​

4. Disclosure and transfer of your information 

We may disclose personal information about you, in accordance with the various legitimate purposes set out above: 

 

• if we receive the personal information from you as a representative of one of our business partners or clients, to your colleagues within the organization that you represent. 

• to third-party service providers who host our website or other information technology systems or otherwise hold or process your personal information on our behalf, under substantially similar confidentiality and data protection conditions. 

• in accordance with our legal obligations, including to competent regulatory, prosecuting and other governmental agencies, or litigation counterparties, in any country or territory or where we are otherwise required by law to disclose. 

• with third-parties as required by law or subpoena or if we reasonably believe that such action is necessary to (a) comply with the our legal obligations under the laws in the jurisdictions in which we operate; (b) to comply with the lawful or reasonable requests of law enforcement, government authorities, courts or to respond to legal process; (c) to enforce our applicable terms/contracts or to protect the security or integrity of our products and services; and/or (d) to exercise or protect the rights, property, or personal safety or health of us, our clients, or any other third-party. 

• with your consent or at your direction, we may share your information with third parties to whom you direct us to share information 

 

We may also share information with others in an aggregated or otherwise de-identified form that does not reasonably identify you. 

 

5. How we keep your personal information safe? 
We are committed to protecting your personal information submitted to us. We maintain an information security program including internal policies addressing the acceptable use and access to confidential business information and personal information, which may be contained within ACA’s information systems. We maintain physical, electronic and procedural safeguards reasonably designed to guard personal information from loss, misuse or unauthorized access, disclosure, alteration or destruction of the information that has been provided to us through our online services. 

 

6. How long do we keep your personal information? 

We will retain your personal information in accordance with our Personal Data Retention Policy, which may provide for us to retain your personal information for a period of at least 7 years or longer as required by applicable law or our internal policies. 

 

Subject to applicable law or our internal policies, we will delete the personal information that we hold about you when we no longer need it to achieve the purpose of the processing. 

 

Note that we may retain some limited information about you even when we know that you have left the organization that you represent, so that we can maintain a continuous relationship with you if and when we are in contact with you again, representing a different organization. 

 

7. Your rights as a resident of certain U.S.-States 

Depending on your country, region, or state of residence, certain rights may apply to you. If you are a resident of the State of California, Colorado, Connecticut, Nevada, Utah or Virginia in the United States, please click here (link to Additional U.S. State Privacy Disclosures) or refer to the section titled “Additional U.S. State Privacy Disclosures” below for additional U.S. state-specific privacy disclosures. 

 

8. Contact us 

We welcome questions, comments and requests regarding this privacy statement and our processing of personal information. Please send them, along with any requests for the disclosures or deletion described under this privacy statement, via any of the contact methods here. 

 

We will respond to your request consistent with applicable data protection laws. Depending upon the type of business relationship that you have with us, we may need to notify you that additional information is necessary to authenticate your identity for your data security or that we will refer your inquiry to the financial services entity that holds the primary relationship with you. 

 

For requests to delete your personal information as permitted under applicable data protection laws, we will work with you to accomplish your requests unless otherwise exempted under applicable data protection laws, such as compliance with applicable law or regulatory inquiry. 

 

9. Changes to this privacy statement 

Any changes we make to this privacy statement in the future will be posted to our website and also available if you contact us. Please check back frequently to see any changes. 

  

 

Additional U.S. State Privacy Disclosures 

These Additional U.S. State Privacy Disclosures to include the California-Specific Disclosures and Nevada-Specific Disclosures (the “Disclosures”) supplement the information contained in our privacy statement by providing additional information about our personal information processing practices relating to individual residents of the States of California, Colorado, Connecticut, Utah, Virginia, and other states as set forth below. For a detailed description of how we collect, use, disclose, and otherwise process personal information in connection with our services, please visit our privacy statement. Unless otherwise expressly stated, all terms defined in our privacy statement retain the same meaning in these Disclosures. 

 

1. Note on ACA Client Data 
Applicable privacy and data protection laws sometimes differentiate between “controllers” and “processors” of personal information. A “controller” determines the purposes and means (or the why and the how) of processing personal information. A “processor,” which is sometimes referred to as a “service provider,” processes personal information on behalf of a controller subject to contractual restrictions. 
 
As part of our business relationship with our clients, we are often asked to receive, gather, store, analyze, or otherwise process information, which may include personal information, on behalf of our clients. We refer to this type of information and personal information as “client data.” When we process client data, we generally act as a processor or service provider, unless otherwise noted in applicable contract/terms for the product or service. This means we typically process client data on behalf of our clients subject to restrictions set forth in our contracts with them. 
 
Where ACA collects personal information on behalf of our clients as a processor, our clients are primarily responsible for how we use and disclose the personal information we collect in our role as a processor. In addition, we are generally not permitted to respond to individual requests relating to client data. As a result, we recommend referring to the privacy statement of the business with which you have a relationship for information on how they engage processors, like us, to process client data on their behalf. If we process your personal information on behalf of one of our clients, and you have questions about how we process your personal information, we may direct any inquiries about our use of your personal information to that client. 

 

2. Personal Information Disclosures 
Personal Information Collection  

We collect various categories of personal information in connection with our services. Please review the What information do we collect from you? section of the privacy statement to learn more about the personal information we collect and the sources from which we collect or receive personal information. Please review the How will we use your information? section of the privacy statement to learn more about the purposes for which we collect and use personal information. 

 

Sensitive Information 
The following personal information elements we collect may be classified as “sensitive” under certain U.S. state privacy laws (“sensitive information”): 

 

• Government identification numbers; and 

• Citizenship or immigration status. 

 

As described in our privacy statement, we use account name and password, as well as payment card information to provide certain of our products and services. 

 

We do not sell sensitive information, and we do not process or otherwise share sensitive information for the purpose of advertising. Depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to limit, or withdraw your consent for, our processing of sensitive information (as described in the Your Privacy Rights section below). 

 

Deidentified Information 

We may at times receive, or process personal information to create, deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual or household. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by law. 

 

3. Your Privacy Rights 
Depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to exercise some or all of the following rights: 

The Right to Know 

The right to confirm whether we are processing personal information about you and, under California law only, to obtain certain personalized details about the personal information we have collected about you, including: 

 

• The categories of personal information collected; 

• The categories of sources of the personal information; 

• The purposes for which the personal information were collected; 

• The categories of personal information disclosed to third parties (if any), and the categories of recipients to whom the personal information were disclosed; 

• The categories of personal information shared for cross-context behavioral advertising purposes (if any), and the categories of recipients to whom the personal information were disclosed for those purposes; and 

• The categories of personal information sold (if any), and the categories of third parties to whom the personal information were sold. 

The Right to Access and Portability 

The right to obtain access to the personal information we have collected about you and, where required by law, the right to obtain a copy of the personal information in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance. 

The Right to Correction 

The right to correct inaccuracies in your personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information. 

The Right to Deletion 

The right to have us delete the personal information we maintain about you. 

The Right to Opt-Out of Sales or Sharing of Personal information 

The right to direct us not to “sell” your personal information to third parties for monetary or other valuable consideration, or “share” your personal information to third parties for cross-context behavioral advertising purposes and targeted advertising purposes. 

“Shine the Light” 

California residents that have an established business relationship with us have the right to know how their personal information is disclosed to third parties for their direct marketing purposes under California’s “Shine the Light” law, or the right to opt out of such practices (Civ. Code §1798.83). 

 
Depending on your state of residency, you may also have the right to not receive retaliatory or discriminatory treatment in connection with a request to exercise the above rights. However, the exercise of the rights described above may result in a different price, rate or quality level of product or service where that difference is reasonably related to the impact the right has on our relationship or is otherwise permitted by law. 

4. How to Exercise Your Privacy Rights 
To Exercise Your Privacy Rights  

To submit a request to exercise one of the privacy rights identified above, please contact us via any of the methods here. 

 

Before processing your request, we may need to verify your identity and confirm you are a resident of a state that offers the requested right(s). In order to verify your identity, we will generally either require the successful authentication of your relationship with us, or the matching of sufficient information you provide us to the information we maintain about you in our systems. As a result, we require requests to include required personal information elements such as the name of the requesting individual, the name and residency of the data subject, or again the scope of personal data involved (e.g., all or a subset of the information). We may at times need to request additional personal information from you, taking into consideration our relationship with you and the sensitivity of your request. 
 
In certain circumstances, we may decline a privacy rights request, particularly where you are not a resident of one of the eligible states or where we are unable to verify your identity. 

 

To Exercise Your Right to Opt-Out of Personal information Sales or Sharing  

ACA does not disclose or “sell” your personal information to third parties for monetary or other valuable consideration the third parties to whom we sell or share personal information may use such information for their own purposes in accordance with their own privacy policies. 

 
You do not need to create an account with us to exercise your Right to Opt-Out. However, we may ask you to provide additional personal information so that we can properly identify you in our dataset and to track compliance with your opt out request. We will only use personal information provided in an opt-out request to review and comply with the request. If you choose not to provide this information, we may only be able to process your request to the extent we are able to identify you in our data systems. 
 
To exercise the Right to Opt-Out, you may submit a request by contacting us here. 

 

To exercise your right to opt-out as it relates to the use of cookies and other tracking technologies for analytics (Cookies-based Opt-Out – Do Not Sell or Share My Personal Information), please adjust the settings in your internet browser. You must reset your preferences if you clear cookies or use a different browser or device. 

 

5. Submitting Authorized Agent Requests 
In certain circumstances, you are permitted to use an authorized agent to submit requests on your behalf through the designated methods set forth above where we can verify the authorized agent’s authority to act on your behalf. In order to verify the authorized agent’s authority, we generally require evidence of either (i) a valid power of attorney or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a statement of authorization for the request. Depending on the evidence provided and your state of residency, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to verify your identity in connection with the request. 

 

6. Appealing Privacy Rights Decisions 
Depending on your state of residency, you may be able to appeal a decision we have made in connection with your privacy rights request. All appeal requests should be submitted by contacting us here. 

 

7. “Shine the Light” Disclosures 
The California “Shine the Light” law gives residents of California the right under certain circumstances to request information from us regarding the manner in which we share certain categories of personal information (as defined in the Shine the Light law) with third parties for their direct marketing purposes. ACA does not share personal information to third parties for direct marketing purposes. 

 

8. Minors 
We do not sell the personal information of consumers we know to be less than 16 years of age. If you are under the age of 18 and you want to remove your name or comments from our website or publicly displayed content, please contact us directly here. We may not be able to modify or delete your information in all circumstances. 

 

9. California-Specific Disclosures 
The following disclosures only apply to residents of the State of California. 
 
Personal information Collection  

In the last 12 months, we may have collected the following categories of personal information: 

• Identifiers, such as name, social security number, date of birth, phone number, address and other contact information, and online identifiers. 

• Personal information, as defined in the California customer records law. 

• Internet or network activity information, such as interactions with our website or websites we create for our clients. 

• Professional or employment-related information, such as company name, business email address, business address and business phone number. 

• Inferences drawn from any of the personal information listed above to create a profile or summary about, for example, an individual’s preferences and characteristics. 

 

Disclosure of Personal Information  

As described in the Disclosure and transfer of your information section of our privacy statement (link to top of privacy policy), we disclose personal information with a variety of third parties for business purposes or we may share your personal information to third parties, subject to your right to opt out of those sharing (see Your Privacy Rights above). 

 

In the previous 12 months, we have disclosed or shared certain of the categories of personal information we collect, explained above, to third parties. 

 

Data Retention  

We will usually store the personal information we collect about you for no longer than necessary to fulfil the purposes for which it was collected, and in accordance with our legitimate business interests and applicable law. However, if necessary, we may retain personal information for longer periods of time, until set retention periods and deadlines expire, for instance where we are required to do so in accordance with legal, tax and accounting requirements set by a legislature, regulator or other government authority. To determine the appropriate duration of the retention of personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of personal information and if we can attain our objectives by other means, as well as our legal, regulatory, tax, accounting and other applicable obligations.  
 
Once retention of the personal information is no longer necessary for the purposes outlined above, we will either delete or deidentify the personal information or, if this is not possible (for example, because personal information has been stored in backup archives), then we will securely store the personal information and isolate it from further processing until deletion or deidentification is possible. 

 

10. Nevada-Specific Disclosures 
If you are a resident of the State of Nevada in the United States, Chapter 603A of the Nevada Revised Statutes permits a Nevada resident to opt out of future sales of certain covered information that a website operator has collected or will collect about the resident. We do not sell your covered information, as defined by Chapter 603A of the Nevada Revised Statutes. If you reside in Nevada, you have the right to submit a request via any of the contact methods here to opt out of the sale of covered information.