California Privacy Rights Act

California Privacy Rights Act (“CPRA”) Rights

CPRA Rights

The CPRA provides verified California residents with the following rights regarding their personal information. For purposes of the CPRA, personal information means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household.
 

1. Information Access Rights. California residents have the right to request, up to twice in a 12-month period, and receive:

   • disclosure of our personal Information Collection Practices during the prior 12 months, including the categories of personal information we collect, the categories of sources of such information, our business purpose for collecting or sharing such information, and the categories of third parties with whom we share such information.

   • a copy of the personal information we have collected about them during the prior 12 months, or at your option since January 1, 2022 (Data Portability)

   • Information Disclosure Practices during the prior 12 months, including a list of the categories of personal information sold with the category of third-party recipients and a list of the categories of personal information that we disclosed for a business purpose.
      

2. Information Correction Right. California residents have the right to request that we correct information that we hold which is inaccurate. We will require that you provide information about yourself so that we can verify your identity before we can make any change in the information we hold about you and we will use commercially reasonable efforts to make the requested corrections.  In some cases, for instance if you have an account with us, you can update your information by logging into your account. You can make information correction requests at any time.
    

3. Information Deletion Right. California residents have the right to request that we delete (and direct our service providers to delete) their personal information subject to certain exceptions. You may make deletion requests at any time. By way of example, we are not required to comply with a request to delete information if the information is necessary for us to complete a transaction for you or otherwise perform a contract; to detect, protect against, or prosecute security incidents, fraud or illegal activity; to use the information only internally in ways reasonably aligned with your expectations as our customer (such as maintaining sales records), and to comply with legal obligations.
    

4. Opt Out Rights.

   • Do Not Sell My Personal Information. If you are 16 years of age or older, you have the right, at any time, to direct us to not sell your personal information. We do not sell the personal information of consumers we actually know are less than 16 years of age, unless we receive affirmative authorization (the “right to opt-in”) from either the consumer who is at least 13 but not yet 16 years of age, or the parent or guardian of a consumer less than 13 years of age.

   • Do Not Share My Personal Information. You have the right to opt out of having your personal information shared with others for cross-context or behavioral advertising purposes. This does not include using your interactions with us or information that you provide to us to select advertisements to show you.

   • Limit Processing of Sensitive Personal Information. You have the right to tell us not to process or disclose Sensitive Personal Information for any purpose other than the purposes disclosed at or before the time we originally collected it.

Making CPRA Requests and Our Responses

1. Access Correction and Deletion
   To exercise access, correction, and deletion rights California residents may contact us by emailing us at ccpa@genwayhome.com. We will ask you for information that allows us to reasonably verify your identity (that you are the person about whom we collected personal information) and will use that information only for that purpose. If you do not have a registered account with us, we may request that you submit a signed statement under penalty of perjury that you are the individual you claim to be. We cannot respond to your request or provide you with personal information if we cannot verify your identity and confirm that the personal information relates to you. We will acknowledge receipt of your request within 10 days and will endeavor to respond within forty-five days of receipt of your request, but if we require more time (up to an additional forty-five days) we will notify you of our need for additional time. 
   
   Any disclosures we provide will only cover the 12-month period preceding receipt of your request, but you may request that we expand the 12-month period to cover information collected since January 1, 2022, and we will honor that expanded request unless doing so would involve a disproportionate effort. For Data Portability requests we will endeavor to provide the information in a format that is readily useable, including by mailing you a paper copy or providing an electronic copy to your registered account, if you have registered an account with us.
    

2. Opt-Out Rights
   If you are a California resident over the age of 16 and would like to instruct us not to sell your personal information, not to share your information for cross-context behavioral marketing purposes, or to limit processing of your Sensitive Personal Information please email us at ccpa@genwayhome.com. We will comply with your request within 15 days. 
   
   You may also opt out by activating a user-enabled global privacy control, such as a browser plug-in or privacy setting, device setting, or other mechanism, that communicates or signals your choice to opt-out of the sale and sharing of personal information. When we receive such a signal, we will stop setting third party, analytics, or advertising partner cookies on your browser.  This will prevent the sale or sharing of information relating to that specific device through cookies to our advertising or analytics partners. This option does not stop all sales or sharing of your information because we cannot match your device’s identification or internet protocol address with your personally identifiable information like your name, phone number, email address or ZIP Code. If you delete cookies on your browser, any prior do not sell or do not share signal is also deleted and you should make sure that your user-enabled setting is always activated.
   
   We will not discriminate against you as a result of your exercise of any of these rights.​

​​

Using an Authorized Agent

You may submit a request through someone holding a formal Power of Attorney. Otherwise, you may submit a request using an authorized agent only if (1) you provide the authorized agent with written permission to make a request and (2) you verify your own identity directly with us. We will require the agent to submit proof to us that they have been authorized to make requests on your behalf.

​

Information Collected, Sources, and Business Purpose for Collection

During the past 12 months, we have collected the following categories of information from the listed sources, used it for the listed business purposes and shared it with the listed categories of third parties. The categories of information include information we collect from our website visitors, registered users, employees, vendors, suppliers, and any other person that interacts with us either online or offline. Not all information is collected about all individuals. For instance, we may collect different information from applicants for employment or from vendors or from customers.

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​

​​

​

More specifically, the business purposes may include:

1. Performing services for you:

   • To administer or otherwise carry out our obligations in relation to any agreement to which we are a party;

   • To assist you in completing a transaction or order;

   • To allow tracking of shipments;

   • To prepare and process invoices;

   • To respond to queries or requests and to provide services and support;

   • To provide aftersales customer relationship management;

   • To create and manage our customer accounts;

   • To notify you about changes to our services and products;

   • To administer any promotion, contest, survey, or competition;

   • To provide you information regarding our products and services,

   • To offer our products and services to you in a personalized way, for example, we may provide suggestions based on your previous requests to enable you to identify suitable products and services more quickly.

2. Advertising customization.

   • For marketing and promotions we believe you may find of interest and to provide you, or allow selected third parties to provide you, with information about products and services that may interest you;

3. Auditing relating to transactions, internal research, and development.

   • To provide for internal business administration and operations, including troubleshooting, site customization, enhancement or development, testing, research, administration and operation of our sites and data analytics;

   • To create products or services that may meet your needs;

   • To measure performance of marketing initiatives, ads, and websites “powered by” another company on our behalf;

4. Security detection, protection, and enforcement; functionality debugging, error repair.

   • As part of our efforts to keep our sites safe and secure;

   • To ensure the security of your account and our business, preventing or detecting fraud, malicious activity or abuses of our sites, for example, by requesting verification information in order to reset your account password (if applicable);

   • To ensure the physical security of our premises through the monitoring of surveillance images;

   • To resolve disputes, to protect the rights, safety and interests ourselves, our users or others, and to comply with our legal obligations.

5. Quality control.

   • To monitor quality control and ensure compliance with our legal obligations, codes and ordinances, policies and procedures,

   • To develop and improve our products and services, for example, by reviewing visits to the sites and various subpages, demand for specific products and services and user comments.

​

Processing Sensitive Personal Information

We collect and process or disclose Sensitive Personal Information for the purposes disclosed above or at the time we collect this information. We do not process this information for purposes other than the purpose for which it was originally collected unless required by law. We use and process Sensitive Personal Information collected from California employees, job applicants or vendors (including racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status) to comply with laws including anti-discrimination laws and disability accommodation laws. We use Sensitive Personal Information from other consumers (including racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status) to provide disability accommodations.

​

Disclosing Personal Information

We may disclose your personal information to a third party or governmental agency for a business purpose. When we disclose to a business, we enter into a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract. Please see above for the categories of recipients of each category of information.
 

Sale of Information
We do not sell your information for monetary consideration, but we may transfer your information to a third party that provide us with services such as helping us with advertising, data analysis and security, which may fall under the definition of “other valuable consideration” which may be consider a ‘sale’ under the CPRA. In the preceding twelve (12) months we provided Identifiers and Electronic Network Activity Information to advertising, analytics, and security vendors.

​

Sharing Personal Information for Cross-Context Behavioral Marketing

 “Sharing” your personal information means making it available to a third party so that they can use it to display cross-context behavioral advertisement to you. Cross-context behavioral advertising means that an advertisement is displayed to you that is selected based on personal information about you obtained or inferred over time from your activities across other companies’ websites, applications or online services that is used to predict your preferences or interests. Cross-context behavioral advertising does not include using your interactions with us or information that you provide to us to select advertisements to show you. We do not share personal information for cross-context behavioral advertising purposes.