We collect information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or device (“personal information“).
Personal information does not include:
The following is a list of categories of personal information which we may collect or may have been collected from California residents within the last twelve (12) months. Please note that the categories and examples provided in the list below are those defined in the CCPA. This does not mean that all examples of that category of personal information were in fact collected by us, but reflects our good faith belief to the best of our knowledge that some of that information from the applicable category may be and may have been collected. For example, certain categories of personal information would only be collected if you provided such personal information directly to us.
|A. Identifiers||A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.||Yes|
|B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))||A name, signature, Social Security number, physical characteristics or description, address, telephone number, driver’s license or state identification card number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information.
Some personal information included in this category may overlap with other categories.
|C. Sensitive personal information categories listed in the California Privacy Rights Act (Cal. Civ. Code § 1798.140(ae))||A social security number, driver’s license, state identification card, financial account numbers.||Yes|
|D. Protected classification characteristics under California or federal law||Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).||Yes|
|E. Commercial information||Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.||Yes|
|F. Biometric information||Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifiers or identifying information, such as fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke or gait, or other physical patterns, and sleep, health or exercise data.||No|
|G. Internet or other similar network activity||Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.||Yes|
|H. Geolocation data
|Approximate physical location.||Yes|
|I. Sensory data||Audio, electronic, visual, thermal, olfactory, or similar information.||No|
|J. Professional or employment-related information||Current or past job history or performance evaluations.||Yes|
|K. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99))||Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.||No|
|L. Inferences drawn from other personal information||Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.||Yes|
We obtain the categories of personal information listed above from the following categories of sources:
We may use or disclose the personal information we collect for one or more of the following purposes:
We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.
We may share your personal information by disclosing it to a third party for a business purpose. We only make these business purpose disclosures under written contracts that describe the purposes, require the recipient to keep the personal information confidential, and prohibit using the disclosed information for any purpose except performing the contract. In the preceding twelve (12) months, Company has disclosed personal information for a business purpose to the categories of third parties indicated in the chart below.
Personal Information Category
Third-Party Recipients Having Received Business Purpose Disclosures
|A. Identifiers||Data analytic providers, social networks, service providers, affiliates, internet cookie data recipients, merchants that we work with to offer our services, lenders and assignees|
|B. California Customer Records personal information categories||Data analytic providers, social networks, service providers, affiliates, internet cookie data recipients, merchants that we work with to merchants that we work with to offer our services, lenders and assignees|
|C. Sensitive personal information||Service Providers, affiliates, lenders and assignees|
|D. Protected classification characteristics under California or federal law||Service Providers, affiliates, lenders and assignees|
|E. Commercial information||Affiliates, lenders and assignees|
|A. Biometric information||None|
|G. Internet or other similar network activity||Data analytic providers, social networks, service providers, affiliates, internet cookie data recipients|
|H. Geolocation data||Data analytic providers, social networks, service providers, affiliates, internet cookie data recipients, merchants that we work with to merchants that we work with to offer our services|
|I. Sensory data||None|
|J. Professional or employment-related information||Service providers and affiliates|
|K. Non-public education information||None|
|L. Inferences drawn from other personal information||Service Providers, affiliates|
Please note that the categories listed above are those defined in the CCPA. This does not mean that all examples of that category of personal information were in fact disclosed, but reflects our good faith belief to the best of our knowledge that some of that information from the applicable category may be and may have been disclosed.
As defined in the CCPA, “sell” and “sale” mean selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for valuable consideration. This means that we may have received some kind of benefit in return for sharing personal information, but not necessarily a monetary benefit.
Our use of Google Analytics, cookies and other tracking technologies may be considered a sale of personal information under the CCPA. Categories of personal information that we have shared through third-party cookies include Identifiers (e.g., IP addresses) and Internet or other similar network activity.
You can opt out of our tracking technologies for analytics and advertising via by clicking the Do Not Sell my Personal Information link on our website.
In the preceding twelve (12) months, AFF has not used or disclosed Sensitive Personal Information for purposes other than those specified under CCPA Regulation 7027(m).
The CCPA provides Consumers (California residents) with specific rights regarding their personal information.
The right to request, up to 2 times in a 12-month period, that we identify to you (1) the categories of personal information we have collected about you going back to January 1, 2022, unless doing so would be impossible or involve disproportionate effort, or unless you request a specific time period, (2) the categories of sources from which the personal information was collected, (3) the business or commercial purpose for collecting, selling, or sharing this information, (4) the categories of third parties with whom we share or have shared your personal information;
The right to request, up to 2 times in a 12-month period, that we disclose to you, free of charge, the specific pieces of personal information we have collected about you going back to January 1, 2022, unless doing so would be impossible or involve disproportionate effort, or unless you request a specific time period; Right to Delete. The right to request, up to 2 times in a 12-month period, that we delete personal information that we collected from you, subject to certain exceptions;
The right to request, up to 2 times in a 12-month period, that we delete personal information that we collected from you, subject to certain exceptions;
The right to request that we correct inaccurate personal information (to the extent such an inaccuracy exists) that we maintain about you;
You have the right, at any time, to opt out of the selling or sharing of your personal information. If you opt-in to personal information sales or sharing, you may opt out of future sales or sharing of your personal information at any time. If you are age 16 or older, you have the right to direct us to not sell your personal information at any time (the “right to opt-out”). We do not sell or share the personal information of consumers we actually know are less than 16 years old.
To exercise your rights described above, please submit a request by either:
Only you, or someone legally authorized to act on your behalf, may make a request related to your personal information.
When you submit a Right to Know, Right to Access, Right to Delete, or Right to Correct request through one of the methods provided above, we will ask you to provide some information in order to verify your identity and respond to your request. Specifically, we will ask you to verify information that can be used to link your identity to particular records in our possession, which depends on the nature of your relationship and interaction with us. For example, we may need you to provide your name, email, phone number, IP address, browser ID, amount of your last purchase with the business, and/or date of your last transaction with the business.
We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the 10-day time frame, please contact firstname.lastname@example.org. We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing. We will deliver our written response electronically, unless you request us to provide it by mail. The response we provide will also explain the reasons we cannot comply with your request, if applicable.
For a request to correct inaccurate personal information, we will accept, review, and consider any documentation that you provide, and we may require that you provide documentation to rebut our own documentation that the personal information is accurate. You should make a good faith effort to provide us with all necessary information at the time that you make the request to correct. We may deny a request to correct if we have a good faith, reasonable, and documented belief that a request to correct is fraudulent or abusive. If we deny your request to correct, we shall inform you of our decision not to comply and provide an explanation as to why we believe the request is fraudulent.
We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
If you are a California resident, you can authorize someone else as an authorized agent who can submit a request on your behalf. To do so, you must either (a) execute a valid, verifiable, and notarized power of attorney or (b) provide other written, signed authorization that we can then verify. When we receive a request submitted on your behalf by an authorized agent who does not have a power of attorney, that person will be asked to provide written proof that they have your permission to act on your behalf, and we will also contact you and ask you for information to verify your own identity directly with us and not through your authorized agent. We may deny a request from an authorized agent if the agent does not provide your signed permission demonstrating that they have been authorized by you to act on your behalf.
We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:
However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.
We retain personal information and sensitive personal information for as long as necessary to complete our business purpose. Because we maintain our applications and websites to protect from accidental or malicious loss and destruction, residual copies of your personal information and sensitive personal information may be retained in our backup and archival systems for a limited period of time, after which the information will be automatically deleted or put beyond use where deletion is not possible.
If you need to access this Policy in an alternative format due to having a disability, please contact email@example.com and/or 1-855-721-1188.