California Notice at Collection and Privacy Notice
California Privacy Notice and Notice of Collection
This California Notice at Collection and Privacy Notice (“California Privacy Notice”) is only applicable to California residents (“you”). It supplements the information contained in the Vestwell Privacy Policy. It is delivered on behalf of Vestwell Holdings Inc. and our subsidiaries and affiliates (collectively, “Vestwell”) and governs certain personal information we collect from you. We have adopted this California Privacy Notice to comply with the California Consumer Privacy Act, Cal. Civ. Code §§ 1798.100 et seq. (“CCPA”). Please take the time to read and understand this California Privacy Notice.
Scope
This California Privacy Notice covers personal information we collect automatically from California-resident individuals who visit our Websites, as defined in our Privacy Policy, or who use our Services. In certain contexts, it also covers personal information we collect from California-resident representatives of individuals and institutions with whom we communicate, do business, or to whom we provide products or services.
There is other personal information that this California Privacy Notice does not cover. In some cases, that personal information may not be subject to the CCPA. In other cases, a different privacy notice may apply. Accordingly, this California Privacy Notice and/or the California privacy rights set out herein may not apply to you or to all of your personal information. For example, the following personal information is not covered by this California Privacy Notice, including personal information that is collected, processed, sold, or disclosed pursuant to the federal Gramm Leach Bliley Act (“GLBA”). To understand how we collect, use, and disclose your nonpublic personal information in accordance with the GLBA, please read our GLBA Notice on our Privacy Policies website.
Additionally, the personal information we have from California residents (1) in their capacity as current or former employees, personnel, or independent contractors of Vestwell; (2) who are emergency contacts of, or benefits recipients related to, current or former employees, personnel, or independent contractors of Vestwell; (3) in their capacity as current or former job applicants or prospective job applicants to Vestwell, please read our California Resident Applicant and Prospective Applicant Privacy Notice.
Notice at Collection
The following table sets forth the categories of personal information we may collect from you as a business; the purposes for which we use it; and whether we “sell” or “share” it for purposes of the CCPA (as those terms are used in the CCPA). Our collection, use, and disclosure of personal information depends on your relationship with us and your interaction with us. For information on our receipt of personal information as a third party when we (i) conduct diligence on potential investments, and (ii) seek to identify new prospects and clients, please see Third Party Processing below.
| Category of personal information | Purpose of Collecting the personal information | Whether We “Share” the Category of personal information for Cross-Context Behavioral Advertising | Whether We “Sell” the Category of personal information |
|---|---|---|---|
| Identifiers and Categories in Cal. Civ. Code 1798.80(e), such as name, unique personal identifier, online identifier, IP address, email address, account name, phone number or signature | To present our Website and its contents to you, To deliver the information, products and services you requested from us, To reach out to you about and market or promote new information to you, To communicate with you, To help us improve our Website and deliver a more personalized experience, To deliver targeted advertising to you, To verify or maintain the quality or safety of our services and to improve, upgrade or enhance our services, To monitor the security of our offices | Yes | No |
| Characteristics of Protected Classifications under California or Federal Law, such as gender | To personalize communications that deliver the information, products and services you requested from us or provide information about products and services that we believe may be of interest to you, To carry out our obligations and enforce our rights, In any other way we describe when you provide the information, or otherwise at your direction or with your consent | No | No |
| Commercial information, such as records of products or services purchased, obtained or considered, or other purchasing or consuming histories of tendencies | To present our Website and its contents to you, To deliver the information, products and services you requested from us, To reach out to you about and market or promote new information to you, To communicate with you, To help us improve our Website and deliver a more personalized experience, To deliver targeted advertising to you | Yes | No |
| Internet or other electronic network activity information, such as browsing history, search history or information regarding interaction with a website, app or advertisement | To present our Website and its contents to you, To deliver the information, products and services you requested from us, To reach out to you about and market or promote new information to you, To communicate with you, To help us improve our Website and deliver a more personalized experience, To deliver targeted advertising to you, To verify or maintain the quality or safety of our services and to improve, upgrade or enhance our services, To carry out our obligations and enforce our rights | Yes | No |
| Geolocation data, such as the state or country associated with your IP address | To present our Website and its contents to you, To deliver the information, products and services you requested from us | Yes | No |
| Audio, electronic, visual, thermal, olfactory or similar information, such as a recording of your voice or photo or video of you | To deliver the information, products and services you requested from us, To communicate with you, To verify or maintain the quality or safety of our services and to improve, upgrade or enhance our services, To monitor the security of our offices, To carry out our obligations and enforce our rights | No | No |
| Professional or employment information, such as your job title or employer | To present our Website and its contents to you, To deliver the information, products and services you requested from us, To reach out to you about and market or promote new information to you, To communicate with you, To help us improve our Website and deliver a more personalized experience, To deliver targeted advertising to you, To monitor the security of our offices, To verify or maintain the quality or safety of our services and to improve, upgrade or enhance our services, To carry out our obligations and enforce our rights | No | No |
| Inferences drawn from the information listed above to create a profile about a California resident reflecting their preferences, characteristics and other attributes | To present our Website and its contents to you, To deliver the information, products and services you requested from us, To reach out to you about and market or promote new information to you, To communicate with you, To help us improve our Website and deliver a more personalized experience, To deliver targeted advertising to you | Yes | No |
We do not collect sensitive personal information from you pursuant to this California Privacy Notice.
Third Party Processing
We may act as a third-party recipient of personal information about California-resident directors and officers of companies on which we or our affiliates are conducting pre-investment diligence. The categories of personal information we receive about such individuals may include: (i) identifiers and Categories in Cal. Civ Code 1798.80(e), such as name or email address; (ii) internet or other network activity, such as information regarding interaction with a social media website or app; (iii) geolocation data, such as physical or mailing address; (iv) professional or employment information, such as current and former job title and employer; and (v) inferences drawn from the above. We use each category of personal information to conduct pre-investment diligence on the company associated with the California-resident individual, or as otherwise permitted by law. In connection with conducting diligence, we do not “share” or “sell” this personal information, as such terms are defined in the CCPA.
We may act as a third-party recipient of personal information about California-resident individuals or representatives of companies with whom we believe we may be interested in doing business. The categories of personal information we receive about such individuals may include: (i) identifiers and Categories in Cal. Civ Code 1798.80(e), such as name, online identifier, or email address; (ii) geolocation data, such as physical or mailing address; (iii) internet or other network activity, such as information regarding interaction with a social media website or app; (iv) professional or employment information, such as current and former job title and employer; and (v) inferences drawn from the above. We use each category of personal information to contact such individuals about products and services we believe may be of interest to them, or as otherwise permitted or required by law. We do not “share” or “sell” this personal information, as such terms are defined in the CCPA.
We will retain your personal information for as long as necessary to fulfill the purposes for which it was collected and processed, including to satisfy any legal, regulatory, accounting, or reporting requirements. To determine the appropriate retention period for your personal information, we will consider the amount, nature, and sensitivity of the personal information, the potential risk from unauthorized use or disclosure, the purposes for which we process personal information, and whether we can achieve those purposes through other means, and applicable legal requirements.
Our Prior Collection, Use, and Disclosure of Personal Information During the Preceding 12 Months
The CCPA requires us to give you specific information about the categories of personal information we collect about you, the sources from which we have obtained that information, the purposes for which we collect it and the categories of entities to whom we disclose it. Our practices regarding the collection, use, and disclosure of personal information depend on your relationship with us and your interaction with us. The chart below explains our prior collection, use, and disclosure for the last 12 months.
| CATEGORY OF PERSONAL INFORMATION | CATEGORIES OF SOURCES FROM WHICH COLLECTED | BUSINESS OR COMMERCIAL PURPOSE FOR COLLECTING PI | CATEGORIES OF THIRD PARTIES AND OTHER ENTITIES TO WHOM WE MAY DISCLOSE |
|---|---|---|---|
| Identifiers and Categories in Cal. Civ. Code 1798.80(e), such as name, unique personal identifier, online identifier, IP address, email address, account name, phone number or signature | Directly from you, such as when you visit our Website, via written forms or our enrollment process From your employer Via social media platforms and other third party services Via email or other correspondence with you Via cookies and other tracking technologies | To present our Website and its contents to you To deliver the information, products and services you requested from us To reach out to you about and market or promote new information to you To communicate with you To help us improve our Website and deliver a more personalized experience, To deliver targeted advertising to you, To monitor the security of our offices | Our affiliates Entities that provide marketing services Our business partners, service providers and vendors Legal authorities as required by law or to protect our rights Advertising networks and analytics providers |
| Characteristics of Protected Classifications under California or Federal Law, such as gender | Directly from you, such as via written or online forms, or when you open an account with us From your employer, financial adviser, representative, or consultant Via email or other correspondence with you | To personalize communications that deliver the information, products and services you requested from us or provide information about products and services that we believe may be of interest to you, To carry out our obligations and enforce our rights | Our affiliates Our business partners, service providers and vendors Legal authorities as required by law or to protect our rights Affiliated and nonaffiliated third party as may be permitted by law (such as in connection with the Sale or restructuring of all or part of our business) |
| Commercial information, such as records of products or services purchased, obtained or considered, or other purchasing or consuming histories of tendencies | Directly from you, such as when you visit our website, via written forms, or open an account with us From your financial adviser, representative, or consultant Via social media platforms and other third party services Via email or other correspondence with you Via cookies and other tracking technologies | To present our Website and its contents to you To deliver the information, products and services you requested from us To reach out to you about and market or promote new information to you To communicate with you To help us improve our Website and deliver a more personalized experience, To deliver targeted advertising to you To monitor the security of our offices | Our affiliates Entities that provide marketing services Our business partners, service providers and vendors Legal authorities as required by law or to protect our rights Advertising networks and analytics providers Social media platforms Affiliated and nonaffiliated third party as may be permitted by law (such as in connection with the Sale or restructuring of all or part of our business) |
| Internet or other electronic network activity information, such as browsing history, search history or information regarding interaction with a website, app or advertisement | Directly from you, such as when you visit our Website or open an account with us Via social media platforms and other third party services Via email or other correspondence with you Via cookies and other tracking technologies | To present our Website and its contents to you To deliver the information, products and services you requested from us To reach out to you about and market or promote new information to you To communicate with you To help us improve our Website and deliver a more personalized experience, To deliver targeted advertising to you To monitor the security of our offices | Our affiliates Entities that provide marketing services Our business partners, service providers and vendors Legal authorities as required by law or to protect our rights Advertising networks and analytics providers Social media platforms Affiliated and nonaffiliated third party as may be permitted by law (such as in connection with the Sale or restructuring of all or part of our business) |
| Geolocation data, such as the state or country associated with your IP address | Directly from you, such as when you visit our website, via written forms, or when you open an account with us From your employer or its payroll provider Via social media platforms and other third party services Via email or other correspondence with you Via cookies and other tracking technologies | To present our Website and its contents to you To deliver the information, products and services you requested from us To reach out to you about and market or promote new information to you To communicate with you To help us improve our Website and deliver a more personalized experience, To deliver targeted advertising to you | Our affiliates Entities that provide marketing services Our business partners, service providers and vendors Legal authorities as required by law or to protect our rights Advertising networks and analytics providers Social media platforms Affiliated and nonaffiliated third party as may be permitted by law (such as in connection with the Sale or restructuring of all or part of our business) |
| Professional or employment information, such as your job title or employer | Directly from you, such as via written forms, or vendor management portals From your brokerage or financial advisory firm, financial adviser or consultant Via social media platforms and other third party services Via email or other correspondence with you | To present our Website and its contents to you To deliver the information, products and services you requested from us To reach out to you about and market or promote new information to you To communicate with you To help us improve our Website and deliver a more personalized experience, To deliver targeted advertising to you To monitor the security of our offices | Our affiliates Entities that provide marketing services Our business partners, service providers and vendors Legal authorities as required by law or to protect our rights Advertising networks and analytics providers Social media platforms Affiliated and nonaffiliated third party as may be permitted by law (such as in connection with the Sale or restructuring of all or part of our business) |
| Inferences drawn from the information listed above to create a profile about a California resident reflecting their preferences, characteristics and other attributes | Directly from you, such as when you visit our website, via written forms, or vendor management portals From your brokerage or financial advisory firm, financial adviser or consultant Via social media platforms and other third party services Via email or other correspondence with you Via cookies and other tracking technologies | To present our Website and its contents to you To deliver the information, products and services you requested from us To reach out to you about and market or promote new information to you To communicate with you To help us improve our Website and deliver a more personalized experience, To deliver targeted advertising to you | Our affiliates Entities that provide marketing services Our business partners, service providers and vendors Legal authorities as required by law or to protect our rights Advertising networks and analytics providers Social media platforms Affiliated and nonaffiliated third party as may be permitted by law (such as in connection with the Sale or restructuring of all or part of our business) |
We do not collect sensitive personal information from you pursuant to this California Privacy Notice.
How We Disclose Personal Information
In the past twelve months, we have disclosed the following categories of personal information for business purposes as set out above:
● Identifiers ● Categories of personal information described in Cal. Civ. Code Section 1798.80(e) ● Characteristics of Protected Classifications under California or Federal Law ● Commercial Information ● Internet or other electronic network activity information ● Geolocation data ● Professional or employment information ● Inferences drawn from other personal information
Sales of personal information
We do not sell your personal information for purposes of the CCPA and have not done so in the past twelve months.
In the past 12 months, we have shared the following categories of personal information with third-party companies for purposes of cross-context behavioral advertising:
● Identifiers ● Categories of personal information described in Cal. Civ. Code Section 1798.80(e) ● Commercial Information ● Internet or other electronic network activity information ● Geolocation data ● Inferences drawn from other personal information
Your Rights as a California Resident
As a California resident, you may have certain rights in relation to your personal information.
Right to Know
You may have the right to know how we have collected, used, and disclosed your personal information. Specifically, you may have the right to know:
● The categories of personal information we have collected about you. ● The categories of sources from which we have collected your personal information. ● The business or commercial purpose for which we collect, sell or share your personal information. ● The categories of third parties to whom we have disclosed your personal information. ● The categories of personal information that we have sold or shared about you and the categories of third parties to whom it was sold or shared. ● The categories of personal information we have disclosed about you for a business purpose and the categories of persons to whom we have disclosed it.
In addition, you may have the right to know the specific pieces of personal information we have collected about you. Subject to certain limitations, you may request that we provide this information dating back to January 1, 2023.
Right to Make a Deletion Request
You may have the right to request that we delete your personal information that we have collected or received. Subject to certain exceptions, we must delete your personal information and direct our service providers and contractors to delete your personal information.
Right to Correct Inaccurate Personal Information
You may have the right to request that we correct inaccurate personal information about you, taking into account the nature of the personal information and the purposes of the processing of the personal information.
Right to Opt-Out of Sales of Personal Information
If we were to sell your personal information for purposes of the CCPA, you may have the right to opt-out of the sale of your personal information.
Right to Opt-Out of Sharing of Personal Information
You may have the right to opt-out of us sharing your personal information for cross-context behavioral advertising purposes.
Right to Limit Use and Disclosure of Sensitive Personal Information
Subject to certain exceptions, you may have the right to limit our use and disclosure of your sensitive personal information. We do not collect sensitive personal information from you pursuant to this California Privacy Notice.
Right to Non-Discrimination
You have the right not to be discriminated against by us for choosing to exercise your rights under the CCPA.
How to Exercise Your California Privacy Rights
If you wish to exercise your right to know, delete, or correct inaccuracies in your personal information, please submit a request to us by emailing us at Legal@vestwell.com, call us at (917) 979-5258. If you maintain an account with us, we may require you to submit a request through that account. To opt-out of the sharing of your personal information for cross-context behavioral advertising purposes, please email Legal@vestwell.com.
“Do Not Track” Signals and Global Privacy Control (“GPC”) Signals
We rely on a third-party service provider to implement a tool in an effort to recognize and honor “do not track” and Global Privacy Control signals as requests to opt-out of “sharing” of personal information for cross-context behavioral advertising purposes.
Information for Authorized Agents
You can authorize a person (“Authorized Agent”) registered with the California Secretary of State to exercise your California privacy rights on your behalf. An Authorized Agent can also include a person who has power of attorney or is acting as a conservator. To submit a request to Vestwell on behalf of another person as an Authorized Agent, please submit a request to us by emailing us at Legal@vestwell.com calling us at (917) 979-5358.
Verifying Your Requests
We only respond to your requests to know, access the specific pieces of personal information we have about you, delete and correct inaccurate personal information when we can verify that you are a California resident exercising your rights regarding your personal information. We may need to ask you for personal information to verify your request so we can match it to the personal information we already have about you. We may also need to obtain additional information about you that we do not already have.
Responding To Your Requests
We aim to promptly verify and respond to your requests within 45 days of receipt but may require a total of up to 90 days to respond to your requests. If we require additional time beyond the initial 45 days after we receive your request, we will let you know within the first 45 days. We do not ordinarily charge a fee for our response to your requests. However, we may do so to the extent your request(s) are excessive, repetitive, or manifestly unfounded.