Privacy Notice

The following notice describes how the Privily service processes your personal information. Please read the notice and do not use Privily if you do not agree to these terms.

Privily is designed to give individuals control over how their data is used and to easily make and receive responses to their privacy questions and requests. Privily’s users include individuals who can use Privily to make and track privacy related requests about their personal information and participating businesses that can use Privily to receive and respond to privacy requests from individuals. References to “you” or “individuals” refer to individuals using Privily.

Who we are

Privily is a service provided by IOR Analytics, a Texas LLC. References to “us” or “Privily” refer to IOR Analytics, LLC. We provide this Privily website and its accompanying Data Subject Rights portal service to our participating businesses, who use it to help manage your privacy questions and requests

While we maintain agreements with participating businesses, we are independent of these businesses. Privily acts as a connector to facilitate data requests between individuals and participating businesses. If you use the Privily service to submit or track privacy requests with one or more participating businesses, IOR acts as a processor or service provider to those businesses, meaning we process your data on their behalf and the participating businesses’ privacy notice also applies.

Information we collect

We collect information about individuals in two main ways, automatically and when individuals voluntarily share information.

Information we collect automatically

When you visit our website, some information is collected automatically. This includes online identifiers such as IP addresses and other network information considered Personal Information or Personal Data under most privacy laws. We use this information to make our website work and for security and fraud prevention. Where a lawful basis is required, we process this information based on our legitimate interests in running this website.

We hold this identifiable personal information only as long as a user request is active so that it can be tracked, as dictated by the needs of our participating businesses. For some requests types, we store a minimum amount of personal information indefinitely on behalf of our participating businesses only to document that a request was made. Our participating businesses use this for compliance purposes, for example so that they do not email you again if you have opted out of marketing emails.

Information individuals provide

If you choose to submit a request to a participating business using our service we may collect additional information from you, We use this information to help identify you with a participating business. For example, we may collect information about your purchases with a participating business, your phone number or email address you used with the participating business, account name with the participating company, or other similar information.

Information we collect from other sources

We collect some personal information from participating businesses, typically to verify your identity. For example, we may receive information about your purchases or account with a company to compare to the information you provide to verify your identity.

We do not collect any information from other sources.

How we use your information

On our own behalf

As noted above, we use your information for two main purposes:

• To make our website work: Our site, like all websites, requires some basic information to function. This includes online identifiers such as IP addresses or similar technical information, which is considered personal information under many laws.
• For security and fraud prevention: We use information you provide and information we collect automatically to monitor our website for security and fraud prevention.

On behalf of participating businesses

Participating businesses use Privily to submit, track, and verify your requests: If you make a request using Privily, we help the participating company use information you provide and information we collect automatically to submit, track, and support response to your request. We provide this service as a processor to the participating business, which is the controller. We act as a processor or service provider to the participating business.

How we do not use your personal information

We’d like to emphasize a few of the things we do not do with personal information

• We do not use personal information for marketing: We do not use personal information collected from the Privily site or information you provide for marketing purposes. You will never receive marketing emails or web ads based on your use of Privily.
• We do not sell information: We do not sell personal information, including as defined in the CCPA.
• We do not share information for cross-contextual advertising: Just as we do not sell personal information, we do not share it or otherwise use it for any advertising, including cross-contextual advertising.

How we share or disclose personal information

We share information only to support our core business activity which is helping our users submit privacy requests and for our participating businesses to receive, verify, respond to, and track privacy requests. We share personal information in the following ways:

• With our service providers: We share personal information with our service providers (sometimes also called “processors”). These service providers are necessary for us to run our website and provide our services. For example, we share information to our hosting provider. Service providers are always obligated to use information only as we instruct them.
• With participating businesses: We share personal information to participating businesses only if an individual asks us to make a request. For example, if you ask us to submit a request to a participating company, we will share that individual’s information to the business.
• For “lawful requests”: A lawful request is when a law enforcement agency, court, regulator, litigant, or other party makes a request for certain information. While we have never received a “lawful request” for personal information, we would honor it if requested. If we ever receive such a request, we will verify its authenticity upon receipt. If we are permitted to do so, we will inform any potentially impacted individuals and allow them a chance to participate. In some very rare instances a law enforcement or other government agency may make a request and prohibit a recipient from notifying the potentially impacted individuals. In such a case, we could be obligated to comply without notifying potentially impacted individuals.
• In certain corporate transactions: We may share personal information upon a transfer or sale to another entity of all or substantially all of our assets or stock in our line of business to which this privacy notice relates or upon any other corporate reorganization. For example, if we sell our business to another company we will need to provide it with personal information necessary to continue to provide services.

How long we retain personal information

We retain personal information only as long as needed to provide services.

• We retain personal information on behalf of our participating businesses during the time a request is pending or in process so we can track the request. Once a request is closed, we delete personal information within 60 days.
• If a participating business disputes a request, the request could take longer. In this case, we will still delete all personal information 60 days after the dispute is resolved and closed, although this could take longer.
• When necessary, we may store personal information longer to help participating business verify continued compliance. For example, if you ask a company to delete your information or opt out of marketing emails, we may hold a minimal amount of personal information longer to make sure the participating company does not email you again.
• When needed for an incident or investigation: In rare circumstances, we may retain information longer to support an investigation into an incident or suspected inappropriate activity.

Location of processing and international transfers

We are located in the United States and serve participating businesses in the United States. Currently, we store data primarily in the United States. We take steps designed to ensure that the data we collect under this statement is processed according to the provisions of this statement and applicable law wherever the data is located.

Transfers to the United States

If you use the Privily service, you consent to the transfer of your personal information to the United States. If you make a request to a participating company using our service from outside the United States, including from the European Economic Area or Switzerland, you consent to the transfer of your personal information to the location of the participating business, which is likely the United States may be elsewhere. If you provide personal information to us to make a request to a participating business, you consent to the transfer of your information and the processing of your information in this way. Any international transfers made will be in accordance with this notice and the applicable law. We also impose appropriate contractual safeguards on third parties and other parties that might access the information, such as our service providers.

Automated decision making

We do not conduct automated decision making on our own behalf or assist participating businesses in automated decision making.

Data subject rights

The Privily service processes information primarily as a processor or service provider on behalf of our participating businesses. For example, if you make a request related to your information held by a participating business, we may hold some information on behalf of the participating company to help them handle your request. You may make privacy requests to the business through Privily, but the participating company’s policies and privacy notice will apply.

We handle a small amount of personal information for our own purposes, such as making the website work. You can make a request to us using the Privily system.

Your rights - European and global users

If you are a resident of the European Union or European Economic Area as well as some other territories, you may have specific rights related to your personal information (also called “personal data”). Specifically, you may have the right to:

• Access your personal data
• Correct your personal data
• Erase your personal data
• Obtain your personal data in a portable format
• Object to processing of your personal for some purposes.
• Object to automated decision making - (We do not employ automated decision making)

While Privily manages privacy requests on behalf of participating businesses, our own use of your personal information is very limited. Your rights may also be limited by our own legitimate interests in using your personal information for specific, lawful purposes.

Your rights - California users

If you are a resident of California, you may have additional privacy rights. These include:

• Right to Know: You have the right to request that we disclose the categories of personal information we collected about you individually, the categories of sources from which the information was collected, the business or commercial purposes for which we collected or sold that information, and the categories of third parties to whom the information was sold or disclosed for a business purpose in the last 12 months.
• Right to Access: You have the right to request access to the personal information specific to you individually, that we collected about you in the last 12 months. Right to Delete: You have the right to request us to delete personal information that we have collected, or maintain about you. Please note that certain exceptions apply to this right, such as when we must retain your information to comply with law. We will notify you of any such exceptions as applicable to your request.
• Right to Opt-Out of Sale: You have the right to opt-out or ask us not to sell your personal information. However, we will never sell personal information.

While Privily manages privacy requests on behalf of participating businesses, our own use of your personal information is very limited. Your rights may also be limited by our own legitimate interests in using your personal information for specific “business purposes” under California law.

Sales, marketing, and related sharing

Privily does not sell personal information, share personal information for cross-contextual advertising, or otherwise use personal information for marketing.

Data uses

The following table illustrates how we use personal information as a controller for our own purposes:

Data	California - Business purposes	GDPR - Lawful basis
Internet or other electronic network activity information	Providing services requested by you Detecting security incidents System debugging	Our legitimate interests in providing the Privily service Performance of contractual obligations to you Consent (rarely)

Security

We employ security safeguards \designed to protect your information from unauthorized access or use. However, like all websites, we cannot guarantee that the Privily service is completely secure. We employ robust technical and administrative controls to protect your data. As data security is an evolving field, we also continually monitor developments to continue to employ controls that are state of the art relative to the cost of implementation and the nature, scope, context and purposes of our data uses.

Questions or complaints

You may contact us with questions or complaints by emailing customer_care@privily.io.

Updates to this privacy notice

This privacy notice was last updated May 2022 and may be updated from time to time. We encourage you to check this page periodically to verify the current privacy notice in effect. Your continued use of Privily after an update to this notice indicates your acceptance of the terms of any new privacy notice.