California Privacy Notice  

INTO North America, Inc. (“INTO,” “we,” “us,” “our”) is a global organisation that complies with various data protection regimes around the world, including the California Consumer Privacy Act (CCPA), and we are providing this CCPA-specific privacy notice (“California Notice”) to supplement the information and disclosures in our Privacy Notice, which are applicable to all our customers.

This California Notice applies solely to individuals residing in California from whom we collect personal information.

We reserve the right to update this California Notice at any time by changing it as it applies to your use of our services. We will use reasonable efforts to notify you in the event material changes are made to our processing activities and/or this California Notice, such as by posting a notice on the services or sending you an email.

Your continued use of the services following our posting of any revised California Notice will constitute your acknowledgement of the amended California Notice.

Please click on one of the links below to find out more information.

• Notice of Collection and Use of Personal Information

• Categories of Personal Information

• Use of Personal Information

• Sources of Personal Information

• Sharing of Personal Information

• Your California Privacy Rights

• Contact Information and Assistance

I. Notice of Collection and Use of Personal Information

We collect information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“personal information”). In addition, we may collect data that is not identifiable to you or otherwise associated with you, such as aggregated data, and is not personal information. To the extent this data is stored or associated with personal information, it will be treated as personal information; otherwise, the data is not subject to this notice.

II. Categories of Personal Information

The chart below outlines the categories of personal information that we have collected and/or disclosed for our business operations in the last twelve (12) months. The examples of personal information provided for each category are taken from the CCPA; they are included to help you understand what the categories mean and are not meant to indicate what we do collect or disclose, and more information about our specific practices can be found in our Privacy Notice.

We will not collect additional categories of personal information other than those categories listed above. If we intend to collect additional categories of personal information, we will provide you with a new notice at or before the time of collection.

III. Use of Personal Information

INTO collects and processes your personal information for the following business and commercial purposes:

• to register your interest when you submit an enquiry to us in order that we can respond to you as necessary for the performance of a contract with you or to take steps at your request before entering into a contract and/or where such processing is necessary for the purposes of our legitimate interests;

• to provide you with information regarding our partnership services and opportunities to perform a contract with you and/or or where such processing is necessary for the purposes of our legitimate interests;

• to accept and process payments for services as necessary for the performance of a contract with you;

• to collect and process any payments you may owe to us in accordance with the relevant terms and conditions for the services that you have selected as necessary for the performance of a contract with you and where such processing is necessary for the purposes of our legitimate interests;

• to deliver our services to you and to provide you with information about them, including letting you know about any new offers and services which may be of interest to you, and to enable us to personalize our communications to you where such processing is necessary for the purposes of our legitimate interests;

• to enable us to conduct analysis, historical research, budget forecasting and management planning where such processing is necessary for the purposes of our legitimate interests in the smooth running of our business;

• to monitor emails to enable us to comply with payment card data security standards;

• to enable you to participate in any surveys or any other promotions we may be running where such processing is necessary for the purposes of our legitimate interests;

• to administer and protect our business and our websites where such processing is necessary for the purposes of our legitimate interests;

• to deliver relevant website content to you where such processing is necessary for the purposes of our legitimate interests;

• to understand the way companies use the Developer Hub so that we can improve this and develop new products and reference materials; and

• to deal with any requests from you regarding your rights under this notice to enable us to comply with a legal obligation.

We will not use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you with notice.

IV. Sources of Personal Information

In the preceding twelve months since this notice was last updated, we collected personal information from general sources including you, your use of our services, your devices, our partners and affiliates, our vendors, and our service providers.

V. Sharing of Personal Information

Your personal information may be disclosed to reliable third parties that provide us with administrative or technical support which include auditing, security, debugging, customer service, account maintenance, marketing, processing transactions, online payment providers, and internal research. We may also share your personal data with government authorities or law enforcement bodies if required by law, with external advisors, or with other personnel who are subject to a confidentiality obligation.

Within the last twelve (12) months, we have shared the following categories of personal information for a business purpose with the following categories of third parties:

Identifiers:

• Public and Private Universities

• INTO Group companies and affiliates

• Operating Systems

• Platforms

• Social Networks

• Recruitment Organizations

Categories of Personal Information in Cal. Civ. Code 1798.80(e):

• Public and Private Universities

• INTO Group companies and affiliates

• Operating Systems

• Platforms

• Social Networks

• Recruitment Organizations

Characteristics of Protected Classifications Under California or Federal Law:

• Public and Private Universities

• INTO Group companies and affiliates

• Operating Systems

• Platforms

• Social Networks

• Recruitment Organizations

Commercial Information:

• Platforms

• Recruitment Organizations

Internet or Other Electronic Network Activity Information:

• Operating Systems

• Platforms

• Social Networks

• Recruitment Organizations

Geolocation Information:

• Operating Systems

• Platforms

• Social Networks

• Recruitment Organizations

Audio and Visual Information:

• Platforms

Professional or Employment-related Information:

• Public and Private Universities

• Operating Systems

• Platforms

• Recruitment Organizations

Education Information:

• Public and Private Universities

• Operating Systems

• Platforms

• Recruitment Organizations

Inferences Drawn from Personal Information:

• Public + Private Universities

• Operating Systems

• Platforms

• Recruitment Organizations

VI. Your California Privacy Rights:

California’s “Shine the Light” law, permits our users who are California residents to request and obtain from us a list of what personal information (if any) we disclosed to third parties for their own direct marketing purposes in the previous calendar year and the names and addresses of those third parties. Requests may be made only once per year per person, must be sent to privacy@intoglobal.com, and are free of charge. However, we do not disclose personal information protected under the “Shine the Light” law to third parties for their own direct marketing purposes.

The CCPA provides California residents with the following rights:

Right to Know. You have the right to request that we disclose certain information to you about the personal information we collected, used, disclosed, and sold about you in the past 12 months. This includes a request to know any or all of the following: (1) categories of personal information collected or disclosed by us; (2) purposes for which categories of personal information are collected by us; (3) categories of sources from which we collect personal information; and (4) specific pieces of personal information we have collected about you.

Data Portability. You have the right to request a copy of personal information we have collected and maintained about you in the past 12 months.

Right to Delete. Subject to certain exceptions, you have the option to have your personal information deleted that we have collected from you. Please note that if you request deletion of your personal information, we may deny your request or may retain certain elements of your personal information if it is necessary for us or our service providers to:

• Complete the transaction for which the personal information was collected, provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between our business and you.

• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity.

• Debug to identify and repair errors that impair existing intended functionality.

• Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law.

• Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.

• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the deletion of the information is likely to render impossible or seriously impair the achievement of such research, if you have provided informed consent.

• To enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us.

• Comply with a legal obligation.

• Otherwise use the personal information, internally, in a lawful manner that is compatible with the context in which you provided the information.

Right to Opt-Out/In. You have the right to opt-out of the sale of your personal information. You also have the right to opt-in to the sale of personal information. However, we do not sell your personal information.

Right to Non-Discrimination. You have the right not to receive discriminatory treatment for the exercise of your CCPA privacy rights. Unless permitted by the CCPA, we will not:

• Deny you goods or services.

• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.

• Provide you a different level or quality of goods or services.

• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Submitting a Verified Consumer Request

To exercise your Right to Know, Data Portability, and Right to Delete, you must provide us with sufficient information to allow us to verify your identity, and describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. Once we receive the information you provide to us, we will review it and determine if more information is necessary to verify your identity as required by law, and we may request additional information in order to do so.

To exercise your California privacy rights described above, please submit a verifiable request to us by:

• completing our Online Rights' Request form

• emailing us at privacy@intoglobal.com

If you don’t have a profile or if you are unable to access, control, or delete your information from within your profile, you can contact us through any of the above methods.

Only you, or a person authorized by you to act on your behalf, may make a verifiable consumer request related to your personal information.

You may only make a verifiable consumer request for Right to Know or Data Portability twice within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative. We will need to verify your identity with at least 3 pieces of information, such as your full name, date of birth, address, application/student ID, email address, and/or phone number.

• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We may deny your request if we are unable to verify your identity or have reason to believe that the request is fraudulent.

Consumer Request by an Authorized Agent

If an authorized agent submits a consumer request on your behalf, the agent must either complete our Online Rights' Request form or send an email to privacy@intoglobal.com with proof that you gave the agent appropriate permission, as required under applicable law to submit the request on your behalf.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify the request’s identity or authority to make the request.

We will acknowledge receipt of the request within ten (10) business days of its receipt. We will respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. We will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period preceding the receipt of the verifiable consumer request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For Data Portability requests, we will provide the responsive information in a portable and, to the extent technically feasible, in a readily useable but secure format that allows you to transmit the information to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Do Not Track

We use analytics systems and providers and participate in ad networks that process Personal Information about your online activities over time and across third-party websites or online services, and these systems and providers may provide some of this information to us. We do not currently process or comply with any web browser’s “do not track” signal or similar mechanisms. Note, however, that you may find information about how to opt out of Google Analytics, DoubleClick online advertising, and/or block or reject certain technologies in our Cookie Policy.

VII. Contact Information and Assistance

If you have any questions, comments, or concerns about our processing activities, or you would like to exercise your privacy rights, please email us at privacy@intoglobal.com or complete our Online Rights' Request form

For more information about how users with disabilities can access this California Notice in an alternative format, please email us at privacy@intoglobal.com