Supplemental Notice for California Residents

Last Updated:  3-16-2022

 

This Supplemental Privacy Notice for California Residents (this “ Supplemental Notice”) supplements Gray’s Privacy Policy found here and applies to you if you reside in California and you do not fall under an exclusion listed in Section 1 below. This Supplemental Notice is adopted to comply with the California Consumer Privacy Act of 2018 (the “ CCPA”). It also addresses requirements of certain other California laws. Capitalized terms used without definition shall have the meanings ascribed to them in the Privacy Policy and other undefined terms shall have the meanings ascribed to them in the CCPA.

 

1. CCPA Exclusions.
This Supplemental Notice does not apply to the following information:

 

(a) Information collected about a natural person in the course of such person acting as a job applicant to, an employee of, owner or director of, or contractor of Gray, including natural persons who provide a service to Gray under a written contract, to the extent that person’s personal information is collected and used by Gray: solely within the context of the person’s role or former role with Gray, for purposes of benefits administration, or to maintain such person’s emergency contact information. California residents who are Gray employees, contractors, or job applicants may request a copy of Gray’s CCPA notice of collection for employees,
contractors, and applicants using the contact information below.

 

(b) Publicly available information from government records, deidentified or aggregated consumer information;

 

(c) Except with respect to Section 5(c) (non-discrimination), information collected from a natural person as part of a communication or transaction between Gray and another business (including a company, partnership, sole proprietorship, nonprofit, or government agency) where such person is an employee, owner, director, officer or contractor of such other business, provided such communication or transaction is made for the purpose of conducting due diligence regarding, or providing or receiving a product orservice to or from, such business and the information is collected in that business context.

 

(d) Other information expressly excluded from the CCPA’s scope, such has HIPAA–protected information and information protected by the Gramm-Leach Bliley Act, the Fair Credit Reporting Act (FCRA), or the Driver’s Privacy Protection Act (DPPA).

 

2. Information We Collect.
Gray collects information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked to a consumer or personal device. For purposes of this Supplemental Notice, such information constitutes personal information.

 

(a) Personal Information Collected. Below are categories of personal information recognized by the CCPA along with examples (provided by the CCPA) of types of personal information in each category:

 

• Identifiers
  Real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers
• CA Customer Records Statute categories
  Name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information (such as temperature, symptoms, health condition), or health insurance information
• Protected Class Characteristics
  Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic
  information (including familial genetic information)
• Commercial Information
  Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies
• Biometric Information
  Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data
• Internet/network activity
  Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement
• Geolocation data
  Physical location or movements
• Sensory data
  Audio, electronic, visual, thermal, olfactory, or similar information
• Professional/employment-related information
  Current or past job history or performance evaluations
• Non-public education information
  Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records
• Inferences drawn from other personal information
  Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes

 

(b) Sources. We obtain Personal Information from you, including from you directly when you provide Gray with the information, from you indirectly when you interact with the Site, and from you when you make electronic communications to Gray. For additional sources of information we collect see the chart in Section 3 below.

 

3. Use of Personal Information.
Gray uses the personal information it collects in the ways described in Section 5 of the Privacy Policy. Gray may use the personal information for commercial purposes as well as business purposes.

 

4. Disclosure of Personal Information.

 

(a) Disclosure. Gray discloses the personal information it collects in the ways described in Section 6 of the Privacy Policy. Gray has shared or disclosed personal Information within the past twelve months as described below. The following chart identifies the categories of personal information recognized by the CCPA and collected by Gray, provides examples of the types of personal information within each category collected by Gray, indicates whether Gray has collected such
categories of personal information during the past twelve months, the source of such personal information, how Gray uses such personal information, and to whom Gray has disclosed such personal information within the past twelve months:

 

Category of Personal Information	Source of Collection	Business Purpose	To Whom Disclosed (categories)
Identifiers	-you/your device -technologically gathered from your operating systems and browsers -service providers -business partners	-marketing/ communications -fulfill requests -provide support -provide goods/services -fulfill contractual obligations -respond to inquiries -contracting	-service providers -business partners -customers
CA Customer Records Statute categories	-you -service providers -business partners	-marketing/ communications -fulfill requests -provide support -provide goods/services -fulfill contractual obligations -respond to inquiries -maintain safe work environment	-service providers -business partners -public health authorities as required by law
Protected Class Characteristics	n/a	n/a	n/a
Commercial Information	-you -service providers -business partners	-provide services to customers – improve services -fulfill contractual obligations -respond to inquiries	-service providers -business partners
Biometric Information	n/a	n/a	n/a
Internet/network activity	-you/your device -analytics and advertising partners -technologically gathered from your operating systems and browsers	-improve Site -personalize Site -improve Site experience -improve customer experience -marketing/ communications	-service providers -analytics and advertising partners -business partners
Geolocation data	-you/your device -analytics and advertising partners -technologically gathered from your operating systems and browsers	-improve Site -personalize Site -improve Site experience -improve customer experience -marketing/ communications	-service providers -analytics and advertising partners -business partners
Sensory data	n/a	n/a	n/a
Professional/employment-related information	-you -business partners -service providers -customers	-provide services -contracting -respond to inquiries -marketing/ communications	-business partners -service providers -customers
Non-public education information	-n/a	-n/a	n/a
Inferences drawn from other personal information	-analytics and advertising partners -business partners -service providers	-provide goods and services -marketing and remarketing -improve customer experience -improve product and service offerings	-analytics and advertising partners -business partners

 

(b) Sale. Gray does not sell Personal Information.

 

5. California Rights.
The CCPA provides you with specific rights as a California resident. This section identifies those rights and how to exercise them.

 

(a) Access and Data Portability. Subject to certain exceptions, you have the right to request certain information about Gray’s collection, use, and/or disclosure of your personal information over the past 12 months. After receipt of a verifiable consumer request from you, Gray will disclose to you the categories of personal information collected, categories of sources for the categories of personal information collected, business or commercial purpose for collecting such personal information, categories of third parties with whom Gray shared such personal information, and specific pieces of personal information collected about you.

 

(b) Deletion. Subject to certain exceptions, you may request that Gray delete Personal Information about you that it has collected and retained.

 

(c) Non-Discrimination. You have the right not to receive discriminatory treatment for the exercise of your privacy rights under the CCPA.

 

6. California Request Process.

 

(a) Instructions. If you reside in California, only you or someone legally authorized to act on your behalf may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child, if applicable. You may make a verifiable consumer request for access or data portability no more than twice within a 12-month period. Such a request must provide sufficient information to allow Gray to reasonably verify that you are (or are an authorized representative of) the person about whom Gray collected the personal information, and describe your request with sufficient detail to allow Gray to properly understand, evaluate, and respond to it. Please note that Gray cannot respond to your request or provide you with information if Gray cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with Gray. Gray will only use personal information provided in a verifiable consumer request to verify your identity or authority to make the request. If you reside in California, you may exercise your personal information rights by submitting verifiable consumer requests in one or more of the following manners:

 

(i) If you are a California resident, you may make verifiable requests to exercise your personal information rights via the online request portal found here .

 

(ii) If you prefer to submit your verifiable request to exercise your personal information rights by phone, you may contact Gray by phone toll free at 888-338-6432 or by submitting a request using any of the contact information set forth in Section 10 below.

 

(b) Verifying Requests. Gray will confirm receipt of your request within the time period prescribed by the CCPA and/or its regulations, let you know how Gray will process the request, and let you know Gray’s verification process, and anticipated timeframe for response. Gray may try to verify your request by asking you to provide certain information and matching it to the information Gray maintains about you. Gray will request at least two data points about you. Depending on the nature of your request, Gray may require more data points to match and/or may require you to sign a declaration confirming under penalty of perjury that you are the consumer whose personal information is the subject of the request.

 

(c) Authorized Agent. If you are a California resident, you may designate an authorized agent to make requests on your behalf to exercise your personal information rights. The authorized agent must be registered with California’s Secretary of State. The authorized agent making any request on your behalf to know or delete certain personal information about you must submit a copy of the written permission you granted them to act as authorized agent or a copy of the document showing you granted them a power of attorney for this purpose. If the authorized agent does not have a power of attorney in compliance with California’s probate law, you must also directly verify your identity with Gray. If adequate proof is not presented, Gray may deny the request.

 

(d) Response Timing and Format. Gray will try to respond to a verified consumer request within forty five (45) days of receipt, but if Gray requires more time to respond, it will let you know how long and why in writing. Gray will respond to you by mail or electronically at your option. Any disclosures Gray provides in response to your request will pertain only to the 12-month period immediately preceding receipt of the verifiable consumer request. If Gray is unable to respond to the request,
Gray will explain why, if applicable. If Gray is unable to verify your identity in connection with a request for specific pieces of information about you, Gray will let you know (but will not disclose the specific pieces of information) and will evaluate the request as though it were a request for categories of personal information disclosed to third parties during the past 12 months. If Gray denies a request due to conflict with federal or state law or an exception to the CCPA, Gray will explain the basis for the denial. If Gray cannot verify your identity in connection with a request to disclose categories of information disclosed to third parties, Gray will let you know, and will provide you information about its general business practices regarding collection, maintenance, and sale of personal information. If Gray cannot verify the identity of an individual requesting deletion of personal data, Gray will deny your request and will treat the request as a request to opt-out of sale. Gray has no obligation to provide you with specific personal information if such disclosure creates a substantial, articulable, and unreasonable risk to security. For any data portability requests, Gray will provide your personal information in a .pdf format. Unless your request is excessive, repetitive, or manifestly unfounded, Gray will not charge a fee to process or respond to your request. If Gray determines that a fee is warranted, Gray will explain why it reached that decision and provide you with a cost estimate before responding.

 

7. Opting out of online advertising. As described in Section 6 of the Privacy Policy, we may allow third-party advertising companies to collect data from visitors to our Sites in order to provide more relevant advertisements. For information on how to limit the access these companies have about you when you visit our sites and opting out of targeted online advertising visit https://optout.networkadvertising.org/?c=1 and optout.aboutads.info.

 

8. Changes to Privacy Policy. Changes to the Supplemental Notice will be posted on this page. If Gray makes material changes to the way it treats users’ personal information, it may choose to notify you by email or through a notice in addition to posting. The date the Supplemental Notice was last revised appears at the top of the Supplemental Notice. You are responsible for ensuring that Gray has a current email address for you and for periodically visiting the Site and the Supplemental Notice to check for any changes.

 

9. Third Party Marketing. California Civil Code Section 1798.83 permits users of the Site who are California residents to request certain information regarding disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please contact Gray at the contact information set forth in Section 10 below.

 

10. Contact. If you have any questions or comments about this Supplemental Notice and Gray’s privacy practices, or if you wish to exercise your rights as a California resident, please contact Gray at privacy@gray.com

 

Or these alternative means:

Postal Mail:
Gray
10 Quality Street
attn: Data Subject Requests – CCPA
Lexington, KY 40507

Phone: 888-338-6432