Live Webinar: Why prioritize PIM in 2025? Find out with Forrester analysts & PIM users. Sign up>

privacy addendums by U.S. state

California
Colorado
Virginia

California Privacy Addendum

This addendum supplements our Privacy Notice and applies only to California Residents. To the extent the California Consumer Privacy Act of 2018, Cal. Civ. Code §§ 1798.100 et. seq (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”) is applicable, this Section is only applicable to you if you are a resident of the state of California (“California Residents”), and only applies to personal information for which Company is a “Business” (as defined in the CCPA, as amended). “Personal Information” means information that identifies, relates to, describes, could reasonably be associated with, or could be reasonably linked directly or indirectly with a particular California consumer or household. Personal Information does not include (i) publicly available information from government records; (ii) deidentified or aggregated consumer information; or (iii) information excluded from the scope of the CCPA, as amended, such as:

  • health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA), clinical trial data, or other qualifying research data;
  • Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), the Farm Credit Act, and the Driver’s Privacy Protection Act of 1994.

CCPA applies to Personal Information we collect from California Residents on or through our services and through other means (such as information collected offline or in person).

As a Business, we may need to collect certain Personal Information from you. If you do not provide the information that we ask for, we may not be able to provide you with the requested services. Sensitive Personal Information is a subset of Personal Information that requires greater security protections and standards of care in handling. For more information please click here and scroll to definition of “Sensitive personal information.” With respect to Personal Information for which you are a “Business” and inriver is a “Service Provider,” as defined in the CCPA, please see the applicable Service Agreement or Terms of Service, as the case may be.
This California Privacy Addendum and the Privacy Notice explain our practices for collecting, using, sharing, maintaining, protecting, and disclosing such information.

Please note that we do not currently recognize automated browser signals regarding tracking mechanisms, which may include ‘Do Not Track’ instructions.

Colorado Privacy Addendum

Your Colorado Privacy Rights

This addendum supplements our Privacy Notice and applies only to Colorado Residents. If you are a Colorado resident, the Colorado Privacy Act (“CPA“) provides you with specific rights regarding your personal data, subject to certain exceptions. The CPA also does not apply to certain types of personal data maintained in compliance with specific federal privacy laws, such the Health Insurance Portability and Accountability Act and the Fair Credit Reporting Act, or for certain governmental purposes. For a complete list see CRS §6-1-1304.

The CPA defines “Personal Data” as any non-public information that can be linked or reasonably linked to an individual and does not include de-identified data. “Sensitive Data Inference(s)” means inferences made by a controller of Personal Data, “alone or in combination with other data, which are used to indicate an individual’s racial or ethnic origin; religious beliefs; mental or physical health condition or diagnosis; sex life or sexual orientation; or citizenship or citizenship status.”

The CPA provides Colorado Residents with the following rights with respect to their Personal Data:

  • The right to opt-out from the sale of their personal data, or use of personal data for targeted advertising and certain types of profiling; If you wish to opt out of having your Personal Data sold or used for targeted advertisement, please click this link: “Do Not Sell or Share My Personal Information” and we will process your request.
  • The right to know whether a controller is collecting personal data;
  • The right to access personal data that a controller has collected about them;
  • The right to correct personal data;
  • The right to delete personal data; and
  • The right to download and remove personal data from a platform in a format that allows the transfer to another platform.

We will not discriminate against you for exercising your rights. To exercise any of your rights, please send us an email at legal@inriver.com or you can also send a request in writing to:

inriver Inc.
Attn: DPO/Compliance
125 South Wacker Drive, #1550
Chicago, IL 60606

To appeal a decision regarding a consumer request please contact us as described above. We will respond within 45 days of your appeal, and any such time may be extended for an additional 60 days if reasonably necessary. We will notify you of any extension within the initial 45-day period. If you still have an unresolved complaint, please direct your complaint to the Colorado Attorney General here Contact the Office of the Colorado Attorney General – Colorado Attorney General | Colorado Attorney General (coag.gov) or call 720-508-6000.

Virginia Privacy Addendum

Your Virginia Privacy Rights

This addendum supplements our Privacy Notice and applies only to Virginia Residents. If you are a Virginia resident, the Virginia Consumer Data Protection Act – Va. Code Ann. §§ 59.1-575 to 59.1-584 (“VCDPA”) provides you with specific rights regarding your personal data, subject to certain exceptions. We collect the type of data described in our Privacy Notice, which includes personal data and sensitive data, as defined by the VCDPA, in the manner described herein and in the Privacy Notice. VCDPA defines “Personal Data” as any information that is linked or reasonably linkable to an identified or identifiable natural person. Personal Data does not include de-identified data or publicly available information. Personal Data that is excluded from the scope of the VCDPA includes:

  • covered entities or business associates covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and related federal laws and regulations, clinical trial data, or other qualifying research data;
  • personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or the Farm Credit Act, and the Driver’s Privacy Protection Act of 1994;
  • information collected from governmental organizations, non-profit organizations and higher education institutions; and
  • data processed or maintained for employment purposes including emergency contact information or benefits administration.

If you do not provide the information that we ask for, we may not be able to provide you with the requested services. Sensitive data is a category of Personal Data that requires greater security protections and standards of care in handling. “Sensitive Data” is defined by the VCDPA as 1) Personal Data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status; 2) the processing of genetic or biometric data for the purpose of uniquely identifying a natural person; 3) the personal data collected from a known child; or 4) precise geolocation data. Subject to limited exceptions, we will only process your Sensitive Data with your consent.

Rights of Virginia Consumers

If you are a Virginia resident the VCDPA provides you with specific rights regarding your Personal Data, subject to certain exceptions. These rights are explained below:

  • Right against retaliation or discrimination. You have the right not to be retaliated or discriminated against for exercising any of the rights described in this section. We will not discriminate against you for exercising your rights.
  • Right to access. Subject to certain exceptions, you have the right to confirm whether we are processing your data and you have the right to access such Personal Data.
  • Right to delete. You have the right to request that we delete any of your Personal Data we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete and will direct our service providers to delete your Personal Data from our records, unless an exception applies. Please click here to learn more about the limitations that may apply to your request.
  • Right to Correct. In certain circumstances and upon the receipt of a verifiable consumer request, you have the right to request that inriver correct any inaccurate Personal Data inriver maintains about you. Upon verifying the validity of a verifiable consumer correction request, we will use commercially reasonable efforts to correct your Personal Data as directed, taking into account the nature of the Personal Data and the purposes of maintaining your Personal Data.
  • Right to Opt-Out of Sale or Use of Your Personal Data for Targeted Advertisement. You have the right to opt-out of having your Personal Data, including Sensitive Data, sold and/ or used for targeted advertising. If you wish to opt out of having your Personal Data sold or used for targeted advertisement please click this link: “Do Not Sell or Share My Personal Information” and we will process your request.
  • Right to Data Portability. You have the right to obtain a copy of your Personal Data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means.

Verification on Consumer Request and Timeline

  • To assert your rights, please contact us as set forth below.
  • To confirm your identity, it is imperative that we verify the consumer request and so you must provide information that allows us to reasonably verify that you are the person about whom we collected the Personal Data or are an authorized representative. If you make a request on behalf of another person, we will need to verify that you have the authority to do so. You must also describe the request with sufficient detail that allows us to properly understand, evaluate and respond to such request. We cannot respond to your request or provide you with Personal Data if we cannot verify your identity or authority to make the request and confirm the Personal Data relates to you. We will not honor your request if an exception to the law applies.
  • We will respond to requests within forty-five (45) days after our receipt of such verifiable request (or within such other time as required by applicable law). If we need additional time, we will notify you in writing prior to the expiration of the forty-five (45) day period and inform you of the reason for an additional forty-five (45) day extension of time. For the avoidance of doubt, any such requests for Personal Data will cover the twelve (12) month period immediately preceding the date of such verifiable request and such requests can be made up to twice annually per consumer. A disclosure of Personal Data in response to such a request will be provided free of charge and in a commonly used format. For more information about requests, please see the “Your rights and controlling your personal information” section of the Privacy Notice.

To exercise any of your rights, please send us an email legal@inriver.com or you can also send a request in writing to:

inriver Inc.
Attn: DPO/Compliance
125 South Wacker Drive, #1550
Chicago, IL 60606

If we are unable to provide you with the requested information, you can appeal our decision by contacting us at legal@inriver.com and within sixty (60) days of receipt of your appeal, we will inform you in writing of any action taken or not taken in response to your appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, you may also contact the Attorney General here to submit a complaint.

Changes to this Privacy Notice

We keep this Privacy Notice under regular review and will place any updates on this website or notify you via the services or products. The Privacy Notice was last updated on April 20, 2023.