11. Your California Privacy Rights
California Consumer Privacy Act
The California Consumer Privacy Act (“CCPA”) provides California residents with rights to receive certain disclosures regarding the collection, use, and disclosure of information about them, as well as rights to know/access, correct, delete, and limit disclosure of Information. You have the right to be free from discrimination based on your exercise of your CCPA rights. To the extent that we collect Information that is subject to the CCPA, that information, our practices, and your rights are described below.
Notice at Collection Regarding the Categories of Information Collected
You have the right to know about our Information collection, use, and disclosure practices. The following table summarizes the categories of Information we collect; the categories of sources of that Information; whether we disclose, sell, or share that Information to service providers or third parties; and the criteria we use to determine the retention period for such Information. The categories we use to describe Information are those enumerated in the CCPA. We collect this Information for the purposes described above in “How We Use Your Information.”
Category | Information Type | Source | We disclose to: | We sell to/share with: |
Identifiers | - Contact information or personal characteristics (name; email address; postal address; telephone number; signature)
| You | Service Providers | Business partners |
Health Information | - Protected health information
- Physical or mental status or aliments
| Not collected | Not collected | Not collected |
Financial Information | - Payment card data
- Bank account information
- Credit information
| You | Service Providers | Not sold/shared |
Protected Classifications and Other Sensitive Data | | Not collected, except in connection with job applications | Service Providers | Not collected |
Biometric Information | - Fingerprint
- Voiceprint
- Facial recognition
- Eye recognition
| Potentially collected at autonomous stores | Service Providers | Not sold/shared |
Commercial Information | - Transaction information
- Billing and payment records
- Order history
| You | Service Providers | Not sold/shared |
Geolocation Information | - Coarse (information that describes location at ZIP code-level or less precision)
| You; our analytics and advertising partners | Service Providers | Advertising partners |
Internet or Electronic Network Activity Information | - IP address
- Device identifier (e.g., MAC)
- Advertising identifier (e.g., IDFA, AAID)
- Information provided in URL string (e.g., search keywords)
- Cookie or tracking pixel information
- Information about your interaction with our website, app, email correspondence, or Services
- Browsing history
- Search history
- Diagnostic information (e.g., crash logs, performance data)
| You; our analytics and advertising partners | Service Providers | Advertising partners |
Audio, Electronic, Visual, Thermal, Olfactory, or Similar Information | - Call recordings
- Photographs
- Video
| You | Service Providers | Not sold/shared |
Inferences Drawn About You | - User profile reflecting preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes
| You; our analytics and advertising partners | Service Providers | Advertising partners |
Content of Communications | - Contents of phone calls, emails, or text messages
- Photos
| You | Service Providers | Not sold/shared |
Additional information about the categories of Personal Information collected and the categories of sources from which Personal Information is collected is in Section 2 of this Policy. The business purpose for collecting the Personal Information listed above is in Section 3 of this Policy. The third parties with which BAC may share the Personal Information listed above are in Section 5 and Section 6 of this Policy. BAC has no actual knowledge that it sells or shares the personal information of consumers under 16 years of age. BAC does not use or disclose sensitive personal information except as provided specifically in this Policy.
We determine the retention period for each of the categories of Information listed above based on (1) the length of time we need to retain the Information to achieve the business or commercial purpose for which it was obtained, (2) any legal or regulatory requirements applicable to such Information, (3) internal operational needs, and (4) any need for the Information based on any actual or anticipated investigation or litigation.
Entities to whom we disclose Information for business purposes are service providers, which are companies that we engage to conduct activities on our behalf. We restrict service providers from using Information for any purpose that is not related to our engagement or that is otherwise not permitted by law.
Entities to whom we “sell” or with whom we “share” Information are third parties. Under the CCPA, a business “sells” Information when it discloses Information to a company for monetary or other benefit. A company may be considered a third party either because we disclose Information to the company for something other than an enumerated business purpose under California law, or because its contract does not restrict it from using Information for purposes unrelated to the service it provides to us. A business “shares” Information when it discloses Information to a company for purposes of cross-context behavioral advertising.
Your rights under the CCPA. Subject to some exceptions you have the following rights:
- Opt out of sale or sharing of Information: You have the right to opt out of our sale or sharing of your Information to third parties. To exercise this right, please visit our Your Privacy Rights or contact us using the information below. Your right to opt out does not apply to our disclosure of Information to service providers.
- Know and request access to and correction or deletion of Information: You have the right to request access to Information collected about you and data regarding the source of that Information, the purposes for which we collect it, and the third parties and service providers to whom we sell, share, or disclose it. You also have the right to request in certain circumstances that we correct Information that we have collected about you and to delete Information that we have collected directly from you. Please contact us to exercise these rights.
California “Shine the Light” Law
California residents are entitled once a year, free of charge, to request and obtain certain information regarding our disclosure, if any, of certain categories of Information to third parties for their own direct marketing purposes in the preceding calendar year. Please contact us to obtain this information.
Privacy notices provided to BAC employees and job applicants in California supersede this Policy.