Update Privacy Policy

Author: jeffmccune

content/en/blog/news/privacy.md

@@ -6,7 +6,7 @@ aliases: ["/privacy/"]
 authors: ["Jeff McCune"]
 ---
 
-_Last Updated: January, 2024_
+_Last Updated: January, 2025_
 
 **Privacy Policy of Open Infrastructure Services LLC**
 
@@ -21,10 +21,15 @@ Open Infrastructure Services LLC provides custom software development and consul
 ## The Data We Collect About You
 
 We may collect, use, store, and transfer different kinds of personal data about you, which we have grouped together as follows:
+
 - Identity Data includes first name, last name, username, or similar identifier.
 - Contact Data includes email address and telephone numbers.
 - Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.
 
+Customer personal data for all of our products and services is transferred to
+the United States for login credential management and support both of which may
+be performed by US-based resources.
+
 ## How Is Your Personal Data Collected?
 
 We use different methods to collect data from and about you, including through:
@@ -34,6 +39,7 @@ We use different methods to collect data from and about you, including through:
 ## How We Use Your Personal Data
 
 We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:
+
 - Where we need to perform the contract we are about to enter into or have entered into with you.
 - Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
 - Where we need to comply with a legal obligation.
@@ -42,25 +48,57 @@ We will only use your personal data when the law allows us to. Most commonly, we
 
 We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed.
 
-## Data Retention
-
-We will only retain your personal data for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.
-
-## Your Legal Rights
-
-Under certain circumstances, you have rights under data protection laws in relation to your personal data, including the right to request access, correction, erasure, restriction, transfer, to object to processing, to portability of data, and (where the lawful ground of processing is consent) to withdraw consent.
+## Your Rights
+
+We recognize, under the EU-U.S. Data Privacy Framework Principles, the
+Swiss-U.S.Data Privacy Framework Principles, CCPA, the EU GDPR, the UK GDPR, the
+Brazilian General Data Protection Law (LGPD), and other applicable privacy laws,
+that you may have certain rights in regards to your Personal Information. We
+feel that your privacy and ability to preserve and exercise your rights is
+important. You are encouraged to review and understand these rights as they
+pertain to you and your Personal Information. In certain circumstances, these
+rights include, but are not limited to:
+
+- Right to be Informed: This means we have to tell you why we process your Personal Information, our retention periods, and who it will be shared with.
+- Right to Access: This means we have to provide you with a copy of your Personal Information we process upon your request.
+- Right to Rectification: This allows you to have inaccurate Personal Information rectified, or completed if it is incomplete.
+- Right to Erasure: This allows you to have your Personal Information erased.
+- Right to Restrict Processing: This means you can limit the way we use their data.
+- Right to Data Portability: This allows you to receive a copy of your Personal Information in a structured, commonly used and machine-readable format and gives you the right to transmit the data to another controller without hindrance.
+- Right to Object: This allows you to object to the processing of your Personal Information at any time.
+- Right to Non-Discrimination: The CPRA prohibits covered businesses from discriminating against consumers for exercising their CPRA rights. This means we cannot charge a different price, deny access to our products, or impose penalties for exercising your rights under the CPRA.
+- Right to Withdraw Consent: This means you can withdraw your consent at any time.
+
+In support of these rights, you may exercise any of the above rights, with
+respect to your Personal Information. You may update, correct, or delete your
+Personal Information; if you wish to delete or suspend your account, please note
+that we may retain certain information as required by law or for legitimate
+business purposes. If you have become aware that an account has been created
+about you without your knowledge or consent, you may contact us to request
+deletion of that said account. You may contact us by emailing
+[email protected]
+
+For your protection, we may only respond with the Personal Information
+associated with the particular email address that you use to send us your
+request, and we may need to verify your identity before implementing your
+request. We will respond to your request within 30 days.
 
 ## Third-party Links
 
-This website may include links to third-party websites, plug-ins, and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements.
+This website may include links to third-party websites, plug-ins, and
+applications. Clicking on those links or enabling those connections may allow
+third parties to collect or share data about you. We do not control these
+third-party websites and are not responsible for their privacy statements.
 
 ## Third-Party Subprocessors
 
 Available on Request
 
 ## Contact Us
 
-For any and all privacy-related matters, questions or comments, or to exercise a right under the EU’s GDPR, the UK’s GDPR or the CCPA, you may contact us in writing or by email. Our contact information is as follow:
+For any and all privacy-related matters, questions or comments, or to exercise a
+right under the EU’s GDPR, the UK’s GDPR or the CCPA, you may contact us in
+writing or by email. Our contact information is as follow:
 
 Open Infrastructure Services, LLC
 
@@ -76,6 +114,21 @@ Email: [email protected]
 
 Website: https://openinfrastructure.co
 
+In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and
+the Swiss-U.S. DPF, Open Infrastructure Services LLC commits to resolve DPF
+Principles-related complaints about our collection and use of your personal
+information. EU and UK individuals and Swiss individuals with inquiries or
+complaints regarding our handling of personal data received in reliance on the
+EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF
+should first contact Open Infrastructure Services LLC at:
+[[email protected]](mailto:[email protected]).
+
+If these processes do not result in a resolution, you may then contact your
+local data protection authority, the U.S. Department of Commerce, and/or the
+Federal Trade Commission for assistance.
+
 ## Changes to the Privacy Policy
 
-We may update this privacy policy from time to time. We encourage you to review this privacy policy frequently to be informed of how we are protecting your information.
+We may update this privacy policy from time to time. We encourage you to review
+this privacy policy frequently to be informed of how we are protecting your
+information.