United States Regional Privacy Notice

Effective August 8, 2024

Overview

This United States Regional Privacy Notice is for people living in the United States and supplements the Granicus Privacy Policy.

This Privacy Policy explains how we collect, use, and disclose your Personal Information. It also describes how to exercise your rights under the California Consumer Privacy Act, the Colorado Privacy Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, the Utah Consumer Privacy Act, the Delaware Online Privacy and Protection Act and the Virginia Consumer Data Protection Act. We call those laws collectively the “U.S. Privacy Laws.”

Collection; Use; & Disclosure:

The sources we have collected this Personal Information from are: directly from California residents or their representatives.

In the past 12 months, however, we have not “sold” Personal Information relating to California residents within the meaning of the CCPA. For purposes of this Privacy Notice, “sold” means the disclosure of Personal Information for monetary or other valuable consideration.

We may disclose this type of information to:

Service Providers, third parties who may acquire your information as a result of a merger, acquisition or other ownership transition, third parties or affiliated companies when you agree to or direct that we share your information with them, other third parties (including government agencies) as required by law or in connection with court proceedings; third party advertising, analytics, business partners may have access to this data, and this may be considered a “sale” or “share” under the CCPA and CPRA under certain circumstances.

Why does Granicus carry out these processing activities using my personal data?

In order to provide the Services to you, to carry out a contractual relationship with you and/or to offer other products and services to you, your personal data is necessary. Not providing personal data may result in disadvantages for you – for example, we may not be able to carry out a contractual relationship with you or you may not be able to use certain products and services or may accept limited functionality. However, not providing your information will not result in legal consequences for you. In addition to the uses and sharing described above, Company and its suppliers may use and disclose personal data as described below:

• Services and Purpose Collected; Communication with You: We will use and share your personal data for the purpose for which it was collected, for example, to process and communicate with you in connection with your use of the Services (including your subscriptions, purchases, and account activity), your requests for information, user-generated content you provide, and opportunities at Company, to administer your account (where applicable) and Company business activities, to provide customer support to users of the Services, and to provide you with information and communications that you request. This includes, for example, sharing with local government entities your survey responses. Your location information will be used, for example, to understand where our users are located and to determine what services are available in those areas. User-generated content will be used for the purpose for which it was provided, including to make that content available to other users of the Services, if applicable, as discussed above and in our Terms.
• Survey Responses: Through our Services (including, without limitation, through services we provide to local, state, provincial, and other government agencies), you may have the opportunity to provide responses to various surveys. You may choose to voluntarily provide responses to such surveys. We will collect any information (personal or otherwise) that you disclose and submit through such surveys. As noted in the table above, you may submit, and we may collect sensitive personal information through such surveys. Where applicable law requires us to obtain your consent, we will obtain your consent prior to collecting sensitive personal information. With regard to any sensitive personal information contained in your survey responses, we only use such sensitive personal information as noted in the table above, which includes, for example, (1) carrying out our obligations under applicable law; (2) performing of our agreement with you or to provide you with services or products requested by you and as reasonably expected in the context of our performance; (3) protecting our legal interests and to ensure the physical safety of ourselves and other individuals; and (4) for other purposes, with your prior consent. We do not disclose personal information (including sensitive personal information) submitted by you through the surveys to any third parties, unless we first obtain your prior consent to do so. With regard to non-sensitive personal information provided via the surveys, we may use that data as otherwise set forth in the above table (e.g., see the “Identifiers” row in the table above). We may also use your personal information (including, without limitation, your sensitive personal information) to generate de-identified or aggregate data. We take reasonable measures designed to ensure that the de-identified and aggregated data cannot be reasonably associated with you. We will not attempt to reidentify the de-identified or aggregated data except solely for the purpose of testing our de-identification processes or determining if they are in compliance with the requirements set forth in this Privacy Notice or under applicable law. Where you consent to have your personal information disclosed to a third party, you hereby direct us to disclose your information (including, without limitation, your sensitive personal information) to such third party.
• Insights: We use information to create a marketing picture of individuals. This includes demographics such as age, income, hobbies, and interests that relate to people’s lifestyle choices and market-specific predictors. We use a combination of actual data held (at individual level or summarized at household, address, postcode, or other geographical level) and derived information (through statistical modeling or by applying a logical rule set) that indicates an individual’s likelihood of having a particular attribute, (e.g., a person’s likelihood to have pets or to fall within a particular marketing segment such as “technology early adopters”).
• Promotional Communications: Company may, to the extent permitted by applicable law and in accordance with your preferences, use personal data to send you promotional communications about Company and our products and services. Company will obtain your prior consent for such promotional communications solely to the extent required by applicable law. In order to provide you with a personalized experience, these communications may be tailored to your preferences based on, for example, inferences we make using your visits to the Services or the links you click on in Company emails. You may opt out of receiving promotional communications from us at any time by following the unsubscribe instructions contained in the applicable email or by contacting us using the contact information provided below under “Contact Us.” Specifically with regard to text messaging, if you opt in to receiving text messages (SMS and MMS) on the Services when prompted, Company may send you autodialed and other text messages at the telephone number you provide relating to your use of the Services. Consenting to receiving text messages is not required to buy goods or services or to otherwise do business with us. Message and data rates may apply. Note that, even if you opt out of receiving promotional communications from Company, you may still receive administrative communications from us with respect to your use of the Services.
• Marketing on Behalf of Third Parties: Some of our customers may engage Granicus and our Services to have Granicus send out marketing and promotional communications about that customer’s services or products. To the extent permitted by applicable law and in accordance with your preferences, we may use your personal information to send you marketing and promotional communications about services or products provided by third parties.
• Disclosing Collected Information:
  • To our Affiliates, Subsidiaries, and Related Entities: Based on how you use the Services and the information that you provide to or request from us, we may share your name, contact information, and related personal data with our affiliated companies who have products or services that we think may be of interest to you. Our affiliated companies may contact you directly with respect to such products and services, provided that if applicable law requires, your prior consent will be obtained. You may opt out of receiving communications from any such affiliated company pursuant to that affiliate’s own policies. You may opt out of receiving communications from us by contacting us using the contact information provided above in this Privacy Notice.
  • To Our Third-Party Suppliers and Service Providers: We will disclose personal data to our and our affiliates’ respective suppliers, vendors, and service providers as necessary for us to provide the Services and our products and services to you and to engage in the use and sharing of personal data as permitted by this Privacy Notice and applicable law. These third parties include, without limitation, our website management and hosting suppliers, customer support providers, those handling the processing and delivery of mailings, cloud storage providers, website analytics providers, payment processors (if and as applicable), product installers, and email service suppliers. Our service providers are authorized to and may use and disclose personal data as necessary for them to provide the applicable products and services to us and as provided by their own privacy policies and our agreements with those third parties.
• Evaluation and Improvement: We may use and disclose personal data to analyze, develop, and improve the content, materials, products, and services that we provide; to inform marketing and communication plans and strategies; to understand user demographics and preferences; to analyze the effectiveness of the Services; and to evaluate user needs and customize Services content and the user experience. To better understand how users access and use our Services, both on an aggregated and individualized basis, including monitoring, evaluating, and analyzing which features and portions of the Services are most popular; for troubleshooting, for statistical purposes, including, for example, identifying geographic regions of visitors to our Services; evaluating frequently asked questions from visitors; and for other statistical purposes.
• De-Identified and Aggregated Data: We may de-identify and/or aggregate personal data and user-generated content, and aggregate other personal data, and use and disclose that aggregate and/or de-identified data for our business purposes, in each case to the extent permitted by applicable law. We may also combine aggregate and/or de-identified data with other data in our possession for purposes of using and disclosing information as described in this Privacy Notice and as permitted under applicable law.
• Lawful Processes; Protection of Company: We may use and share personal data in accordance with and in response to regulatory authorities, courts with competent jurisdiction, valid law enforcement requests, governmental agency requests, emergency services, and other necessary third parties for legal, protection, security, and safety purposes (e.g., to comply with laws or regulations, to respond to subpoenas and legal processes, to perform credit checks, to protect the safety of our employees, agents, and customers, or any other person). We may use personal data and share it with third parties if we believe doing so is necessary or appropriate to protect our rights or the rights of others, including to enforce our agreements, policies, and terms, to bring legal action, to protect our operations and assets, or to pursue remedies or limit damages that we may sustain.
• Business Transactions: If Company undergoes a change in control, acquisition, merger, reorganization, asset sale (in whole or in part), or similar transaction, we may transfer, sell, share, or otherwise disclose personal data to the subsequent owner(s) or successor(s) of those transactions. We may also disclose personal data in connection with the evaluation of those transactions. Those owner(s), successor(s), and other recipients will be bound by this Privacy Notice as it applies to the information disclosed. Also, if Company or any of its assets are acquired or if Company goes out of business, enters bankruptcy, or goes through some other change in control or reorganization, personal data may be one of the assets transferred to or acquired by a third party.
• With Your Consent. With your consent, we may use and share your personal data in ways not specifically described in this Privacy Notice.

In the past 12 months, we have collected the categories of personal information and used such personal information for the purposes set forth in the “Collection; Use; & Disclosure” and “Why Does Granicus Carry Out These Processing Activities Using My Personal Data?” sections above.

Does Granicus use cookies and collect other trackers?

Cookies are text files containing small amounts of information which are downloaded to your computer or mobile device when you visit a website. Cookies are then sent back to the originating website on each subsequent visit, or to another website that recognizes that cookie. Cookies are useful because they allow a website to recognize a user’s device. Cookies allow you to navigate between pages efficiently, remembering your preferences and generally improving the user experience.

Our Cookie Policy provides you with more information about our use of cookies.

Additionally, as you navigate and use the Services, certain information can be passively collected using various technologies. We passively collect a variety of types of information in a variety of ways, including as described below.

User Activity. We collect information on how the Services are used, for example, the features you use, the links that you click on, your search parameters, data reflecting transactions and interactions that have taken place using the Services, how you interact with other users, performance statistics, and other usage data.

IP Addresses and Related Data. The servers used to operate and provide the Services may collect data pertaining to you and the equipment, software, and communication methods you use to access the Internet and the Services, including IP addresses assigned to the computers and other devices from where you access the Internet, your Internet service provider (ISP), device ID numbers and unique identifiers, your media access control (MAC) address, your operating system, your device’s screen resolution, your web browser type, the pages you access on the Services, the websites you access before and after visiting the Services, the length of time you spend on the Services, date and time stamps, clickstream data, your approximate geographic location, performance statistics, and usage data. Company may use this information to administer the Services and their servers, to generate statistical information, to monitor and analyze Service traffic and usage patterns, to monitor and help prevent fraud, to investigate complaints and violations of our policies, and to improve the Services.

We may combine this information with personal data and information obtained from third parties for security reasons and to protect our rights or the rights of others. The suppliers that we use to provide the Services may collect information about your visits to the Services and other websites. Some of this information may be collected using cookies and similar tracking technologies as explained above.

Does Granicus share my personal data with third parties?

To help us carry out our Processing Activities, and pursuant to and consistent with the purposes for collecting your information as set forth in this Privacy Notice, we may share your personal data with third parties as follows:

For the full list of the Granicus entities, Data Processors and other third parties that we may share your data with, please contact us as set out below.

Third Party Websites. This Site may, from time to time, contain links to and from the websites of our partner networks, advertisers and affiliates. If you follow a link to any third-party websites, please note that the third-party websites have their own privacy policies and that we have no control over how they may use your personal data. You should check the privacy policies of third-party websites before you submit any personal data to them.

Social media features – the Website includes social media plugins, including links to Facebook, LinkedIn and Twitter. These features may collect your IP address, which page you are visiting on our site, and may set a cookie to enable the plugin to function properly. Social media features are governed by the privacy policy of the company providing it. By choosing to use any third-party social media platform or choosing to share content or communications with any social media platform, you allow us to share information with the designated social media platform. Interactions, integrations, and content sharing with a social media platform and their features may require or allow the social media company to collect information from or about you, whether through cookies, registration information, or otherwise. Social media companies may track your online activity even when you do not choose to interact with the social media platform or its widgets or other features. We encourage you to review the privacy policy of any social media platform that you use or visit in connection with the Services, as those platforms’ respective privacy policies will govern their collection, use, and disclosure of information they collect from you. We cannot control any policies or terms of such third party platform. As a result, we cannot be responsible for any use or disclosure of your information or content by third-party platforms, which you use at your own risk.

The Services may also use the advertising services and networks offered by social media platforms to deliver advertising content. Use of these services requires social media platforms to implement cookies or pixel tags to deliver ads to you while you are logged into the applicable social media platform.

If you do not want social media platforms to collect information relating to you via the Services or to link information collected via the Services to your social media accounts, we suggest that you: (a) do not connect to or share information with social media platforms using the Services; (b) hide social media platform plug-ins using an ad blocker; (c) always log off completely from social media platforms before visiting the Services or other websites and delete all related cookies; and, (d) where the option is made available by a social media platform, disable the advertising services and networks operated by that platform. For example, you may opt out of Twitter’s interest-based advertising by notifying Twitter through one of the methods it describes here. You hereby acknowledge that Company makes no guarantee that exercising the foregoing options is guaranteed to prevent applicable social media platforms from tracking you and, further, you acknowledge that Company is not responsible for a social media platform’s tracking of you.

Our Social Media Pages. Company is active on social media. You may have the opportunity to comment on social media platforms regarding, as well as send us reviews and testimonials regarding, Company and the products and services we offer and/or to submit or upload related photos and other materials. Company reserves the right to post on the Services, other websites, and social media pages any comments, photos, or content that you post on our social media pages or provide to us (whether through social media or otherwise) to the extent permitted by applicable law.

Live Chat Features. If you use any chat or messaging feature on the Services, we will collect all text and other information and content that you may provide or input using those features. If you use a chat or messaging feature while signed into your account, we may link that information to other information we collect from and/or about you.

Your Consumer Request Rights Under U.S. Privacy Laws

Where applicable and subject to exceptions as set forth under applicable U.S. Privacy Laws, you may have the following rights:

• Right to Confirm: The right to confirm whether we are processing your personal information.
• Right to Access: You may have the right to request access to any of your personal information that we hold. Specifically, you have the right to request the disclosure of:
  • What personal information has been collected;
  • The categories of sources from which the personal information was collected;
  • The business or commercial purpose for collection or selling personal information;
  • The categories of third parties with whom we share personal information; and
  • The specific pieces of personal information we have collected about you.
• Right to Data Portability: You may have the right to receive all such personal information about you from Company in a structured, commonly used and machine-readable format, and also to require us to transmit it to another entity where this is technically feasible.
• Right to Deletion: You may have the right to request the deletion of your personal information that we have collected.
• Right to Correction: You may have the right to request the correction of your personal information that we collected.
• Right to Opt-Out: You may have the right to opt-out of:
  • Targeted advertising and the sharing of personal information that is shared for cross-contextual behavioral advertising purposes;
  • The sale of your personal information;
• Non-Discrimination: The right to not be discriminated against due to your exercise of your rights under applicable law. We do not discriminate against users for exercising the rights granted to them under applicable law and that are applicable to our processing of your personal information.
• Sensitive Data: You may have the right to limit our processing (or completely opt-out, if allowed under applicable law) of sensitive personal information to what is necessary.

We do not use your personal information to profile you in furtherance of decisions that produce legal or significantly similar effects (as may be defined under applicable law).

The above rights are only exercisable by you where the applicable law grants you the right being exerted and where no exception or exemption under applicable law applies. You may also have a registered agent (if and only as permitted under applicable law) that you authorize to act on your behalf. If you have a registered agent act on your behalf, we have the right to authenticate such agent’s authority to act. To exercise the rights described herein (only to the extent applicable), you may submit a verifiable request to us by through the methods set forth under the “Exercise Your Rights” section of the general Granicus Privacy Notice.

Selling and Sharing

We do not sell your personal information as the concept of “selling” is traditionally understood as being the exchange of something for money. However, we use your personal information to send you marketing and promotional communications on behalf of our customers who may have products or services of interest to you. Applicable U.S. state data protection laws hold such disclosures and sharing to be considered “selling” or “sharing”. Therefore, you have the right to opt out of such selling and sharing. In the preceding 12 months, we have sold or shared the following categories of personal information with the following categories of third parties and for the following purposes:

You have the right to opt out of the selling or sharing of your personal information as described herein. You may exercise this right to opt out by contacting use through the methods set forth below under the “Contact Us” section of the general Granicus Privacy Notice.

Do Not Track Requests

Some U.S. Privacy Laws require to indicate whether we honor “Do Not Track” settings in your browser concerning targeted advertising. Due to the automatic collection of data using cookies as described in our Cookie Policy, we do not honor “do not track” requests. For this reason, your selection of the “Do Not Track” option provided by your browser may not have any effect on our collection of information using cookies and tracking technologies.

Submitting a Request and Verification

If this Privacy Notice expressly stated above that you have certain rights or applicable law grants you certain rights as it relates to this Privacy Notice and personal information, you may submit a verifiable request to us by

• Telephone: 800-314-0147
• Emailing: dpo@granicus.com

In your request, you must provide enough information to allow us to verify you are the person about whom we collected personal information, or their authorized representative. You must also describe your request with enough detail so that we can understand, evaluate and respond to it.

Before Granicus is able to respond to any request, we may ask to verify your identity by providing us with certain information or identification. In some instances, we may decline to honor your request. For example, we may decline to honor your request if we cannot verify your identity or confirm that the personal information that we maintain relates to you, or if we cannot verify that you have the authority to make a request on behalf of another individual. In other instances, we may decline to honor your request where an exception applies, such as where the disclosure of personal information would adversely affect the rights and freedoms of another consumer or where the personal information that we maintain about you is not subject to access or deletion rights, such as information relating to our employees and contractors that is used for our employment and vendor management purposes.

When you exercise your Right to Know, Right to Delete, and/or Right to Correct, we may ask that you provide us with information, beyond your full name, in order to verify your identity and fulfill your request. If we are unable to verify that the individual submitting the request is the same individual about whom we have collected information (or someone authorized by that individual to act on their behalf), we will not be able to process the request. Pursuant to the U.S. Privacy Laws, if applicable, we will not require you to verify your identity, beyond asking for the information necessary to complete your request, when you exercise your Right to Opt-Out of Sharing, Right to Opt-Out of Sale, or Right to Limit the Use and Disclosure of Sensitive Personal Information.

We will respond to your request within the applicable timeframe required under applicable law. If we deny your request, you can appeal such denial by emailing us at dpo@granicus.com.

Authorized Agents

Only you or a registered agent (if and only as permitted under applicable law) that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. If you have a registered agent act on your behalf, we have the right to authenticate such agent’s authority to act. If you are an authorized representative submitting a request on a user’s behalf, please complete the applicable request per the instructions below. We will follow up to request a signed, written permission signed by the individual who is the subject of the request authorizing you to make the request on their behalf. The written permission must state your full legal name, the full legal name of the individual who is the subject of the request, and needs to be clear about the permission granted. Alternatively, you may submit a copy of a power of attorney under Probate Code sections 4000-4465. In either case, please also indicate in your email the nature of your request. The consumer’s identity, in addition to your own, will need to be independently verified in order for us to be able to fulfill your request. We may also ask the consumer to directly confirm with us that they provided you permission to submit a request. Please keep in mind that if we do not receive adequate proof that you are authorized to act on the consumer’s behalf, we may deny the request.

You may also have the right to not receive discriminatory treatment for exercising your rights under applicable law. We do not and will not discriminate against you for exercising your rights granted under applicable law and that are applicable to our processing of your personal information.

Data Retention

Grancius will not retain personal information for longer than is reasonably necessary for each disclosed purpose outlined in this Privacy Notice. We store personal information for as long as necessary for the purposes for which it was collected or which you subsequently authorize it and otherwise to carry out the purposes described in this Privacy Notice.

Users Younger Than 16

The Services are not directed at children under 16 years of age. Granicus does not knowingly collect or sell information of users younger than 16 years of age.

Notice to Virginia Residents

We set forth above in our Privacy Policy the categories of personal data we process, the purpose for processing personal data, the categories of personal data shared, and the categories of third parties with whom personal data is shared.

If you are a Virginia Consumer and would like to exercise your rights pursuant to the Virginia Consumer Data Protection Act (VCDPA), and any implementing regulations adopted thereunder, please please email: dpo@granicus.com to submit a request.

Virginia Consumers have the following rights, all subject to the meanings and exceptions set forth in the VCDPA:

1. To confirm whether we are processing your Personal Data and request to access such data (“Right to Access”).
2. That we correct inaccurate Personal Data we hold about you (“Right to Correct”).
3. That we delete the Personal Data provided by you or obtained about you (“Right to Delete”).
4. To obtain a copy of the Personal Data previously provided by you to us and, to the extent feasible, in a readily usable format to allow data portability (“Right to Obtain”).
5. To opt-out out of the processing of your Personal Data for the purposes of targeted advertising (“Right to Opt-Out of Targeted Advertising”).

Granicus engages in online advertising practices (and certain analytics or similar activities) that may be considered “targeted advertising” under the VCDPA. To disable sharing through cookies set by 3rd parties that may be considered targeted advertising under the VCDPA, click here: Cookie Policy

Granicus does not sell Personal Data to third parties for monetary compensation.

VCDPA Appeals

Pursuant to the VCDPA, if, for any reason, you would like to appeal our decision relating to your request, you have the right to submit an appeal and can do so by emailing the dpo@granicus.com Please include your full name, the basis for your appeal, and any additional information to consider.

Notice to Nevada Residents

Granicus does not currently sell your covered information as those terms are defined under applicable Nevada law.