California Consumers Only: Your California Privacy Rights

What This Privacy Policy Covers

This Privacy Rights Act Notice (“Notice”) provides additional information to California residents whose Personal Information is collected by Palm Beach Tan, Inc. (“Palm Beach Tan” or “PBT”) pursuant to California laws, including the California Consumer Privacy Act (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”). If you are not a California resident, this Notice does not apply to you. Any capitalized terms undefined in this Notice have the same definition as the Policy.

This Notice covers information collected (through offline and online methods) when you visit any Palm Beach Tan salon or business location, visit the Palm Beach Tan website at www.palmbeachtan.com (the “Site”), use the My PBT mobile application, contact us by phone or email, subscribe to our mailing lists, enter a sweepstakes/contest sponsored by us, or when you engage with us on social networking sites including Facebook.

Right to Know About Personal Information Collected, Disclosed, or Sold and Shared

Information Collected

In the preceding 12 months, we have collected the categories of Personal Information about California consumers as described in Annex 1 to this Notice. To review these categories click here.

Business-to-Business (“B2B”) Information

If you are a contact person for any of our business partners, vendors, distributors, suppliers, service providers, contractors, or other entities with which we have a business relationship or potential business relationship, we collect the contact information you provide to us, including name, phone number, address, email address and other contact and relationship information consistent with your role in facilitating that business relationship. We use that information for internal purposes, including to contact you, send and receive information, and otherwise facilitate the business relationship. We do not disclose that information outside our business relationship without your consent. See Annex 1 for more details.

Information Sold or Shared

As explained in Annex 1 of this Policy, we share your data with third-party partners such as social networking sites and advertising companies in order to serve you with ads tailored to your preferences across various platforms. This type of sharing may be considered “selling” or “sharing” under the CPRA. You can control the information shared about you and request an opt-out as explained below.

We have sold or shared the following categories of personal information for a business or commercial purpose in the preceding 12 months:

• Personal Identifiers
• Commercial Information
• Internet Activity
• Geo-location Data

We do not knowingly sell the personal information of individuals under 16 years of age without affirmative authorization.

Information Disclosed for Business Purposes

We have disclosed the following categories of personal information for a business or commercial purpose in the preceding 12 months:

• Personal Identifiers
• Commercial Information
• Internet Activity
• Geo-location Data

For details regarding the categories of third parties with whom we have shared, sold, or disclosed personal information, please see Annex 1.

Right to Know

You have the right to request that we disclose to you the following information about Personal Information we collect from you:

• categories of personal information collected;
• categories of sources of personal information collected;
• the business or commercial purpose for collecting or selling personal information;
• the categories of third parties with whom we share personal information; and
• the specific pieces of personal information we have collected about you over the past 12 months.

You also have a right to know if we have shared, sold, or disclosed your Personal Information for a business purpose over the past 12 months and, if so, the categories of Personal Information shared, sold, or disclosed and the categories of third parties to whom the Personal Information was shared, sold, or disclosed, along with the business or commercial purpose for which the Personal Information was shared, sold, or disclosed.

Requests to Know

To make a request for any of the information set forth above (a “Request to Know”), please submit a verifiable consumer request pursuant to the instructions below. You may only make a Request to Know twice within a 12-month period. We will acknowledge your Request to Know within 10 days and will attempt to respond substantively within 45-90 calendar days.

The Request to Know must provide sufficient information to allow us to verify that you are the person about whom the Personal Information was collected, sold or disclosed and must contain sufficient detail to allow us to properly understand, evaluate and respond to your request. If we cannot verify your identity, we will not be able to respond to your request.

You can make a Request to Know the personal information we have about you in the following ways:

• You may make a request by contacting us at:
  • California – Fresno 1 (888) 977-7688
  • California – Northern California 1 (800) 835-7527
  • California – Southern California 1 (888) 412-9170
• You may also make a request through our contact form

Once we receive your Request to Know, we will begin the process to verify that you are the person that is the subject of the request (the “Verification Process”). The Verification Process consists of matching identifying information provided by you with the information we have about you in our records. You will be asked to provide us with information that will help us to verify your identity. If we cannot verify your identity, we will not be able to respond to your request.

Right to Know Sensitive Personal Information Collected

You have the right to request the deletion of your personal information collected or maintained by us (“Request to Delete”), subject to certain exceptions permitted by law.

To make a Request to Delete, please submit a verifiable consumer request pursuant to the instructions below. We will acknowledge your Request to Delete within 10 days and will attempt to respond substantively within 45-90 calendar days.

The Request to Delete must provide sufficient information to allow us to verify that you are the person about whom the personal information was collected, sold or disclosed and must contain sufficient detail to allow us to properly understand, evaluate and respond to your request. If we cannot verify your identity, we will not be able to respond to your request. Additionally, as permitted by law, if the information requested to be deleted is necessary for us to maintain, we will not be able to comply with your request. We will notify you if this is the case.

You can make a Request to Delete in the following ways:

• You may make a request by contacting us at:
  • California – Fresno 1 (888) 977-7688
  • California – Northern California 1 (800) 835-7527
  • California – Southern California 1 (888) 412-9170
• You may also make a request through our: contact form

Once we receive your initial request to delete and your separate confirmation to delete, we will need to verify that you are the person that is the subject of the request (the “Verification Process”). The Verification Process consists of matching identifying information provided by you with the information we have about you in our records. If we cannot verify your identity, we will not be able to respond to your request. If the information requested to be deleted is necessary for us to maintain, we will not be able to comply with your request and will notify you this is the case.

We will retain correspondence, documents and information related to any Request to Know, Request to Delete, or Request to Opt-Out for 24 months as required by law.

Right to Opt-out of Sale or Sharing of Personal Information

You have the right to opt-out of the sale or sharing of your Personal Information. As explained in Annex 1 of this Policy, we share your data with third parties such as social networking sites and advertising companies, in order to serve you with ads tailored to your preferences across various platforms. This type of sharing may be considered “selling” or “sharing” under the CPRA. You can control the information shared about you and request an opt-out as explained below. We will process your Request to Opt-Out of sale within 15 days.

Requests to Opt Out Of a Sale or Share of Personal Information

You can make a Request to Opt Out in the following ways:

• You may make a request by contacting us at:
  • California – Fresno 1 (888) 977-7688
  • California – Northern California 1 (800) 835-7527
  • California – Southern California 1 (888) 412-9170
• You may also make a request through our: contact form

Once we receive your initial request to delete and your separate confirmation to delete, we will need to verify that you are the person that is the subject of the request (the “Verification Process”). The Verification Process consists of matching identifying information provided by you with the information we have about you in our records. If we cannot verify your identity, we will not be able to respond to your request. If the information requested to be deleted is necessary for us to maintain, we will not be able to comply with your request and will notify you this is the case.

We will retain correspondence, documents and information related to any Request to Know, Request to Delete, or Request to Opt-Out for 24 months as required by law.

Opt-out Preference Signals

We honor opt-out preference signals that you enable, including a Global Privacy Control. Opt-out preference signals are plug-ins available in certain browsers that signal to websites you visit of your preferences to opt out of the sale and sharing of certain Personal Information. In order to process your request through an opt-out preference signal, you must use a browser supporting the preference signal. If you choose to use an opt-out preference signal, you will need to turn it on for each browser and each device you use. If you have enabled an opt-out preference signal device from your browser, we will not sell or share your Personal Information without first seeking your explicit consent.

This Policy does not apply to, and we are not responsible for, third-party cookies, web beacons, or other tracking technologies, which are covered by such third-parties’ privacy policies. For more information, we encourage you to check the privacy policies of these third parties to learn about their privacy practices.

Cookies

As explained in our “How We Use ‘Cookies’ and Other Automated Technology” section (add link), you can opt out of cookies using your browser. You may also exercise your right to opt-out of cookies using our Cookie Settings (Link to OneTrust Form).

Please Note:

• Opt-outs are device and browser based. You must opt out on each device and each browser where you want your choice to apply.
• Opt-outs may be stored via cookies. If you clear cookies, your opt out may no longer be valid and you must opt out again where you want your choices to apply.
• We may still share your information with our service providers that help us perform functions that are necessary for our business such as vendors that host our Site, credit card processors, analytics processors. These entities are contractually obligated to keep this information confidential and not use it for any purpose other than for the services they provide to our business.
• You may still receive ads from us that are not tailored to your interests.

Additional Options to Opt-out of Sale or Sharing

In addition to the above options to opt out of the sale or sharing of your information under the CCPA as described above, you have controls and choices with respect to collection and use of your information by third parties. These are summarized for you below. We do not control or maintain opt-out mechanisms for third-party companies and are not responsible for their operation.

Advertising Opt-Out

You can opt out of sharing your information with third-party companies engaged in targeted advertising including social networking sites such as Google and Facebook using the following tools provided through the AdChoices website powered by the Digital Advertising Alliance (“DAA”):

• For websites: http://optout.aboutads.info/
• For mobile apps: http://www.aboutads.info/appchoices

Google Opt-Out

You can opt out of Google Analytics by installing Google’s Opt Out browser add on: https://tools.google.com/dlpage/gaoptout.

You can opt out of interest-based Google ads using: https://adssettings.google.com/u/0/authenticated.

Facebook Ad Preferences

To understand more about Facebook advertising and manage your preferences, please visit https://www.facebook.com/about/ads. Login to Facebook and go to Settings > Ads > Ad Settings (web) or Ad Preferences > Ad Settings (app) for more information..

Right to Non-discrimination for Exercising Consumer Privacy Rights

You have the right not to receive discriminatory treatment for exercising your privacy rights conferred by the California Consumer Privacy Act, including by exercising the rights specified herein. Some of the functionality and features available to you may change or no longer be available to you in some instances.

Right to Correct

You have the right to request that we rectify inaccurate information about you (“Request to Correct”).

Requests to Correct

To make a Request to Correct, please submit a verifiable consumer request pursuant to the instructions below. We will acknowledge your Request to Correct within 10 business days and we will attempt to respond substantively within 45-90 calendar days.

You can make a Request to Correct in the following ways:

• You may make a request by contacting us at:
  • California – Fresno 1 (888) 977-7688
  • California – Northern California 1 (800) 835-7527
  • California – Southern California 1 (888) 412-9170
• You may also make a request through our contact form

Once we receive your Request to Correct, we will need to verify that you are the person that is the subject of the request through the Verification Process. The Verification Process consists of matching identifying information provided by you with the information we have about you in our records. You will be asked to provide us with information that will help us to verify your identity. If we cannot verify your identity, we will not be able to respond to your request.

We will review all information provided by you to us, to determine whether the information is inaccurate. We reserve the right to delete the information instead of correcting if such deletion does not impact you or you consent to the deletion.

We will inform you of our decision to deny or grant your request.

We will retain correspondence, documents and information related to any Request to Correct for 24 months as required by law.

Right to Access Information About Automated Decision Making and the Right to Opt-out of Automated Decision Making

You can request access to information about automated decision making processes Palm Beach Tan uses and you may request to opt out of automated decision making. We do not engage in automated decision making regarding your personal information.

Retention of Personal Information

We will retain your Personal Information for as long as it is necessary for the purposes set out in Annex 1 and to the extent necessary to comply with our legal obligations (for example, if we are required to retain your Personal Information to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

Authorized Agent Information

You may designate an authorized agent to make a request on your behalf under the California Consumer Privacy Act.

Authorized agents can make requests under the California Consumer Privacy Act by emailing us at email address: ccparequests@palmbeachtan.com. We will require authorized agents to provide proof of the consumer’s identity and proof of designation as an the authorized agent. We may also require that a consumer verify his or her own identity directly with us before we respond to an authorized agent’s request.

We reserve the right to deny requests in certain circumstances, such as where we have a reasonable belief that the request is fraudulent.

Other California Disclosure Information

California Do Not Track Notice

Because there are not yet common, industry accepted “do not track” standards and systems, our Site does not respond to Do Not Track signals. In addition, we may allow third parties to collect personal information from your activity on our Site, as described in the “Information Collection and Use” section above and described in Annex 1 below.

California Shine The Light Disclosure Information

Although we do not disclose to any third parties for their marketing purposes any personal information, California residents are entitled to receive the following disclosure information under California law:

Under California Law, California residents have the right to request in writing from businesses with which they have an established business relationship, (1) a list of the categories of personal information, such as name, address, email address, and the type of services provided to the customer, that a business has disclosed to third parties (including affiliates that are separate legal entities) during the immediately preceding calendar year for the third-parties' direct marketing purposes, and (2) the names and addresses of all such third parties. We will respond to such written requests within 30 days following receipt at the email or mailing address specified below under “Contact Us”. If we receive your request at a different email or mailing address, we will respond within a reasonable period of time, but not to exceed 150 days from the date received. Please note that we are required to respond to each customer only once per calendar year.

Changes to This Notice

Palm Beach Tan may update this Notice from time to time for any reason. If this Notice changes, the revised notice will include a new effective date. Be sure to check the Notice whenever you submit Personal Information or use our website, app, services, or engage with our social media accounts. The effective date of this Notice is July 1, 2023.

Contact for More Information

For information and questions about the use of your personal information or this California Consumer Privacy Section or your rights under California law, you may contact us through our contact form.

Colorado, Connecticut, Virginia Consumers Only: Colorado, Connecticut, and Virginia Privacy Act Notices

This Notice provides additional information to Colorado, Connecticut, and Virginia residents whose personal data is collected pursuant to the Colorado Privacy Act (“CPA”), Connecticut Data Privacy Act (“CTDPA”), and Virginia Consumer Data Protection Act (“VCDPA”).

The Notice below applies only to Connecticut, Colorado, and Virginia residents. Any capitalized terms undefined in this Notice have the same definition as the Policy.

Right to Confirm, Access, and Data Portability

You have the right to confirm whether or not we are processing your personal data and to access such personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means. We will respond to your request within 45 days of receipt, unless we request an extension for an additional 45 days to respond.

You can exercise this right in the following ways:

• You may make a request by contacting us at:
  • Colorado: (866) 690-9080
  • Connecticut: (866) 644-5631
  • Virgina: (866) 644-5631
• You make also make a request through our contact form.

Once we receive your request, we will begin the process to authenticate your identity to confirm that you are the person that is the subject of the request (the “Authentication Process”). The Authentication Process consists of matching identifying information provided by you with the information we have about you in our records. Upon making a request, you should be prepared to provide us with information that will help us to verify your identification. If we cannot authenticate your identity, we will not be able to respond to your request.

Information Collected

We have collected the categories of personal data about Connecticut, Colorado, and Virginia consumers as described in this Notice in Annex 1. To review these categories, click here.

Information Sold or Used for Targeted Advertising

As explained in Annex 1 of this Policy, we and our third-party partners such as social networking sites and advertising companies, share your data in order to serve you with ads tailored to your preferences across various platforms. This type of sharing may be considered a “sale” or sharing for targeted advertising purposes under certain state laws. You can control the information shared about you and request an opt-out.

We sell personal data to third parties for a business or commercial purpose as follows:

• Personal Identifiers
• Commercial Information
• Internet/Network Activity
• Geo-location data

We disclose the following categories of personal data for Targeted Advertising (See Annex 1 for further details):

• Personal Identifiers
• Commercial Information
• Internet/Network Activity
• Geo-location data

For details regarding the categories of third parties with whom we have shared this information, please see Annex 1.

Right to Request Deletion of Personal Data

You have the right to request the deletion of your personal data provided by or obtained about you (“Request to Delete”), subject to certain exceptions permitted by law.

To make a Request to Delete, please submit a verifiable consumer request pursuant to the instructions below. We will respond to your request within 45 days of receipt, unless we request an extension for an additional 45 days to respond.

Requests to Delete

You can make a Request to Delete in the following ways:

• You may make a request by contacting us at:
  • Colorado: (866) 690-9080
  • Connecticut: (866) 644-5631
  • Virgina: (866) 644-5631
• You make also make a request through our contact form

Once we receive your request, we will begin the process to authenticate your identity to confirm that you are the person that is the subject of the request (the “Authentication Process”). The Authentication Process consists of matching identifying information provided by you with the information we have about you in our records. Upon making a request, you should be prepared to provide us with information that will help us to verify your identification. If we cannot authenticate your identity, we will not be able to respond to your request.

Right to Correct

You have the right to request that we rectify inaccurate information about you.

To make a Request to Correct, please submit a verifiable consumer request pursuant to the instructions below. We will attempt to respond substantively within 45-90 days.

Requests to Correct

You can make a Request to Correct in the following ways:

• You may make a request by contacting us at:
  • Colorado: (866) 690-9080
  • Connecticut: (866) 644-5631
  • Virgina: (866) 644-5631
• You make also make a request through our contact form

Once we receive your request, we will begin the process to authenticate your identity to confirm that you are the person that is the subject of the request (the “Authentication Process”). The Authentication Process consists of matching identifying information provided by you with the information we have about you in our records. Upon making a request, you should be prepared to provide us with information that will help us to verify your identification. If we cannot authenticate your identity, we will not be able to respond to your request.

We will retain correspondence, documents and information related to any Request to Correct for 24 months as required by law.

Right to Opt-out of Sale of Personal Data

You have the right to opt-out of the sale of your personal data.

Requests to Opt Out

You can make a Request to Opt Out in the following ways:

• You may make a request by contacting us at:
  • Colorado: (866) 690-9080
  • Connecticut: (866) 644-5631
  • Virgina: (866) 644-5631
• You make also make a request through our contact form

Right to Opt Out of Data Processing for Targeted Advertising

You have the right to opt out of the processing of your personal data for purposes of targeted advertising (“Request to Opt Out”).

Requests to Opt Out

You can make a Request to Opt Out in the following ways:

• You may make a request by contacting us at:
  • Colorado: (866) 690-9080
  • Connecticut: (866) 644-5631
  • Virgina: (866) 644-5631
• You make also make a request through our contact form

Opt-out Preference Signals

We honor opt-out preference signals that you enable, including a Global Privacy Control. Opt-out preference signals are plug-ins available in certain browsers that signal to websites you visit of your preferences to opt out of the sale and sharing of certain personal data. If you have enabled an opt-out preference signal device from your browser, we will not sell or share your personal data for targeted advertising purposes without first seeking your explicit consent.

Cookies

As explained in our “How We Use ‘Cookies’ and Other Automated Technology” section (add link to the Cookies section in the main Privacy Policy), you can opt out of cookies using your browser. You may also exercise your right to opt-out of cookies using our Cookie Preference Center (Link to Cookie Banner).

Please Note:

• Opt-outs are device and browser based. You must opt out on each device and each browser where you want your choice to apply.
• Opt-outs maybe stored via cookies. If you clear cookies, your opt-out may no longer be valid and you must opt out again where you want your choices to apply.
• We may still share your Personal Information with our service providers that help us perform functions that are necessary for our business such as vendors that host our Site, analytics processors, etc. These entities are contractually obligated to keep this information confidential and not use it for any purpose other than for the services they provide to our business.
• You may still receive ads from us that are not tailored to your interests.

Additional Options to Opt Out of Sale or Targeted Advertising

In addition to the above options to opt out of the “sale” or processing of your personal data for targeted advertising as described above, you have controls and choices with respect to collection and use of your data by third parties. These are summarized for you below. We do not control or maintain opt-out mechanisms for third party companies and are not responsible for their operation.

Advertising Opt-Out

You can opt out of sharing your data with third-party companies engaged in targeted advertising including social networking sites such as Google and Facebook using the following tools:

• For Websites
• For Mobile Apps

Google Opt-Out

If you would like to opt out of Google Analytics and Ads, you can.  If you are on the web, you can opt out of Google Analytics by installing Google’s Opt Out browser add on here: https://tools.google.com/dlpage/gaoptout, and you can opt out of interest-based Google ads using this link: https://adssettings.google.com/u/0/authenticated.

Facebook Ad Preferences

To understand more about Facebook advertising and manage your preferences, please visit Facebook Ads.  Login to Facebook and go to Settings > Ads > Ad Settings (web) or Ad Preferences > Ad Settings (app) for more information.

Right to Opt Out of Profiling

You have the right to opt out of the processing of your personal data for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects (“Request to Opt Out of Profiling”).

Requests to Opt Out of Profiling

You can make a Request to Opt Out of Profiling in the following ways:

• You may make a request by contacting us at:
  • Colorado: (866) 690-9080
  • Connecticut: (866) 644-5631
  • Virgina: (866) 644-5631
• You make also make a request through our contact form

Once we receive your request, we will begin the process to authenticate your identity to confirm that you are the person that is the subject of the request (the “Authentication Process”). The Authentication Process consists of matching identifying information provided by you with the information we have about you in our records. Upon making a request, you should be prepared to provide us with information that will help us to verify your identification. If we cannot authenticate your identity, we will not be able to respond to your request.

Right to Non-discrimination for Exercising Consumer Privacy Rights

You have the right not to receive discriminatory treatment for exercising your privacy rights, including by exercising the rights specified herein. As the Right to Non-Discrimination is effective across the board, there is no specific “request” that you need to make in order to exercise this right.

Authorized Agent

You may designate an authorized agent to make a request on your behalf to opt out of the sale of personal data.

Authorized agents may make requests under the CTDPA, CPA, and VCDPA on behalf of consumers by filling out our customer care form. We will require authorized agents to provide proof of the consumer’s consent to and designation of the authorized agent for purpose of making the request, and will require authorized agents to provide information necessary to verify the identity of the consumer who is the subject of the request. We may also require that a consumer verify his or her own identity directly with us before we respond to an authorized agent’s request.

Right to Appeal

You have the right to appeal our decision to deny any of your privacy rights requests above. Within 45 days of receipt of your appeal (45 days for Colorado residents), we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.

Colorado residents, if your appeal is denied, you may submit a complaint to the Colorado Attorney General at https://coag.gov/office-sections/consumer-protection/.

Connecticut residents, if your appeal is denied, you may submit a complaint to the Connecticut Attorney General at https://portal.ct.gov/AG/Common/Complaint-Form-Landing-page

Virginia residents, if your appeal is denied, you may submit a complaint to the Virginia Attorney General at https://www.oag.state.va.us/consumer-protection/index.php/file-a-complaint.

Making an Appeal

You can make an appeal in the following ways:

• You may make an appeal by phone by contacting us at: [insert applicable phone number]
  • Colorado: (866) 690-9080
  • Connecticut: (866) 644-5631
  • Virgina: (866) 644-5631
• You may also enter your appeal here https://palmbeachtan.com/contact-us#customer-service-questions. We reserve the right to deny appeals in certain circumstances, such as where we have a reasonable belief that the request is fraudulent.

Retention of Personal Data

We will retain your personal data for as long as it is necessary for the purposes set out in the Privacy Policy https://palmbeachtan.com/privacy-policy and to the extent necessary to comply with our legal obligations (for example, if we are required to retain your personal data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.