Updated January 1, 2024

The California Consumer Privacy Act (“CCPA”), which provides California Consumers certain rights regarding their Personal Information (“PI”) as those terms are defined in the CCPA, became effective on January 1, 2020. As of that date, the California Attorney General had not completed the rule making process to establish the regulations for businesses to implement the law.

In the meantime, we are providing you with notice of the personal information we collect and our purposes for that collection for data that may be subject to the CCPA (“CCPA Notice”). This CCPA Notice does not cover information that is outside of the scope of the CCPA. This notice also does not apply to data collected from employees, applicants, or contractors or to data collected from individuals acting as representatives of another business in connection with business communications or transactions.

We may collect and share the following personal information that may be subject to the CCPA for the following purposes:

CATEGORY OF PI	PURPOSES FOR COLLECTION	CATEGORIES OF THIRD PARTIES WITH WHOM PI IS SHARED
1. Identifiers and Personal Records (e.g., name, phone number, e-mail address, IP address)	Providing our services, improving our services, quality assurance, marketing, security, internal analytics, and reporting	Vendors, data analytics partners, advertising partners, financial services providers
2. Internet Usage Information (e.g., information regarding your interaction with our services)	Security, internal analytics, and reporting	Vendors, data analytics partners, advertising partners
3. Geolocation Data	Security, internal analytics, and reporting	Vendors, data analytics partners, advertising partners
4. Inferences from PI Collected (e.g. your preferences, your likelihood of interest in certain of our services)	Providing our services, improving our services, marketing	Vendors, data analytics partners, advertising partners

In addition, we may collect, use, and disclose your PI as required or permitted by applicable law, or as directed by you, in accordance with this Privacy Policy.

We do not knowingly “sell” personal information that we collect from you, in accordance with the definition of “sell” in the CCPA and will treat personal information we collect from you as subject to a do not sell request.

California Consumers have the right to exercise the privacy rights under the CCPA. California Consumers may exercise these rights via an authorized agent who meets the agency requirements of the CCPA. Any request you submit to us is subject to an identification and residency verification process (“Verifiable Consumer Request”). We will not fulfill your CCPA request unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected PI.

We will make commercially reasonable efforts to identify Consumer PI that we collect, process, store, disclose, and otherwise use and to respond to your California Consumer privacy rights requests. We will typically not charge a fee to fully respond to your requests, but we may charge a reasonable fee, or refuse to act upon a request, if your request is excessive, repetitive, unfounded, or overly burdensome.

If you are a California Consumer and would like to register a request under your “right to know about personal information collected, disclosed or sold” (including right to obtain copies of specific pieces and/or information about categories of personal information practices), “right to request deletion of personal information,” or “right to opt-out of the sale of personal information,” or otherwise exercise any of your other privacy rights under the CCPA, you can contact us at research@granite-research.com and we will respond to your request as and when we have regulatory guidance on how to properly verify you and respond to your requests and are able to do so.

You have the right to send us a request, no more than twice in a twelve-month period, for any of the following for the period that is twelve months prior to the request date:

• The categories of PI we have collected about you.
• The categories of sources from which we collected your PI.
• The business or commercial purposes for our collecting or selling your PI.
• The categories of third parties with whom we have shared your PI.
• The specific pieces of PI we have collected about you.
• A list of the categories of PI disclosed for a business purpose in the prior 12 months, or that no disclosure occurred.
• A list of the categories of PI sold about you in the prior 12 months, or that no sale occurred. If we sold your PI, we will explain:
  • The categories of your PI we have sold.
  • The categories of third parties to which we sold PI, by categories of PI sold for each third party.

You have the right to make or obtain a transportable copy, no more than twice in a twelve-month period, of your PI that we have collected in the period that is 12 months prior to the request date and are maintaining.

Please note that PI is retained by us for various time periods, so we may not be able to fully respond to what might be relevant going back 12 months prior to the request.

Except to the extent we have a basis for retention under CCPA, you may request that we delete your PI that we have collected directly from you and are maintaining. Note also that we are not required to delete your PI that we did not collect directly from you.

You may alternatively exercise more limited control of your PI by instead exercising one of the more limited opt-outs, including unsubscribing from email newsletters.

We will revise this CCPA Privacy Notice from time to time as implementing regulations further develop and come into effect and we are able to provide you with better information on your CCPA rights and how to exercise them.