2.1.

Data Provided by You

We may collect the following types of Personal Data and other data directly from you when you use the Services, sign up for Beta testing of Orson, or contact us.  We may collect the following types of Personal Data:

• Identifiers, including name, company name, Slack username and ID, email address, postal address, phone number

• Information in Customer Records, including name, email address, postal address, phone number, payment and other financial data;

• Contact Information, including name, email address, and phone number;

• Biometric Data, including imagery of face, video and audio recordings;

• Audio and Video Recordings. Orson may collect, receive, capture, and store audio and video recordings of you and metadata derived from your use of features, and additional related data.

• Financial Data, including billing and payment data; and

• Sensitive Personal Data, including biometric data.

Special Category Information

Some of the data that we may collect as a result of providing the Services is particularly sensitive (e.g., biometric data). We only collect this data as provided by or consented by you.

Such sensitive data is only shared for the purpose of providing the Services you request or as consented for and will not be shared or used by us for any other purposes.  This data is held to a strict retention schedule, as described in the Retention Period Section below.

2.2.

Data Automatically Collected by the Sites

Orson and third-party service providers may automatically collect data about you when you use the Sites. This data is primarily needed to maintain the security and operation of the Sites, and for our internal analytics so that we can improve the Product and Business Services. This data may include:

• Identifiers, including IP address and cookies;
  • Cookies, are small data files that we transfer to your computer’s hard disk for record-keeping purposes. Cookies do not personally identify you; they merely identify the computer or device with which you access the Sites. The Sites use cookies to analyze trends, recognize you, tailor our Product and Business Services to you, or to detect and prevent fraud. You can instruct your browser, by changing its options, to disable cookies or to prompt you before accepting a cookie from the Sites. If you disable cookies, however, you may not be able to use all portions or functionality of the Sites;

• Internet or Other Electronic Network Activity Data, including device and usage data, Internet Protocol (IP) address, browser and device characteristics, how you use the Sites, browser type, version, language and time zone setting, browser plug-in types, country or location, operating system, internal automations and system settings, type of device you are using, actions you take on the Sites, the pages that led you to the Sites and, if applicable, the search terms you typed into a search engine that led you to the Sites; and

• Third Party Cookies
  • Google Analytics, visitors to the Sites may be tracked using Google Analytics. The Personal Data collected by Google Analytics is primarily used to optimize the Sites for users; however, we may also use this data for marketing purposes. The Personal Data we automatically collect using Google Analytics is shared with Google. For more information on Google’s Privacy Policies, visit: https://policies.google.com/privacy. You can also opt-out of having your Personal Data used by Google Analytics by following the instructions located at https://tools.google.com/dlpage/gaoptout/. Google Analytics may collect the following types of data from users of the Sites:

• Type of web browser used, software manufacture and version number.
• Type of operating system
• Color processing ability of the users screen
• JavaScript support
• Flash version
• Screen resolution
• Network location and IP address
• Country, city, state, region, county, or any other geographic data
• Hostname
• Bandwidth (internet connection speed)
• Time of visit
• Pages visited
• Time spent on each page of the website
• Referring website statistics
• The website the user came through in order to arrive at the Sites
• Search engine query used

We also use Google Analytics for Display and Search Advertising and, specifically, Google Analytics Demographics and Interest Reporting, on the Sites to help display advertising for products or services that we think may be of interest to you. We will use demographic information collected through our use of Google Analytics Demographics and Interest Reporting for purposes of performing internal statistical analytics relating to the Sites. You can opt-out of receiving interest-based advertisements through the Sites, as well as customize the types of advertisements that will be displayed to you through the Sites, by following the instructions located at https://support.google.com/ads.

• Heat Mapping and Session Recording, are used to capture how you use and interact with the Sites through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Sites usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for Sites optimization, fraud/security purposes, and advertising.

• Pixel Tags and Web Beacons, are tiny graphic files with a unique identifier that is similar in function to a cookie but would allow us to count the number of visitors that have visited certain pages or screens of the Sites, and to help determine the effectiveness of promotional or advertising campaigns. When used in HTML-formatted email messages, web beacons can tell the sender whether and when the email has been opened. In contrast to cookies, which may be stored on your computer’s hard drive, web beacons are typically embedded invisibly on pages or screens. We may use web beacons in providing the Services.

• Meta Pixel, We use Meta Pixel Tags to better measure, optimize, and retarget our marketing campaigns. This allows user specific behavior to be tracked after they have been redirected to the advertiser’s website by clicking on a Facebook ad. This enables us to measure the effectiveness of Facebook ads for statistical and market research purposes. The data collected in this way is anonymous to us, in other words, we do not see the Personal Data of individual users. This data is stored and processed by Facebook. Facebook may link this information to your Facebook account and also use it for its own promotional purposes, in accordance with Facebook’s Data Usage Policy https://www.facebook.com/about/privacy/. For more information on opt-out options, please visit: https://www.facebook.com/help/568137493302217.

2.3.

Data Received from Third Parties

In some instances, Orson may receive Personal Data and/or anonymous data about you from other parties, such as our affiliates, business partners, and service providers. That data may be obtained online, offline, or through publicly available resources.  We may combine this data with the data you provide, and other data we already have about you.

5.1.

Advertising

We may also use third-party advertisers, ad networks, and other advertising, marketing, and promotional companies, to serve advertisements about the Product and Business Services. Such third parties may gather data about your visit to the Services, monitor your access or market our products and services to you, monitor the ads you view, click-on, or interact with, when they were delivered, and the screens and pages that they are on. If you wish to not have this data used for the purpose of serving you targeted ads, you may opt out by clicking here. Please note this does not opt you out of being served advertising. You will continue to receive generic ads.

We and our service providers may use data about your interactions with the Services to predict your interests and select the ads you see on and off the Services. This is known as interest-based advertising. In providing interest-based ads, we follow the Self-Regulatory Principles for Online Behavioral Advertising developed by the Digital Advertising Alliance ("DAA").  For more information about interest-based advertising and how you can opt out, visit:

• Digital Advertising Alliance (DAA): http://www.aboutads.info/choices

• Network Advertising Initiative (NAI): http://www.networkadvertising.org/choices/

5.2.

Marketing

From time to time if you have supplied your email address, Orson and its affiliates may send you marketing or informational emails. If you prefer not to receive any or all of our marketing and promotional communications, you may opt-out of these communications by following the opt-out prompts on these communications. You also may ask us not to send you other marketing or informational communications by contacting us as specified in the Contact Information section below, and we will honor your request. Please note that even after you are removed from our marketing lists, we may still send you non-promotional communications, such as responding to your support requests.

5.3.

Do Not Track

Some browsers have a “Do Not Track” (DNT) feature that lets you tell websites and online services that you do not want to have your online activities tracked. Such browser features and industry standards are not uniform. As such, Orson does not monitor or respond to DNT browser requests.  If a standard is adopted that we must follow in the future, then we will inform you about that practice in a revised version of this Privacy Policy.

12.1.

Data Controller.

The Data Controller is Orson.

12.2.

Processing Purposes and Legal Bases.

Orson processes your Personal Data for the lawful purposes, and under the legal bases set forth in the Collection of Personal Data section above.

12.3.

Onward Transfer.

Orson will not disclose Personal Data to a third party except as stated below:

We may disclose Personal Data to subcontractors and third-party agents. Before disclosing Personal Data to a subcontractor or third-party agent, we will obtain assurances by contractual agreement from the recipient that it will: (i) transfer such data only for limited and specified purposes; (ii) ascertain that the subcontractor or third-party agent is obligated to provide at least the same level of privacy protection as is required by the GDPR; (iii) take reasonable and appropriate steps to ensure that subcontractors and third-party agents effectively process the Personal Data transferred in a manner consistent with the organization’s obligations under the GDPR; (iv) require subcontractors and third-party agents to notify the organization if it makes a determination that it can no longer meet its obligation to provide the same level of protection as is required by the GDPR; (v) upon notice, including under (iv), take reasonable and appropriate steps to stop and remediate unauthorized processing; and (vi) provide a summary or a representative copy of the relevant privacy provisions of its contract with subcontractors and third-party agents to the Supervisory Authorities upon request.

We also may be required to disclose, and may disclose, Personal Data in response to lawful requests by public authorities, including for the purpose of meeting national security or law enforcement requirements, or in the event of a merger or acquisition.

12.4.

Rights under the GDPR.

Data Subjects have the following privacy rights under the GDPR:

• Right of Access. You have the right to obtain confirmation from us as to whether or not we process Personal Data from you, and you also have the right to at any time obtain access to your Personal Data stored by us.
• Right to Rectification. If we process your Personal Data, we use reasonable measures to ensure that your Personal Data is accurate and up-to-date for the purposes for which your Personal Data was collected. If your Personal Data is inaccurate or incomplete, you have the right to require us to correct it.
• Right to Erasure. You may have the right to require us to delete your Personal Data.
• Right to Restrict Processing. You may have the right to request the restriction or suppression of Personal Data.
• Right to Withdraw Consent. If you have given your consent to the processing of your Personal Data, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on the consent before the withdrawal.
• Right to Data Portability. You may have the right to receive the Personal Data concerning you and which you have provided to us, in a structured, commonly used and machine-readable format or to transmit this data to another controller.
• Right to Object. You may have the right to object to the processing of your Personal Data as further specified in this Privacy Policy and you may have the right to object to decisions being made with your Personal Data based solely on automated decision making or profiling.
• Right to Lodge a Complaint with Supervisory Authority. You have the right to lodge a complaint with a data protection supervisory authority located in the European Union or UK. Further information about how to contact your local data protection authority is available at the website of the European Commission.

If you would like to exercise your EEA and UK privacy rights, please contact us as specified in the Contact Information section with a reference to “EEA and UK.” 

12.5.

Choices under the GDPR.

Data Subjects have the right to opt out of (i) disclosures of their Personal Data to third parties not identified at the time of collection or subsequently authorized, and (ii) uses of Personal Data for purposes materially different from those disclosed at the time of collection or subsequently authorized. Data Subjects who wish to limit the use or disclosure of their Personal Data should submit that request to our Data Protection Officer. We will cooperate with Data Subjects’ instructions regarding Data Subjects’ choices.

All of our general emails also contain an unsubscribe link at the bottom and you can unsubscribe to such emails at any time by clicking on that link.

12.6.

Security.

See Confidentiality and Security section above for more information about our security practices.

12.7.

Retention of Personal Data.

For more information, please refer to the Retention Period section above.

12.8.

Transfers to the United States.

In using the Services, your Personal Data will be transferred to the United States, which is not recognized as a country having adequate safeguards for the protection of Personal Data. Orson relies on your consent or Article 49 of the GDPR for transfers of data collected from Data Subjects in the EU and EEA. Transfers are made to Orson only if the Data Subject has explicitly consented to the proposed transfer after having been informed of the possible risks of such transfers. Additionally, we transfer data as necessary for the performance of a contract between you as the Data Subject and Orson as the Controller, to Data Processors who have an agreement with us that includes protecting your privacy and the security of your data, and in cases where your Personal Data is necessary for the implementation of pre-contractual measures taken in accordance with your requests.

13.1.

Shine the Light

Under California Civil Code Section 1798.83 (“Shine the Light”), California residents have the right to request in writing from businesses with whom they have an established business relationship, (a) a list of the categories of Personal Data, such as name, e-mail and mailing address and the type of services provided to the customer, that a business has disclosed to third parties (including affiliates that are separate legal entities) during the immediately preceding calendar year for the third parties’ direct marketing purposes; and (b) the names and addresses of all such third parties. To request the above information, please contact us as directed in the Contact Information section below with a reference to California Disclosure Information.

13.2.

Categories of Personal Data Collected.

We may collect (and have collected during the 12-month period prior to the “Last Modified” date of this Privacy Policy) the above categories of Personal Data about you in the Collection of Personal Data section above.

13.3.

Purpose of Collection.

We may use (and may have used during the 12-month period prior to the “Last Modified” date of this Privacy Policy) your Personal Data for the business or commercial purposes described in the Purpose of Collection section above.

13.4.

Sources of Personal Data.

During the 12-month period prior to the “Last Modified” date of this Privacy Policy, we may obtain (and may have obtained) Personal Data about you from the sources identified in the Collection of Personal Data section above.

13.5.

Selling and Sharing Personal Data.

We do not sell or share your Personal Data in exchange for monetary consideration; however, we may use tools described above such as Google Analytics, which may be interpreted as sharing your Personal Data.  As such, please see the above Personal Data Automatically Collected and Choices sections for more information regarding opting out of use of these tools.

During the 12-month period prior to the “Last Modified” date of this Privacy Policy, we may have shared or disclosed the following categories of Personal Data about you for a business or commercial purpose with certain categories of third parties, as described below:

Categories of Personal Data that May Be Sold, Shared, or Disclosed	Categories of Third Parties to whom Personal Data May Be Sold, Shared, or Disclosed	Business or Commercial Purpose of Selling, Sharing, or Disclosing Personal Data
Identifiers	Subsidiaries and Affiliates Service Providers and Contractors Business Partners Marketing Partners Advertising Partners	Provide the Product, Business Services, and Services Communicate with you Monitor the Services Respond to Inquiries and Fulfill Requests Improve the Services Support Business Operations Fulfill Other Purposes
Personal Data Categories Listed in The California Customer Records Statute (Cal. Civ. Code §1798.80(e))	Subsidiaries and Affiliates Service Providers and Contractors Business Partners Marketing Partners Advertising Partners	Provide the Product, Business Services, and Services Communicate with you Monitor the Services Respond to Inquiries and Fulfill Requests Process payment Improve the Services Support Business Operations Fulfill Other Purposes
Contact Information	Subsidiaries and Affiliates Service Providers and Contractors Business Partners Marketing Partners Advertising Partners	Provide the Product, Business Services, and Services Communicate with you Monitor the Services Respond to Inquiries and Fulfill Requests Improve the Services Support Business Operations Fulfill Other Purposes
Biometric Data	Subsidiaries and Affiliates Service Providers and Contractors Business Partners	Provide the Product, Business Services, and Services Improve the Services
Financial Data	Subsidiaries and Affiliates Service Providers and Contractors Business Partners	Provide the Product, Business Services, and Services Process payment
Sensitive Personal Data	Subsidiaries and Affiliates Service Providers and Contractors Business Partners	Provide the Product, Business Services, and Services Communicate with you Monitor the Services Respond to Inquiries and Fulfill Requests Improve the Services Support Business Operations Fulfill Other Purposes
Internet or Other Electronic Network Activity	Subsidiaries and Affiliates Service Providers and Contractors Business Partners Marketing Partners Advertising Partners	Provide the Services Monitor and maintain the Services Improve the Services Support Business Operations Fulfill Other Purposes

13.6.

California Consumer Privacy Rights.

Under CCPA, consumers have certain rights regarding their Personal Data, as described below.

• Right of Access: You have the right to request, twice in a 12-month period, that we disclose to you the following information about you, limited to the preceding twelve (12) months:
  • The categories of Personal Data that we collected about you;
  • The categories of sources from which the Personal Data is collected;
  • The business or commercial purpose for collecting or selling Personal Data;
  • The categories of third parties with whom we share Personal Data;
  • The specific pieces of Personal Data that we have collected about you;
  • The categories of Personal Data that we disclosed about you for a business purpose or sold to third-parties; and
  • For each category of Personal Data identified, the categories of third parties to whom the information was disclosed or sold.
• Right of Deletion: You have the right to request that we delete any Personal Data about you which we have collected from you, subject to exceptions within the law.
• Right to Opt-Out: You have the right to opt-out of the disclosure of Personal Data about you for monetary or other valuable consideration. However, we do not sell any Personal Data.
• Right to Opt-In: We do not have actual knowledge that we collect, share, or sell the Personal Data of minors under the age of 16.
• Right to Limit Use and Disclosure of Sensitive Personal Data: You may request specific limitations on further sharing, use, or disclosure of your Sensitive Personal Data that is collected or processed for “the purpose of inferring characteristics about a consumer.” However, we do not collect or process Sensitive Personal Data for this purpose.
• Right to Correction: You have the right to request that we maintain accurate Personal Data about you and correct any Personal Data about you which we have collected from you, subject to exceptions within the law.

If you would like to exercise your California privacy rights, please refer to the Consumer Requests and Verification section below. 

14.1.

Rights under VCDPA, CPA, CTDPA, and UCPA.

Virginia, Colorado, Connecticut, and Utah privacy law provides residents with specific rights regarding Personal Data, including:

• Right to Access. You have the right to confirm whether or not we are processing your Personal Data and to access such information.
• Right to Correction. You have the right to correct inaccuracies in your Personal Data which we have collected, taking into account the nature of the Personal Data and the purposes of processing the Personal Data.
• Right to Deletion. You have the right to request deletion of Personal Data provided by or obtained about you, subject to legal exemptions.
• Right to Data Portability. You have the right to obtain a copy of your Personal Data.
• Right to Opt-Out. You have the right to opt out of the processing of Personal Data for purposes of (1) targeted advertising; (2) the sale of Personal Data; or, if you are in Virginia or Colorado (3) profiling in furtherance of decisions that produce legal or similarly significant effects.

If you would like to exercise any of the rights provided, please refer to the Consumer Requests and Verification section below.

15.1.

Right to Non-Discrimination.

We may not discriminate against you because you exercise any of your privacy rights contained in this Privacy Policy including, but not limited to:

• Denying goods or services to you;
• Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties;
• Providing a different level or quality of goods or services to you; or
• Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

15.2.

Verifying Requests.

You may request to exercise your rights of access, deletion, or correction by contacting us as described in the Contact Information section below. To help protect your privacy and maintain security, we will take steps to verify your identity before processing your request.  If you request access to or deletion of your Personal Data, we may require you to provide any of the following information: name, date of birth, email address, telephone number, or postal address. When you make such a request, you can expect the following:

• As required under applicable law, we will verify your identity. You will need to provide us with your email address and full name. We may ask for additional information if needed.
• We will confirm that you want your information accessed, corrected, and/or deleted.
• We will confirm our receipt of your request within 10 days. If you have not received a response within a few days after that, please let us know by contacting us at the webpage or phone number listed below.
• We will respond to your request within 45 days upon receipt of your request. If necessary, we may need an additional period of time, up to another 45 days, but we will reply either way within the first 45-day period and, if we need an extension, we will explain why.
• In certain cases, a request for access, correction, or deletion may be denied. For example, if we cannot verify your identity, the law requires that we maintain the information, or if we need the information for internal purposes such as providing Services or completing an order. If we deny your request, we will explain why we denied it and delete any other information that is not protected and subject to denial.

15.3.

Authorized Agents.

You may designate an authorized agent to request any of the above rights on your behalf. You may make such a designation by providing the agent with written permission, signed by you, to act on your behalf. Your agent may contact us as described in the Contact Information section below to make a request on your behalf. Even if you choose to use an agent, we may, as permitted by law, require:

• The authorized agent to provide proof that you provided signed permission to the authorized agent to submit the request;
• You to verify your identity directly with us; or
• You to directly confirm with us that you provided the authorized agent permission to submit the request.

15.4.

Virginia and Connecticut Appeal Process.

If you have made a request to access, correct, or delete your Personal Data under VCDPA and CTDPA, and we have declined to take action, you may appeal our decision within 45 days of the denial. When you make such an appeal, you can expect the following:

• We will verify your identity. You will need to provide us with your email address and full name. We may ask for additional information if needed.

• We will review your appeal and respond in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decision, within 45 days upon receipt of your appeal. If necessary, we may need an additional period of time, up to another 45 days, but we will reply either way within the first 45-day period and, if we need an extension, we will explain why.

• In certain cases, an appeal may be denied. For example, if we cannot verify your identity, the law requires that we maintain the information, or if we need the information for internal purposes such as providing Services or completing an order. If we deny your appeal, we will explain why we denied it and provide you with a method to contact your state’s Attorney General to submit a complaint.