CASTATUS, INC. CALIFORNIA PRIVACY NOTICE

Effective Date: May 1, 2023

THIS CALIFORNIA PRIVACY NOTICE SUPPLEMENTS OUR GENERAL PRIVACY POLICY AND ONLY APPLIES TO USERS WHO ARE RESIDENTS OF THE STATE OF CALIFORNIA AND WHO EITHER (A) RECEIVE SERVICES DIRECTLY FROM COMPANY OR (B) ARE USERS OF THE SITES.

This California Privacy Notice has been adopted to comply with the California Consumer Privacy Act of 2018 (“CCPA”) and terms defined in the CCPA have the same meaning when used in this Notice, unless those terms have been otherwise defined in the general Privacy Policy. Unless otherwise defined in this Privacy Notice, defined terms in this Privacy Notice will have the meanings ascribed to them in our general Privacy Policy. Accordingly, as this Privacy Notice supplements our general Privacy Policy, this Privacy Notice should be reviewed in conjunction with our general Privacy Policy.

What Information Do We Collect and Disclose?

The Company may collect and disclose, and over the previous 12 months has collected and disclosed, the following categories of personal information:

• Personal Information and Identifiers;
• Commercial Information;
• Network Information; and
• Geolocation Information.

How Do We Collect Information?

The Company collects this information from you through information you submit to us or input onto the Sites or through passive means, such as website cookies. We also collect information from third parties, including our customers, service providers and vendors, auditors, advisors and government authorities, as applicable and necessary. For more information regarding our data collection practices please read our general Privacy Policy.

Special Note for Employees of Customers: If you are an employee of a customer that uses the Services, please refer to your employer’s privacy policy, which applies to the collection, use, processing and retention of your personal information. Under applicable privacy laws we are a data processor and your employer will remain the data controller at all times. Individual employees of our customers who seek access to their personal information, or who seek to correct, amend, or delete inaccurate personal information should direct their requests to their employers.

How and Where Do We Process and Store Data?

Methods of Processing. The data processing is carried out in accordance with our privacy procedures and policies and using computers and/or related software and IT tools. In some cases, the data may be accessible to certain types of (i) internal parties in charge or involved with the operation of our Sites and Services (i.e., administration, legal, sales and marketing, etc.) or (ii) external parties who assist us in providing, operating, and maintaining our Sites and Services, (i.e., third-party technical service providers, mail carriers, hosting providers, communications agencies). Still, we notify both internal and external parties of this Privacy Notice and require that internal parties (through employment agreements and related employment policies) and external parties (through written agreements) keep and maintain the data in accordance with the safeguards described in this Privacy Notice and related policies and procedures.

Third Party Processing. We assess and review each of our third party processers to ensure that they are in compliance with this Privacy Notice.

Why Do We Collect and Process Information?

We collect and process personal information for business and commercial purposes. To learn more about why we collect and process information, please review our general Privacy Policy.

Do We Share Information With Third Parties?

We take reasonable precautions to be sure that affiliates and non-affiliated third party service providers, to whom we may disclose your personally identifiable information are aware of our privacy policies and will treat the information in a similarly responsible manner. Our contracts and written agreements with non-affiliated third party service providers that receive information from us about you prohibit those parties from transferring the information other than to provide the service that you obtain from us. To learn more about why we share information with third parties please see our general Privacy Policy.

Do We Sell Your Information?

No. Although the Company shares data with third parties as outlined in in the Privacy Policy, the Company does not sell any of your personal information to any third party.

How Do We Protect Personal Data?

The Company protects data using administrative, technical, and physical safeguards. When we use third-party service providers, we ask those providers to implement similar safeguards. However, we cannot guaranty that your information is completely secure either within the Company or on the systems of third party service providers.

How Long Do We Keep Your Personal Data?

We retain personal data we collect from you when we have an ongoing legitimate business need to do so (i.e., to provide you with the Services you have requested or to comply with applicable legal requirements). When we no longer have an ongoing legitimate business need to process your personal information, we will physically destroy, delete or anonymize it or, if this is not possible, then we will securely store your personal data and isolate it from any further processing until deletion is possible.

California Consumer Rights:

If you are a California resident and are engaged in a direct business relationship with the Company as a consumer for provision of the Company’s Sites or Services, you may have the following rights:

• Right to Know. You may request that we provide to you specific pieces of personal information and categories of personal information that we have collected for the 12 month period preceding your request, such as (i) the categories of personal information we collected about you; (ii) the categories of sources from which we collected such personal information; (iii) the purposes for collecting your personal information; and (iv) the categories of third parties with access to your personal information, if any.
  
  Though you may request specific pieces of your personal information that we have collected, we may not provide the following information in order to protect the security of such information: social security numbers, driver’s license or other state or government issued identification numbers, bank account numbers or other financial information, any health insurance or medical identification numbers or related information, account passwords or security questions and answers.
  
  
• Right to Request Deletion. Under certain, limited circumstances, you may request that we delete personal information that we have collected from you or maintain about you.
  
  
• Right to Opt-Out of Sale of Personal Information. We do not sell personal information as defined under the CCPA.
  
  
• Right to Non-Discrimination. We will not discriminate against any consumer who has chosen to exercise their rights under the CCPA. By way of example, we will not deny you the Services, charge you different prices/rates for the Services, or provide you a different level of quality of service.
  
  
• Right to correct. You may request that we correct any inaccurate information that we may have about you.
  
  
• Right to limit use and disclosure of sensitive personal information. In the case that we have any of your sensitive personal information (for example, your social security number, financial account information, your precise geolocation data, or your genetic data) you may direct us to only use that information for limited purposes, such as providing you with the services you requested.

How To Submit a California Rights Request:

If you are a California Resident and you have a direct business relationship with the Company or you otherwise use the Sites, you may make a request pertaining to the rights described above by contacting us at (833) 330-4888, or by clicking here for a Request for Disclosure and emailing or sending the Request to the email address or mailing address listed below:

Castatus, Inc.
10808 S. River Front Parkway, Suite 3097
South Jordan, UT 84095

Email Address:  privacy@castatus.com

If you choose to email or mail your request, please include “California Privacy Rights Request” in the subject line.

PLEASE NOTE THAT YOUR REQUEST WILL NOT BE PROCESSED UNTIL YOUR IDENTITY HAS BEEN VERIFIED. ONCE YOUR IDENTITY HAS BEEN VERIFIED, YOUR REQUEST WILL BE PROCESSED IN ACCORDANCE WITH THE CCPA. WE WILL PROVIDE ADDITIONAL DETAILS AND DIRECTIONS ON IDENTITY VERIFICATION, AND AS APPROPRIATE, UPON RECEIVING YOUR REQUEST.

Once the Company has verified your identity, we will respond to your request within 45 days. If we require more time (up to an additional 90 days), will notify you in writing of the reason and the extension period.

Please note the Company, at its option, may not respond to more than two requests in a 12 month period.

Changes To This Privacy Notice:

We reserve the right to amend this Privacy Notice at our discretion and at any time. When we make changes to his Privacy Notice, we will give notice to you via (i) the Sites or (ii), where feasible, and at our discretion, contact information available to us. We encourage you to periodically review this Privacy Notice so as to remain informed on how we are protecting your information.