Supplemental Privacy Policy for California Residents
Last updated: 09/12/2023
This Supplemental Privacy Policy for California Residents supplements the information contained in our Privacy Policy and applies to California residents (consumers) who visit or use the Website. We adopt this policy to comply with the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020, and other California privacy laws. Any terms defined in the CCPA have the same meaning when used in this policy. Any capitalized terms not defined in this policy or in the CCPA have the meaning provided in our Privacy Policy.
This policy outlines the personal information we collect or process about you if you are a consumer when you access or use the Website or the services we provide or offer specifically to you through the Website; how we use, share, and protect that personal information; and what your rights are with respect to your personal information that we gather and process.
In this policy, personal information and sensitive personal information have the same meanings as under the CCPA:
Personal information is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.
Personal information does not include publicly available information or information that has been de-identified (i.e. information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer) or aggregated (i.e. information that relates to a group or category of consumers, from which individual consumer identities have been removed).
Sensitive personal information means: (1) personal information that reveals (A) a consumer's social security, driver's license, state identification card, or passport number; (B) a consumer's account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; (C) a consumer's precise geolocation; (D) a consumer's racial or ethnic origin, religious or philosophical beliefs, or union membership; (E) the contents of a consumer's mail, email and text messages, unless the business is the intended recipient of the communication; (F) a consumer's genetic data; and (2)(A) the processing of biometric information for the purpose of uniquely identifying a consumer; (B) personal information collected and analyzed concerning a consumer's health; or (C) personal information collected and analyzed concerning a consumer's sex life or sexual orientation.
Sensitive personal information that is publicly available is not considered to be sensitive personal information or personal information.
The CCPA also excludes from its scope certain other information, including (but not limited to):
- health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 and the California Confidentiality of Medical Information Act or clinical trial data; and
- personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act or California Financial Information Privacy Act, and the Driver's Privacy Protection Act of 1994.
Categories of personal information and sensitive personal information we collect
additional categories of personal information without providing you notice.
We have collected the following categories of personal information within the last twelve (12) months:
| Category | Description | Collected |
|---|---|---|
| (A) | Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, social security number, driver's license number, passport number, or other similar identifiers. | Yes |
| (B) | Any personal information described in subdivision (e) of Section 1798.80. i.e.: any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, their name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. |
Yes |
| (C) | Characteristics of protected classifications under California or federal law. Examples: Age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information). |
Yes (limited to Template Data provided by you) |
| (D) | Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. | Yes |
| (E) | Biometric information. Defined as: an individual's physiological, biological, or behavioral characteristics, including an individual's deoxyribonucleic acid (DNA), that can be used, singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information. |
No |
| (F) | Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer's interaction with an internet website, application, or advertisement. | Yes |
| (G) | Geolocation data. | No |
| (H) | Audio, electronic, visual, thermal, olfactory, or similar information. | No |
| (I) | Professional or employment-related information. | Yes |
| (J) | Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99). Examples: Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records. |
No |
| (K) | Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. | No |
We have collected the following categories of sensitive personal information within the last twelve (12) months:
| Category | Description | Collected |
|---|---|---|
| (A) | A consumer's social security, driver's license, state identification card, or passport number. | No |
| (B) | A consumer's account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account. | No |
| (C) | A consumer's precise geolocation. | No |
| (D) | A consumer's racial or ethnic origin, religious or philosophical beliefs, or union membership. | Not explicitly. However, consumers may volunteer information about their religious observances when completing our funeral directive or living will templates in order to describe what type of service they want on death or what kinds of treatment they would or would not want in certain events |
| (E) | The contents of a consumer's mail, email, and text messages unless the business is the intended recipient of the communication. | No |
| (F) | A consumer's genetic data. | No |
| (G) | The processing of biometric information for the purpose of uniquely identifying a consumer. | No |
| (H) | Personal information collected and analyzed concerning a consumer's health. | No |
| (I) | Personal information collected and analyzed concerning a consumer's sex life or sexual orientation. | No |
Use of personal information
We may use the personal information we collect for the business or commercial purposes listed in the 'How we use your personal data' section of our Privacy Policy. We will not use the personal information we collect for materially different, unrelated, or incompatible purposes without providing you notice.
Sources of personal information
We may obtain the categories of personal information listed above from the sources described in the 'How is your personal data collected?' section of our Privacy Policy.
Selling or sharing personal information or sensitive personal information
We do not sell or share your personal information or sensitive personal information, as defined under the CCPA.
We do not knowingly collect personal information or sensitive personal information from minors; our services are for use by adults.
Disclosing personal information
We may disclose your personal information to the categories of third parties described in the 'Disclosures of your personal data' section of our Privacy Policy. In the preceding twelve (12) months, we have disclosed the following categories of personal information for the business or commercial purpose(s) specified:
| Category | Description | Disclosed | Purpose |
|---|---|---|---|
| (A) | Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, social security number, driver's license number, passport number, or other similar identifiers. | Yes | Information provided to:
|
| (B) | Any categories of personal information described in subdivision (e) of Section 1798.80. i.e.: any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. |
Yes | Information provided to:
|
| (C) | Characteristics of protected classifications under California or federal law. Examples: Age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information). |
Yes | Information provided to:
|
| (D) | Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. | No | |
| (E) | Biometric information. Defined as: an individual's physiological, biological, or behavioral characteristics, including an individual's deoxyribonucleic acid (DNA), that can be used, singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted, and keystroke patterns or rhythms, gait patterns or rhythms, and sleep, health, or exercise data that contain identifying information. |
No | |
| (F) | Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer's interaction with an internet website, application, or advertisement. | No | |
| (G) | Geolocation data. | No | |
| (H) | Audio, electronic, visual, thermal, olfactory, or similar information. | No | |
| (I) | Professional or employment-related information. | Yes | Information provided to:
|
| (J) | Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99). Examples: Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records. |
No | |
| (K) | Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. | No |
Use and disclosure of sensitive personal information
We only use sensitive personal information as is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services or as otherwise authorized under the California Consumer Privacy Act Regulations.
We do not collect or process sensitive personal information for the purpose of inferring characteristics about you.
We do not disclose sensitive personal information.
Your consumer rights
The CCPA provides you with specific rights regarding your personal information (information). This section describes your consumer rights and explains how to exercise those rights.
However, neither these rights in particular, nor the CCPA in general, restrict our ability, amongst other things, to:
- Comply with federal, state, or local laws.
- Comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities.
- Co-operate with law enforcement agencies concerning conduct or activity that we, a service provider of ours, or a third party reasonably and in good faith believes may violate federal, state, or local law.
- Exercise or defend legal claims.
- Collect or sell a consumer's personal information if every aspect of that commercial conduct takes place wholly outside of California.
Requests to know
You have the right to request that we disclose certain information to you about our collection and use of your personal information:
- The categories of personal information we collected about you.
- The categories of sources for the personal information we collected about you.
- Our business or commercial purpose(s) for collecting, selling or sharing that personal information.
- If we sold or shared your personal information, the categories of personal information that we sold or shared about you and the categories of third parties to whom the personal information was sold or shared, by category or categories of personal information for each category of third parties to whom the personal information was sold or shared.
- If we disclosed your personal information for a business purpose, the categories of personal information that we disclosed about you for a business purpose and the categories of persons to whom that personal information was disclosed for a business purpose.
- The specific pieces of personal information we collected about you.
We are not obligated to provide the above information to the same consumer more than twice in a 12-month period.
Requests to delete
You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm a verifiable consumer request (see 'Exercising your consumer rights' below), we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.
We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:
- Complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between us and you.
- Help to ensure security and integrity to the extent the use of the consumer's personal information is reasonably necessary and proportionate for those purposes.
- Debug to identify and repair errors that impair existing intended functionality.
- Exercise free speech, ensure the right of another consumer to exercise that consumer's right of free speech, or exercise another right provided for by law.
- Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.
- Engage in public or peer-reviewed scientific, historical, or statistical research that conforms or adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, if you have provided informed consent.
- To enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us and compatible with the context in which you provided the information.
- Comply with a legal obligation.
Requests to correct
You have the right to request that we correct any inaccurate personal information that we maintain about you, taking into account the nature of the personal information and the purposes of the processing of the personal information.
Once we receive and confirm a verifiable consumer request (see 'Exercising your consumer rights' below), we will reach a determination as to whether the personal information is or is not accurate. To assist us with this, you should make a good-faith effort to provide us with all necessary information available at the time of your request. We may ask you to supply further documentation.
We may deny your request if we determine that the contested personal information is more likely than not accurate based on the totality of the circumstances.
Direct marketing
We do not disclose personal information to third parties for their direct marketing purposes.
Right of non-retaliation
We will not discriminate against you for exercising any of your consumer rights. Unless permitted by the CCPA, we will not, as a result of you exercising any of your consumer rights:
- Deny you services.
- Charge you different prices or rates for services, including through granting discounts or other benefits, or imposing penalties.
- Provide you a different level or quality of services.
- Suggest that you may receive a different price or rate for services or a different level or quality of services.
Exercising Your consumer rights
To exercise the consumer rights described above, a verifiable consumer request must be made by email at email at support@epoqlegal.com or by completing the webform here. A verifiable consumer request is one that we can reasonably verify, using commercially reasonable methods, to have been made by or (with proper authority) on behalf of the consumer about whom the business has collected personal information.
Only you, or an agent that is authorized to act on your behalf, may make a verifiable consumer request related to your personal information. To designate an authorized agent, see 'Authorized Agents' below.
We may request additional information so we may confirm a request to delete your personal information.
The verifiable consumer request must:
- Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or that the request is made by an authorized representative on behalf of the person about whom we collected personal information.
- Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
Making a verifiable consumer request does not require you to create an account with us, although we may communicate with you about your request via a pre-established account, if applicable. However, in order to safeguard the personal information in our possession, if we cannot verify your identity or authority to act on another's behalf, we will be unable to comply with your request. We will only use personal information you provide when submitting a verifiable request to confirm your identity or authority, or to fulfill your request.
Authorized Agents
A request may be made on your behalf by an individual that you have authorized to act on your behalf, or by a person who has power of attorney from you or who is acting as a conservator for you. A request may also be made on your behalf by an organization registered with the Secretary of State.
If you authorize an agent, we may require that your agent provide proof that they have been authorized to exercise your rights on your behalf. We may request that your authorized agent submit proof of identity. We may deny a request from your agent to exercise your rights on your behalf if they fail to submit adequate proof of identity or adequate proof that they have the authority to exercise your rights.
Response Timing and Format
We shall confirm receipt of a consumer request within 10 business days after receiving it and provide information about how we will process the request, including describing in general our verification process and when you should expect a response.
We endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days in total), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to the registered email associated with the account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. The response we provide will explain the reasons we cannot comply with a request, if applicable. For requests to know, we will provide the specific pieces of personal information obtained from you in a format that is easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format, which also may be transmitted to another entity at your request without hindrance.
We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
Changes to this Supplemental Privacy Policy for California Residents
We reserve the right to amend this policy at our discretion and at any time. The date this policy was last updated is identified at the top of this page. You are responsible for periodically visiting the Website and this policy to check for any changes.
Contact us
If you have any questions or comments about this Supplemental Privacy Policy for California Residents, the ways in which we collect and use your information described in this policy or in our Privacy Policy, your rights regarding such use, or wish to exercise your consumer rights under California law, please do not hesitate to please contact us by email at support@epoqlegal.com or by completing the webform here.
CPRA_1