PRIVACY POLICY
- Visit our website at https://cardintegrators.com or any website of ours that links to this Privacy Notice
- Use Badge platform, Bulk Print Services, website, support, integrations, cardholder data, school/customer-controlled data, student data, and general company privacy practices. CI Solutions works with schools and other institutional customers to support effective and efficient safety, identification, credentialing, transportation, access, and operational practices through physical ID cards and Mobile IDs. These credentials may or may not include RFID, NFC, barcode, QR code, card serial number, chip serial number, UID, or other credential technologies, depending on the customer’s configuration and operational needs.In many cases, CI Solutions processes personal information on behalf of our customers. For example, a school, school district, college, employer, agency, or organization may provide student, employee, member, visitor, or cardholder information so that CI Solutions can create, print, encode, enroll, distribute, display, or support physical or digital ID cards and related credentials. CI Solutions does not sell personal information. CI Solutions does not use student, cardholder, or customer-provided credentialing information for targeted advertising. CI Solutions does not create advertising profiles from Badge, Bulk Print Services, or the Badge Mobile ID App.
- Engage with us in other related ways, including any marketing or events
SUMMARY OF KEY POINTS
TABLE OF CONTENTS
1. WHAT INFORMATION DO WE COLLECT?
Personal information you disclose to us
In Short:We collect personal information that you provide to us.
- names
- contact preferences
- usernames
- passwords
- email addresses
- phone numbers
- contact or authentication data
- job titles
- mailing addresses
- student data
Information automatically collected
In Short:Some information — such as your Internet Protocol (IP) address and/or browser and device characteristics — is collected automatically when you visit our Services.
- Log and Usage Data. Log and usage data is service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Services and which we record in log files. Depending on how you interact with us, this log data may include your IP address, device information, browser type, and settings and information about your activity in the Services (such as the date/time stamps associated with your usage, pages and files viewed, searches, and other actions you take such as which features you use), device event information (such as system activity, error reports (sometimes called “crash dumps”), and hardware settings).
- Device Data. We collect device data such as information about your computer, phone, tablet, or other device you use to access the Services. Depending on the device used, this device data may include information such as your IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, operating system, and system configuration information.
- Location Data. We collect location data such as information about your device’s location, which can be either precise or imprecise. How much information we collect depends on the type and settings of the device you use to access the Services. For example, we may use GPS and other technologies to collect geolocation data that tells us your current location (based on your IP address). You can opt out of allowing us to collect this information either by refusing access to the information or by disabling your Location setting on your device. However, if you choose to opt out, you may not be able to use certain aspects of the Services.
2. HOW DO WE PROCESS YOUR INFORMATION?
In Short: We process your information to provide, improve, and administer our Services, communicate with you, for security and fraud prevention, and to comply with law. We process the personal information for the following purposes listed below. We may also process your information for other purposes only with your prior explicit consent.
We process your personal information for a variety of reasons, depending on how you interact with our Services, including:
- To deliver and facilitate delivery of services to the user. We may process your information to provide you with the requested service.
- To respond to user inquiries/offer support to users. We may process your information to respond to your inquiries and solve any potential issues you might have with the requested service.
- To send administrative information to you. We may process your information to send you details about our products and services, changes to our terms and policies, and other similar information.
- To fulfill and manage your orders. We may process your information to fulfill and manage your orders, payments, returns, and exchanges made through the Services.
- To request feedback. We may process your information when necessary to request feedback and to contact you about your use of our Services.
- To protect our Services. We may process your information as part of our efforts to keep our Services safe and secure, including fraud monitoring and prevention.
- To evaluate and improve our Services, products, marketing, and your experience. We may process your information when we believe it is necessary to identify usage trends, determine the effectiveness of our promotional campaigns, and to evaluate and improve our Services, products, marketing, and your experience.
- To identify usage trends. We may process information about how you use our Services to better understand how they are being used so we can improve them.
- To comply with our legal obligations. We may process your information to comply with our legal obligations, respond to legal requests, and exercise, establish, or defend our legal rights.
3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR INFORMATION?
In Short: We only process your personal information when we believe it is necessary and we have a valid legal reason (i.e., legal basis) to do so under applicable law, like with your consent, to comply with laws, to provide you with services to enter into or fulfill our contractual obligations, to protect your rights, or to fulfill our legitimate business interests.
- If collection is clearly in the interests of an individual and consent cannot be obtained in a timely way
- For investigations and fraud detection and prevention
- For business transactions provided certain conditions are met
- If it is contained in a witness statement and the collection is necessary to assess, process, or settle an insurance claim
- For identifying injured, ill, or deceased persons and communicating with next of kin
- If we have reasonable grounds to believe an individual has been, is, or may be victim of financial abuse
- If it is reasonable to expect collection and use with consent would compromise the availability or the accuracy of the information and the collection is reasonable for purposes related to investigating a breach of an agreement or a contravention of the laws of Canada or a province
- If disclosure is required to comply with a subpoena, warrant, court order, or rules of the court relating to the production of records
- If it was produced by an individual in the course of their employment, business, or profession and the collection is consistent with the purposes for which the information was produced
- If the collection is solely for journalistic, artistic, or literary purposes
- If the information is publicly available and is specified by the regulations
- We may disclose de-identified information for approved research or statistics projects, subject to ethics oversight and confidentiality commitments
- Business Transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
6. HOW LONG DO WE KEEP YOUR INFORMATION?
In Short: We keep your information for as long as necessary to fulfill the purposes outlined in this Privacy Notice unless otherwise required by law.
7. HOW DO WE KEEP YOUR INFORMATION SAFE?
In Short: We aim to protect your personal information through a system of organizational and technical security measures.
8. DO WE COLLECT INFORMATION FROM MINORS?
In Short: We do not knowingly collect data from or market to children under 18 years of age or the equivalent age as specified by law in your jurisdiction.
9. WHAT ARE YOUR PRIVACY RIGHTS?
In Short: Depending on your state of residence in the US or in some regions, such as Canada, you have rights that allow you greater access to and control over your personal information. You may review, change, or terminate your account at any time, depending on your country, province, or state of residence.
10. CONTROLS FOR DO-NOT-TRACK FEATURES
Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this Privacy Notice.
11. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
In Short: If you are a resident of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the right to request access to and receive details about the personal information we maintain about you and how we have processed it, correct inaccuracies, get a copy of, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. More information is provided below.
Categories of Personal Information We Collect
The table below shows the categories of personal information we have collected in the past twelve (12) months. The table includes illustrative examples of each category and does not reflect the personal information we collect from you. For a comprehensive inventory of all personal information we process, please refer to the section “WHAT INFORMATION DO WE COLLECT?“
| Category | Examples | Collected |
|---|---|---|
A. Identifiers | Contact details, such as real name, alias, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address, and account name | YES |
B. Personal information as defined in the CA Customer Records statute | Name, contact information, education, employment, employment history, and financial information | NO |
C. Protected classification characteristics under state or federal law | Gender, age, date of birth, race and ethnicity, national origin, marital status, and other demographic data | NO |
D. Commercial information | Transaction information, purchase history, financial details, and payment information | NO |
E. Biometric information | Fingerprints and voiceprints | NO |
F. Internet or other similar network activity | Browsing history, search history, online behavior, interest data, and interactions with our and other websites, applications, systems, and advertisements | NO |
G. Geolocation data | Device location | NO |
H. Audio, electronic, sensory, or similar information | Images and audio, video or call recordings created in connection with our business activities | NO |
I. Professional or employment-related information | Business contact details in order to provide you our Services at a business level or job title, work history, and professional qualifications if you apply for a job with us | NO |
J. Education Information | Student records and directory information | YES |
K. Inferences drawn from collected personal information | Inferences drawn from any of the collected personal information listed above to create a profile or summary about, for example, an individual’s preferences and characteristics | NO |
| L. Sensitive personal Information | Account login information | YES |
- Receiving help through our customer support channels;
- Participation in customer surveys or contests; and
- Facilitation in the delivery of our Services and to respond to your inquiries.
- Category A – As long as the user has an account with us
- Category J – As long as the user has an account with us
- Category L – As long as the user has an account with us
Sources of Personal Information
Learn more about the sources of personal information we collect in “WHAT INFORMATION DO WE COLLECT?“
How We Use and Share Personal Information
Learn more about how we use your personal information in the section, “HOW DO WE PROCESS YOUR INFORMATION?“
Your Rights
You have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:
- Right to know whether or not we are processing your personal data
- Right to access your personal data
- Right to correct inaccuracies in your personal data
- Right to request the deletion of your personal data
- Right to obtain a copy of the personal data you previously shared with us
- Right to non-discrimination for exercising your rights
- Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California’s privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects (“profiling”)
- Right to access the categories of personal data being processed (as permitted by applicable law, including the privacy law in Minnesota)
- Right to obtain a list of the categories of third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in California, Delaware, and Maryland)
- Right to obtain a list of specific third parties to which we have disclosed personal data (as permitted by applicable law, including the privacy law in Minnesota and Oregon)
- Right to obtain a list of third parties to which we have sold personal data (as permitted by applicable law, including the privacy law in Connecticut)
- Right to review, understand, question, and depending on where you live, correct how personal data has been profiled (as permitted by applicable law, including the privacy law in Connecticut and Minnesota)
- Right to limit use and disclosure of sensitive personal data (as permitted by applicable law, including the privacy law in California)
- Right to opt out of the collection of sensitive data and personal data collected through the operation of a voice or facial recognition feature (as permitted by applicable law, including the privacy law in Florida)
How to Exercise Your Rights
To exercise these rights, you can contact us by visiting https://www.cardintegrators.com/privacy-policy/, by emailing us at privacy@cardintegrators.com, by mailing CI Solutions Privacy 3625 Serpentine Drive, Los Alamitos, CA 90720, or by referring to the contact details at the bottom of this document.
Under certain US state data protection laws, you can designate an authorized agent to make a request on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with applicable laws.
Request Verification
Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. We will only use personal information provided in your request to verify your identity or authority to make the request. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes.
If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request and the agent will need to provide a written and signed permission from you to submit such request on your behalf.
Appeals
Under certain US state data protection laws, if we decline to take action regarding your request, you may appeal our decision by emailing us at privacy@cardintegrators.com. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal is denied, you may submit a complaint to your state attorney general.
California “Shine The Light” Law
California Civil Code Section 1798.83, also known as the “Shine The Light” law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in the section “HOW CAN YOU CONTACT US ABOUT THIS NOTICE?“
12. NO UNAUTHORIZED USE OF DATA
CI Solutions shall use Data only for the purpose of fulfilling its duties and obligations under the Service Agreement and will not share Data with or disclose it to any third party without the prior written consent of the customer or District, except as required by law or to fulfill its duties and obligations under the Service Agreement.
13. REASONABLE PRECAUTIONS
CI Solutions shall take reasonable precautions to secure usernames, passwords, and any other means of gaining access to the services and hosted data. Safeguards associated with industry standards are leveraged and best practices including, but not limited to, encryption, firewalls and password protection must be in place when student PII is stored or transferred.
14. DATA SECURITY
CI Solutions agrees to abide by and maintain adequate data security measures, consistent with industry standards and technology best practices, to protect Data from unauthorized disclosure or acquisition by an unauthorized person. The general security duties by CI Solutions are set forth below. CI Solutions shall further detail its security programs and measures upon request. These measures shall include, but are not limited to: a. Passwords and Employee Access. CI Solutions shall secure usernames, passwords, and any other means of gaining access to the Services or to Data, at a level consistent with an industry standards. CI Solutions shall only provide access to Data to employees that are performing the Services. Employees with access to Data shall have signed confidentiality agreements regarding said Data. All employees with access to Data shall pass criminal background checks. b. Security Protocols. Both parties agree to maintain security protocols that meet industry best practices in the transfer or transmission of any data, including ensuring that data may only be viewed or accessed by parties legally allowed to do so. CI Solutions shall maintain all data obtained or generated pursuant to the Service Agreement in a secure computer environment. c. Employee Training. CI Solutions shall provide periodic security training to those of its employees who operate or have access to the system. d. Security Technology. When the Services are accessed using a supported web browser, Secure Socket Layer (“SSL”) or equivalent technology shall be employed to protect data from unauthorized access. The service security measures shall include server authentication and data encryption. CI Solutions shall host data pursuant to the Service Agreement in an environment using a firewall that is periodically updated according to industry standards. e. Periodic Risk Assessment. CI Solutions conducts periodic risk assessments and remediate any identified security and privacy vulnerabilities in a timely manner. Upon request, CI Solutions will provide customers an executive summary of the risk assessment or equivalent report and confirmation of remediation. g. Backups. CI Solutions agrees to maintain backup copies, backed up at least daily, of Data in case of CI Solutions system failure or any other unforeseen event resulting in loss of any portion of Data. h. Audits. Within 30 days of receiving a request from a customer, and not to exceed one request per year, the customer may audit the measures outlined in a mutual DPA or as stated within this Policy. CI Solutions will cooperate fully with any local, state, or federal agency with oversight authority/jurisdiction in connection with any audit or investigation of CI Solutions and/or delivery of Services to the District or Customer, and shall provide full access to CI Soltuions records pertaining to the Customer and delivery of Services to the Customer Account. i. Incident Response. CI Solutions carries an incident response plan that reflects best practices and is consistent with industry standards and federal and state law for responding to a data breach, breach of security, privacy incident or unauthorized acquisition or use of any portion of Data, including PII, and agrees to provide the Customer, upon request, an executive summary of the written incident response plan.
15. BADGE MOBILE ID APP PRIVACY POLICY
CI Solutions maintains a separate privacy policy for the Badge Mobile ID App, which explains how information is handled when authorized users access a digital version of their ID card through the mobile application. For more information, please review the Badge Mobile ID App Privacy Policy at https://www.cardintegrators.com/site-privacy-badge-mobile/
16. DO WE MAKE UPDATES TO THIS NOTICE?
In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.
17. HOW CAN YOU CONTACT US ABOUT THIS NOTICE?
If you have questions or comments about this notice, you may email us at privacy@cardintegrators.com or contact us by post at:
18. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?
You have the right to request access to the personal information we collect from you, details about how we have processed it, correct inaccuracies, or delete your personal information. You may also have the right to withdraw your consent to our processing of your personal information. These rights may be limited in some circumstances by applicable law. To request to review, update, or delete your personal information, please visit: https://www.cardintegrators.com/privacy-policy/.