US State Supplemental Privacy Notice to Residents of California, Colorado, Connecticut, Virginia, and Utah

Effective Date: January 1, 2023

This Supplemental Privacy Policy applies to you only if you are a natural person and live in California, Colorado, Connecticut, Virginia, or Utah (“consumers” or “you”). This Supplemental Privacy Policy is incorporated into and forms part of the Divvy Privacy Policy.

This Supplemental Privacy Policy describes how we collect, process, and disclose your personal information. It also describes the rights you have with regard to your personal information, which apply when new or updated laws take effect in these states. This Supplemental Privacy Policy does not apply to any employees, owners, directors, officers, or contractors of Divvy or its affiliates.

Personal Information We Collect, Use and Share

During the past twelve (12) months, we have collected, used, and shared the following categories of personal information:

Category of Personal Information Category of Source Business or commercial purpose(s) for collection Categories of third parties with whom we share
 

Personal identifiers

 

Directly from you or your agents

From your Organization

From your Vendors or Customers

From other third parties you choose to interact with

From our service providers

From public sources

 

To provide our Service to you

To communicate with you

To verify your identity

To protect your account

To prevent fraud or illegal activity

Our marketing activities

 

Our service providers

Your authorized service providers

Other third parties that you authorize

Our business and marketing partners

Third parties as required by law

 

Financial information, including bank account number, credit card number

 

Directly from you or your agents

From your Organization

From your Vendors or Customers

From other third parties you choose to interact with

From our service providers

From public sources

 

To provide our Service to you

To verify your identity

To protect your account

To prevent fraud or illegal activity

 

Commercial information, including products/services purchased

 

Directly from you or your agents

From your Vendors or Customers

 

Provide our Service to you

Prevent fraud or illegal activity

 

Internet or other electronic network activity information

 

Directly from you

From our service providers

 

Provide our Service to you

Protect your account

Prevent fraud or illegal activity

Debug or repair our Service

Maintain reliability, quality or safety of our Service

Improve our Service

Our marketing activities

 

Geolocation data

 

Directly from you

From your mobile provider or ISP

 

Provide our Service to you

Protect your account

Prevent fraud or illegal activity

Debug or repair our Service

Maintain reliability, quality or safety of our Service

 

Audio, electronic, visual, or similar information

 

Directly from you

 

Provide our Service to you

Prevent fraud or illegal activity

Improve our Service

Maintain reliability, quality or safety of our Service

 

Professional or employment-related information

 

Directly from you

From your Organization

From your Vendors or Customers

 

Provide our Service to you

Prevent fraud or illegal activity

Our marketing activities

 

Inferences drawn to create a profile about a consumer

 

Divvypay.com

 

Provide our Service to you

Prevent fraud or illegal activity

Maintain reliability, quality or safety of our Service

Our marketing activities

 

Sensitive Personal Information

When we collect government identification (such as your driver’s license number or Social Security number), financial details (such as your bank account or credit card numbers), we are deemed to be collecting data that is “sensitive” under state privacy laws. Where legally required, we will obtain your consent for collecting this information. For our California users, we do not use or disclose sensitive personal information for any purpose other than as permitted by law, such as to provide our Service to you, to detect security incidents, and resist malicious or fraudulent actions, nor do we use or disclose such information to build a profile about you.

Retention

We retain your personal information as long as it is necessary to provide you our Service and to comply with our data retention requirements. Even after you stop using our Service, we may be required to keep your information for as long as necessary to comply with our legal and regulatory obligations, to make or defend legal claims, and to protect against fraudulent activity of others.

Sales of Personal Information

In the past twelve (12) months, Divvy has not sold personal information.

Sales/Sharing

In the last 12 months, we have allowed third parties ad providers to collect personal information from our website visitors in order to provide them with targeted advertising and analytics. This practice may constitute a sale of personal information under certain state laws and, in California, may also constitute “sharing” (which is a term used to address the sharing of information for advertising purposes) of personal information. To the extent that our practice constitutes a sale or sharing of your personal information, you have the right to opt-out of the sale or sharing of your personal information with third parties for purposes of targeted advertising by filling out this Opt-Out Form and by enabling Global Privacy Control on your browser or opting-out of cookies by clicking here:

Global Privacy Control (“GPC”) is a setting you can enable in your web browser to communicate your privacy preference for not having certain information about your webpage visits collected across websites. For all the details, including how to turn on GPC, visit https://globalprivacycontrol.org/. Our websites that link to this privacy policy recognize and respond to GPC signals.

Consistent with our practice of not collecting data on anyone under 16 years old, we do not have actual knowledge that we shared information on such minors with the companies we work with on targeted advertising.

Your Rights and Choices

Subject to certain limitations, you have the following rights with respect to the personal information that we collect about you:

  1. Right to Know. You can ask us to give you information about our collection and use of your personal information. Specifically, you can request that we provide one or more of the following:
    • The categories of personal information we collected about you.
    • The categories of sources for the personal information we collected about you.
    • Our business or commercial purpose for collecting, selling, or sharing your personal information.
    • The categories of third parties to whom we disclose that personal information.
    • The specific pieces of personal information we collected about you .
  2. Right to Delete. Subject to certain limitations, you can ask us to delete your personal information.
  3. Right to Correct. You can ask us to correct inaccurate personal information that we have about you.
  4. Right to Opt Out of Targeted Advertising or Sale. You can ask us to stop using your personal information for targeted advertising. Please see the discussion on Sales/Sharing above.
  5. Right Against Discrimination. We will not discriminate against you for exercising your rights.

You can exercise your right to know, delete, or correct your personal information by emailing us at [email protected] or calling us at (855) 229-3111. If you do not receive a confirmation of our receipt of your request within 10 days, we may not have received your request and you should re-submit it. Once we receive your request, we will attempt to verify your identity. We may ask you for additional information to help us verify your identity, including by asking you to confirm other personal information you have provided to us. We may deny your request for reasons permitted by law—including our inability to verify your identity. If we deny your request, we will tell you why we did so.

Subject to certain restrictions, you can have an agent exercise your rights for you. If you have an agent exercising your rights, that person must provide to us your written authorization allowing them to make such a request on your behalf. We reserve the right to deny the agent’s request if we are not reasonably able to confirm proper authorization and/or verify your identity as the requestor.

Appeals

Residents of Colorado, Connecticut, and Virginia can appeal a refusal to take action on a request by contacting us by email at [email protected].

Contact Information

If you have any questions or comments about this information, the ways in which we collect and use your personal information, your choices and rights regarding such use, or wish to exercise your rights under state privacy laws, you may contact us at [email protected] or (855) 229-3111.