Privacy Notice for California residents

Effective date: December 30, 2022

If you are a California resident you have certain rights related to the collection, use and disclosure of your personal information under the California Consumer Privacy Act of 2018 (“CCPA”) and, as amended, the California Privacy Rights Act of 2020 (“CPRA”), also known as Proposition 24.

Collection, Use, and Disclosure of Personal Information

Personal Information is data that identifies you or that makes you identifiable. Access collects, uses, and discloses the Personal Information about California Consumers for business purposes only, and consistent with applicable laws. We only control the collection, use and disclosure of information collected from our website and the following personal information as identified under each category of personal information, for business purposes identified and with the third parties identified below.

CATEGORY DESCRIPTION ACCESS CONTROLS COLLECTION
Identifiers A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers. YES
Personal information as described by §1798.80(e) of the CA Civil Code A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.

“Personal information” does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records.

 YES
Characteristics of protected classifications under California or federal law. Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information). NO
Commercial information Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. NO
Biometric information Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, face prints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data. NO
Internet or other electronic network activity information Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement. YES
Geolocation data Physical location or movements. NO
Sensory data Audio, electronic, visual, thermal, olfactory, or similar information. NO
Professional or employment-related information Current or past job history or performance evaluations. NO
Education information Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records. NO
Inferences about consumers Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. NO

Note that under the CPRA, Personal Information does not include:

  • Publicly available information or lawfully obtained, truthful information that is a matter of public concern.
  • Information that is de-identified or aggregate consumer information.
  • Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA);
  • Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), Gramm-Leach-Bliley Act (GLBA), California Financial Information Privacy Act (FIPA), and Driver’s Privacy Protection Act of 1994.

In addition to the uses set forth above, Access may use and share the categories of Personal Information identified:

  • To comply with applicable legal and regulatory requests and obligations (including investigations).
  • To establish or defend legal claims and allegations.
  • For security or the prevention, detection, or investigation of fraud, suspected or actual illegal activity, or other misconduct.
  • To seek advice from lawyers, auditors and other professional advisers.

Use of Personal Information

We may use your personal information for the following business purposes:

  • respond to you regarding the reason you contacted us;
  • operate our business;
  • create and improve our products;
  • prevent, investigate, resolve or provide notice of fraud, unlawful or criminal activity, disputes, security issues or unauthorized access to or use of information; and
  • any other lawful, legitimate business purpose.

If you visit our website:

If you provided consent, we may process personal information about you to:

  • respond to your individual rights requests;
  • manage your consent preferences;
  • deliver the resources and information you have requested online;
  • send direct email marketing communications about our solutions, events and related resources that may be of interest to you; and
  • Access uses cookies to enhance your experience, to display customized content in accordance with your browser settings, and to help us better understand how you use our website.

You may withdraw your consent at any time by clicking the “unsubscribe” link in the email communications we send to you. At any time, you can change or withdraw your consent from the Cookie Declaration on our website.

Disclosure of Personal Information

We may disclose your personal information with third parties for a business purpose. These third parties include,

  • those who perform services on our behalf;
  • to fulfill your requests;
  • in response to government authorities in response to their requests for such information;
  • in connection with claims, disputes or litigation;
  • when otherwise required by law;
  • when disclosure is necessary to protect the health and safety of you or us; or
  • if Access is involved in a corporate business transaction, such as a merger, acquisition, joint venture, or financing or sale of company assets, including bankruptcy proceedings

We have not sold the personal information of California residents in the preceding twelve months.  Access does not “sell” data as defined in Section 1798.140 of the CPRA.

Your Rights as a California Resident

You have basic rights under privacy and data protection laws related to the data we process about you. You may exercise those rights by contacting us via web form, email or telephone. You do not have to pay a fee, and we will acknowledge your request is received within 10 days, verify your identity where it is needed, and act on your request within 45 days. We will honor the requests you make related to your rights as the law allows. In some cases, there may be legal or other official reasons that we may not be able to address the specific request you make related to your rights.

In California, you may:

  • request access to specific pieces of personal information collected about you;
  • request to know the personal information we process about you;
  • request to know the personal information we sell or share about you;
  • request rectification of inaccuracies in your personal information;
  • request deletion of personal information about you;
  • request data portability, your requested information will be provided in a readily usable format to allow transmission to other organizations;
  • request to opt out of a “sale” or “sharing” of your personal information, please see the section below on how we manage those processes; and
  • request to limit the use or disclosure of your sensitive person information

Right to Know and Right to Request Information

You have the right to request that we disclose what personal information we collect, use, disclose or sell.  You have the right to request information about the personal information we have collected about you within the last twelve months. You may request to know if we have collected, sold or shared with third parties, for a business purpose, the following information:

  • The categories of personal information we have collected about you
  • The categories of sources of personal information we collected about you
  • Our business or commercial purpose for collecting or selling personal information about you
  • The categories of third parties with whom we share personal information
  • The specific pieces of personal information we have collected about
  • Whether we have sold your personal information and if so the categories of personal information that each category of recipient purchased; and
  • Whether we have disclosed your personal information for a business purpose and if so, the categories of personal information that each category of recipient received

You may request this information no more than twice in a 12‐month period.

Right to Request Deletion

You have the right to request that we delete your personal information.  Under certain circumstances, we may be unable to delete your personal information, for example, to comply with legal obligations, or to complete a business transaction that you have requested.  Requests are subject to certain exceptions.  These exceptions include:

  • Completing the transaction for which we collected the personal information, providing a good or service that you requested, taking actions reasonably anticipated within the  context of our ongoing business relationship with you, or otherwise performing our contract with you;
  • Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, or prosecuting those responsible for such activities;
  • Debugging products to identify and repair errors that impair existing intended functionality;
  • Exercising free speech, ensuring the right of another consumer to exercise their free speech rights, or exercising another right provided for by law;
  • Complying with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.);
  • Engaging in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent;
  • Enabling solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;
  • Complying with a legal obligation;
  • Making other internal or lawful uses of that information that are compatible with the context in which you provided it.

Right to Non-Discrimination

You have a right not to receive discriminatory treatment for exercising your privacy rights as identified in this section of the privacy notice as conferred by the CPRA.

We will not discriminate against you for exercising your rights under the CPRA.  Unless permitted by the CPRA, we will not:

  • Deny you goods or services.
  • Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
  • Provide you a different level or quality of goods or services.
  • Suggest that you may receive a different price or rate for goods or services or a different level of quality of goods or services

Exercise Your Rights

To exercise the rights described above, please submit a verifiable consumer request by contacting us by any of the following methods:

  • Email:  [email protected]
  • Phone: 1-877-345-3546
  • Mail: 500 Unicorn Park Drive, Suite 503, Woburn, MA 01801

Note that under the CPRA, you may only make such a request twice within a 12-month period.  Access will respond appropriately within the required timeframes of the CPRA.

When you submit a request, we will verify your request and may ask you to complete a request form, provide identification, proof of address, an email, or details from a previous order to ensure verification.  We also may use a third party verification provider to verify your identity.  You may designate an authorized agent to make a request to know or a request to delete your personal information by providing the authorized agent written permission to do so; and by verifying your own identity with us directly.  We will deny any requests from agents that do not submit proof of authorization.

Questions

If you have questions concerning this notice, or to request this notice in another format, please contact us via e-mail at [email protected], 1.877.345.3546 or by writing to 500 Unicorn Park Drive, Suite 503, Woburn, MA 01801.

This notice was last updated December 30, 2022