California Privacy Notice

Our company, Referral Factory BV (“Company” “us” “we” “our”), runs a referral creation service available at https://referral-factory.com, where users can create referral campaigns, including managing their customer relations (“Dashboard”) as fully explained in the General Terms and Conditions This California Privacy Notice (“Notice”) shall apply to “Consumers” as defined by the California Consumer Privacy Act (together with related regulations the “CCPA”) as a supplement to our other privacy policies or notices. When there is a conflict between any other Company policy, notice or statement and this Notice, this Notice will prevail as to California (and United States) Consumers and their rights under the CCPA. Please be aware of any privacy policy or notice posted or referenced on our websites, mobile apps, products, or services.

This Notice covers our collection, use and disclosure of California Consumers’ “Personal Information” (“PI”) as defined by the CCPA, except to the extent such PI is exempted from the notice obligations of the CCPA for the twelve (12) months preceding the Effective Date. This Notice also explains the rights California Consumers have under CCPA laws, and provides other notices to Californians required by other laws and regulations. The description of our data practices in this Notice will be updated annually.

Our practices after the Effective Date may differ, however, if different from this Notice, we will provide notice of the current practices, which may include reference to our general privacy policy or other applicable privacy notices.

This Notice reflects our good faith understanding of the law and our data practices as of the Effective Date, but there remain differing interpretations of the CCPA. Consequently, we may from regularly update information in this and other notices regarding our data practices and your rights, modify our methods for responding to your requests, and/or supplement our response to your requests, as we continue to develop our compliance program to reflect the evolution of the law and our understanding of how it relates to our data practices. Publicly available information is also not treated as PI under the CCPA, so this Notice is not intended to apply to that data and your Consumer privacy rights do not apply to that data.

To aid in readability, in some places, we have abbreviated or summarized CCPA terms or language, but a full copy of the CCPA is available at Title 1.81.5 of the California Civil Code, Sections 1798.100 - 199 for your review. Terms defined in the CCPA that are used in this Notice with initial capitalizations shall have the same meaning as in the CCPA.

Based on our 2022 data practices, and onwards, through the Effective Date published on the top of page 1, we collect the following types of PI about California and US Consumers, and use and share it as explained below. This Notice will be updated annually, and our current privacy notices at the point of collection, and general privacy policies, may reflect more current practices.

The chart above reflects the categories of personal information required by the CCPA. There may be additional information that we collect that meets the CCPA’s definition of personal information but is not reflected by a category, in those cases we will treat it as personal information as required by the CCPA, but will not include it when we must describe our practices by category of personal information.

As permitted by applicable law, we do not regard aggregate consumer information or deidentified data as PI and we may convert, or permit others to convert, your PI into such data or information, and may elect not to treat publicly available information as PI. We do not make any attempt to reidentify personal information or keep it longer than we need it in order to reply your requests.

We may collect your PI directly from you, or from service providers, vendors, our affiliates, or other individuals and businesses.

In general, we collect, use, retain and share your PI to provide services, operate our Dashboard, process your registration to our Dashboard, process payments and transactions, enable your communications with others on the Dashboard, manage and improve the Dashboard. More details on our disclosures of PI, you’ll find in the next section in this Notice.

We may collect, retain, use, and share your PI for one or more of the following business purposes involved in the processing of PI:

• Services: to provide your services and for purposes related to the operation of our business, including marketing our business;
• Research and Development: to further develop our Dashboard and new products and services;
• Quality Assurance: to verify or maintain the quality and safety of our Dashboard and to improve, upgrade, or enhance the service we provide;
• Security: to detect security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity;
• Debugging: to identify and repair errors that impair existing intended functionality; and
• Other Business Purposes: to comply with your directions, applicable law or legal process, or for other business purposes that do not constitute a sale of your personal information as defined by the CCPA such as disclosure to our service providers and their subcontractors.

In addition, we may collect, retain, use and share your PI as required or permitted by applicable law and as explained in the next section.

We may share PI with our service providers, other vendors, affiliates, and/or third parties, as set forth in the chart above at which PI we collect.

The PI you disclose via the Dashboard is shared with other users, and operators of the Dashboard insofar as such data is shared through the message functionalities, your profile, or through similar functionalities of the Dashboard. Your PI may also be transferred to other controllers within the group of companies of which we are part (i.e., our affiliates), but only where this is necessary for administrative purposes.

In addition, your PI may be disclosed to third parties that provide us with various services in support of our Dashboard, including hosting and analytical services. We may also share your PI with payment providers, which facilitate transactions and the purchase of credits on the Dashboard. We may further share your personal data as described in the chart above with government authorities, law enforcement bodies and similar entities if required by law or deemed in our interest, with external advisors and with our personnel who are subject to appropriate confidentiality obligations.

We do not believe that in 2020 or 2021 we “sold” PI as the term is defined by the CCPA.

We provide California Consumers the privacy rights as described in this part of this Notice. You have the right to exercise the rights mentioned here with the use of an authorized agent who meets the CCPA agency requirements, including related regulations. As permitted by the CCPA, any Right to Know or Right to Delete request you will submit to us is subject to an identity verification process (“Verifiable Consumer Request”).

In order for us to investigate your request, we must first verify your identity, meaning that we need to make sure that you are the Consumer we may have collected PI about, or a person who has been duly authorized to make the request on behalf of the Consumer. You are not required to create an account with a password in order to make a Verifiable Consumer Request. However, you may use your account to do so. To protect PI, we will never provide or delete PI, unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected PI, or that person’s authorized agent. To make this request, email us at [email protected] via our webform or Dashboard and respond to any follow-up inquires we may make in the future or use your password-protected account.

If we cannot comply with the request, we will explain the reasons to you. We will use PI provided in a Verifiable Consumer Request just to verify your identity or authority to make the request and to track and document request responses, unless you also gave it to us for another purpose.

We will make commercially reasonable efforts to identify PI from Consumers that we process, store, collect, disclose and otherwise use and to respond to your California Consumer privacy rights requests. In some instances, particularly with large and/or typically irrelevant data (sets), we may suggest that you receive the most recent summary of your PI and provide you the opportunity to elect whether you want the rest or not. We may direct you to where you may access and copy responsive PI yourself. We disclose and deliver the required information to a consumer free of charge within 45 days of receiving a verifiable consumer request. Typically, we will not charge any fee to fully respond to your requests; provided, however, that we may charge a reasonable fee, or refuse to act upon a request, if your request is excessive, unfounded or overly burdensome. If we determine that the request warrants a fee, or that we may refuse it, we will give you notice explaining why we made that decision. You will be provided a cost estimate and the opportunity to accept such fees before we will charge you for responding to your request.

Consistent with the CCPA and our interests in the security of your PI, we will not deliver to you your financial account information, an account password, or security questions or answers in response to a CCPA request. However, you may be able to access this information yourself through your personal account if you have an active account with us.

Your California Consumer privacy rights are the following:

A. The Right to Know:

I. Categories:

You have the right to send us a request, no more than twice per year, for any of the following for the period that is twelve months prior to the date you have made the request:

The categories of PI we have collected about you.

• The sources from which we collected your PI.
• The business or commercial purposes for our collecting your PI.
• The categories of third parties to whom we have shared your PI.
• A list of the categories of PI disclosed for a business purpose in the prior 12 months and, for each, the categories of recipients, or that no disclosure occurred.
• A list of the categories of PI sold about you in the prior 12 months and, for each, the categories of recipients, or that no sale occurred.

To make a request, send us an email at [email protected] with the email address you used to register your account on the Dashboard. If you do not have an account with us, we are required to verify your request to know categories of PI to a reasonable degree of certainty, which may include matching at least two data points provided by you with data points maintained by us, which we have determined to be reliable for the purpose of verifying your identity. If you fail to do so, we will be unable to verify you sufficiently to accept your request. The information you send for us to verify your identity will be used for this purpose only. If we cannot verify you to this standard, we will refer you to this Notice for general information on our data practices. For your specific pieces of information, as required by the CCPA, we will apply the verification standards set forth in subsection (II) below.

Please note that PI is retained by us for various time periods, so we may not be able to fully respond to what might be relevant going back one year before your request.

II. Specific Pieces:

You have the right to make or obtain a transportable copy, no more than twice per year, of your PI that we have collected in the prior 12 months and are maintaining. To make a request, send us an email at [email protected] with the email address you used to register your account with the Dashboard. If you don’t have a password-protected account with us, we are required to verify your request to know specific pieces of PI to a reasonably high degree of certainty, which may include matching at least three data points provided by you with data points maintained by us, which we have determined to be reliable for the purpose of verifying your identity together with a signed declaration under penalty of perjury that the requestor is the Consumer whose PI is the subject of the request. If you do not provide the data points, we will be unable to verify you sufficiently to honor your request. The information you send for us to verify your identity will be used for this purpose only if we cannot verify you to this standard we will treat the request as a category request as set forth in subsection (i) above.

Please note that we retain PI for various time periods, so we may not be able to fully respond to what might be relevant going back 12 months prior to the request.

III. Do Not Sell:

As of the Effective Date, we do not believe that we “sold” PI as such term is defined under the CCPA, and we will not sell PI that we collected without having given you an opportunity to opt-out unless we first give you notice of our intent to sell and an express opportunity to opt-out of that sale.

We may disclose your PI for the following purposes, which are not a sale: (i) if you direct us to share PI; (ii) to comply with your requests under the CCPA; (iii) disclosures to our affiliates as explained above, or as part of a merger or asset sale; and (iv) as otherwise required or permitted by applicable law. See also the disclosures above on business purposes disclosures, which are also not a sale.

IV. Delete:

Except to the extent we have a basis to retain PI under CCPA, you may request that we delete your PI that we have directly collected from you and are maintaining. Our retention rights include, without limitation, to complete transactions and services you have requested or that are reasonably anticipated, for security purposes, for legitimate internal business purposes, including maintaining business records, to comply with the applicable law and regulations, to exercise or defend legal claims, and to cooperate with public authorities. Note also that we are not required to delete your PI that we did not collect directly from you. To make a request, send us an email at [email protected], via our webform or Dashboard with the email address you used to register your account with the Dashboard or submit a request through your account with us. You are not required to create a password-protected account with us to make a Verifiable Consumer Request, but you may use your password-protected account to do so. If you don’t have a password-protected account with us, we are required to verify your request to delete to a reasonable degree of certainty, which includes matching at least two data points provided by you with data points maintained by us, or to a reasonably high degree of certainty, which may include matching at least three data points provided by you with data points maintained by us, depending on the sensitivity of the PI and the risk of harm to you posted by unauthorized deletion. If you do not provide the data points, we will be unable to verify you sufficiently to honor your request. The information you send for us to verify your identity will be used for this purpose only.

In addition, you can always opt-out of our commercial emails without making a deletion request by following the unsubscribe instructions on the bottom of those messages.

V. Non-Discrimination and Financial Incentive Programs:

We will not discriminate against you in any manner prohibited by the CCPA when you exercise your privacy rights in the CCPA.

VI. Authorized Agents:

If a Consumer chooses to submit a request through an authorized agent, Company requires you to:

• Provide the authorized agent with a written permission to submit a request, a copy of which must be provided to us;
• Verify that instruction and their own identity directly with us.

If the authorized agent has a power of attorney that is issued under California Probate Code, sections 4000 to 4465, then the written agreement is not necessary. In the absence of the two conditions mentioned above, we will reject any request submitted through an agent. In addition, the agent is subject to the verification standards applicable to the type of request(s) made by you.

VII. Limitation of Rights:

Notwithstanding anything to the contrary, we may collect, use and disclose your PI as required or permitted by the applicable law and this may override consumer’s CCPA rights. In addition, we need not accept any of your requests to the extent that doing so would infringe upon our or any other person or party’s rights or conflict with applicable law.

In addition to CCPA rights, certain California and US citizens are entitled to other notices, including:

I. Third-Party Marketing and Your California Privacy Rights:

We do not share personal information as defined by California Civil Code § 1798.83 with third parties, other than our affiliates, for their direct marketing purposes without obtaining your consent. If you are a California resident, you may request information about our compliance with the California Civil Code by sending us an email at [email protected]. Any such request must include "California Privacy Rights Request" in the first line of the description and include your name, street address, city, state, and ZIP code. Please note that we are only required to respond to one request per customer each year, and we are not required to respond to requests made by means other than through this email address or mail address.

As these rights and your CCPA rights are not the same and exist under different laws, you must exercise your rights under each law separately.

II. Children and Minors:

The Dashboard is intended for a mature audience. We do not intend to collect personal information as defined by the U.S. Children’s Online Privacy Protection Act, or personal information of minors. If you are under the age of eighteen (18), or otherwise under the age of majority where you reside (19 or 21 in some states) then you are not permitted to register as a user, create an account or otherwise use the Dashboard or submit personal information to us and we accordingly do not knowingly sell or publicly display minors’ personal information. In the event we are informed that we have obtained a child’s or minor’s personal information, we will delete it, or otherwise take appropriate action, as required by applicable law. This removal process cannot ensure complete or comprehensive removal. For instance, third parties may have republished or archived content by search engines and others that we do not control.