Privacy Policy

Effective Date: July 1, 2023

CaaStle Inc. and its subsidiaries ("CaaStle", "we," "us," or "our") takes your privacy seriously. This Privacy Policy describes how we collect, use, share and protect Personal Information of our employees including former employees (collectively "Employees"), job applicants and independent contractors (Employees, job applicants and independent contractors collectively referred as "People Resources", "you" or "your"). This Privacy Policy applies to People Resources who are residents of California. If you are also a customer of a CaaStle service, please visit those sites for additional information about how to access your customer data. This Privacy Policy informs People Resources about the categories of Personal Information CaaStle has collected about them in the preceding twelve (12) months period.

This Privacy Policy explains:

• The categories of Personal Information we collect about People Resources
• The categories of sources from which we collect People Resources' Personal Information
• The purposes for which we use People Resources' Personal Information
• How we may disclose People Resources' Personal Information
• How long we keep People Resources' Personal Information
• People Resources' privacy rights and how to exercise them
• Other important information
• Contact information

Definitions

Personal information means information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular People Resource . Personal information does not include publicly available information from government records, and deidentified or aggregated People Resources information.

• I. CATEGORIES OF PERSONAL INFORMATION WE COLLECT

  We have collected the following categories of Personal Information from People Resources within the last twelve (12) months.

  Category	Examples1	Collected
  		Employee	Applicant	Contractor
  A. Identifiers.	Name, persona email address, personal postal address, Internet Protocol address, personal zip code, personal phone number, fax number, account name, social media account name, user names, profile links, social media handles, Social Security number, unique personal identifier, online identifier, driver's license number, passport number, or other similar identifiers.	YES	YES	YES
  B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	Signature, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.	YES	YES	YES
  C. Protected classification characteristics under California or federal law.	Age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information), requests for family leave, disability leave and medical leave.	YES	NO	NO
  D. Commercial information.	Records of purchase history and purchasing consumption or tendencies.	YES	NO	NO
  E. Biometric information.	Voice recordings, genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.	NO	NO	NO
  F. Internet or other similar network activity.	Browsing history, search history, information on People Resource's interaction with a website, application, or advertisement.	YES	YES	YES
  G. Geolocation data.	Physical location or movements.	YES	NO	NO
  H. Sensory data.	Audio, electronic, visual, thermal, olfactory, or similar information.	NO	NO	NO
  I. Professional or employment-related information.	Current or past job history or performance evaluations.	YES	YES	YES
  J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	NO	NO	NO
  K. Inferences drawn from other personal information.	Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	NO	NO	NO
  L. Sensitive Personal Information	Personal information that reveals a person's: social security, driver's license, state identification card or passport number, account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password or credentials allowing access to the account; precise geolocation, race or ethnic origin, religious or philosophical beliefs, union membership, contents of a person's mail, email and text messages unless the business is the intended recipient; genetic data; processing biometric information for the purpose of uniquely identifying a person; information collected and analyzed concerning a person's health, sex life or sexual orientation. Note: Sensitive personal information does not include information that is "publicly available" as defined in 1798.140(v)(1)(L).cal	YES	YES	YES

  ¹ Examples provided in the table are only for illustration purposes and does not represent that CaaStle collects all the information listed as examples. To determine or identify any specific pieces of Personal Information we have collected on you, you may exercise your privacy rights mentioned in Section VI below.

  Statement regarding inferring characteristics from sensitive personal information. We do not collect or process sensitive personal information for the purpose of inferring your characteristics.

• II. CATEGORIES OF SOURCES FROM WHICH WE COLLECT PEOPLE RESOURCES' PERSONAL INFORMATION

  In the event we obtain Personal Information from People Resources as identified above, we may use the following categories of sources:

  • Directly from People Resource - We collect certain categories of Personal Information directly from the People Resource.
  • Information created by or at the direction of CaaStle - As part of People Resources' relationship with CaaStle, we create Personal Information related to or about their engagement with CaaStle or collect such Personal Information from your colleagues.
  • Third parties - We collect People Resource's Personal Information from job references, business partners, professional employer organizations or staffing agencies, insurance companies, background check verification organizations.
  • Technologies installed by CaaStle or using CaaStle's resources - We may monitor activity across CaaStle networks or utilize video or audio security systems etc,. to the extent required or permitted by law.
  • Public internet sources - We collect information from publicly accessible social media, job boards, public profiles, and other public online sources.
  • Public records - for example, court records etc.

• III. PURPOSES FOR WHICH WE USE PEOPLE RESOURCES' PERSONAL INFORMATION

  We collect People Resources' Personal Information as reasonably necessary and proportionate to achieve following business purposes:

  • Manage our employment or professional relationship with People Resource.
  • Recruit and process employment applications, including verifying eligibility for employment and conducting background and relationship checks.
  • Conduct employee onboarding.
  • Maintain and administer payroll and employee benefit plans including for leaves of absence.
  • Maintain personnel records and comply with record retention requirements.
  • Provide employees with human resources management services and employee data maintenance and support services.
  • Communicate with employees and independent contractors and their emergency contacts and plan beneficiaries.
  • Comply with applicable state and federal labor, employment, tax, benefits, workers' compensation, disability, equal employment opportunity, workplace safety, and related laws.
  • Prevent unauthorized access to or use of the CaaStle property, including information systems, electronic devices, network, and data.
  • Ensure compliance with CaaStle policies.
  • Respond to law enforcement requests and as required by applicable law or court order.
  • Exercise or defend our legal rights.
  • Design, implement, and promote CaaStle's diversity and inclusion programs.
  • Perform workforce analytics, data analytics, and benchmarking.
  • Conduct internal audits, grievances, and suspected violations of CaaStle's policy.
  • Administer and design health wellness programs.
  • Evaluate and provide useful feedback about job performance including appropriateness for promotion or transfer to a new position at CaaStle, facilitate better working relationships, and for employee professional development.
  • Conduct job applicant reference checks to assist in hiring decisions.
  • Seek and process independent contractor arrangements.
  • Maintain and administer independent contractor payments.
  • Provide independent contractors with any data maintenance and support services.

• IV. HOW WE MAY DISCLOSE PEOPLE RESOURCES' PERSONAL INFORMATION

  CaaStle may disclose People Resources' Personal Information to the following recipients:

  • As required by law or other legal obligations - We may disclose People Resources' Personal Information to government authorities or administrative agencies as required by law or other regulations, such as to verify eligibility for employment, maintain and administer payroll, or otherwise comply with applicable state and federal labor, employment, tax, benefits, workers' compensation, disability, equal employment opportunity, workplace safety, and related laws. We may also disclose People Resources' Personal Information to respond to law enforcement requests or as required by applicable law or court order.
  • To protect CaaStle and others. We may disclose People Resource Personal Information where we believe it is necessary to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, or as evidence in litigation in which we are involved.
  • Screening providers - We may disclose job applicant and employee Personal Information for pre-employment screening purposes, such as drug testing providers, consumer reporting agencies, including background or credit check providers, and personality assessment or survey providers.
  • Service providers - We may disclose People Resources' Personal Information to vendors, service providers, contractors or agents with whom we contract and who perform functions on our behalf. These service providers may include recruiters, human resources vendors, financial service providers, consultants, benefit providers and vendors that provide recruiting resources.
  • Business transfers - If we are acquired by or merged with another company, if substantially all of our assets are transferred to another company, or as part of a bankruptcy proceeding, we may transfer People Resources' Personal Information to the other company.

  Statement regarding sale or sharing of Personal Information. We do not sell the Personal Information of People Resources nor share the Personal Information of People Resources for cross-context behavioral advertising.

• V. HOW LONG WE KEEP PEOPLE RESOURCES' PERSONAL INFORMATION

  We retain personal information for the period necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. The length of time we retain Personal Information depends on the nature of Personal Information and the context in which it was received. The retention period for our business records is set based on the length of time Lincoln needs the record for: (1) its original purpose; (2) other operational purposes, such as audits and reporting; and/or (3) legal compliance, including maintenance of opt-out/in lists, legal defense, and legal holds.

• VI. PEOPLE RESOURCES' PRIVACY RIGHTS AND HOW TO EXERCISE THEM

  A. Your California Privacy Rights

  If you are a resident of California, you may exercise the rights or submit requests and questions described in this section.

  • Right to know what Personal Information we collect, and right to access Personal Information. You have a right to know categories of Personal Information collected, the sources of Personal Information, our purpose of collecting and using Personal Information, and categories of external recipients to which Personal Information is disclosed. This information is provided above in this Privacy Policy. You also have a right to request for copies of specific pieces of Personal Information collected in the preceding twelve (12) months period or at your option since January 1, 2022. You may submit a verifiable request for access to your Personal Information. You may make these requests up to twice in a twelve (12) months period. If required by law, upon request, we will grant you access to the personal information that we have about you. Please note that we will deny a request to access personal information if we are unable to verify that it is you or someone legally authorized to act on your behalf who is making the request.
  • Right to correct inaccurate Personal Information. If you believe that Personal Information we maintain about you is inaccurate, you have the right to submit a verifiable request for the correction of inaccurate Personal Information maintained by us, taking into account the nature of the Personal Information and the purposes of processing the Personal Information.
  • Right to delete Personal Information. You have the right to submit a verifiable request for the deletion of Personal Information that you have provided to us, subject to certain exceptions allowed under applicable law.
  • Right to opt-out of sale and sharing of your Personal Information. You have the right to opt out of the sale of your personal information and the disclosure of your personal information for cross-context advertising. As noted above, we do not sell Personal Information or share Personal Information for cross-context advertising.
  • Right to limit use of sensitive Personal Information. You have the right to tell us not to process sensitive personal information except for the purpose for which it was originally collected. As noted above, we do not collect or process sensitive personal information for the purpose of inferring your characteristics.
  • Right to non-discrimination for the exercise of your privacy rights. If you choose to exercise any of the privacy rights described above, we will not discriminate against you. You also have the right not to receive discriminatory treatment by us, including retaliation against you.

  B. How to Exercise Privacy Rights

  You may exercise the rights described above by:

  • Submitting requests through our webform here www.CaaStle.com and/or
  • Contacting us at peopleops@caastle.com

  C. How We Verify and Respond to Your Requests

  When you submit a privacy rights request, we will require that you verify your identity before we can process your request. Considering the nature of your request, we may request additional Personal Information to verify your identity (and this information will not be used for any other purpose than verification). We will match the Personal Information that you provide with your request against information that we already have about you in our records. If we are not able to verify your identity, we may require different Personal Information (that we have not already collected for another purpose) to verify the request.

  Even if we are able to verify a request, we may nevertheless deny the request because we are either required or permitted to by law. Regardless of the method used to submit a request to access, delete, or correct your personal information, we must deny your request if we are unable to verify your identity.

  We will acknowledge receipt of your requests to know, to delete, and to correct information within ten (10) business days of receipt of your requests. We will respond to your request within forty-five (45) days; if we need additional time we will notify you that we need up to another forty-five (45) days to respond.

  D. Authorized Agents

  You may also designate an authorized agent to make a request on your behalf; however, we may require a signed copy of the "Authorized Agent Designation Form" authorizing the agent to submit the request. Please note that you will still need to verify your identity directly with us before we can process the request submitted by an authorized agent. You can obtain an "Authorized Agent Designation Form" by submission of request as per methods noted above in Section VI.(B).

• VII. OTHER IMPORTANT INFORMATION

  • Changes to This Privacy Policy. Please refer back to this Privacy Policy on a regular basis. We may modify this Privacy Policy from time to time and without notice. The most recent version of the Privacy Policy will always be posted on this Page, with the effective date posted at the top of the Privacy Policy. By visiting this Page after the effective date, you are deemed to consent to our then-current Privacy Policy.

• VIII. CONTACT INFORMATION

  If you have any questions, comments, or concerns about our privacy practices, please contact us by one of the following methods:

  By e-mail at peopleops@caastle.com , or
  By writing to us at the following address:
  CaaStle Inc.
  5 Penn Plaza, Fl. 4
  New York, NY 10001
  Attn: Legal Department

CLICK HERE TO SUBMIT A REQUEST.

Last Updated and Effective Date: September 1, 2023

CaaStle Inc. and its subsidiaries ("CaaStle", "we," "us," or "our") takes your privacy seriously. This Privacy Policy describes how CaaStle collects, uses, shares, and protects Personal Information. This Privacy Policy covers Business Contacts (defined below) who are residents of California and applies to the Personal Information that is provided in their business interactions with CaaStle. This Privacy Policy informs Business Contacts about the categories of Personal Information CaaStle has collected about them in the preceding twelve (12) months period and also includes information about rights and choices regarding your Personal Information, and how you can reach us. You can skip to a particular topic by clicking on the headings listed below.

This Privacy Policy does not apply to:

• Personal Information that is collected (a) through our customer facing website or mobile application that we operate and (b) in connection with your use of our products and services. If you are also a customer of a CaaStle service, please visit those sites from which you have availed our products or services, for additional information about our privacy practices with respect to customer data.
• Personal information that we collect about any individual in their capacity as one of our current or former employees, job applicants, or contractors. For information about our privacy practices with respect to information that we collect about employees, job applicants, and contractors, please visit this link.

Definitions

"Branded Affiliates" means creators who partner with CaaStle to launch and market to members of their communities, and to consumers generally, branded rental subscription programs for apparel in the United States. For the purposes of this Privacy Policy, Business Contacts includes our Branded Affiliates.

"Business Contacts" means any individual who is acting as an employee, owner, director, officer, or independent contractor of our vendors, clients, professional service providers or Branded Affiliates (collectively referred to as our "Business Partners") and who interacts with CaaStle during the course of providing or receiving a product or service. For the purposes of this Privacy Policy, Business Contacts are also referred to as "you" or "your".

"Personal Information" means information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Business Contact. Personal information does not include publicly available information from government records, and deidentified or aggregated Business Contact information.

This Privacy Policy explains:

• Types of Information We Collect and Why.
• How We Collect Information.
• How We Use Information.
• How We Share Information.
• Cookies and Other Tracking Technologies.
• Your Choices.
• How We Protect Personal Information.
• How Long We Retain Information.
• Children's Privacy.
• Other Important Information.
• Contact Information.

• I. Types of Information We Collect and Why.

  The following provides examples of the types of information that we collect, identifies the sources from which we collect such information, and explains why we collect the information.

  Category of Information	Examples of Information	Sources of Collection	Business Purpose(s)
  Identifiers	Name, mail address, postal address, IP address, billing code, phone number, account name, social media account names / usernames / handles, social security number, unique personal identifier, online identifier.	We collect this information directly from you, collect it from your device or browser, or receive it from third parties such as social media platforms etc.	We use this information to manage and maintain our relationship with you and our Business Partners, including account management, the selection and vetting of Business Partners, information gathering regarding Business Partners, and performing due diligence reviews.
  Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))	Signature, bank account number, credit card number, debit card number, or any other financial information.	We collect this information from you directly, typically when you enter into a definitive arrangement with us.	We use this information to manage and maintain our relationship with you and our Business Partners, including account management.
  Internet or Other Similar Network Activity	Browsing history, search history, and information about your interactions with our Site, Services, advertisements, information about social media posts, and other content.	We may collect this information from you directly typically when you interact with our Site, collect it from your device or browser, or receive it from third parties such as social media platforms or third-party applications etc.	We may use this information to improve the Site to optimize and provide a better user experience, information gathering regarding Business Partners, analyze and measure effectiveness of social media posts, and performing due diligence reviews.
  Professional and/or Education-Related Information	Occupation like company details and job title.	We may collect this information from you directly.	We use this information to manage and maintain our relationship with you and our Business Partners, including account management, the selection and vetting of Business Partners, information gathering regarding Business Partners, and performing due diligence reviews.
  Protected classification characteristics under California or federal law	Residential status.	We may collect this information directly from you when you show interest in joining us as a Branded Affiliate.	We use this information for legal compliance purposes.
  Geolocation Data	Physical location within a greater metropolitan area	We collect this information directly from your interactions with our Site.	We may use this information to manage and maintain our relationship with you and our Business Partners.
  Sensory Data	Audio or visual recorded electronic information	We may collect this information directly from you typically when you provide feedback to us.	We may use this information to improve our services and our Business Partners experience.
  Sensitive Personal Information	Personal information that reveals a person's social security number, account log-in, financial account, password or credentials allowing access to the account.	We may collect this information directly from you typically when you provide W-9 for tax related purposes and when we create your account to manage our relationship.	We use this information to manage and maintain our relationship with you and our Business Partners.

  Statement regarding inferring characteristics from sensitive personal information. We do not use or disclose any sensitive personal information to draw inferences or build a profile about you or to conduct advertising of any kind.

  We may use aggregate, statistical and "de-identified" information, which is anonymized and does not specifically identify you or any other individual person(s). We only use such information in a de-identified form and will not attempt to reidentify such information, except as permitted or required by applicable law.

• II. How We Collect Information.

  We collect personal information in a variety of different ways depending upon the category of Personal Information.

  • Information Provided by You. We ask you to provide personal information when you engage with us in a business capacity.
  • Information Collected from a Device Associated with You. We and our third-party partners with whom we work to provide you Services may automatically collect certain of your information when you access our website www.caastle.com (“Site”). Such information may include your Internet Protocol address ("IP address"), device identifier(s), browser type, and information about how you use and interact with the Services.
    
    

    We use tracking technologies, such as cookies, web beacons (also known as "pixels"), and other similar technologies (collectively, "Tracking Technologies") to collect this information. A cookie is a small text file that is stored on a device for record-keeping or tracking purposes. Web beacons and pixels are pieces of code embedded in the Services that can collect information about a person's interaction with a particular web page or content, such as whether the person has clicked on a particular link. For more information about Tracking Technologies and how to manage your preferences, see Section IV (Cookies and Other Tracking Technologies) and Section VI (Your Choices) below.

    Additionally, we use log files to record certain technical information about how our customers and Site visitors interact with the Services. This Site traffic information may include your IP address, browser type, internet service provider, timestamps, and other clickstream data. Our servers store this information in log files.

    If the information that we collect automatically identifies you or could be reasonably used to identify you, then it is treated as your personal information. In many cases, the information that we collect automatically is only used in de-identified or aggregated forms, and it does not identify any particular individual.

  • Information Collected from Third-Party Sources. We may receive certain of your information from third-party sources, such as our Service Providers (defined in Section IV (How We Share Information) below) with whom we have partnered for business purposes. We may also obtain information about you from publicly available sources such as social media platforms. This Privacy Policy does not apply to the collection of information by those third parties. For more information about the privacy practices of social media platforms and other third-party networks, please review the privacy policies and settings of the third-party platforms and networks that you use.

• III. How We Use Information.

  We collect your Personal Information for maintaining business relationships with you, which includes:

  • When CaaStle is providing certain services:
    • (a) To provide the products and services requested by our client or Branded Affiliates and perform our contractual obligations to you or the organization you work for.
    • (b) To communicate with you about the services or products your organization uses.
    • (c) To advertise and market our new products and services to you.
    • (d) To provide technical support and customer service.
    • (e) To detect and help protect against security incidents and illegal, fraudulent, or unauthorized activities.
    • (f) To authenticate your credentials for account access and information and provide other security protections.
    • (g) To raise invoices for services rendered or product offered.
    • (h) To improve our services.
  • When CaaStle is receiving certain services:
    • (a) To allow our Business Partners to provide services contracted.
    • (b) To process orders and payments.
  • General purpose:
    • (a) To verify your identity.
    • (b) To comply with, defend, pursue, and enforce applicable legal and regulatory obligations and respond to governmental requests.
    • (c) To facilitate or verify the appropriate calculation of taxes.

  The purposes listed above are general and may not apply to all categories of Business Contacts. To determine or identify the specific purpose for which we have collected your Personal Information we have collected on you, you may exercise your privacy rights mentioned in Section VI below.

• IV. How We Share Information.

  We may disclose your information to our affiliates and/or to certain third parties as described below:

  • Our Affiliates and in Connection with Business Transactions. We may share information with other companies within the CaaStle corporate family (e.g., sister companies, subsidiaries, joint ventures, or other companies under common control) (our "Affiliates"). If another person or entity acquires, or plans to acquire, our company, business, or assets, we may share information with that person or entity, including at the negotiation stage. Some or all of the personal information that we collect may be part of the assets that are transferred to complete this type of transaction.
  • Service Providers. We share information with service providers that we have engaged to assist us with providing and improving the Services and our business operations ("Service Providers"). For example, we use Service Providers to assist with managing our Site, processing payments, fulfilling and shipping orders, providing technical support, conducting surveys and research, analytics, marketing our Services, communicating with our customers, detecting and preventing fraud, collecting overdue payments, dispute resolution, and legal compliance. We share information with Service Providers only as necessary for them to perform their functions.
  • Advertising Networks. We may partner with advertising networks to provide advertisements that promote our services on third-party websites and applications that may be of interest to you ("Advertising Networks"). We may share your information with Advertising Networks to provide tailored advertising content. Additionally, these Advertising Networks may collect information about your visits to our Site using Tracking Technologies. Please see Section VI (Your Choices) below for information about managing your preferences in relation to targeted advertising.
  • Governmental Authorities and Legal Process. We may disclose information to federal, state, and/or local governmental agencies and authorities, including those related to law enforcement ("Governmental Authorities"), if we are required to do so to comply with the law or legal processes. When permitted, we may disclose personal information to Governmental Authorities in response to their request(s) or in connection with a legal process when we believe that disclosing such information is necessary or advisable to defend against a legal claim or to protect our or others' safety, rights, or property.
  • Other Third Parties. We may disclose your information to other third parties when we have your consent or direction to do so.

• V. Cookies and Other Tracking Technologies.

  We and certain of our third-party partners use cookies and other Tracking Technologies to gather information when you interact with our Site (www.caastle.com). Some Tracking Technologies help us maintain the security of our Site, prevent crashes, fix bugs, save certain of your preferences, and assist with basic site functions. These Tracking Technologies are referred to as "strictly necessary" because they are necessary for our Site to work properly. We use "performance" cookies and other Tracking Technologies to assess the performance of our Site, for data analytics purposes, and to help us understand how our visitors interact with our Site. We use “functional” cookies and other Tracking Technologies to personalize your experience with our Site and offer enhanced functionality when you access or use our Site. For example, we use "functional" Tracking Technologies to maintain your preferences over time and recognize you when you return to the Site.

  We also permit certain of our third-party partners to use "advertising" cookies and other Tracking Technologies on our Site for analytics and advertising purposes, including to help manage and display advertisements, to tailor content to your interests, and/or to send targeted communications. Our third-party partners may use information accessible through these Tracking Technologies to provide advertising about products and services tailored to your interests, and such advertisements may appear on our websites or other, third-party websites that we do not control. These third parties may also collect information over time and across other websites, in addition to our Site. Under certain privacy laws, this may be considered "targeted," "cross-context behavioral," or "interest-based" advertising. You may opt-out of these “advertising” Tracking Technologies by clicking the “Do Not Sell or Share My Personal Information” link in the footer of our Site's homepage and following the instructions to set your preferences. Please see Section VI (Your Choices) below for more information about your options.

  You may also block or delete cookies from your device by modifying your browser settings. Please note that the Site may not function properly for you if you block or delete certain cookies. To find out more information about cookies generally, including information about how to delete cookies, please visit https://allaboutcookies.org/.

• VI. Your Choices.

  A. Your California Privacy Rights

  If you are a resident of California, you may exercise the rights or submit requests and questions described in this section.

  • Right to know what Personal Information we collect, and right to access Personal Information. You have a right to know categories of Personal Information collected, the sources of Personal Information, our purpose of collecting and using Personal Information, and categories of external recipients to which Personal Information is disclosed. This information is provided above in this Privacy Policy. You also have a right to request for copies of specific pieces of Personal Information collected in the preceding twelve (12) months period or at your option since January 1, 2022. You may submit a verifiable request for access to your Personal Information. You may make these requests up to twice in a twelve (12) months period. If required by law, upon request, we will grant you access to the personal information that we have about you. Please note that we will deny a request to access personal information if we are unable to verify that it is you or someone legally authorized to act on your behalf who is making the request.
  • Right to correct inaccurate Personal Information. If you believe that Personal Information we maintain about you is inaccurate, you have the right to submit a verifiable request for the correction of inaccurate Personal Information maintained by us, taking into account the nature of the Personal Information and the purposes of processing the Personal Information.
  • Right to delete Personal Information. You have the right to submit a verifiable request for the deletion of Personal Information that you have provided to us, subject to we require to keep your personal information on file to continue providing you with or receiving from you the certain services, comply with our legal obligations, resolve disputes, enforce our agreements, protect against fraudulent or other unlawful activity, or for another one of our business purposes.
  • Right to opt-out of sale and sharing of your Personal Information. You have the right to opt out of the sale of your personal information and the disclosure of your personal information for cross-context advertising. Our use of "advertising" Tracking Technologies may be considered a "sale" or "sharing" of personal information for targeted advertising purposes under applicable law. You may opt out of these Tracking Technologies by doing one of the following:
  • Accessing the privacy preference center and setting your preferences via this link: Do Not Sell or Share My Personal Information, which is also accessible via the footer of our Site's homepage. Please note that, in some cases, your opt-out preferences may only be linked to your device or browser identifier. If you visit our Site from another device or using another browser (or after your original browser's cookies have been erased), you may need to renew your opt-out choice;
  • Visiting our Site and broadcasting a legally-recognized opt-out preference signal, such as the Global Privacy Control (GPC) on the browser(s) and/or browser extension(s) that you use to access our Site, to the extent that such browser(s) and/or browser extension(s) support the signal you are using. Please note that, in some cases, your opt-out preference signal may only be linked to your device or browser identifier. If you visit our Site from another device or using another browser (or after your original browser's cookies have been erased), you may need to renew your opt-out choice. For more information about how to use the GPC browser signal, please visit https://globalprivacycontrol.org/; or
  • By emailing us at privacyops@caastle.com with your opt-out request.

  As described in further detail in Section IV (How We Share Information) above, we may also share certain personal information with our third-party partners for direct or targeted advertising purposes, using means other than advertising Tracking Technologies. Under applicable law, disclosing information for these purposes may be considered a "sale" or "sharing" of personal information for targeted advertising purposes. However, you may opt out of having your information "sold" or "shared" for these purposes, by means other than Tracking Technologies, by doing one of the following:

  • Submitting an opt-out request using this link: Opt-Out Request Form, which is also linked within the privacy preference center that is accessible via the "Do Not Sell or Share My Personal Information" link in the footer of our Site's homepage; or
  • By emailing us at privacyops@caastle.com with your opt-out request.
  • Right to limit use of sensitive Personal Information. You have the right to tell us not to process sensitive personal information except for the purpose for which it was originally collected. As noted above, we do not collect or process sensitive personal information for the purpose of inferring your characteristics.
  • Right to non-discrimination for the exercise of your privacy rights. If you choose to exercise any of the privacy rights described above, we will not discriminate against you. You also have the right not to receive discriminatory treatment by us, including retaliation against you.

  B. How to Exercise Privacy Rights

  You may exercise the rights described above by:

  • Clicking the "CLICK HERE TO SUBMIT A REQUEST IF YOU ARE A BUSINESS CONTACT" link at the bottom of this Privacy Policy and completing the online request form; or
  • By contacting us at privacyops@caastle.com

  C. How We Verify and Respond to Your Requests

  When you submit a privacy rights request, we will require that you verify your identity before we can process your request. Considering the nature of your request, we may request additional Personal Information to verify your identity (and this information will not be used for any other purpose than verification). We will match the Personal Information that you provide with your request against information that we already have about you in our records. If we are not able to verify your identity, we may require different Personal Information (that we have not already collected for another purpose) to verify the request.

  Even if we are able to verify a request, we may nevertheless deny the request because we are either required or permitted to by law. Regardless of the method used to submit a request to access, delete, or correct your personal information, we must deny your request if we are unable to verify your identity.

  We will acknowledge receipt of your requests to know, to delete, and to correct information within ten (10) business days of receipt of your requests. We will respond to your request within forty-five (45) days; if we need additional time we will notify you that we need up to another forty-five (45) days to respond.

  D. Authorized Agents

  You may also designate an authorized agent to make a request on your behalf; however, we may require a signed copy of the “Authorized Agent Designation Form” authorizing the agent to submit the request. Please note that you will still need to verify your identity directly with us before we can process the request submitted by an authorized agent. You can obtain an “Authorized Agent Designation Form” by submission of request as per methods noted above in Section VI.(B).

• VII. How We Protect Personal Information.

  We maintain reasonable and appropriate physical, electronic, and procedural safeguards that are designed to help protect your Personal information from unauthorized access, use, and disclosure. Although we work diligently to protect the personal information that is in our possession, no method of transmission over the internet or security system is 100% secure, and we cannot guarantee that our security measures will prevent all unauthorized persons from illegally accessing personal information. In the event that we are required by law to inform you of a breach of your personal information, we may notify you electronically, in writing, or by telephone, if permitted to do so by law.

• VIII. How Long We Retain Information.

  We retain personal information for the period necessary to fulfill the purposes outlined in this Privacy Policy, including for the purposes of satisfying any legal, accounting, or other reporting requirements, unless a longer retention period is required or permitted by applicable law. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the information, the potential risk of harm from unauthorized use or disclosure of the information, the purposes for which we obtained the information and whether we can achieve those purposes through other means, and applicable legal requirements.

• IX. Children's Privacy.

  We don't knowingly collect data from or about children under the age of 16 years.

• X. Other Important Information.

  The following additional information relates to our privacy practices:

  • Changes to This Privacy Policy. Please refer back to this Privacy Policy on a regular basis. We may modify this Privacy Policy from time to time and without notice. The most recent version of the Privacy Policy will always be posted on this Page, with the effective date posted at the top of the Privacy Policy. By visiting this Page after the effective date, you are deemed to consent to our then-current Privacy Policy.

• XI. Contact Information.

  If you have any questions, comments, or concerns about our privacy practices, please contact us by one of the following methods:

  By e-mail at privacyops@caastle.com, or
  By writing to us at the following address:
  CaaStle Inc.
  5 Penn Plaza, Fl. 4
  New York, NY 10001
  Attn: Legal Department

CLICK HERE TO SUBMIT A REQUEST IF YOU ARE A BUSINESS CONTACT.