Retrium Privacy Notice for California Residents

Effective Date: 4/11/21

This Privacy Notice for California Residents (“CA Privacy Notice”) supplements the information contained in Retrium’s General Privacy Policy www.retrium.com/privacy (“Privacy Notice”) and applies solely to all individuals who reside in the State of California (“consumers” or “you”). We adopt this CA Privacy Notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”) and any terms defined in the CCPA have the same meaning when used in this CA Privacy Notice. Terms capitalized herein but not defined, have the meanings assigned in the Privacy Notice.  

Under the CCPA California residents have the following rights (“CCPA Rights”):

• You have the right to request and receive information on Retrium’s data collection practices during the preceding twelve (12) months, including the categories of Personal Information we have collected, disclosed for a business purpose and/or sold; the sources from which we collected Personal Information; our business use of Personal Information; and the categories of third parties to whom we disclosed your Personal Information. 
• You have the right to request and receive information on Retrium’s data sharing practices including the categories of Personal Information we have shared for a business purpose or sold and the categories of third parties receiving such information. 
• You have the right to request and receive the specific pieces of your Personal Information that we have collected. 
• You have the right to have your Personal Information that we have collected deleted, subject to certain exceptions, including legal compliance. 
• You have the right to opt-out of the sale of your Personal Information to third parties.
• You have the right not to be discriminated against because you exercised any of your CCPA Rights.

1. Personal Information We Collect. Retrium collects the categories of Personal Information described in this Section A.   We obtain the categories of Personal Information from users and individuals who provide information about themselves and through technology we employ such as cookies and similar technologies. 

b. Recent Disclosures of Personal Information for a Business Purpose

1. Personal Information Disclosed:  In the preceding twelve (12) months, Retrium has disclosed the following categories of Personal Information for a business purpose: 

A. Identifiers.

B. California Customer Records Personal Information categories.

F. Internet or other similar network activity.

G. Geolocation data.

‍

2. Third Parties Disclosed To:  We disclose your Personal Information for a business purpose to the following categories of third parties: 

• Our Customers and Other Authorized Business Partners: a list of these providers can be reviewed here.  
• Employees who are authorized
• Agents and Service Providers such as payment processors, employee benefits providers, professional services providers, marketing partners. 
• Third parties to comply with legal process, to protect the company’s, our affiliates’, customers’, and others’ rights, property and safety, to enforce our rights and to provide security and fraud prevention. 
• Government regulators to comply with our legal obligations and where subpoenaed.

C. Recent Sale of Personal Information
Personal Information Disclosed:  In the preceding twelve (12) months we shared the following categories of Personal Information for monetary consideration or for other valuable consideration such as sharing with a third party that provides us with advertising, data analysis and security services, which may fall under the definition of for “other valuable consideration” which may be considered a ‘sale’ under the CCPA: None

1. Third Parties Disclosed To:  We have sold your Personal Information to the following categories of third parties: Not Applicable

D. Your CCPA Rights and Choices

This section describes how to exercise your CCPA Rights.

1. Access to Specific Information and Data Portability Rights.  Once we receive and confirm your verifiable consumer request (see Section D(3) below (Exercising Access, Data Portability, and Deletion Rights)), we will disclose to you:

• The categories of Personal Information we collected about you.
• The categories of Personal Information we sold about you. 
• The categories of Personal Information we disclosed about you for a business purpose.
• The categories of sources for the Personal Information we collected about you.
• Our business or commercial purpose for collecting or selling that Personal Information.
• The categories of third parties with whom we sold, disclosed or shared that Personal Information.
• The specific pieces of Personal Information we collected about you (also called a data portability request).
• If we sold or disclosed your Personal Information for a business purpose, two separate lists disclosing:

• Sales, identifying the Personal Information categories that each category of recipient purchased; and 
• disclosures for a business purpose, identifying the Personal Information categories that each category of recipient obtained. 

We are not required to search for Personal Information if all of the following conditions are met:

• We do not maintain the Personal Information in a searchable or reasonably accessible format.
• We maintain the Personal Information solely for legal or compliance purposes.
• We do not sell the Personal Information and do not use it for any commercial purpose.
• We describe to you the categories of records that may contain Personal Information that we did not search because of the conditions stated above.

2. Deletion Request Rights.  Once we receive and confirm your verifiable consumer request (see Section D(3) below (Exercising Access, Data Portability, and Deletion Rights), we will delete (and direct our service providers to delete) your Personal Information from our records, unless an exception applies.

• We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to: 
• Complete the transaction for which we collected the Personal Information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform our contract with you.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
• Debug products to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
• Comply with a legal obligation.
• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

3. Exercising Access, Data Portability, and Deletion Rights. To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to us by either:

• Emailing us at privacy@retrium.com with the subject line of “CCPA Request”
• Visiting www.retrium.com
• Mailing us at Retrium, 8705B Colesville Road, #219, Silver Spring, MD 20910
• Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your Personal Information. You may also make a verifiable consumer request on behalf of your minor child. 
• You may only make a verifiable consumer request for access or data portability twice within a twelve (12) month period. The verifiable consumer request must:
• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative, which may include:
• We require the following information: email address
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Response Timing and Format

We endeavor to confirm receipt of a request to know or a request to delete within ten (10) business days, and provide information about how we will process the request. We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 45/90 days), we will inform you of the reason and extension period in writing.

We will deliver our written response electronically. 

Any disclosures we provide will only cover the twelve (12) month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.