CERTA PROPAINTERS, LTD.

PRIVACY POLICY

Last Updated: June 20, 2024

This Privacy Policy (“Privacy Policy” or “Policy”) explains how Certa ProPainters, Ltd. (“we,” or “us,” or “our”) collects personal information based on your interactions with us online and offline, including on our websites, applications, forums, blogs (collectively the “Sites”), other online offerings, when we provide services or offer products online or offline (collectively, the “Services”). This Policy applies to our collection and use of personal information and describes rights you may have with respect to your personal information under various US state laws. By using our Sites and otherwise interacting with us, you agree to the terms of our Terms of Use, including this Policy. Policy. 

This Policy does not cover the personal information we collect about employees and independent contractors, or job applicants. 

Notice at Collection – Personal Information We Collect

We collect the following categories of personal information: 

• Personal identifiers: name, email address, address of the property for which service is requested or provided, your home or billing address, telephone numbers, customer number, account password, IP address 

• Protected class information: For franchise applicants, age, gender, and marital status 

• Commercial and financial information: records of products or Services ordered or considered; other purchasing or consuming histories; payment information; bank account and income information when we assist you in obtaining financing.  For franchise applicants, information about your assets, income, property, and business ownership interests, and other financial information you provide to us 

• Internet or other electronic activity information: your device and browser type, your browsing and search history on our Sites, and information regarding your interaction with our Sites and our advertisements 

• Educational information: education history information provided by franchisee applicants 

• Professional information: job title, information about your employer and, for franchise applicants, employment and business ownership history and recommendations provided by references 

• Audio information: recordings of customer service calls for quality assurance purposes 

• Inferences drawn from personal information we collect 

Sensitive personal information: health-related information if, for example, you tell us you have health conditions (e.g., allergies) that need to be taken into consideration when we provide our Services to you 

We have collected the same categories of personal information in the 12 months prior to the date of this Privacy Policy.    

Notice at Collection – Purposes for Collection of Personal Information

We collect the categories of Personal Information identified for the following purposes:

Notice at Collection – Categories of Personal Information We Sell, Share or Use for Targeted Advertising and Recipients

When we engage in digital advertising, we may sell the following categories of personal information (according to the broad definition of the word “sell” under certain state laws), share them for purposes of cross-context behavioral advertising, or otherwise use them for targeted advertising: personal identifiers (IP address) and internet or other electronic activity information.   

These categories of personal information are sold to or shared for cross-context behavioral advertising or targeted advertising with, advertising networks and other companies that facilitate digital advertising. We do so by allowing third parties to place cookies or other trackers on our Sites that may collect information about your online activities over time and across different websites or applications.  This allows us to reach people that are most likely to be interested in the Services we provide.  Additionally, third parties may use the information they collect to provide you with personalized content and present you with third-party products or services in which you may be interested.  For more information about the use of cookies and trackers, see the section “Our Use of Cookies and Analytics” below.   

We also sell the following categories of personal information to our affiliates, most of which are in the home improvement business, so they can offer their products and services to you:  name, email address, physical address, commercial information such as purchasing history information. 

We do not sell, share for cross-context behavioral advertising, or otherwise use for targeted advertising, any of the other categories of personal information we collect. 

To opt out of sales and sharing of personal information, click here.

Notice at Collection – Retention Periods

We retain the categories of personal information we collect for the length of time necessary to provide our Service (including any warranty services) and to comply with legal obligations or to protect our legal rights.   

Categories of Sources From Which We Collect Personal Information

We collect personal information directly from our customers, website users, and representatives of entities with which we do business or may do business, data aggregators and data brokers.   

We also collect personal information from franchisee applicants, franchises, and referrals provided about franchisee applicants.

Use or Disclosure of Sensitive Personal Information

We do not use or disclose sensitive personal information to create inferences or profiles about individuals or for any purposes other than providing our Services.   

No Profiling to Facilitate Decisions with Legal or Other Significant Effects

We do not engage in the automated processing of personal information to create profiles about individuals that are used in furtherance of decisions with legal or other similarly significant effects, such as the provision or denial of financial or lending services, housing, insurance, or access to essential goods or services. 

Disclosure of Personal Information For Business Purposes in the Past 12 Months

The following chart describes the categories of personal information that we disclosed for a business purpose in the 12 months prior to the date of this Policy: 

Business Purposes for Such Disclosures

We disclosed the aforementioned categories of personal information for the following purposes: to provide our Services; manage customer, supplier and vendor accounts and relationships; process payments; verify customers’ identities; fulfill orders and transactions; engage in advertising and marketing of our Services and those of our affiliates; operate our IT systems and secure our systems; prevent fraud and other illegal activities; obtain professional advice about legal and accounting matters; evaluate and manage franchise applicants and owners.  

Additional Information About How We May Disclose Personal Information and Purposes for Disclosures

We may also disclose your personal information as required or permitted by law to comply with a subpoena or similar legal process or government request, or when we believe in good faith that disclosure is legally required or otherwise necessary to protect our rights and property or the rights, property or safety of others, including to law enforcement agencies, and judicial and regulatory authorities. We may also disclose your personal information to third parties to help detect and protect against fraud or data security vulnerabilities. And we may disclose or transfer your personal information to a third party in the event of an actual or potential sale, merger, reorganization of our entity or other restructuring. 

Our Use of Cookies and Analytics

We and our service providers may use cookies, pixel tags, web beacons and other similar tracking technologies (“tracking technologies”) to automatically collect information through the Services. Tracking technologies are essentially small data files placed on your computer, tablet, mobile phone, or other devices that allow us to record certain pieces of information whenever you visit or interact with our Sites and Services. We may use these tracking technologies to help identify irregular behavior, prevent fraudulent activity, and improve security, as well as making it possible for you to save your preferences and help us understand how you interact with our Site.   

We also allow third parties, including Google and Meta, to use tracking technologies on our Sites for analytics and advertising.  They assist in helping display advertisements, tailor advertisements to your interests and to assist in determining if you require assistance or are having problems navigating on our Sites.  Some of these third parties use the tracking technologies to collect information about how you interact with other websites and advertisements across the Internet in order to provide advertising that is tailored to your interests, and which may appear on our Sites or on other websites or platforms.  

You may set your browser to notify you when you receive a cookie. Many web browsers also allow you to block cookies. You can disable cookies from your computer system by following the instructions on your browser or at www.youradchoices.com. 

We use Google Analytics to evaluate the use of our Sites. Google Analytics uses cookies and other identifiers to collect information, such as how often users visit a Site, what pages they visit when they do so, and what other websites they visited prior to visiting our Site. For information about Google’s privacy practices, please refer to the Google Privacy Policy: https://policies.google.com/privacy?hl=en-US#infocollect. 

Personal Information of Minors

Our products and Services are not directed to minors under the age of 18 and we do not knowingly sell or share for purposes of behavioral advertising the personal information of minors, including minors under 16 years of age.  

Third Party Websites and Social Media Buttons

Our Sites may contain links to third party websites, including social media buttons that link to social media platforms. This Policy does not govern how those third parties or social media platforms collect or use personal information and we do not endorse or have control over their practices.  The privacy policies and terms of use for those third parties’ websites/apps or social media platforms govern those companies’ privacy practices. We are not responsible for the content or privacy practices of any third-party websites or platforms.

Do Not Track Signals

Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. Please note that we do not respond to or honor DNT signals.  We recognize the Global Privacy Control opt-out preference signal for IP addresses in California and Colorado.  See U.S. Privacy Rights – Opt-Out Preference Signals discussion below for more information about the Global Privacy Control.   

How We Keep Your Personal Information Secure

We implement and maintain reasonable security appropriate to the nature of the personal information that we collect, use, retain, transfer or otherwise process.  However, there is no perfect security, and reasonable security is a process that involves risk management rather than risk elimination.  While we are committed to maintaining a reasonable information security program, no such program can be perfect; in other words, all risk cannot reasonably be eliminated. Data security incidents and breaches can occur due to factors that cannot reasonably be prevented.  Accordingly, it cannot be assumed that the occurrence of any given incident or breach results from our failure to implement and maintain reasonable security.

Changes to This Policy

We will review and update this Policy from time to time.  If changes are made, we will update the Privacy Policy and reflect the date of such modification in the date above. If the changes are material, you will be notified via email or a notice on our website. 

Accessibility

We are committed to ensuring that our communications are accessible to people with disabilities. To make accessibility-related requests or report barriers, please contact us at [email protected].  

US State Data Privacy Rights

We are subject to state privacy laws in California, Colorado, Connecticut, Oregon, Texas, Utah, and Virginia. These laws give state residents various rights with respect to many types of personal information we collect about them, with some exceptions.  The rights provided under these laws are similar in many respects, with some differences from state to state.  We list below the rights that may be applicable to our business under these laws:  

Right to Know: The right to confirm whether or not we are processing a resident’s personal information and to access such data.  Laws in some states provide the right to know more detailed information.  

• California’s privacy law gives residents the right to request the following additional information collected since January 1, 2022: Categories of personal information we have collected about them; categories of sources from which such personal information was collected; categories of personal information that the business sold or disclosed for a business purpose about the consumer; categories of third parties to whom the personal information was sold or disclosed for a business purpose; and the business or commercial purpose for collecting or selling your personal information. 

• Oregon’s privacy law gives residents the right to request a list of third party entities to which we have disclosed personal information.  

Right to Access / Copy: The right to access or request a copy of the personal information we have collected from the resident, subject to certain exceptions. 

Right to Delete: The right to request deletion of their personal information that we have collected from or about the resident and to have such information deleted, subject to certain exceptions. 

Right to Correct: The right to request that we correct inaccuracies in the resident’s personal information, taking into account the nature of personal data and purposes of processing such information.  This is not a right under the Utah data privacy law.  

Right to Limit the Use of Sensitive Personal Information: California’s law gives residents the right to request that we not use or disclose their sensitive personal information for inferring characteristics about a consumer or for purposes other than to provide goods and services, protect and investigate fraud and other security-related issues, nonpersonalized advertising, and similar purposes described in the law.    

Rights to Opt Out:  Various rights to request that we stop using the resident’s personal information for one or more of the following purposes:  

• Sale of Personal Information: The right to request that we stop selling f their personal information, consistent with the definition of “sale” in each law. This is not a right available under the Utah data privacy law. 

• Targeted Advertising: The right to request that we stop processing their personal information for targeted advertising, subject to exceptions in some state laws.  This is not a right that is specified under the California data privacy law.    

• Sharing for Cross-Context Behavioral Advertising: California’s law provides the right to request that we stop sharing personal information for cross-context behavioral advertising.   

Please note, California’s law is the only law that applies to all state residents, irrespective of the context in which they interact with us (e.g., a customer, a business contact, a vendor).  Laws in other states apply only to people when acting in an individual or household context. 

California Shine the Light

California Civil Code Section 1798.83, also known as the “Shine the Light” law, permits California residents to annually request information about the personal information disclosed to third parties for direct marketing purposes in the preceding calendar year.  To make a request, please contact us at 1-844-991-0269. 

Exercising Your Rights

• We will respond to requests from residents of states with data privacy laws that apply to us and will do so with respect to the rights that are provided under the requestor’s state law as of the effective date of that law.  The laws in some states listed above may not be in effect as of the date of this Privacy Policy.  

  To exercise rights to know, access/copy, delete, correct, or know third parties to whom personal information is disclosed, contact us at 1-844-991-0269 or click here.  We will provide a substantive response to these requests within 45 days of the date on which we receive your request. If we require additional information or time to process your requests, we will contact you. 

  To exercise opt-out rights, submit your request here. 

  Opt-out Preference Signals 

  An opt-out preference signal is sent by a platform, technology, or mechanism on behalf of consumers and communicates a consumer’s choice to opt out of the sale and sharing of personal information for cross-context behavioral advertising with all businesses that recognize the signal, without having to make individualized requests.  The signal can be set on certain browsers or through opt-out plug-in tools.   

  We recognize the Global Privacy Control signal for California and Colorado residents based on IP address and do so at the browser level and, therefore, it does not apply to personal information we may collect offline or that we may associate only with your name or email address.  This means that if the signal is sent through a specific browser, we will recognize it for that browser only, and only with respect to the identifiers for that browser.  If you would like more information about opt-out preference signals, including how to use them, the Global Privacy Control website has such information (https://globalprivacycontrol.org/).  

  We will respond to opt-out requests and requests to limit the use of sensitive information as soon as feasibly possible, but no later than 15 business days after receipt of your request.  If we require additional information or time to process your requests, we will contact you.  

  Exercising Your Rights Using Authorized Agents 

  Agents may submit opt-out requests on behalf of individuals under several state data privacy laws; this is not an option that is available under laws in Texas, Utah, or Virginia.  California residents can designate an agent to submit all other types of requests. If the agent submits an opt-out request on your behalf, the agent will need to provide us with your signed permission indicating the agent has been authorized to submit the opt-out request on your behalf.  Agents can submit opt-out requests here.   

  If you are a California resident and you use an agent to submit other types of requests, the agent will need to provide us with your signed permission indicating the agent has been authorized to submit the request on your behalf.  You will also be required to verify your identity directly with us or confirm with us that you provided the agent with permission to submit the request. Agents can submit requests on behalf of California residents (other than opt-out requests) here.   

  Please note that this subsection does not apply when an agent is authorized to act on your behalf pursuant to a valid power of attorney.  Any such requests will be processed in accordance with state law pertaining to powers of attorney. 

  Verification of Requests  

  When you exercise rights other than opt-out rights, we will take steps to verify your identity.  We will ask you for at least two pieces of personal information, depending on the nature of the request, and attempt to match those to information that we maintain or collect about you. 

  If we are unable to verify your identity with the degree of certainty required, we will not be able to respond to the request.  We will notify you to explain the basis of the denial. 

  When We Do Not Act on a Request – Appeal Process  

  In some cases, we may not act on your requests (e.g., if we cannot do so under other laws that apply). When this is the case, we will explain our reasons for not providing you with the information or taking the action (e.g., correcting data) you requested.     

  Additionally, under some state laws, you have the right to appeal our decision by contacting us within 30 days after your receipt of our decision.  We will provide additional details about how to appeal in our response to you.  

  Non-Discrimination 

  If you exercise any of the rights explained in this Privacy Policy, we will continue to treat you fairly.  If you exercise your rights under this Privacy Policy, you will not be denied or charged different prices or rates for goods or services or provided a different level or quality of goods or services than others.  

  Contact Us 

  If there are any questions regarding this Privacy Policy or to request a copy of this Privacy Policy in another format you may contact us at [email protected] or 1-844-991-0269.