CCPA Consumer Privacy Notice

Effective Date: January 1, 2020

This California Privacy Notice (“Notice”) applies to “Consumers” as defined by the California Consumer Privacy Act (“CCPA”).  In the event of a conflict between any other Company policy, statement, or notice and this Notice, this Notice will prevail as to California Consumers and their rights under the CCPA. 

In accordance with the CCPA’s requirements, this Notice covers the calendar year 2019 and describes our collection, use, disclosure, and sale of California Consumers’ “Personal Information” (“PI”), as well as rights California Consumers have under the CCPA.  Terms defined in the CCPA that are used in this Notice have the same meanings as in the CCPA. 

COLLECTION AND USE OF PERSONAL INFORMATION

 

We collect PI about California Consumers as described in the table below.

Category

Examples of PI Collected

Sources of PI

Purposes for PI Collection

Categories of Recipients

Identifiers

 

Name; postal address; email address; billing address;  shipping address; phone number; net promoter score survey response and comments; payment card data

Consumer and Transaction

Providing Services; Auditing Related to Interactions and Transactions; Detecting Security Incidents and Protecting Against Fraud;

Short-Term Transient Use (e.g., contextual advertising); Quality/Safety Control; Promotion and Marketing and related purposes

 

Employees, contractors, service providers and vendors, and operating systems and platforms

 

Customer Records

 

Name; postal address; email address; billing address;  shipping address; phone number; net promoter score survey response and comments; payment card data

Consumer and Transaction

Providing Services; Auditing Related to Interactions and Transactions; Detecting Security Incidents and Protecting Against Fraud;

Short-Term Transient Use (e.g., contextual advertising); Quality/Safety Control; Promotion and Marketing and related purposes

Employees, contractors, service providers and vendors, and operating systems and platforms

 

Commercial Information / Purchase Details

Purchase history

Consumer and Transaction

Providing Services; Auditing Related to Interactions and Transactions; Detecting Security Incidents and Protecting Against Fraud;

Short-Term Transient Use (e.g., contextual advertising); Quality/Safety Control; Promotion and Marketing and related purposes

 

Employees, contractors, service providers and vendors, and operating systems and platforms

 

Sensory Data

 

Audio recordings of customer service calls; CCTV footage at company facilities

Consumer and Transaction

Providing Services; Auditing Related to Interactions and Transactions; Detecting Security Incidents and Protecting Against Fraud;

Short-Term Transient Use (e.g., contextual advertising); Quality/Safety Control; Promotion and Marketing and related purposes

Employees, contractors, service providers and vendors, and operating systems and platforms

 

Inferences from PI Collected

Customer profiles reflecting preferences and transactions with the Company

Consumer and Transaction

Providing Services; Auditing Related to Interactions and Transactions; Detecting Security Incidents and Protecting Against Fraud;

Short-Term Transient Use (e.g., contextual advertising); Quality/Safety Control; Promotion and Marketing and related purposes

 

Employees, contractors, service providers and vendors, and operating systems and platforms

 

 

In addition, we may collect, use, and disclose your PI as required or permitted by applicable law.  We do not treat deidentified data or aggregate consumer information as PI, and we reserve the right to convert, or permit others to convert, your PI into deidentified data or aggregate consumer information.

 

Subject to the CCPA’s restrictions and obligations, our affiliates, service providers, and vendors also may use your PI for some or all of the above-listed business purposes. 

We may share your PI with our affiliates, service providers, vendors (including those that may facilitate interest-based advertising and other advertising and marketing), and other parties as described in the table above.

We do not “sell” (as the term “sale” is defined by the CCPA) Consumer PI.

CALIFORNIA PRIVACY RIGHTS

Under the CCPA, California Consumers have certain rights which they may exercise independently or through an authorized agent.  CCPA rights requests are subject to an identification and verification process.  We will not fulfill a CCPA request unless we have been provided sufficient information for us to reasonably verify that the requestor is the Consumer about whom we collected PI. 

 

Some PI we maintain about Consumers (e.g., clickstream data) is not sufficiently associated with enough PI about the Consumer for us to be able to verify that it is a particular Consumer’s PI.  Accordingly, we will not include such information in response to Consumer requests.  If we cannot comply with a request, we will explain the reasons in our response.  You are not required to create an account with us to make a verifiable request.  We will use PI provided in your request only to verify your identity or authority to make the request and to track and document request responses, unless you also provided the PI to us for another purpose.

 

Your California Consumer privacy rights are described below.  To make a request, please contact us at DataPrivacyTeam@Greif.com or call us at 800-763-0884.  Please provide your name and how you would like us to contact you.  We may use your transaction history or information you have provided to verify your request.  If you request that we provide you with specific pieces of information about you, we will apply the heightened verification standards set forth in this Notice.  Authorized Agents may submit requests on behalf of Consumers as provided above in this paragraph by identifying the Consumer who the Authorized Agent represents and notifying us how to contact such Authorized Agent.   

 

We may collect, use, and disclose your PI as required or permitted by applicable law. Please note we are not obligated to comply with consumer requests to the extent that doing so would infringe on our, or any other person’s or party’s, rights or conflict with applicable law.

 

Disclosure Rights

You have the right to request that we disclose your PI that we have collected and are maintaining for the 12-month period prior to the request date.  Consumer requests of this nature may be made no more than two times in a 12-month period.

  1. The categories of PI we have collected about you, including the categories of sources from which we collected your PI and the purpose(s) for such collection.
  2. The specific pieces of PI we have collected about you.
  3. The categories of third parties to whom we have disclosed your PI, including a list of the categories of PI disclosed (or a statement that no such disclosure occurred).
  4. A list of the categories of PI sold about you, including the categories of third parties to whom we sold your PI and the purposes for the sale (or a statement that no such sale occurred). 

 

With respect to (1) and (2) above, we will provide this information in a portable and, if technically feasible, readily usable format.

“Do Not Sell” Rights

We do not sell California Consumer PI as defined under the CCPA and, until such time as we change our practices by updating this Privacy Notice, will treat PI collected under this Notice as subject to a “do not sell” request.

 

Some browsers have signals that may be characterized as “do not track” signals, but we do not understand them to operate in that manner or to signify a “do not sell” request.  We understand that various parties are developing “do not sell” signals, and we may recognize certain such signals if we conclude such a program is appropriate.

 

Deletion Rights

You may request that we delete your PI that we have collected directly from you.  Under the CCPA, we may decline to delete your PI under certain circumstances, for example, if we need the PI to complete transactions or provide services you have requested or that are reasonably anticipated, for security purposes, for internal business purposes (including maintaining business records), to comply with law, or to exercise or defend legal claims.  Note also that we are not required to delete your PI that we did not collect directly from you. 

Non-Discrimination

We will not discriminate against you in a manner prohibited by the CCPA because you exercise your CCPA rights. 

CONTACT US

For more information regarding your California privacy rights, you may contact us at 800-763-0884 or email us at DataPrivacyTeam@Greif.com. You may also write to us at: Greif, 425 Winter Road, Delaware, Ohio 43015, Attention:  CCPA Compliance Team.