal information collected about the consumer in response to a verifiable consumer request.

Deletion. A business must delete the personal information collected about a consumer and direct service providers to delete the consumer's personal information in response to a verified consumer request, subject to certain exceptions.

Antidiscrimination. A business must not discriminate against a consumer who exercises any of the consumer's rights under the CCPA. However, a business may charge different prices or provide a different quality of goods or services if the difference is reasonably related to the value provided to the consumer by the consumer's data and may offer financial incentives to a consumer for the collection, sale, or deletion of personal information on a prior opt-in consent basis.

Opt Out and Website Requirements. A business that sells consumers' personal information to third parties needs to notify consumers thereof and that the consumers have the right to opt out of the sale of their personal information. A business must provide a "Do Not Sell My Personal Information" link on its internet homepage that links to a webpage that allows a consumer to opt out of the sale of their personal information. A business must not sell a consumer’s personal information if the business has actual knowledge that the consumer is less than age 16, unless the consumer between ages 13 and 16, or the consumer's parent or guardian for a consumer who is younger than 13, has authorized the sale of the consumer's personal information.

Privacy Policy Requirements. A business must describe in its online privacy policy or in any California-specific description of consumer privacy rights the following, which must be updated at least once every 12 months:

• Consumers' rights under the CCPA, including the consumer right to opt out of the sale of the consumer's personal information and a separate link to the "Do Not Sell My Personal Information" internet webpage
• The methods for submitting consumer requests
• A list of the categories of personal information that the business has collected about consumers, sold about consumers, and disclosed about consumers for a business purpose in the preceding 12 months

California Consumer Privacy Act Statement

This STATEMENT supplements the information contained in the Privacy Notice of Thread Tank and its subsidiaries and affiliates (collectively, “we,” “us,” or “our”) and applies solely to visitors, users, and others who reside in the State of California (“consumers” or “you”). We adopt this statement to comply with the California Consumer Privacy Act (“CCPA”) and other California privacy laws.  Any terms defined in the CCPA have the same meaning when used in this statement.

Information We Collect

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (“personal information”). In particular, we have collected the following categories of personal information from consumers within the last twelve (12) months:

Personal information does not include:

• Publicly available information from government records.
• De-identified or aggregated consumer information.
• Information excluded from the CCPA's scope, like:
  • Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data
  • Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994

We obtain the categories of personal information listed above from the following categories of sources:

• Directly from our clients or their agents. For example, from documents that our clients provide to us related to the services for which they engage us
• Indirectly from our clients or their agents. For example, through information we collect from our clients in the course of providing services to them
• Directly and indirectly from activity on our website (www.threadtank.com). For example, from submissions through our website portal or website usage details collected automatically
• From third-parties that interact with us in connection with the services we perform

Use of Personal Information

We may use or disclose the personal information we collect for one or more of the following business purposes:

• To fulfill or meet the reason for which the information is provided
• To provide you with information, products or services that you request from us
• To provide you with email alerts and other notices concerning our products or services, that may be of interest to you
• To improve our website and present its contents to you
• For testing, research, analysis and product development
• As necessary or appropriate to protect the rights, property or safety of us, our clients or others
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations
• As described to you when collecting your personal information or as otherwise set forth in the CCPA

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

Sharing Personal Information

We may disclose your personal information to a third party for a business purpose.  When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.

We disclose your personal information for a business purpose to the following categories of third parties:

• Our affiliates
• Service providers
• Third parties to whom you or your agents authorize us to disclose your personal information in connection with products or services we provide to you

In the preceding twelve (12) months, we have not sold any personal information.

Your Rights and Choices

The CCPA provides consumers (California residents) with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.

Access to Specific Information and Data Portability Rights

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you:

• The categories of personal information we collected about you
• The categories of sources for the personal information we collected about you
• Our business or commercial purpose for collecting or selling that personal information
• The categories of third parties with whom we share that personal information
• The specific pieces of personal information we collected about you (also called a data portability request)
• If we sold or disclosed your personal information for a business purpose, two separate lists disclosing:
  • sales, identifying the personal information categories that each category of recipient purchased; and
  • disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained

Deletion Request Rights

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete your personal information from our records, unless an exception applies.

Only you or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.  Making a verifiable consumer request does not require you to create an account with us.  We will only use personal information provided in a verifiable consumer request to verify the requestor's identity or authority to make the request.

Response Timing and Format

We endeavor to respond to a verifiable consumer request within 45 days of its receipt.  If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.  If you have an account with us, we will deliver our written response to that account.  If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.  Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt.  The response we provide will also explain the reasons we cannot comply with a request, if applicable. 

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Changes to Our Privacy Statement

We reserve the right to amend this privacy statement at our discretion and at any time. Any changes made to this privacy statement will be available on our website.

Contact Information

If you have any questions or comments about this statement, our Privacy Notice, the ways in which we collect and use your personal information, your choices and rights regarding such use, or wish to exercise your rights under California law, please email us at:  support[at]threadtank.com