CCPA Privacy Notice For California Consumers

Effective January 1, 2024

Hibu Inc. (“Hibu”, “we”, “us” or “our”) is providing this Privacy Rights Notice for California Consumers (“CCPA Privacy Notice”) to notify you of our privacy practices as required by the California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act of 2020 (CPRA) and to explain the rights available to you under the CCPA/CPRA.  This Notice applies to Personal Information that we collect from Consumers.  “Personal Information” means information that identifies, relates to, describes, references, is capable of being associated with or could reasonably be linked, directly or indirectly, with a particular consumer or household.  “Consumer” means a person who is a California resident. For purposes of this CCPA / CPRA Privacy Notice when we refer to “you” or “your” we mean a Consumer.  For more information on our privacy practices, please see our Privacy Policy.

This Notice does not apply with respect to Personal Information we collect from our employees, independent contractors or job applicants.  For information as to the Personal Information we collect from such individuals, click here.

 

Information We Collect

We have collected the following categories of Personal Information from Consumers within the last twelve (12) months:

CategoryExamples
IdentifiersName, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name or other similar identifiers
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))Credit card, debit card, bank account number and other financial information you provide in connection with your purchase of our Services
F. Internet or other similar network activityBrowsing history, search history, information on a consumer's interaction with a website, application, or advertisement
H. Audio, electronic, visual, thermal, olfactory or similar informationPhotos or videos provided in connection with our Services, call recordings we initiate and the content of certain communications between our clients and other consumers
K. Inferences drawn from Personal InformationInferences drawn from any of the information above to create a profile reflecting the Consumer’s preferences

 

Personal Information does not include deidentified or aggregated consumer information.

We obtain the categories of Personal Information listed above from the following categories of sources, as more fully described in our Privacy Policy:

  • Directly from you when you visit our website, fill in forms on our websites or submit information through our websites, including by posting reviews or other information.
  • Directly from you when you sign up for an account on our websites or purchase our products or services.
  • Indirectly from you through website usage details collected automatically, online searches you conduct or your interaction with ads that we place on websites or other media or your interaction with ads, including video ads, we send to you or make available to you.  For example, we may collect information about your use of our websites through cookies, which are information files stored on your computer that help websites remember who you are and information about your visit.   
  • Directly from you when you communicate with us, including by phone, email, text message, messaging application, social media, through our mobile applications or through other means.
  • From third parties with whom we interact in connection with the Services we perform.
  • From your social media account.  When you use a social network login to access our services, you may share certain Personal Information from your social media account with us, for example, your name, email address, photos, list of social media contacts, and any other information that may be or you make accessible to us when you connect your social media account to your services account.  The specific information shared depends on your security settings and the privacy policy of your social media network.
  • From third-party data providers when they share information with us.
     

 

Sensitive Personal Information

Certain information we collect from our clients may be considered “Sensitive Personal Information” under the CCPR/CPRA, including credit card or account information and the content of certain communications between our clients and other Consumers.  We collect and store such Sensitive Personal Information solely to collect payments and to provide services to our clients.

 

Purposes for the Collection and/or Use of Personal Information

We may collect and use the Personal Information or Sensitive Personal Information we collect for one or more of the following purposes, as more fully described in our Privacy Policy:

  • To provide the products and services you purchase and/or request.
  • To provide you with customer service, including responding to your requests for services or for information or to otherwise communicate with you.
  • To advertise or promote your business on third party search engines, social media sites and other relevant business websites on your behalf or to register a domain name on your behalf.
  • To personalize your website experience by serving you with content, offers and advertising relevant to your interests.  
  • To track your usage of and interaction with our websites, communications, ads, including video ads, products and services. 
  • To respond to law enforcement requests, court orders and as otherwise necessary to comply with laws and regulations.
  • For our internal purposes such as accounting, auditing, data analysis, and research to improve and develop our products, services, content, advertising, and communications.
  • As otherwise described to you when collecting your Personal Information or as subsequently agreed to by you.

 

Disclosure of Personal Information

We may disclose the categories of Personal Information we collect to third parties, including our service providers and vendors, for various business purposes.  When we disclose Personal Information for a business purpose, we require the recipient to adhere to security and confidentiality obligations and not to use or process such Personal Information other than for a specified business purpose and in accordance with our instructions.  See the section entitled “For What Purposes to we Disclose Personal Information” in our Privacy Policy for more information as to these disclosures.  

 

Sale and Sharing of Personal Information; Exercising Your Opt-Out Rights

Under the CCPA / CPRA, certain transfers or sharing of Personal Information may constitute “selling” when such Personal Information is disclosed to a third party for monetary or other valuable consideration or “sharing” when such Personal Information is disclosed to a third party for purposes of targeted, or cross-contextual, advertising.  


We may “sell” or “share” your Personal Information with third party digital advertising networks in order to serve you content, offers and advertising relevant to your interests.  Specifically, that includes sharing Identifiers – such as your Internet Protocol address, email address and/or phone number; or Internet activity -- including your browsing history, search history and/or information as to your interaction with our websites, marketing or advertising.  


Under the CCPA / CPRA, you have the right to opt-out from the sale of your Personal Information or from the sharing of your Personal Information for purposes of targeted or cross-context behavioral advertising.  If you would like to exercise your right to opt-out, click the Do Not Sell or Share My Personal Information button at the footer of our website.   Please note that the use of certain third-party cookies and other tracking devices on this site may be considered “sharing” under the CCPA / CCPRA.  You can opt out of such sharing by clicking on the “Cookie Settings” button at the footer of our website to customize your cookie settings.  You can also opt-out from such sharing by broadcasting an Opt-Out Preference Signal, such as the Global Privacy Control (GPC) (on the browsers and/or browser extensions that support such a signal) from your device.  
 

Exercising Your Information Access and Information Deletion Rights

Under the CCPA / CPRA, you have certain rights with respect to your Personal Information collected and maintained by us, including: (i) the right to access your Personal Information, (ii) the right to information about the Personal Information we have collected, (iii) the right to delete your Personal Information, and (iv) the right to correct your Personal information. 

You have the right to limit the use and disclosure of your Sensitive Personal Information to the purpose of providing you with services.  We only collect, use and disclose Sensitive Personal Information of Consumers for purposes of providing our services.  Therefore, we are not required to provide you with the right to limit use of Sensitive Personal Information.

To exercise these rights described above, please submit a verifiable request to us by either of the following methods:

 

Only you or a person authorized to act on your behalf may make a verifiable request related to your Personal Information. You may also make a verifiable request on behalf of your minor child. If you are making a request as an authorized person for someone else, please provide us with information sufficient to demonstrate your authority to act on behalf of such person.

You may make a verifiable request for information access not more than twice within any 12-month period.  The verifiable request must:

  • provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative of such person; and
  • include sufficient detail that allows us to properly understand, evaluate and respond to the request.

 

We cannot respond to your request or provide you with Personal Information if we cannot verify your identify or authority to make the request and confirm the Personal Information related to you.

Making a verifiable request does not require you to create an account with us.  However, if you have an account with us, we may require you to log-in to your account in order to verify your identify or authority to request access to or deletion of your Personal Information.

We will only use Personal Information provided in a verifiable request to verify the requestor’s identity or authority to make the request.

Response Timing and Format

We endeavor to respond to a verifiable request within forty-five (45) days of our receipt of the request. If we require more time (up to an additional 45 days), we will inform you of the reason and extension period in writing.

Any disclosures we provide will only cover the 12-month period preceding the date our receipt of your verifiable request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For requests to access your Personal Information, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity.
 

Retention of Personal Information

We store your Personal Information as reasonably necessary and proportionate to accomplish the purposes identified in this Notice and to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

 

Hibu as a Service Provider

Hibu acts as a service provider to our clients. When acting in this capacity, we process personal information on behalf of our clients and we have no direct relationship with the end-users who use our clients’ services or products or visit our clients’ websites.

 

Contact Us

For any questions or concerns about this Notice or about Hibu’s privacy practices, please contact us at Privacy.OfficerUS@hibu.com.