The California Consumer Protection Act (the "CCPA"), as amended by the California Privacy Rights Act ("CPRA") provides California Residents (visitors, users, and others who are consumers residing in the State of California as defined by the CCPA and in Section 17014 of Title 18 of the California Code of Regulations) with specific rights regarding their "Personal Information." For this California Notice, unless we indicate otherwise, "personal information" means information that identifies, relates to, describes, references, is reasonably capable of being associated with or could reasonably be linked, directly or indirectly, with a person or household. Personal information does not include: publicly available information from government records; de-identified or aggregated consumer information; and, information excluded from the CCPA's scope, including: health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data, certain information covered by sector-specific privacy laws, such as the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Billey Act (GLBA), the California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994 (DPPA). Any terms defined in the CCPA have the same meaning when used in this Notice.
These rights apply to visitors, users, and others who reside in the State of California. The following sections describe your CCPA rights and explain how to exercise those rights.
We may collect the following categories of Personal Information (as defined in the CCPA):
| Categories of Personal Information |
Examples of Personal Information from CCPA |
Do we collect this information? |
We also want you to know |
| A. Identifiers. |
A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers. |
YES |
We do NOT collect Social Security Number, driver's license number and passport number. |
| B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). ("Customer Records") |
A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories. |
YES |
We do NOT collect signature, Social Security Number, passport number, driver's license or state ID, insurance policy number, medical information or health insurance information. |
| C. Protected classification characteristics under California or federal law. |
Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information). |
NO |
We do NOT collect this information, unless it is somehow conveyed in artwork, videos or other user submitted content as part of our art gallery. |
| D. Commercial information. |
Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. |
YES |
We collect order history for merchandise purchased on Artsonia. |
| E. Biometric information as defined in the CCPA. |
Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data. |
NO |
We do NOT collect this information, unless it is somehow conveyed in artwork, videos or other user submitted content as part of our art gallery. |
| F. Internet or other similar network activity. |
Browsing history, search history, information on a customer's interaction with a website, application, or advertisement. |
YES |
We collect this information to help customize your user experience. |
| G. Geolocation data. |
Physical location or movements. |
YES |
When you use our Service we may collect and process information about your geographic location, for example through IP address or within user-submitted artwork or other content.
We only collect coarse location data, unless you provide your full address information to us manually (e.g. when a Teacher registers for a School account or a customer purchases a product).
We do NOT collect precise geolocation data from Children. We will not store or track your device location on an on-going basis or without your permission. We do not share precise geo-location data with third parties, other than our subprocessors as necessary to provide the Service (such as fulfilling product orders).
|
| H. Sensory data. |
Audio, electronic, visual, thermal, olfactory, or similar information. |
YES |
We do NOT specifically collect this information, except when it is conveyed in artwork, videos or other user submitted content as part of our Service. |
| I. Professional or employment-related information. |
Current or past job history or performance evaluations. |
NO |
N/A |
| J. Non-public education info (per FERPA (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)). |
Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records. |
YES |
We do collect and store student artist portfolios including grades, homerooms, and educational institutions.
We do NOT collect student transcripts, student financial information or student disciplinary records.
|
| K. Inferences drawn from other personal information. |
Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. |
YES |
We may use personal information to encourage activity within our services. |
We collect Personal Information so that we can best serve you, including for the following business purposes:
- to create and allow access to accounts
- to create a school gallery and ensure that visitors can locate the correct school
- to create a student digital portfolio and showcase their artwork to parents, friends, and family
- to create screennames for the public galleries
- to locate students in the public portfolio
- to organize student portfolios and artwork
- to process orders and ship product
- to communicate with customers, students, teachers, and parents
- to encourage students and teachers
- to allow parents and teachers to communicate about a student's artwork portfolio
- to identify the devices used and improve the product and experience
- to improve our products, websites, services marketing emails and notifications
- to provide the Artsonia service
As described in more detail in our Privacy Policy, we store Personal Information for as long as it's necessary to fulfill the purposes described, above, to provide our products and Services to you and others, and to satisfy any applicable legal requirements. This retention period will vary for different types of information.
- Personal Information we've collected over the past year. In the past twelve (12) months, we have collected one or more pieces of Personal Information from the following categories defined in the CCPA: identifiers, customer records, commercial information, internet or other similar network activity, geolocation data, non-public educational information, and inferences.
- Sources of Personal Information. The sources of information from whom we collect Personal Information are: our users, parents and legal guardians, teachers (with permission), cookies and similar technologies, and third parties who update or supplement the information that we've collected automatically. Our business and commercial purposes for collecting Personal Information are summarized, above, in the "Notice at Collection" section of this California Privacy Notice.
- We have not "sold" or "shared" personal information in the past twelve months. For the purposes of this Notice, the terms "sold" and "shared" do NOT include the sale of merchandise within the Artsonia Gift Shop. Artsonia does not "sell" or "share" Personal Information as such terms are defined by the CCPA; and, we don't engage in behaviorally-targeted advertising. Accordingly, we do not offer "do not sell" or "do not share" opt-out functions.
- Some of the Personal Information we collect is made available to our trusted partners. The following categories of personal information are made available to other members of the Artsonia Family, our service providers, and third parties for which you've given consent: identifiers, personal Information listed in the California Customer Records Statute, commercial information, internet or other network activity, non-public educational information, inferences drawn from personal information.
Requests to know. The CCPA and CPRA give California Residents the right to ask us about our collection and use of the Personal Information we have collected, used and disclosed over the past twelve (12) months. To do so, you can submit a verifiable consumer request ("Request to Know"). Once we receive and confirm your verifiable consumer request, we will disclose to you:
- The categories of Personal Information we collected about you.
- The categories of sources for the Personal Information we collected about you.
- Our business or commercial purpose for collecting that Personal Information.
- The categories of third parties with whom we share that Personal Information.
- The specific pieces of Personal Information we collected about you (also called a Data Portability Request).
- If we sold or disclosed your Personal Information for a business purpose, two separate lists disclosing: (1) sales, identifying the Personal Information categories that each category of recipient; and (2) disclosures for a business purpose, identifying the Personal Information categories that each category of recipient obtained.
You may make a request to know us by calling 800-869-9974 or by submitting a personal information request form. The delivery of our response may take place electronically or by mail. We are not required to respond to requests to know more than twice in a 12-month period.
Correction and deletion requests. California Residents have the right to request that we correct inaccurate Personal Information or delete the Personal Information that we collected from you and retained ("Requests to Correct" or "Requests to Delete"). Once we receive and confirm your verifiable consumer request, we will correct or delete (and direct our service providers to correct or delete) your Personal Information from our records, unless an exception applies. With respect to deletion requests, your personal information will be deleted by permanently and completely erasing the personal information on our systems, de-identifying the personal information or aggregating the personal information.
Please note that we cannot delete or change information that is retained at the direction of a school, including Artwork uploaded by students or teachers on behalf of students, unless the school makes or approves the request. We may also deny your deletion request and, then, won't comply with your request (so we also wouldn't ask service providers to comply with the request) if retaining the information is necessary to perform certain functions or commitments as follows: completing the transaction for which the personal information was collected; providing a service requested; otherwise performing our contract with you or taking reasonably anticipated actions within the context of our ongoing business relationship with you; detecting security incidents and protecting against malicious, deceptive or otherwise illegal activity or to prosecute those responsible for those activities; complying with a legal obligation or otherwise using the personal information, internally, in a lawful manner; complying with the California Electronic Communications Privacy Act; fulfilling the terms of a written warranty or product recall conducted in accordance with federal law; or, for a purpose otherwise contemplated by Cal. Civ. Code Section 1798.105(c)-(d) and as amended. If your personal information is stored on archived or backup systems, we may delay compliance with your request with respect to that data until it is restored.
How to submit a request to exercise your CCPA rights. To exercise the rights described above, please submit a verifiable consumer request to us by either:
Should you call us or visit the website we've shown above, you'll be provided access to the form we have for making a verifiable request. But, generally, your verifiable request must provide sufficient information to allow us to reasonably verify you are the person about whom we collected personal information or that you are the authorized representative of that person and describe your request with sufficient detail to allow us to understand, evaluate and respond to it.
Only you or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your Personal Information. If the request is made through an agent, we reserve the right to require a signed authorization or verification of the agent's identity from you in order protect the privacy of the Personal Information requested. You may also make a verifiable consumer request on behalf of your minor child. or children under the age of thirteen (13), requests must be made by the child's parent or legal guardian. Upon receipt of a request, we may ask you for additional information to verify your identity. Any additional information you provide will be used only to verify your identity and not for any other purpose.
Here's the thing: we can't provide you with the information sought in a Request to Know, or comply with a Request to Delete, if we can't verify your identity or authority to make the request and/or can't confirm the personal information relates to you. We're trying to avoid any unauthorized access of your data. So, even if you already have an account with us, we reserve the right to require additional information from you to verify your request before we respond. If you are not an account holder, or if we believe that the request is fraudulent or that there is fraudulent activity with your account, we may require that you provide a declaration, under penalty of perjury, that you are authorized to make the request, in addition to requiring additional information, before we comply. Any information provided to us in a verifiable customer request will be used only to verify the requestor's identity or authority to make the request and, except as required by law, will be deleted after we have processed your request. We also reserve the right to refuse a Request to Know or a Request to Delete if we believe that the request may be fraudulent or may compromise the security of personal information. Where we refuse a Request, we'll let you know and explain the reasons for refusing.
We won't charge for processing or responding to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
How we'll respond to your CCPA requests. We'll let you know that we received your request within ten (10) business days of receipt and give you information regarding how we will process you request. We'll try to respond to a verifiable consumer request within forty-five (45) calendar days of its receipt. And, if we require more time to provide a response, up to ninety (90) days from receipt, we will write to you and give you the reason for the extra time and amount of extra time. For example, if you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. If we are not able to verify your request in time to provide you a response within ninety (90) days, we reserve the right to deny your request.
Any disclosures we provide will only cover the twelve (12) month period preceding the verifiable consumer request's receipt. For data portability requests, we will select a format by which to provide your personal information that is readily useable and should allow you to send the information from one entity to another entity without problems. For requests to delete, we will let you know whether or not we were able to comply with your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. If we are only able to comply with part of your request, we will let you know the portions with which we cannot comply and explain why. Know that we don't charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive or manifestly unfounded.
As mentioned above, we may collect or process sensitive data as needed or required to deliver services you have requested, to inform you of other products or services, and to contact you via surveys to conduct research about your opinions. You may request that we delete this information, subject to certain exceptions as provided by the CCPA.
Non-Discrimination. You have the right not to be discriminated against for the exercise of your California privacy rights described above. Unless permitted by the CCPA, we will not:
- Deny you goods or services;
- Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
- Provide you a different level or quality of goods or services; or,
- Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
Notice of financial incentive
