CCPA Privacy Notice
This PRIVACY NOTICE FOR CALIFORNIA RESIDENTS supplements the information contained in the Privacy Statement of HybridFi Inc. and its subsidiaries (collectively, “we,” “us,” or “our”) and applies solely to our visitors, users, and others who reside in the State of California (“consumers” or “you”). We adopt this notice to comply with the California Consumer Privacy Act of 2018 (“CCPA”). Any terms defined in the CCPA have the same meaning when used in this notice.
Under the CCPA, this CCPA Privacy Notice and the privacy practices and rights it describes do not apply to the information we collect, use or disclose about consumers when they initiate the process of applying for our financial products and services, or receive our financial products and services. This is because this information is subject to the federal Gramm-Leach-Bliley Act (“GLBA”), and implementing regulations, or the California Financial Information Privacy Act (“FIPA”). The GLBA and/or FIPA governs the information of consumers who initiated the process of applying for our financial products or services, or receive our financial products and services. This CCPA Privacy Notice and the privacy practices and rights it describes also do not apply to representatives of businesses that seek to obtain our products or services, or to provide products or services to us.
Information We Collect
We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (“personal information”). In particular, we have collected the following categories of personal information from consumers within the last twelve (12) months:
Please note that personal information excludes:
- Publicly available information from government records.
- De-identified or aggregated consumer information.
- Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (the "FCRA"), the Gramm-Leach-Bliley Act (the "GLBA") or California Financial Information Privacy Act (the "FIPA"), and the Driver's Privacy Protection Act of 1994.
We obtain the categories of personal information listed above from the following categories of sources:
- Directly from our clients. For example, from documents that our clients provide to us related to the services for which they engage us.
- From our clients’ agents. For example, through information we collect in the course of providing services to our clients.
- From activity on our website (www.pennyworks.com) and/or our mobile app. For example, from submissions through our website portal or website usage details collected automatically.
- From third parties that provide data to us.
Use of Personal Information
We may use or disclose the personal information we collect for one or more of the following business purposes:
- To provide the products or services you request.
- To provide you with topical and broad communications via SMS, email and push notifications, as part of your engagement with the PennyWorks platform (for instance, informing you of a new offering, or letting you know that you have received a distribution payment on an investment).
- To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collections.
- To improve our website and present its contents to you.
- For testing, research, analysis and product development.
- As necessary or appropriate to protect the rights, property or safety of us, our clients or others.
- To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
- As described to you when collecting your personal information or as otherwise set forth in the CCPA.
- To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.
Sharing Personal Information
We may disclose your personal information to a third party for a business purpose.
In the preceding twelve (12) months, we have disclosed the following categories of personal information for a business purpose:
Category A: Identifiers.
Category B: California Customer Records personal information categories.
Category C: Classification characteristics under California or federal law.
Category F: Internet or other similar network activity information.
We disclose your personal information for a business purpose to the following categories of third parties:
- Service providers. These include (but are not limited to) providers such as our banking and payment partners, our customer relationship management partners communication providers (email, SMS, etc.)
- Third parties to whom you or your agents direct us to disclose your personal information in connection with products or services we provide to you (e.g. your accountant or CPA to verify your accreditation status to us)
Your Rights and Choices
The CCPA provides consumers (that are California residents) whose information is subject to the CCPA with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.
Information and Access Requests
You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you:
- The categories of personal information we collected about you.
- The categories of sources for the personal information we collected about you.
- Our business or commercial purpose for collecting or selling that personal information.
- The categories of third parties with whom we share that personal information.
- The specific pieces of personal information we collected about you.
- If we disclosed your personal information for a business purpose, a separate list of the disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.
Changing Information Previously Submitted
Deletion Request Rights
You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete your personal information from our records, unless an exception applies.
We may deny your deletion request where required or permitted by applicable law.
Exercising Information Access and Deletion Rights
To exercise the access and deletion rights described above, please submit a verifiable consumer request to us by either:
- Submitting your request on this form
- Calling us at 848-420-8350
- Emailing us at firstname.lastname@example.org (with “Request to access or delete my data under CCPA” in the subject line)
Only you or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information.
You may only make a verifiable consumer request for access twice within a 12-month period. The verifiable consumer request must:
- Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
- Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify the requestor's identity or authority to make the request.
Response Timing and Format
We endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response via a secure link sent to the registered email address on the account. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable.
How We Respond To Do-Not-Track Signals From Your Browser.
We do not currently respond to “do not track” signals or other mechanisms that might enable users to opt out of tracking on our Site and/or App.
Online Tracking Opt-out
We use on our websites services provided by Google, Facebook and LinkedIn and other companies that use tracking technology. These services rely on tracking technologies – such as cookies and web beacons – to collect directly from your device information about your browsing activities, your interactions with websites, and the device you are using to connect to the Internet. There are a number of ways to opt out of having your online activity and device data collected through these services, which we have summarized below:
- Blocking cookies in your browser. Most browsers let you remove or reject cookies, including cookies used for interest-based advertising. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. For more information about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit https://www.allaboutcookies.org.
- Blocking advertising ID use in your mobile settings. Your mobile device settings may provide functionality to limit use of the advertising ID associated with your mobile device for interest-based advertising purposes.
- Using privacy plug-ins or browsers. You can block our websites from setting cookies used for interest-based ads by using a browser with privacy features, like Brave (https://www.brave.com), or installing browser plugins like Privacy Badger (https://www.privacybadger.org), Ghostery (www.ghostery.com) or uBlockOrigin (https://www.ublockorigin.com), and configuring them to block third party cookies/trackers.
- Platform opt-outs. Some of our advertising partners offer opt-out features that let you opt-out of use of your information for interest-based advertising. For example, you may opt out of interest-based advertising by some of our partners by visiting the following links:
• Google: https://www.adssettings.google.com
• Facebook: https://www.facebook/com/about/ads
• LinkedIn: https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out
- Advertising industry opt-out tools. You can also use these opt-out options to limit use of your information for interest-based advertising by participating companies:
• Digital advertising Alliance: http://optout.aboutads.info
• Network Advertising Initiative: https://optout.networkadvertising.org/?c=1
Note that because these opt-out mechanisms are specific to the device or browser on which they are exercised, you will need to opt-out on every browser and device that you use.]
We will not discriminate against you for exercising any of your CCPA rights.
Changes to Our Privacy Notice
We reserve the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will notify you by email or through a notice on our website homepage.
If you have any questions or comments about this notice, our Privacy Statement, the ways in which we collect and use your personal information, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:
Attn: [CCPA Privacy Matters]
221 River St.
9th Floor, Suite #9165
Hoboken, NJ 07030