Local Rights and Disclosures
Effective Date: August 26, 2025.
Certain local laws require specific disclosures related to our data practices.
US State Disclosures
Residents of certain US states (including California, Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia) may have some or all of the following rights, which can be exercised by contacting us as described in the “How to contact us” section above:
- Access and obtain a copy of personal information about you.
- Confirm the categories and/or specific pieces of personal information about you we have collected, used, disclosed, or shared with third parties.
- Correct inaccuracies or delete personal information about you.
- Opt out from profiling that may produce legal or other significant effects.
- Opt out from targeted advertising and/or the sale or sharing of personal information about you.
- Request a list of categories, or for Oregon residents specific names, of third parties to which we have disclosed personal information about you.
- Non-discrimination for the exercise of your privacy rights.
If you are a resident of California, you may opt out of having your personal information shared with third parties for the third party's direct marketing purposes.
The California Consumer Privacy Act requires specific disclosures about how personal information is shared or sold. Note that the definition of “sale” includes almost any sharing of information to third parties who are not service providers. Selling personal information does not mean it was given to a third party in exchange for monetary compensation.
| Category | Categories of third parties receiving personal information for business purposes | Categories of third parties to whom personal information was “sold” as defined by the CCPA, including for targeted advertising purposes |
|---|---|---|
| Identifiers such as real name, alias, postal address, unique personal identifier, online identifier, IP address, email address, account name, social security number, driver's license number, passport number, or other similar identifiers. | Affiliates, business partners, service providers, and social media/advertising companies. | Social media/advertising companies, Cobrand customers with whom you interact. |
| Characteristics of protected classifications under California or federal law, such as gender. | Service providers and social media/advertising companies. | Social media/advertising companies. |
| Commercial information, including products or services purchased obtained, or considered, or other purchasing or consuming histories of tendencies. | Affiliates, business partners, service providers, and social media/advertising companies. | N/A |
| Biometric information. | N/A | N/A |
| Internet or other electronic network activity information, including browsing history, search history, and information regarding a consumer's interaction with an internet website, application, or advertisement. | Affiliates, business partners, service providers, and social media/advertising companies. | Social media/advertising companies. |
| Geolocation data. | Service providers and social media/advertising companies. | Social media/advertising companies. |
| Audio, electronic, visual, thermal, olfactory, or similar information. | Service providers. | N/A |
| Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. | Affiliates, business partners, service providers, and social media/advertising companies. | Social media/advertising companies, customers with whom you interact. |
| Other information about you that is linked to the personal information above. | Affiliates, business partners, service providers, and social media/advertising companies. | Social media/advertising companies, Cobrand customers with whom you interact. |
| Sensitive personal information. | N/A | N/A |
We collect personal information from:
- Individuals directly.
- Business partners and affiliates.
- Service providers.
If you are not satisfied with the results of a privacy rights request you can contact us to appeal our decision as described in the "How to contact us" section above. Please include "Appeal" in the subject line of your message.
We may require validation of your identity before fulfilling your privacy rights request. Validation will vary depending on the type of request and risk of disclosure to an unauthorized person. Validation steps may include providing a copy of a government-issued identification or similar, logging in with an account, or providing other details that support the authenticity of the request.
You may designate a third party as an agent to make privacy rights requests on your behalf. An agent must be designated in writing or through a power of attorney. We will require a designated agent to validate their authority prior to fulfilling requests made on your behalf.
EEA and UK disclosures
If you are located in the European Economic Area or United Kingdom, you may have additional rights regarding our processing of personal data about you.
You may have the right to:
- Access and obtain a copy of personal data about you.
- Confirm the categories and specific pieces of personal data about that we have collected, used, disclosed, or shared with third parties.
- Correct inaccuracies or delete personal data about you.
- Object to or restrict processing of personal data about you.
- Opt out from direct marketing, profiling, and/or targeted advertising.
If you believe our processing of personal data about you does not comply with applicable laws, you may also have the right to lodge a complaint with your local supervisory authority.
We do not process your personal data for automated decision-making. Our processing of your personal data may require transfer of your personal data outside of the European Economic Area and United Kingdom. In these cases we will take steps to apply approved safeguards, usually through approved data transfer agreements.
In some cases you may have the right to request a copy of these safeguards, which you can do by contacting us as described in the "How to contact us" section above.
How to contact us
If you have questions or concerns about this privacy policy or our data practices, contact us at [email protected].
The full Privacy Policy is available on the Privacy Policy page.