Springbrook Holding Company, LLC

Privacy Policy

Introduction

This Privacy Policy was updated on or about May 1, 2023.

Springbrook Holding Company, LLC and its affiliated companies and subsidiaries (collectively referred to as “Springbrook,” “we,” or “us”) respect your privacy. This Privacy Policy describes how we collect Information from and about you, what we do with the Information, how we share it, and how we handle the content you place in our products and services. It also explains the choices available to you regarding use of your Personal Information. By providing Information or Personal Information to us including on our website or in connection with the purchase or use of our products or services, or signing an agreement that incorporates this Privacy Policy by reference you agree to and are bound by this Privacy Policy.

Scope of this Privacy Policy

This Privacy Policy applies to the Information we obtain through your use of Springbrook’s products and services or visitation to Springbrook websites where this Privacy Policy is posted. It does not apply to any other Information collected by Springbrook through other means. If you have agreements with Springbrook for Springbrook products and services, then those agreements control to the extent of any conflict. Further, this Privacy Policy does not cover the activities of third parties except as specifically stated.

Definitions

Downloadable Products means Springbrook’s downloadable software products and mobile applications, including bundles of code, resources, and configuration files that can be used with a Springbrook product to add new functionality (including product version upgrades) created by Springbrook that are installed by customers on a device of their choice.

Information means all forms of data, content (which includes data that you upload, submit, post, create, transmit, store or display in a Springbrook product or service), and information collected by us.

Personal Information means Information that may be used to readily identify or contact you as an individual person, such as: name, address, email address or phone number. Personal Information does not include Information that has been anonymized such that it does not allow for the ready identification of specific individuals.

Our Collection of Personal Information

Springbrook collects Personal Information from you at several different points, including but not limited to the following: when we correspond with you as a customer or prospective customer; when you use our products or services; when you visit, register, or otherwise provide us your Personal Information on our website; when you contact us for help; when you interact with our advertising and marketing content; and when you participate at our conferences, attend our webinars, or visit our tradeshow booths.

In using our products or services or requesting Information, you may provide a password for your account, your real name, industry, agency name, job role and contact Information. We may also collect other information including but not limited to the specific Springbrook product or service being used, the associated license identifier and domain name, financial information (for example, information about your payment card numbers), the username and IP address or the individual using the product or service function; your credit card number and billing address when purchasing an Springbrook product or service; analytics Information including aggregated usage data; and other additional Information required to detail the operation of the Springbrook product or service.

Our Use of your Information and Personal Information

Springbrook may use your Information and Personal Information to:

Deliver the products and services that you have requested, including software
Manage your customer relationship and provide you with customer
Perform research and analysis about our customers’ use of, or interest in, our products, services or content.
Operate and improve our internal operations, systems, products and services including benchmarking system performance.
Understand you and your preferences to enhance your
Respond to your comments and questions, and provide customer
Send you service-related information, including confirmations, invoices, technical notices, updates, security alerts, and support and administrative messages.
Enforce our terms and
Recruit, onboard, and distribute payroll and benefits.
Communicate with you about products or services that may be of interest to

Our Disclosure of your Personal Information to Third Parties

We may share your Personal Information with third parties only in the ways that are described in this Privacy Policy:

When we have your permission, including when you choose to share Personal Information including using Springbrook Community or post to our blogs.
We may provide your Personal Information to our agents, partners, contractors, vendors or service providers who perform functions on our behalf.
We may share your information with our current or future “affiliates” (which means a parent company, any subsidiaries, joint ventures, or other companies under common control), in which case we will require our affiliates to honor this Privacy
We may disclose Personal Information to comply with laws or in response to legal process, for example, in response to a court order or a We also may disclose Personal Information in response to a law enforcement agency’s request, or where we believe it is necessary to investigate, verify, prevent, enforce compliance with, or take action regarding: illegal or suspected illegal activities; suspected fraud; situations involving potential threats to the physical safety of any person; protection of the rights and property of Springbrook, our agents, customers or others; or violations or suspected violations of our agreements, policies or end user license agreements; or as otherwise required or permitted by law, or consistent with legal requirements. We reserve the right to transfer or disclose Personal Information in our system relating to or during negotiation of any merger, financing, acquisition, bankruptcy, dissolution, transaction or other proceeding involving sale, transfer, divestiture or assignment of all or a portion of our business or assets to a different entity.
Finally, we may also share aggregated, anonymized or statistical information about you, including demographics data, with others for a variety of purposes, including for their own uses, for example, for improving their products and services for Springbrook and

Our Security Measures to Protect your Personal Information

We have put in place reasonable and appropriate physical, electronic, and managerial procedures in an effort to help safeguard Personal Information we collect. However, Springbrook cannot fully eliminate security risks associated with Personal Information. To help protect yourself, please use a strong password, do not use the same passwords you use with other accounts or services, and protect your usernames and passwords.

End Customer Data

Springbrook’s customers may electronically submit Information to the product or service for processing and storage purposes (“End Customer Data”). We may access or process End Customer Data only for the purpose of providing a product or service or preventing or addressing service or technical problems or as may be required by law. If your Personal Information has been submitted to us by a Springbrook customer and you wish to exercise any rights you may have to access, correct, amend, or delete such data, please inquire with the relevant customer directly. Since Springbrook personnel have limited ability to access Information our customers submit to our products or services, if you wish to make your request directly to Springbrook, please provide the name of the Springbrook customer who submitted your data to our product or service. We will refer your request to that customer.

Our Retention of your Personal Information

Personal Information will be retained as long as needed to fulfill legitimate business purposes for which it was collected, including the purposes outlined in this Privacy Policy, or for a period of time specifically required or allowed by applicable regulations or laws. We will also retain and use your Personal Information for as long as necessary to comply with our legal obligations, resolve disputes and enforce our agreements.

Cookies/Web Beacons

Our websites use cookies to recognize you when you visit our website. We use cookies and similar tracking technologies to collect information on our website, mobile application, and via email.

Cookies are small text files that are stored on your computer. They are designed to hold a small amount of data specific to a website or server that can be accessed either by the website or your computer. We use cookies to capture information such as IP address and electronic activity data.

We use this information to remember your site preferences. Additionally, we aggregate this data to analyze site traffic and the effectiveness of our marketing efforts.

When you use our websites, you can usually choose to set your browser to remove cookies and to reject cookies from our servers. If you choose to remove or reject cookies, this could affect certain features or services of our websites.

While we and others give you certain choices, as further outlined in this Privacy Policy, there are many ways that web browser signals and similar mechanisms can indicate your choice to disable tracking, and we may not be aware of nor honor every mechanism.

Do Not Track

Most modern web browsers give you the option to send a Do Not Track signal to the sites you visit, indicating that you do not wish to be tracked. However, there is no accepted standard for how a site should respond to this signal, and we do not take any action in response to this signal. Instead, in addition to publicly available third-party tools, we offer you the choices described in this policy to manage the collection and use of information about you.

International Storage and Transfer of your Personal Information

Springbrook is a global company with affiliates, various business processes, management structures and technical systems that cross borders. Information collected by Springbrook or on behalf of Springbrook may be stored on our computers, on our mobile devises, or on our servers, and may be transferred to, accessed from, or stored and processed in the United States.

Your Access to and Amendment of your Personal Information

Our marketing emails tell you how to “opt-out” of receiving further marketing emails. If you opt out, we may still send you non-marketing emails including emails about your accounts and our business dealings with you.

We allow you to access your Personal Information (with proper identification verification), and allow you to correct, amend or delete inaccurate Personal Information, except where the burden or expense of providing such an access is disproportionate to the individual privacy risk, or where the rights of persons other than the requesting individual risk being violated. This information request can be made by sending an email to [email protected]

Children’s Privacy

Because of the nature of our business, our services are not designed to appeal to minors. We do not knowingly attempt to solicit or receive any information from anyone under the age of 16. If you are a parent or guardian and you are aware that your child has provided us with Personal Information, please contact us immediately.

For California Residents

This privacy notice section for California residents supplements the information contained in our Privacy Policy and it applies solely to all visitors, users, and others who reside in the State of California.

For the purposes of the CCPA, “Personal Data” means any information that identifies, relates to, describes or is capable of being associated with, or could reasonably be linked, directly or indirectly, with You.

Categories of Personal Information Collected

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (“personal information”). In particular, we have collected the following categories of personal information from consumers within the last twelve (12) months:

Category	Examples	Collected
A. Identifiers.	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.	YES
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.	YES
C. Protected classification characteristics under California or federal law.	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).	NO
D. Commercial information.	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	YES
E. Biometric information.	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.	NO
F. Internet or other similar network activity.	Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.	YES
G. Geolocation data.	Physical location or movements.	NO
H. Sensory data.	Audio, electronic, visual, thermal, olfactory, or similar information.	NO
I. Professional or employment-related information.	Current or past job history or performance evaluations.	NO
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	NO
K. Inferences drawn from other personal information.	Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	NO

Personal information does not include:

Publicly available information from government records.
De-identified or aggregated consumer information.
Information excluded from the CCPA’s scope, like:
- health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
- personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.

Sources of Personal Information

We obtain the categories of personal information listed above from the following categories of sources:

Directly from our clients or their agents. For example, from documents that our clients provide to us related to the services for which they engage us.
Indirectly from our clients or their agents. For example, through information we collect from our clients in the course of providing services to them.
Directly and indirectly from activity on our website (www.springbrooksoftware.com). For example, from submissions through our website portal or website usage details collected automatically.
From third-parties that interact with us in connection with the services we perform. For example, from payment processors when they process a payment transaction and provide us with the results.

Use of Personal Information for Business Purposes or Commercial Purposes

We may use or disclose personal information We collect for “business purposes” or “commercial purposes” (as defined under the CCPA), which may include the following examples:

To fulfill or meet the reason for which the information is provided. For example, in processing a payment for a utility bill.
To provide you with information, products or services that you request from us.
To provide you with email alerts, event registrations and other notices concerning our products or services, or events or news, that may be of interest to you.
To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collections.
To improve our website and present its contents to you.
For testing, research, analysis and product development.
As necessary or appropriate to protect the rights, property or safety of us, our clients or others.
To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
As described to you when collecting your personal information or as otherwise set forth in the CCPA.
To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.

Please note that the examples provided above are illustrative and not intended to be exhaustive. We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice. If We decide to collect additional categories of personal information or use the personal information We collected for materially different, unrelated, or incompatible purposes We will update this Privacy Policy.

Disclosure of Personal Information for Business Purposes or Commercial Purposes

We may use or disclose and may have used or disclosed in the last twelve (12) months the following categories of personal information for business or commercial purposes:

Category A: Identifiers
Category B: Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))
Category D: Commercial information
Category F: Internet or other similar network activity

Please note that the categories listed above are those defined in the CCPA. This does not mean that all examples of that category of personal information were in fact disclosed, but reflects our good faith belief to the best of our knowledge that some of that information from the applicable category may be and may have been disclosed.

When We disclose personal information for a business purpose or a commercial purpose, We enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.

Sale of Personal Information

As defined in the CCPA, “sell” and “sale” mean selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to a third party for valuable consideration.

We do NOT sell any information to any parties.

Sale of Personal Information of Minors Under 16 Years of Age

We do not knowingly collect personal information from minors under the age of 16 through our Service, although certain third-party websites that we link to may do so. These third-party websites have their own terms of use and privacy policies and we encourage parents and legal guardians to monitor their children’s Internet usage and instruct their children to never provide information on other websites without their permission.

If you have reason to believe that a child under the age of 16 has provided us with personal information, please contact us with sufficient detail to enable us to delete that information.

Your Rights under the CCPA

The CCPA provides California residents with specific rights regarding their personal information. If you are a resident of California, you have the following rights:

The right to notice. you have the right to be notified which categories of Personal Data are being collected and the purposes for which the Personal Data is being used.
The right to request. Under CCPA, you have the right to request that We disclose information to you about our collection, use, sale, disclosure for business purposes and share of personal information. Once We receive and confirm your request, We will disclose to You:
- The categories of personal information We collected about You
- The categories of sources for the personal information We collected about You
- our business or commercial purpose for collecting or selling that personal information
- The categories of third parties with whom We share that personal information
- The specific pieces of personal information We collected about You
- If we sold your personal information or disclosed your personal information for a business purpose, We will disclose to You:
  - The categories of personal information categories sold
  - The categories of personal information categories disclosed
- The right to say no to the sale of Personal Data (opt-out). you have the right to direct us to not sell your personal information. To submit an opt-out request please contact Us.
- The right to delete Personal Data. you have the right to request the deletion of your Personal Data, subject to certain exceptions. Once We receive and confirm your request, We will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for us or our service providers to:
  - Complete the transaction for which We collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with You, or otherwise perform our contract with You.
  - Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
  - Debug products to identify and repair errors that impair existing intended functionality.
  - Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
  - Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
  - Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
  - Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with Us.
  - Comply with a legal obligation.
  - Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
- The right not to be discriminated against. you have the right not to be discriminated against for exercising any of your consumer’s rights, including by:
  - Denying goods or services to You
  - Charging different prices or rates for goods or services, including the use of discounts or other benefits or imposing penalties
  - Providing a different level or quality of goods or services to You
  - Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services

Exercising your CCPA Data Protection Rights

In order to exercise any of your rights under the CCPA, and if you are a California resident, you can contact Us:

Submit a request using the form located at the end of this webpage.
By sending us an email: [email protected]

Only You, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable request related to your personal information.

Your request to us must:

Provide sufficient information that allows us to reasonably verify you are the person about whom We collected personal information or an authorized representative
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it

We cannot respond to your request or provide you with the required information if we cannot:

Verify your identity or authority to make the request
And confirm that the personal information relates to You
We will disclose and deliver the required information free of charge within 45 days of receiving your verifiable request. The time period to provide the required information may be extended once by an additional 45 days when reasonably necessary and with prior notice.

Any disclosures We provide will only cover the 12-month period preceding the verifiable request’s receipt.

For data portability requests, We will select a format to provide your personal information that is readily usable and should allow you to transmit the information from one entity to another entity without hindrance.

Changes to This Privacy Policy

From time to time, we may collect and use Personal Information in ways not previously disclosed in our Privacy Policy. If our information practices or this policy change, we will post adjustments to this policy and change the “Last Updated” date. Unless additional notice or consent is required by applicable laws, this will serve as your notification of these changes.

Contacting Us

If you have questions or suggestions, please email Springbrook at [email protected].

Please send all written communication to:

Springbrook Holding Company, LLC Attn: Legal Department

21370 SW Langer Farms Pkwy STE 142-507

Sherwood, OR 97140