Data Protection

CCPA Compliance

Understanding our commitment to data protection and your rights under the California Consumer Privacy Act.

About CCPA

The CCPA is a new California privacy law. The law came in to effect in January 2020. The CCPA applies to companies doing business in California that meet certain statutory thresholds. The CCPA empowers California residents (“consumers”) to control their personal information through the grant of consumer rights, including the right to sue for data breaches.

Like the GDPR, the CCPA requires businesses to provide detailed privacy notices with prescribed content, including transparent disclosures about information collection and use practices, sharing of personal information, and consumers’ privacy rights. Consumers are granted access and deletion rights, the right to opt-out of the “sale” of their personal information, and the right to sue for data breaches. Consumers also have the right to be free from discrimination for exercising these rights. Privacy notices must also be accessible to individuals with disabilities.

What constitutes personal information under CCPA?

Personal information is any information that directly identifies, relates to, describes, is reasonably capable of being associated with or could reasonably be linked, either directly or indirectly, with a particular individual or household. This includes, for example, names; aliases; unique personal identifiers (such as social security number, driver’s license number, passport number, etc.); account or user names; IP addresses; unique device or cookie identifier, biometric data; educational, professional, or employment data; behavioural data; internet activity data; and inferences drawn about an individual based on the foregoing or online activity.

What is a "sale" of personal information under CCPA?

A “sale” of personal information is any disclosure of or grant of access to personal information in exchange for money or other valuable consideration. These sales are regulated by requiring businesses that sell personal information to provide consumers detailed notice and the opportunity to opt out of these sales.

What roles are assigned to organisations under the CCPA?

Companies can be a “business”, “service provider”, or “third party.” Many organisations will qualify as one or more depending on the relationship of the parties and the nature of their data processing activities. This is how Zileo views these roles in relation to our services and associated responsibilities:

Business

A business is a for-profit entity that (a) does business in California, regardless of whether it has any physical presence in the state; (b) processes personal information of California residents or on whose behalf such personal information is processed;(c) alone, or jointly with others, determines the means and purposes of the processing; and (d) either: (i) has more than $25 million in annual gross revenue; (ii) annually buys, sells, receives or shares for a commercial purpose the personal information of at least 50,000 consumers, whether alone or in combination with other businesses; or (iii) derives at least 50% of its annual revenue from the sale of consumers’ personal information. If you satisfy this definition, you are a likely a business while using Zileo.

Service Provider

Zileo is a “service provider” because we process personal information on your behalf pursuant to a written agreement. The CCPA requires that this agreement limit our ability to use the personal information we process on your behalf solely to what is needed to perform the services or as may otherwise be permitted by the CCPA. We offer our customers subject to the CCPA an addendum incorporating these terms.

Third Party

Companies with whom personal information is shared but which use the information for their own uses, including sharing with other parties, are “third parties.” Sharing with third parties must be disclosed in a business’s privacy policy and may constitute a “sale” if performed in exchange for money or valuable consideration, with attendant obligations for the third party.