If you are a resident of California, your right to submit certain requests relating to your personal information is described below. Please note that these rights are subject to certain exceptions and certain of these rights are subject to verification mechanisms. You may designate an authorized agent to make the requests below on your behalf; however, you will still need to verify your identity directly with us before your request can be processed.
Rights to Know, Correct and Delete
Right to Know Personal Information Collected About You
If you are a California resident, you have the right to know: (1) the categories of personal information we have collected about you; (2) the categories of sources from which the personal information is collected; (3) the business or commercial purpose for collecting, selling, or sharing personal information; (4) the categories of third parties to whom we disclose personal information; and (5) the specific pieces of personal information we have collected about you. You also have the right to know the list of all third parties to whom we have disclosed personal information, as defined under California Civil Code Section 1798.83(e) (a/k/a the “Shine the Light Law”), during the preceding year for third party direct marketing purposes.
Right to Know Personal Information Disclosed or Shared
For California residents, since we share and/or disclose your personal information, as described above, you have the right to request that we tell to you: (1) the categories of personal information that we collected about you; (2) the categories of personal information that we sold or shared about you and the categories of third parties to whom the personal information was sold or shared, by category or categories of personal information for each category of third parties to whom the personal information was sold or shared; and (3) the categories of personal information that we disclosed about you for a business purpose and the categories of persons to whom it was disclosed for a business purpose.
Right to Correct Inaccurate Information
California residents also have the right to request that we correct your personal information collected or maintained by us. If you believe that any of the personal information we maintain about you is inaccurate, you have the right to submit a request for us to correct that information. Upon receipt of a request, we will use commercially reasonable efforts to correct the information as you direct.
Right to Request Deletion of Your Personal Information
California residents also have the right to request that we delete your personal information collected or maintained by us. We will let you know what, if any, personal information we can delete from our records, and we will direct any service providers that may have collected personal information about you to delete your personal information from their records. There may be circumstances where we cannot delete your personal information or direct service providers to delete your personal information from their records. For example, if we need to: (1) retain your personal information to complete a transaction or provide services; (2) detect security incidents; (3) protect against unlawful activities; (4) identify, debug or repair errors; or (5) comply with a legal obligation.
Exercising Rights to Know, Correct and Delete, and Related Verification Measures
You may submit a request regarding your rights to know, correct and/or delete by clicking here or by calling us at 804-550-2188.
Upon submission of a request to know, correct or delete, we will take reasonable steps to confirm that the person submitting the request to know or request to delete is the person to whom the information relates (or his or her authorized agent), and to prevent unauthorized access or deletion of information. The specific steps taken to verify the identity of the requesting person may vary based on the nature of the request, including the type, sensitivity, and value of the information requested, the risk of harm posed by unauthorized access or deletion, the likelihood that fraudulent or malicious actors may seek the information, the robustness of personal information provided to verify your identity, the nature of our business relationship with you, and available technology for verification.
We will generally try to avoid requesting additional information from you for the purpose of verification, but we may need to do so if we cannot verify your identity based on the information already maintained by us. If we request additional information to verify your identity, it will be for that purpose only and will be deleted as soon as practical after processing the request, except as otherwise provided by law.
The following generally describes the verification processes we use:
- Password Protected Accounts. If you have a password-protected account with us, we may use existing authentication practices to verify your identity but will require re-authentication before disclosing, correcting or deleting data. If we suspect fraudulent or malicious activity relating to your account, we will require further verification (as described below) before complying with a request to know or delete.
- Verification for Non-Accountholders. If you do not have, or cannot access, a password-protected account with us, we will generally verify your identity as follows:
- For requests to know categories of personal information, we will verify your identity to a reasonable degree of certainty by matching at least two data points provided by you with reliable data points maintained by us.
- For requests to know specific pieces of personal information, we will verify your identity to a reasonably high degree of certainty by matching at least three data points provided by you with reliable data points maintained by us. We will also require a declaration, signed under penalty of perjury, that the person requesting the information is the person whose information is the subject of the request or that person’s authorized representative. We will maintain all signed declarations as part of our records.
- For requests to correct or delete personal information, we will verify your identity to a reasonable degree or a reasonably high degree of certainty depending on the sensitivity of the personal information and the risk of harm posed by unauthorized deletion. We will act in good faith when determining the appropriate standard to apply.
If there is no reasonable method by which we can verify your identity, we will state so in response to a request to know or delete personal information, including an explanation of why we have no reasonable method to verify your identity.
If you use an authorized agent to submit a request to know, delete or correct, we may require the authorized agent to provide proof that you gave the agent signed permission to submit the request. We may also require you to do either of the following: (a) verify your own identity directly with us; or (b) directly confirm with us that you provided the authorized agent permission to submit the request. This requirement does not apply if you have provided the authorized agent with power of attorney pursuant to Probate Code sections 4121 to 4130.
We will respond to requests to know, requests to delete and / or delete no later than 45 calendar days. If we cannot verify your request within 45 days, we may deny your request. If necessary, we may take up to an additional 45 days to respond to your request but in such an event will provide you a notice and an explanation of the reason that we will take more than 45 days to respond to your request.
Right to Opt-Out of the Sharing of Your Personal Information
You may opt-out of the sharing of your personal information by completing the form here.
Right to Limit the Use of Your Sensitive Personal Information
We limit the processing of your Sensitive Personal Information to the following: (i) to that use which is necessary to perform the services or provide the goods reasonably expected by you; (ii) to help to ensure security and integrity; (iii) to perform services on our behalf; (iv) to undertake activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us; and (v) to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us.
Right to Non-Discrimination for the Exercise of Your Privacy Rights
If you choose to exercise any of the privacy rights conferred by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, you also have the right not to receive discriminatory treatment by us. This means that consistent with California law, we will not deny providing our services to you, charge you different prices or provide a different level or quality of service to you unless those differences are related to the value of your personal information.
