CPRA Policy For Consumers and B2B

PURPOSE AND INTENT

Jitsu and its operating groups, parent(s), subsidiaries and affiliates (collectively, “the Company”) are committed to protecting the privacy and security of your personal information. This California privacy policy describes how we collect, use, retain, secure and disclose personal information about you (our “Information Practices”). This privacy policy is intended to comply with the California Consumer Privacy Act, California Privacy Rights Act (“CPRA”), and applicable regulations (together the “CPRA”).

It is important that you understand this California privacy policy, together with any other privacy notices we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information. If you have any questions about this privacy policy or our Information Practices, please contact us at: CPRA@gojitsu.com.

If you wish to access this California privacy policy in an alternate format or require an accommodation to access this privacy policy, please contact us at: CPRA@gojitsu.com.

DATA PROTECTION PRINCIPLES

We collect, use, retain, and share your personal information in accordance with certain data privacy and data protection principles. Specifically, the personal information we collect about you is:

used lawfully, fairly and in a transparent way;
collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes;
reasonably necessary and proportionate to achieve these purposes;
accurate and kept up to date;
kept only as long as necessary for these purposes; and
kept securely.

If we intend to collect, use, retain, or share your personal information for any purpose that is incompatible with the purposes for which your personal information was collected, we will obtain your consent to do so.

For the purposes of this privacy policy, “personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

“Sensitive personal information” is a subcategory of personal information and means personal information that reveals: (a) an individual’s social security, driver’s license, state identification card, or passport number; (b) an individual’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; (c) an individual’s precise geolocation; (d) an individual’s racial or ethnic origin, religious or philosophical beliefs, or union membership; (e) the contents of an individual’s mail, email, and text messages unless the Company is the intended recipient of the communication; (f) an individual’s genetic data; (g) an individual’s biometric information used to uniquely identify the individual; (h) personal information collected and analyzed regarding an individual’s health; and (i) personal information collected and analyzed regarding an individual’s sex life or sexual orientation.

PERSONAL INFORMATION WE COLLECT AND HOW WE COLLECT IT, USE IT, AND RETAIN IT

We collect, receive, use and retain personal information for the following purposes. However, we do not:

sell your personal information;

share or disclose your personal information to third parties other than the entities or service providers listed below;

share or disclose your sensitive information to third parties for purposes other than those listed below or otherwise permitted by the CPRA;

sell or share the personal information of consumers under 16 years of age; or
permit third parties to collect your personal information on our behalf other than our service providers listed below.

The categories of Personal Information we have collected during the previous twelve months include:

Categories of Personal Information Collected	Sources of the Personal Information	Purposes for Collecting the Personal Information	Categories of Entities with whom the Personal Information Is Shared
Identifiers such as name, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, or other similar identifiers.	You, background check service providers, references, customers.	Manage our business relationship; comply with applicable laws and contractual rights; exercise and defend our legal rights.	Company personnel involved with selection; background check service providers; references; applicable law enforcement and government agencies; IT service providers
Protected categories such as race, color, national origin, religion, sex or gender, disability, age, citizenship status, ancestry, marital status, and medical condition	You, background service providers, ; references and former employers.	Manage our business relationship; comply with applicable laws; exercise and defend our legal rights.	Company personnel involved with selection, background check service providers; references; applicable law enforcement and government agencies; IT service providers.
Sensitive Personal Information, such as social security number; driver’s license number; precise geolocation; financial account.	You, background check service providers.	Verify identity; comply with applicable laws; exercise and defend our legal rights.	Company personnel involved with selection; background check service providers; references; applicable law enforcement and government agencies; IT service providers.
Geolocation information	You, your computer or mobile device, IT department personnel and service providers	Verify identity; Comply with applicable laws; exercise and defend our legal rights; and other short-term transient use.	Company IT personnel, service providers; applicable law enforcement and government agencies; IT service providers.
Audio, electronic, visual, thermal, or similar information	You, our recording device, IT department personnel and service providers	Verify identity; comply with applicable laws; exercise and defend our legal rights.	Company personnel involved with selection, IT; IT service providers; applicable law enforcement and government agencies; IT service providers.
Professional or employment-related information such as job preference and work availability; qualifications; employment history and experience; military service reference and background check information including relevant criminal history and credit history; pre-employment test results; immigration and work eligibility; information provided by the applicant during the interview and hiring process	You, background check service providers.	Manage our business relationship; comply with applicable laws; exercise and defend our legal rights.	Company personnel involved with selection; recruiting and background check service providers; applicable law enforcement and government agencies; IT service providers
Inferences drawn from the personal information collected	Personal information collected	Manage our business relationship; comply with applicable laws; exercise and defend our legal rights.	Company personnel involved with selection; recruiting and background check service providers; applicable law enforcement and government agencies; IT service providers

The categories of Personal Information we have sold or shared collected to third parties during the preceding twelve months include the following. However, we have not sold or shared Personal Information of consumers under the age of 16.

Categories of Personal Information Sold or Shared	Categories of Entities with whom We have sold or shared Personal Information	Purposes for the Sale or Sharing
Identifiers, such as contact information	Our third-party business partners, third-party sites or platforms such as social networking sites, and other third party marketing companies.	To deliver contextual advertising, conduct cross-device tracking to serve you first-party ads directly, or for non-interest based advertising purposes, such as attribution and analytics.
Protected Categories, such as demographic information like gender and age),	Our third-party business partners, third-party sites or platforms such as social networking sites, and other third party marketing companies.	To deliver contextual advertising, conduct cross-device tracking to serve you first-party ads directly, or for non-interest based advertising purposes, such as attribution and analytics.
Sensitive Information, such as demographic information like gender and age),	Our third-party business partners and service providers, third-party sites or platforms such as social networking sites, and other third party marketing companies.	To deliver contextual advertising, conduct cross-device tracking to serve you first-party ads directly, or for non-interest based advertising purposes, such as attribution and analytics.
Internet or other electronic network activity information,	Our third-party business partners and service providers, third-party sites or platforms such as social networking sites, and other third party marketing companies.	To deliver contextual advertising, conduct cross-device tracking to serve you first-party ads directly, or for non-interest based advertising purposes, such as attribution and analytics.
Commercial Information such as payment card information associated with you	Our third-party business partners and service providers, third-party sites or platforms such as social networking sites, and other third party marketing companies.	To deliver contextual advertising, conduct cross-device tracking to serve you first-party ads directly, or for non-interest based advertising purposes, such as attribution and analytics.
Geolocation data	Our third-party business partners and service providers, third-party sites or platforms such as social networking sites, and other third party marketing companies.	To deliver contextual advertising, conduct cross-device tracking to serve you first-party ads directly, or for non-interest based advertising purposes, such as attribution and analytics.
Audio, electronic, visual or similar information	Our third-party business partners and service providers, third-party sites or platforms such as social networking sites, and other third party marketing companies.	To deliver contextual advertising, conduct cross-device tracking to serve you first-party ads directly, or for non-interest based advertising purposes, such as attribution and analytics.
Inferences drawn from the personal information collected	Our third-party business partners and service providers, third-party sites or platforms such as social networking sites, and other third party marketing companies.	To deliver contextual advertising, conduct cross-device tracking to serve you first-party ads directly, or for non-interest based advertising purposes, such as attribution and analytics.

HOW WE SHARE PERSONAL INFORMATION

We may disclose your personal information to the following categories of recipients, including for the business purposes described above:

Our affiliate companies;

Our trusted third-party services providers and partners who assist us in providing our products and services and operating our business;

Competent law enforcement agencies, courts, and government agencies to comply with our legal obligations and exercise our legal rights;

Appropriate entities in connection with any proposed purchase, merger, or acquisition; and

Other persons and entities with your consent to the disclosure.

DATA RETENTION

We will only retain your personal information for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements. Generally, we retain personal information for the duration of our relationship with you plus any legally required record or data retention period and/or any period of time necessary to exercise our legal rights. Thereafter, we will securely destroy your personal information in accordance with the Company’s record retention policies.

In some circumstances, we may anonymize your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.

YOUR PRIVACY RIGHTS

As a California resident, you have the following privacy rights regarding your personal information:

The right to know and right to access the personal information we have collected about you, including the categories of personal information; the categories of sources from which the personal information is collected; the business or commercial purpose for collecting, selling, or sharing personal information; the categories of third parties to whom the business discloses personal information; and the specific pieces of personal information the business has collected about the consumer;
The right to delete personal information that we have collected from you, subject to certain exceptions;
The right to correct inaccurate personal information that we maintain about you;
The right of portability, or right to have us transfer your personal information to other persons or entities upon your request;
The right to limit the use of your sensitive information;
The right to opt-out of the sale or sharing of your personal information to third parties; and
The right not to be discriminated against for exercising your of privacy rights.

You can exercise your right to know, delete, or correct your Personal Information by submitting a request to us by using the webform by clicking this “Right to Know” link; emailing us at: CPRA@gojitsu.com or calling us at: (855) 249-SHIP. To protect the security of your personal information, we will require you to verify your identity by providing us with identifying information such as your personal email address, personal telephone number, home address, and/or other information that we can match with the personal information we haves already collected about you to verify your identity.

You may use an authorized agent to exercise your right to know, delete, or correct your Personal Information. We will require your authorized agent to provide us with either (1) a power of attorney authorizing the authorized agent to act on your behalf or (2) your written authorization permitting the authorized agent to request access to your personal information on your behalf. Further, we will require you or your authorized agent to provide us with identifying information to verify your identity. We may also require you to either verify your own identity directly with us or directly confirm with us that you provided the authorized agent permission to submit the request.

You can exercise your right to opt-out of the sale or sharing of your information by clicking the “Do Not Sell or Share My Personal Information” link here or on our website’s homepage and completing the interactive online form; or by emailing us at: CPRA@gojitsu.com; or by calling us at: (855) 249-SHIP; or by asking us to provide you with a hardcopy “Consumer Access Request” form at any of our physical locations that you visit; or by using an opt-out preference signal that meets the following requirements:

The signal is in a format commonly used and recognized by businesses. An example would be an HTTP header field or JavaScript object.
The platform, technology, or mechanism that sends the opt-out preference signal makes it clear to the consumer, whether in its configuration or in disclosures to the public, that the use of the signal is meant to have the effect of opting the consumer out of the sale and sharing of their personal information.

If we already have information about you when we receive your opt-out preference signal, we will honor your request to opt-out of the sale or sharing of your personal information for all of the personal information we have collected about you both online and offline. If we do not already have information about you when we receive your opt-out preference signal, we will honor your request to opt-out of the sale or sharing of your personal information for all of the personal information we have collected about you from the platform or device that sent the opt-out preference signal. Further, we may ask you for additional information necessary to complete your request. Further information regarding opt-out preference signals and how you can use opt-out preference signals can be found at: https://globalprivacycontrols.org

You can exercise your right to limit the use and disclosure of your sensitive personal information by clicking the “Limit the Use of My Sensitive Personal Information” link here or on our website’s homepage and completing the interactive online form; or by emailing us at: CPRA@gojitsu.com; or by calling us at: (855) 249-SHIP; or by asking us to provide you with a hardcopy Consumer Access Request form at any of our physical locations that you visit.

In addition to the privacy rights above, individual California residents have the right under the California Online Privacy Protection Act (CalOPPA) to request information about our disclosures of certain categories of personal information to our affiliates or third parties for their direct marketing purposes. We will provide a list of the categories of personal information disclosed to third parties or our affiliates for their direct marketing purposes during the immediately preceding calendar year, along with the names and addresses of these third parties or affiliates. This request may be made no more than once per calendar year. Individual California Users must submit their requests to us either by email at: CPRA@gojitsu.com or write us at the mailing address in the Changes and Contact section below. We reserve our right not to respond to requests submitted other than to the email or mailing addresses specified in this section.

DATA SECURITY

While no data security system can fully protect personal information from unauthorized data breaches, we have implemented reasonable safeguards and controls, consistent with its legal obligations under California and other local, state and federal laws. The Company is committed to: (i) seeking to safeguard all personal information that you provide to us; (ii) seeking to ensure that it remains confidential and secure; and (iii) taking all reasonable steps to ensure that personal privacy is respected. All our data is stored in written or electronic form on our servers and computers and in various physical locations. We maintain physical, electronic and procedural safeguards to protect your personal information from misuse, unauthorized access or disclosure and loss or corruption by computer viruses and other sources of harm. We restrict access to personal information to those staff members of the Company and our services providers who need to know that information for the purposes identified in our privacy policy and privacy notices.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

PERSONAL INFORMATION OF MINORS

The Company does not collect, sell or share personal information for individuals under the age of 16.

CHANGES TO THIS PRIVACY POLICY

As we strive to improve our practices, we may revise the Company’s privacy policy from time to time. This privacy policy is not a contract and we reserve the right to change this policy at any time and to notify you of those changes by posting an updated version of this policy. It is your responsibility to check this policy from time to time for any changes.

This privacy policy was last updated on June 23, 2023.

QUESTIONS AND FURTHER INFORMATION

If you have any questions or would like further information regarding this privacy policy or our privacy practices, please contact us at: CPRA@gojitsu.com.

Jitsu CPRA California Privacy Policy for Consumers and B2B Customers