Creovai Supplemental Website Privacy Notice for California, Colorado, Virginia, Utah, Texas & Connecticut Consumers

Last Modified: October 4, 2024

This Supplemental Website Privacy Notice (“Supplemental Notice”) applies only to information collected about California, Colorado, Virginia, Utah, Texas and Connecticut consumers. It provides information required under the California Consumer Privacy Act of 2018 and California Privacy Rights Act of 2020 and their implementing regulations (collectively, the “CCPA”), the Colorado Privacy Act of 2021 (the “CPA”), the Virginia Consumer Data Protection Act of 2021 (the “VCDPA”), the Utah Consumer Privacy Act of 2022 (the “UCPA”), the Texas Data Privacy and Security Act (“TDPSA”), and the Connecticut Data Privacy Act of 2022 (“CDPA”).

This Supplemental Notice describes Creovai’s (“Creovai”, “we,” “us,” “our”) practices regarding the collection, use, and disclosure of Personal Information and provides instructions for submitting data subject requests. This Supplemental Notice is parallel in scope to our Privacy Policy and applies to information collected through both online and offline interactions with consumers.

Some portions of this Supplemental Notice apply only to consumers of particular states. In those instances, we have indicated that such language applies only to those consumers.

Please also note that this Supplemental Notice does not address our collection and processing of Personal Information from employees, job applicants, other individuals with whom we interact in an employment-related context, or business contacts. California residents who are employees may access our website privacy disclosures applicable to them by contacting Human Resources.

A. Definitions

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal Information includes “personal data” as that term is defined in the CPA, VCDPA, UCPA, TDPSA, and CDPA. Personal Information also includes “Sensitive Personal Information,” as defined below, except where otherwise noted.
“Sensitive Personal Information” means Personal Information that reveals a consumer’s social security, driver’s license, state identification card, or passport number; account log-in, financial account number, debit card number, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; precise geolocation; racial or ethnic origin, religious beliefs, or union membership; contents of email or text messages; and genetic data. Sensitive Personal Information also includes processing of biometric information for the purpose of uniquely identifying a consumer and Personal Information collected and analyzed concerning a consumer’s health, sex life, or sexual orientation. Sensitive Personal Information also includes “sensitive data” as that term is defined in the CPA, VCDPA, UCPA, TDPSA, and CDPA.
“Third-Party” has the meanings afforded to it in the CCPA, CPA, VCDPA, UCPA, and CDPA.
“Vendor” means a service provider, contractor, or processor as those terms are defined in the CCPA, CPA, VCDPA, UCPA, TDPSA, and CDPA.
‍

To the extent other terms used in this Supplemental Notice are defined terms under the CCPA, CPA, VCDPA, UCPA, TDPSA, or CDPA they shall have the meanings afforded to them in those statutes, whether or not capitalized herein.

B. Collection & Processing of Personal Information

We, and our Vendors, collect the following categories of Personal Information about consumers. We also have collected and processed the following categories of Personal Information about consumers in the preceding 12 months:

Identifiers, such as name or social security number;
Contact and financial information, including phone number, address, email address, bank account number, credit card number, debit card number, or any other financial information;
Characteristics of protected classifications under state or federal law, such as gender;
Internet or other electronic network activity information, such as browsing history and interactions with our websites or advertisements;
Geolocation data, such as device location; and
Professional or employment-related information, such as work history and prior employer.
‍

Retention of Personal Information. We retain each of the six categories of Personal Information listed in Section B for the period reasonably necessary to provide services to you and for the period reasonably necessary to support our business operational purposes listed in Section E.

When assessing the data retention period, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure of the information, the purposes for which we process the data and whether we can achieve those purposes through other means, and the applicable legal requirements.

C. Categories of Personal Information We Disclose to Vendors & Third Parties

In the past twelve months, we may have disclosed the following categories of Personal Information to Vendors and Third Parties for a business purpose:

Identifiers, such as name or social security number;
Contact and financial information, including phone number, address, email address, bank account number, credit card number, debit card number, or any other financial information;
Characteristics of protected classifications under state or federal law, such as gender;
Internet or other electronic network activity information, such as browsing history and interactions with our websites or advertisements;
Geolocation data, such as device location; and
Professional or employment-related information, such as work history and prior employer.
‍

Disclosure for California Consumers: We will not sell or share any of the categories of Personal Information we collect about you, and we have not sold or shared Personal Information about California consumers in the past twelve months. We do not have actual knowledge that we sell or share Personal Information of California consumers under 16 years of age. For purposes of the CCPA, a “sale” is the disclosure of Personal Information to a Third-Party for monetary or other valuable consideration, and a “share” is the disclosure of Personal Information to a Third-Party for cross-context behavioral advertising, whether for monetary or other valuable consideration.

Disclosure for Colorado, Virginia, Utah, Texas, and Connecticut Consumers: We do not sell or share Personal Information to Third Parties or process Personal Information for purposes of targeted advertising, as the terms “sell,” “share,” “process,” and “targeted advertising” are defined in the CPA, VCDPA, UCPA, TDPSA,and CDPA.

D. Sources from Which We Collect Personal Information

We may collect Personal Information directly from California, Colorado, Virginia, Utah, Texas and Connecticut consumers, as well as from public databases, providers of demographic data, publications, professional organizations, social media platforms, people with whom you are connected on social media platforms, and Vendors and Third Parties when they share the information with us.

E. Purposes for Processing & Disclosing Personal Information

We, and our Vendors, collect, process, and disclose the Personal Information (excluding Sensitive Personal Information) described in this Supplemental Notice to:

Operate, manage, and maintain our business;
Confirm consumer identities;
Manage client relationships;
Provide client services;
Provide, develop, improve, and maintain our services;
Record and maintain client instructions;
Process payment transactions;
Promote client or business-development events and programming;
Direct marketing, including newsletters and client alerts;
Better understand the market for our existing services, and potential new services, and adjust our research, development, and marketing strategies accordingly;
Conduct research, analytics, and data analysis;
Monitor and improve website functionality;
Maintain our facilities and infrastructure;
Protect against security threats and misuse of our websites;
Conduct risk and security controls and monitoring;
Detect and prevent fraud;
Perform accounting, audit, and other internal functions, such as internal investigations;
Process payment transactions;
Maintain records;
Otherwise accomplish our business purposes and objectives.
‍

In addition to the purposes identified above, Creovai may use and disclose Personal Information that we collect as necessary or appropriate to:

Comply with laws and regulations, including, without limitation, applicable tax, health and safety, anti-discrimination, immigration, labor and employment, and social welfare laws;
Monitor, investigate, and enforce compliance with and potential breaches of Creovai policies and procedures and legal and regulatory requirements;
Comply with civil, criminal, judicial, or regulatory inquiries, investigations, subpoenas, or summons; and
Exercise or defend the legal rights of Creovai and its employees, affiliates, customers, contractors, and agents.
‍

We, and our Vendors, collect and process the Sensitive Personal Information described in this Supplemental Notice only for the purposes listed below that are authorized by the CCPA and its implementing regulations:

Performing the services reasonably expected by an average consumer who requests those services;
Ensuring security and integrity to the extent the use of the consumer's Personal Information is reasonably necessary and proportionate for these purposes;
Preventing, detecting, and investigating security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted Personal Information;
Resisting malicious, deceptive, fraudulent, or illegal actions directed at the business and prosecuting those responsible for those actions;
Ensuring the physical safety of natural persons;

Performing services on our behalf, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on our behalf;
Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us; and
Collecting or processing Sensitive Personal Information where such collection or processing is not for the purpose of inferring characteristics about a consumer.

F. Categories of Entities to Whom We Disclose Personal Information

Affiliates & Vendors. We may disclose your Personal Information to our affiliates and Vendors for the purposes described in Section E of this Supplemental Notice. Our Vendors provide us with services for our websites, as well as other products and services, such as web hosting, data analysis, payment processing, customer service, infrastructure provision, technology services, email delivery services, credit card processing, legal services, and other similar services. We grant our Vendors access to Personal Information only to the extent necessary for them to perform their functions, and we require them to protect the confidentiality and security of such information.
Third Parties. For each category of Personal Information identified in Section C, we disclose such Personal Information to the following categories of Third Parties:
- At Your Direction. We may disclose your Personal Information to any Third-Party with your consent or at your direction.
- Business Transfers or Assignments. We may disclose your Personal Information to other entities as reasonably necessary to facilitate a merger, sale, joint venture or collaboration, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings).
- Legal and Regulatory. We may disclose your Personal Information to government authorities, including regulatory agencies and courts, as reasonably necessary for our business operational purposes, to assert and defend legal claims, and otherwise as permitted or required by law.

G. Data Subject Rights

California, Colorado, Virginia, Utah, Texas, and Connecticut consumers have certain rights with respect to the collection and use of their Personal Information. Those rights vary by state.

As required by the CCPA, we provide detailed information below regarding the data subject rights available to California consumers.

Colorado, Virginia, Utah, Texas, and Connecticut consumers have similar rights, and you can find more detail by referencing the CPA, VCDPA, UCPA, TDPSA, or CDPA, as applicable.

California consumers have the following data subject rights:

Data Subject Rights Disclosure for California Consumers: California consumers have the following rights regarding our collection and use of their Personal Information, subject to certain exceptions.
- Right to Receive Information on Privacy Practices: You have the right to receive the following information at or before the point of collection:
  - The categories of Personal Information to be collected;
  - The purposes for which the categories of Personal Information are collected or used;
  - Whether or not that Personal Information is sold or shared;
  - If the business collects Sensitive Personal Information, the categories of Sensitive Personal Information to be collected, the purposes for which it is collected or used, and whether that information is sold or shared; and
  - The length of time the business intends to retain each category of Personal Information, or if that is not possible, the criteria used to determine that period.

We have provided such information in this Supplemental Notice, and you may request further information about our privacy practices by contacting us as at the contact information provided above.

Right to Deletion: You may request that we delete any Personal Information about you we that we collected from you.
Right to Correction: You may request that we correct any inaccurate Personal Information we maintain about you.
Right to Know: You may request that we provide you with the following information about how we have handled your Personal Information:
- The categories of Personal Information we collected about you;
- The categories of sources from which we collected such Personal Information;
- The business or commercial purpose for collecting, selling, or sharing Personal Information about you;
- The categories of Third Parties to whom we disclose such Personal Information; and
- The specific pieces of Personal Information we have collected about you.
Right to Receive Information About Onward Disclosures: You may request that we disclose to you:
- The categories of Personal Information that we have collected about you;
- The categories of Personal Information that we have sold or shared about you and the categories of Third Parties to whom the Personal Information was sold or shared; and
- The categories of Personal Information we have disclosed about you for a business purpose and the categories of persons to whom it was disclosed for a business purpose.
Right to Non-Discrimination: You have the right not to be discriminated against for exercising your data subject rights. We will not discriminate against you for exercising your data subject rights.

Rights to Opt-Out of the Sale and Sharing of Your Personal Information and to Limit the Use of Your Sensitive Personal Information: You have the right to opt-out of the sale and sharing of your Personal Information. You also have the right to limit the use of your Sensitive Personal Information to the purposes authorized by the CCPA. We will not sell or share any of the categories of Personal Information we Collect about you, and we have not sold or shared Personal Information in the past twelve months. Further, we do not use or disclose Sensitive Personal Information for purposes beyond those authorized by the CCPA.

You may exercise the data subject rights applicable to you under the CCPA, CPA, VCDPA, UCPA, TDPSA, or CDPA by contacting us by emailing info@creovai.com.

Consumers in some states may also authorize an agent to make data subject requests on their behalf via the above-listed methods.

Verification of Data Subject Requests. We may ask you to provide information that will enable us to verify your identity to comply with your data subject request. When a California consumer authorizes an agent to make a request on their behalf, we may require the agent to provide proof of signed permission from the consumer to submit the request, or we may require the consumer to verify their own identity to us or confirm with us that they provided the agent with permission to submit the request. In some instances, we may decline to honor your request if an exception applies under applicable law. We will respond to your request consistent with applicable law.
Non-Discrimination. We will not discriminate against you for exercising your data subject rights. For example, we will not deny services to you, or charge you different prices or rates, or provide a different level of quality for services as a result of you exercising your data subject rights.
‍

Appeals for Virginia, Colorado, and Connecticut Consumers. Virginia, Colorado, and Connecticut consumers have the right to appeal our decisions on their data subject requests. This section does not apply to California, Texas, or Utah consumers. To appeal our decision on your data subject requests, you may contact us by emailing info@creovai.com.

Please enclose a copy of or otherwise specifically reference our decision on your data subject request, so that we may adequately address your appeal. We will respond to your appeal in accordance with applicable law.

H. Disclosures

Opt-Out Preference Signals. We do not sell or share Personal Information or use or disclose Sensitive Personal Information for purposes other than those authorized by the CCPA and its implementing regulations, as listed in Section E. Accordingly, we do not process opt-out preference signals. If we process opt-out preference signals in the future, we will update this policy to provide details about how we do so.
Disclosure About Direct Marketing for California Residents. California Civil Code § 1798.83 permits California residents to annually request certain information regarding our disclosure of Personal Information to other entities for their direct marketing purposes in the preceding calendar year. We do not distribute your Personal Information to other entities for their own direct marketing purposes.
Financial Incentives for California Consumers. Under California law, we do not provide financial incentives to California consumers who allow us to collect, retain, sell, or share their Personal Information. We will describe such programs to you when we offer them to you.
Changes to our Supplemental Notice. We reserve the right to amend this Supplemental Notice at our discretion and at any time. When we make material changes to this Supplemental Notice, we will notify you by posting an updated Supplemental Notice on our website and listing the effective date of such updates.
‍

I. Privacy Rights in Other US States

Some states have passed laws that may not yet be in effect and, in the absence of a comprehensive federal law, other states may pass comprehensive data privacy laws that provide their residents with similar rights to those provided above to residents of California, Colorado, Virginia, Utah, Texas, and Connecticut.

Many of these new state data privacy laws may contain the same or similar protections as those described above, but the exact scope of these rights may vary. To exercise any of these rights please contact us as provided below.

Contacting Us

If you have any questions, comments, requests, or concerns related to this Supplemental Notice, Creovai’s information practices, or how to access this policy in another format, please contact us by emailing info@creovai.com.