The following notice describes how the Privily service processes your personal data (also called “personal information”). Please read the notice carefully. Our Terms of Use also govern your use of our Website.
Privily is designed to give individuals control over how their data is used and to easily make and receive responses to privacy questions and requests. Privily’s users include individuals who can use Privily to make and track privacy related requests about their personal data and participating businesses that can use Privily to receive and respond to privacy requests from individuals. References to “you” or “individuals” refer to individual consumers using Privily.
Privily is a service provided by IOR Analytics, a Texas LLC. References to “us” or “Privily” refer to IOR Analytics, LLC. We provide this Privily website and its accompanying Data Subject Rights portal service to our participating businesses, who use it to help manage your privacy questions and requests.
While we maintain agreements with participating businesses, we are independent of these businesses. Privily acts as a connector to facilitate data requests between individuals and participating businesses. If you use the Privily service to submit or track privacy requests with one or more participating businesses, Privily acts as a processor or service provider to those businesses, meaning we process your data on their behalf and the participating businesses’ privacy notice applies.
We collect information about individuals in two main ways, automatically and when individuals voluntarily share information.
Information we collect automatically
When you visit our website, some information is collected automatically. This includes online identifiers such as IP addresses and other network information considered Personal Information or Personal Data under most privacy laws. We use this information to make our website work and for security and fraud prevention. Where a lawful basis is required, we process this information based on our legitimate interests in running this website.
We hold this identifiable personal data only as long as a user request is active so that it can be tracked, as dictated by the needs of our participating businesses. For some requests types, we store a minimum amount of personal data indefinitely on behalf of our participating businesses only to document that a request was made. Our participating businesses use this for compliance purposes, for example so that they do not email you again if you have opted out of marketing emails.
Information individuals provide
If you choose to submit a request to a participating business using our service we may collect additional information from you, We use this information to help identify you with a participating business. For example, we may collect information about your purchases with a participating business, your phone number or email address you used with the participating business, account name with the participating company, or other similar information.
Information we collect from other sources
We collect some personal data from participating businesses, typically to verify your identity. For example, we may receive information about your purchases or account with a company to compare to the information you provide to verify your identity.
We do not collect any information from other sources.
On our own behalf
As noted above, we use your information for two main purposes:
- To make our website work: Our site, like all websites, requires some basic information to function. This includes online identifiers such as IP addresses or similar technical information, which is considered personal data under many laws.
- For security and fraud prevention: We use information you provide and information we collect automatically to monitor our website for security and fraud prevention.
On behalf of participating businesses
Participating businesses use Privily to submit, track, and verify your requests: If you make a request using Privily, we help the participating company use information you provide and information we collect automatically to submit, track, and support response to your request. We provide this service as a processor to the participating business, which is the controller. We act as a processor or service provider to the participating business.
We’d like to emphasize a few of the things we do not do with personal data
- We do not use personal data for marketing: We do not use personal data collected from the Privily site or information you provide for marketing purposes. You will never receive marketing emails or web ads based on your use of Privily.
- We do not sell information: We do not sell personal data, including sales of personal information as defined in the CCPA.
- We do not share information for cross-contextual advertising: Just as we do not sell personal data, we do not share it or otherwise use it for any advertising, including cross-contextual advertising.
We share information only to support our core business activity which is helping our users submit privacy requests and for our participating businesses to receive, verify, respond to, and track privacy requests. We share personal data in the following ways:
- With our service providers: We share personal data with our service providers (sometimes also called “processors”). These service providers are necessary for us to run our website and provide our services. For example, we share information to our hosting provider. Service providers are always obligated to use information only as we instruct them.
- With participating businesses: We share personal data to participating businesses only if an individual asks us to make a request. For example, if you ask us to submit a request to a participating company, we will share that individual’s information to the business.
- For “lawful requests”: A lawful request is when a law enforcement agency, court, regulator, litigant, or other party makes a request for certain information. While we have never received a “lawful request” for personal data, we would honor it if requested. If we ever receive such a request, we will verify its authenticity upon receipt. If we are permitted to do so, we will inform any potentially impacted individuals and allow them a chance to participate. In some very rare instances a law enforcement or other government agency may make a request and prohibit a recipient from notifying the potentially impacted individuals. In such a case, we could be obligated to comply without notifying potentially impacted individuals.
- In certain corporate transactions: We may share personal data upon a transfer or sale to another entity of all or substantially all of our assets or stock in our line of business to which this privacy notice relates or upon any other corporate reorganization. For example, if we sell our business to another company we will need to provide it with personal data necessary to continue to provide services.
We retain personal data only as long as needed to provide services.
- We retain personal data on behalf of our participating businesses during the time a request is pending or in process so we can track the request. Once a request is closed, we delete personal data within 60 days.
- If a participating individual disputes a request, the request could take longer. In this case, we will still delete all personal data 60 days after the dispute is resolved and closed, although this could take longer.
- When necessary, we may store personal data longer to help participating businesses verify continued compliance. For example, if you ask a company to delete your information or opt out of marketing emails, we may hold a minimal amount of personal data longer to make sure the participating company does not email you again.
- When needed for an incident or investigation: In rare circumstances, we may retain information longer to support an investigation into an incident or suspected inappropriate activity.
We are located in the United States and serve participating businesses in the United States. Currently, we store data primarily in the United States. We take steps designed to ensure that the data we collect under this statement is processed according to the provisions of this statement and applicable law wherever the data is located.
Transfers to the United States
If you use the Privily service, you consent to the transfer of your personal data to the United States. If you make a request to a participating company using our service from outside the United States, including from the European Economic Area or Switzerland, you consent to the transfer of your personal data to the location of the participating business, which could be anywhere in the world, including the United States. If you provide personal data to us to make a request to a participating business, you consent to the transfer of your information and the processing of your information in this way. Any international transfers made will be in accordance with this notice and the applicable law. We also impose appropriate contractual safeguards on third parties and other parties that might access the information, such as our service providers.
We do not conduct automated decision making on our own behalf. Some participating businesses may employ automated decision making for some purposes, including in responding to data subject requests. Where relevant, automated decision making used by participating businesses is disclosed in a business’s own privacy notice.
The Privily service processes information primarily as a processor or service provider on behalf of our participating businesses. For example, if you make a request related to your information held by a participating business, we may hold some information on behalf of the participating company to help them handle your request. You may make privacy requests to the business through Privily, but the participating company’s policies and privacy notice will apply.
We handle a small amount of personal data for our own purposes, such as making the website work. You can make a request to us using the Privily system.
Your rights - European and global users
If you are a resident of the European Union or European Economic Area as well as some other territories, you may have specific rights related to your personal data (also called “personal information”). Specifically, you may have the right to:
- Access your personal data
- Correct your personal data
- Erase your personal data
- Obtain your personal data in a portable format
- Object to processing of your personal data for some purposes.
- Object to automated decision making - (We do not employ automated decision making)
While Privily manages privacy requests on behalf of participating businesses, our own use of your personal data is very limited. Your rights may also be limited by our own legitimate interests in using your personal data for specific, lawful purposes.
Your rights - California users
If you are a resident of California, you may have additional privacy rights. These include:
- Right to Know: You have the right to request that we disclose the categories of personal data we collected about you individually, the categories of sources from which the information was collected, the business or commercial purposes for which we collected or sold that information, and the categories of third parties to whom the information was sold or disclosed for a business purpose in the last 12 months.
- Right to Access: You have the right to request access to the personal data specific to you individually, that we collected about you in the last 12 months.
- Right to Delete: You have the right to request us to delete personal data that we have collected, or maintain about you. Please note that certain exceptions apply to this right, such as when we must retain your information to comply with law. We will notify you of any such exceptions as applicable to your request.
- Right to Opt-Out of Sale: You have the right to opt out or ask us not to sell your personal data. However, we do not sell personal data regardless of your opt oout status.
While Privily manages privacy requests on behalf of participating businesses, our own use of your personal data is very limited. Your rights may also be limited by our own legitimate interests in using your personal data for specific “business purposes” under California law.
Privily does not sell personal data, share personal data for cross-contextual advertising, or otherwise use personal data for marketing.
The following table illustrates how we use personal information as a controller for our own purposes:
Internet or other electronic network activity information
We employ security safeguards designed to protect your information from unauthorized access or use. However, like all websites, we cannot guarantee that the Privily service is completely secure. We employ robust technical and administrative controls to protect your data. As data security is an evolving field, we also continually monitor developments to continue to employ controls that are state of the art relative to the cost of implementation and the nature, scope, context and purposes of our data uses.
If you have a request related to your personal information, questions, complaints or suggestions you may submit a request to us through our system.
This privacy notice was last updated 23 October, 2024 and may be updated from time to time. We encourage you to check this page periodically to verify the current privacy notice in effect. Your continued use of Privily after an update to this notice indicates your acceptance of the terms of any new privacy notice.
Contact us today to learn more about how we can meet your data mapping challenges.
