Privacy notice
At 9Spokes, we put trust at the foundation of our customer relationships and are committed to protecting the privacy of individuals whose information is in our custody. We take the security of personal data very seriously and understand that privacy is not just an essential part of what we do, but also at the core of our business.
At 9Spokes, we put trust at the foundation of our customer relationships and are committed to protecting the privacy of the people whose information we hold. We take the security of personal data very seriously, because privacy is not just an essential part of what we do, but also at the core of our business.
9Spokes’ policy is to comply with applicable local laws, including the General Data Protection Regulation (GDPR), to ensure we handle and use personal data in a compliant way. This includes ensuring:
- We only collect data relevant to providing you with the best service.
- We are transparent about how we handle, store, and use your data.
- You are able to access and modify your personal data as needed.
- You can contact us about your data at any time at privacy@9spokes.com.
1. IMPORTANT INFORMATION AND WHO WE ARE
1.1 9Spokes International Limited (a New Zealand registered company) 9 Spokes UK Limited (a company registered in England and Wales) and 9 Spokes US, Inc. (a Delaware Corporation) (referred to as “9Spokes”, “we”, “our” or “us”) are data controllers and are responsible for your personal data. As members of the 9Spokes group of companies, 9Spokes may share your personal data with other members of our group in accordance with section 8 below.
1.2 This Privacy Notice explains how, as a data controller, 9 Spokes may collect, use, and/or share information that we collect from or about you, or that you provide to us, and how we will process it in accordance with applicable data protection laws. Where you use a 9Spokes platform, product, or service (“9Spokes Services”) or your personal data is processed in connection with the 9Spokes Services, 9Spokes will be the data controller of such information. There may sometimes be more than one data controller of your information within our group.
1.3 This Privacy Notice applies if you make any enquiry to us, apply to work with us, or use any of 9Spokes’ products or services offered or provided by us or our banking and/or fintech clients (we refer to these clients as “9Spokes Clients”). It does not apply in relation to the collection of personal data by any of the software applications (“Apps”) that you may connect to the 9Spokes platform from third party software developers or the collection of personal data by any third party online service providers (which may include, for example, banks, open banking providers or credit rating agencies) (“Online Services”) that you may connect to the 9Spokes platform. Collectively, these App providers and third-party online service providers are known as “Online Service Partners” (“OSPs”). Please make sure you read each OSP's privacy notice, as 9Spokes is not responsible for the privacy practices of the OSPs or the content of their Apps or services.
1.4 We sometimes make updates to this Privacy Notice. The most current version (and the date of last update) will be posted on the 9Spokes website, and we recommend that you check regularly to ensure you are familiar with the most current version of this Privacy Notice.
2. SCOPE OF PRIVACY NOTICE
2.1 This Privacy Notice applies to personal data. “Personal data” is any information or opinion that can be used to identify you or that we can link to you or your household, such as a name, an identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of a natural person.
2.2 This Privacy Notice explains and describes:
a) When this Privacy Notice applies.
b) The types of personal data we collect and how we collect it.
c) The legal basis for our use of personal data.
d) Where your personal data is stored.
e) The ways we use and disclose personal data.
f) Who we disclose personal data to.
g) How we may use personal data for digital advertising & analytics purposes.
h) How we use cookies and other tracking technologies.
i) Our information security processes.
j) Your rights in relation to your personal data.
3. WHEN THIS PRIVACY NOTICE APPLIES AND DOES NOT APPLY
3.1 This Privacy Notice applies:
a) to your use of the 9S Services;
b) as a result of your relationship with one or more 9Spokes Clients, unless we only act on their instructions as their data processor (in which case their privacy notice will apply);
c) to any personal data about you that we collect from third parties;
d) where you make inquiries with us, or apply to us for a job or work placement.
3.2 This Privacy Notice also applies to our use of cookies and similar technologies, as described in more detail in section 11 below: (Tracking Technologies We Use).
3.3 Personal data we process on behalf of 9Spokes Clients. We provide Services to our corporate clients that enable them to engage with end users. When 9Spokes Clients collect personal data from their end users through the 9Spokes Services, this Privacy Policy does not apply to that collection. This is because the 9Spokes Clients control the collection of that data, and 9Spokes acts on their behalf when we process that information. To understand how 9Spokes Clients use the data they collect through the 9Spokes Services, please read the relevant 9Spokes Client’s privacy notice. If you are an end user of a 9Spokes Client and would like to access, correct, amend, or delete personal data, or you have any questions about how they are using your information, please contact them directly.
4. PERSONAL DATA WE COLLECT
4.1 Identity and general types of personal data. The personal data 9Spokes collects, stores, and transfers will depend on what products and services you request from us. This may include:
a) current and historical personal data;
b) data provided to 9Spokes in person, by email, telephone or online such as: name (including employee and subcontractor names), title, identification, employment, position held, enquiry/complaint details, information about the organisation with which you are affiliated, emails, usernames, addresses, country of residence, geographic
location, log-in information, other contact details, date of birth (where you have applied to us for a job or work placement), telephone numbers, billing information, or other personally identifiable information you provide to 9Spokes directly, or through the 9Spokes Services, Online Services, or any Apps.
4.2 Technical data. The data that 9Spokes collects and stores when you use the 9Spokes Services may include technical information, such as the Internet protocol (IP) address used to connect your computer, tablet, mobile or other device to the 9Spokes Services, Online Services or any of the Apps, login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, information you post online, full Uniform Resource Locators (URL) clickstream to, through and from the 9Spokes Services, Online Services or any of the Apps; and other information we collect through the use of cookies and similar technology.
4.3 User Content. The 9Spokes Services allow you to personally monitor certain financial, personal and other information about your business or your customers which you have provided to 9Spokes or an OSP through an App or Online Service (“User Content”). To provide the 9Spokes Services, 9Spokes extracts User Content from Apps and Online Services. 9Spokes may also integrate User Content with other Apps or Online Services you have connected to the 9Spokes Services.
4.4 Third party data. When you provide, through the 9Spokes Services, an App or Online Service, personal data of a third party (for example details about your customers), 9Spokes will collect that data from you and use it in accordance with this Privacy Notice. Where you provide the personal data of a third party, you must ensure that the third party is aware of this Privacy Notice, understands it, and has agreed to accept it.
4.5 Enquiry data. We will also collect your personal data if you make an enquiry about any aspect of 9Spokes, if you are an actual or potential investor in 9Spokes, request information from 9Spokes, contact 9Spokes through our network of websites or in any other manner, or access 9Spokes' network of websites for any reason.
4.6 Service-related data. Sometimes, personal data must be provided to 9Spokes in order for us to legally or contractually provide a service to you, for example, where we need to fulfill a password reset request.
4.7 Data received from other websites and third parties. We may receive information about you if you use any websites that we operate or other services we provide. We may also work with third parties (including, for example, business partners, technical, payment and delivery service providers, advertising networks, analytics providers, search information providers, credit reference or employment checking agencies) to help us provide 9Spokes Services and we may receive information about you from them.
5. THE REASONS WHY WE MAY USE PERSONAL DATA
5.1. Where we use your personal data, we rely on the following legal grounds (where recognised under applicable law):
a) Performance of a contract: we may need to collect and use your personal data to enter into a contract with you or to perform a contract that you have with us.
b) Legitimate interests: Where 9Spokes considers use of your personal data is non- detrimental to you, within your reasonable expectations, and necessary for our own, or a third party’s, legitimate purpose, including:
(i) for our own direct marketing or continued communication with you;
(ii) the prevention of fraud;
(iii) our own internal administrative purposes;
(iv) personalisation of the 9Spokes Services we provide to you;
(v) ensuring network and information security, including preventing unauthorized access to electronic communications networks and stopping damage to computer and electronic communication systems;
(vi) reporting possible criminal acts or threats to you or us, or to public security, to a competent authority; and
(vii) to comply with a contractual obligation to another organization or individual, e.g., towards your employing organization.
c) Compliance with a legal obligation: 9Spokes may be required to process your personal data due to legal requirements, including employment, tax and other laws that apply to us.
d) Consent: You may be asked to provide your consent in connection with certain services that 9Spokes offers, for example in respect of any processing of your personal data for our marketing purposes, or in respect of certain special categories of personal data such as your health or racial background where we are legally obliged to gain your consent due to the sensitive nature of the data and the circumstances in which it is gathered or transferred. Where we rely on your consent, you may withdraw it at any time by
contacting us in accordance with section 17 (Contacting Us) below.
6. WHERE YOUR PERSONAL DATA IS STORED
6.1. 9Spokes stores your personal data on infrastructure operated by third party cloud service providers. 9Spokes also stores investor information with its share registry (Boardroom Pty Limited ABN 14 003 209 836).
6.2. Data that 9Spokes collects from you may be held by our group companies in the jurisdiction in which the relevant 9Spokes Client is located or has otherwise selected (noting that the privacy policy of that 9Spokes Client will apply in addition to this privacy policy). 9Spokes will ensure that your personal data we control is protected to at least the same standard as that which is required in the jurisdiction in which you are located.
6.3. If you are in the European Economic Area ("EEA"), the data that 9Spokes collects from you may be transferred to, and stored at, a destination outside the EEA that does not have a similar standard of data protection laws to those maintained by the member states of the European Union. It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Where necessary, we rely on or make use of European Commission-approved standard contractual data protection clauses, binding corporate rules for transfers to data processors, or other appropriate legal mechanisms to safeguard the transfer, including European Union data protection adequacy rulings. You have the right to request a copy of the mechanisms used by contacting us using the details set out in section 17 (Contacting Us).
7. WAYS WE USE DATA
7.1. 9Spokes may collect your personal data so that we can provide you with the 9Spokes Services and for various internal functions and services. This may include:
a) carrying out our obligations under contracts between 9Spokes and 9Spokes Clients, including providing you with information, products, services and content through the 9Spokes Services;
b) allowing you to participate in interactive features of the 9Spokes Services, when you choose to do so;
c) confirming receipt of profile changes;
d) extracting User Content from, and integrating User Content with, Apps and Online Services you have connected to the 9Spokes Services;
e) communicating with, and assisting, a 9Spokes Client to ensure your successful use of the 9Spokes Services offered to you by the 9Spokes Client;
f) providing technical support and other services to ensure your successful use of the 9Spokes Services;
g) if you are an investor in 9Spokes, purposes relating to your investment in 9Spokes, including servicing your needs as an investor and shareholder;
h) as we believe reasonably necessary or appropriate to protect your, our, or others’ rights;
i) dealing with your requests and enquiries;
j) to provide you with information about other goods and services that we or a third party may offer that are similar or related to those that you have already purchased or enquired about;
k) sending out feedback and surveys and addressing any issues or complaints;
l) answering any queries about 9Spokes and our products and services or any other offering;
m) sending newsletters, advertising and promotions;
n) notifying you about changes to the 9Spokes Services or products or contacting you in relation to service updates that affect you, regulatory updates that affect the 9Spokes Services and any additional information in relation to the 9Spokes Services that we think you may find interesting;
o) research, development and provision of features and services within the 9Spokes platform including:
(i) displaying and visualising your data in charts, tables, and other visualisations;
(ii) developing predictive services, including cashflow forecasting, anomaly detection and performance insights;
(iii) personalising the way in which content is presented to you and to provide you with the most user-friendly navigation experience;
(iv) improving our platform including the development of new features through aggregated and De-identified Content (as defined below);
(p) planning, service development, security and risk management;
(q) using IP addresses to identify the location of users, to block disruptive use, to establish the number of visits from different countries and to determine what country you are
accessing the 9Spokes Services from;
(r) with your consent, or as otherwise disclosed at the time information is collected;
(s) as we believe reasonably necessary or appropriate to comply with our legal obligations, or respond to legal processes or requests for information issued by government
authorities or other third parties.
7.2. These functions and services correspond with the following legal bases (where recognised under applicable law): (a) – (g): performance of a contract (please refer to section 5.1 (a) above); (h) – (q): legitimate interests (please refer to section 5.1 (b) above); (s): compliance with a legal obligation (please refer to section 5.1 (c) above); and (r): consent.
7.3. However, where we provide our services, features or content, or carry out other obligations arising from a contract with an organization (e.g. your employing organization) or individual other than that to whom personal data relates, we rely on our legitimate interest (please refer to section 5.1 (b) (vii) above) rather than on the performance of a contract.
7.4. Where personal data is classified under applicable data protection law to be ‘sensitive’ (meaning racial or ethnical origin, political opinions or memberships, religious and philosophical beliefs, trade union, professional or trade association membership, physical or mental health, sexual life, criminal proceedings and offences, and genetic or biometric information, or biometric templates) 9Spokes will only use this information to provide the service you require and we will ask for your explicit consent. In addition, we may process information revealing race, ethnic origin, sexual orientation and any disability may (to the extent permitted under local laws) to facilitate effective equal opportunities monitoring or to comply with legal obligations to make reasonable adjustments.
7.5. If you do not provide 9Spokes with your personal information, one or more of the 9Spokes Services may not be able to be provided or performed.
7.6. We may combine information that is gathered by different means for the purposes set out above.
7.7. 9Spokes may also modify the content of any User Content by removing from such content all material that could identify you or any other person or organisation (“De-identified Content”). 9Spokes may then use, reproduce and adapt De-identified Content for its own internal use and for the use of 9Spokes Clients (for example, for benchmarking and other commercial purposes for which 9Spokes may receive payment from 9Spokes Clients).
7.8. We do not make decisions based solely on automated processing or profiling that produce legal effects concerning you (or have similarly significant effects).
8. DISCLOSURE OF DATA
8.1. In providing our services and operating our business, 9Spokes may allow the other entities within the 9Spokes group to access your personal data for our internal administrative purposes. Such processing will always be consistent with section 5 (The Reasons why we may use Personal Data), section 6 (Where Your Personal Information Is Stored), and applicable law.
8.2. 9Spokes will share your personal data with OSPs where it is necessary to provide the 9Spokes Services you have requested from us. We will also share your personal data with a 9Spokes Client through whom you access the 9Spokes Services, where it is necessary to provide the 9Spokes Services requested by the 9Spokes Client. In that case, the 9Spokes Client is responsible for selecting the jurisdiction in which any personal data will be processed in relation to the 9Spokes Services.
8.3. 9Spokes may also disclose your personal data to third parties as described below:
a) where you have consented to us sharing your personal data in this way, or as otherwise disclosed at the time of data collection or sharing;
b) when such sharing is provided for under a contract we have with a 9Spokes Client through whom you access the 9Spokes Services;
c) where it is relevant in the circumstances to share the personal data with our partners in co-promotional arrangements (such as jointly sponsored events or external venues);
d) if we need to enforce or apply a contract to which you have agreed, for example, the terms of use or end-user licence agreement you have agreed with a 9Spokes Client through whom you access the 9Spokes Services;
e) to third-party professional advisors, such as accountants and IT service professionals, that you have appointed and authorised to access your personal data;
f) to an OSP support provider where you have requested support in relation to an App or Online Service;
g) to enable 9Spokes to undertake financial transactions with you or on your behalf, such as invoicing and processing of payments, as well as compliance with any applicable legal, tax or regulatory obligations that may affect you or 9Spokes;
h) to any entity to which 9Spokes is required, or authorised by law, to disclose such personal data, such as responding to a formal request in a court order, judicial proceeding or subpoena;
i) to protect against misuse or unauthorised use of the 9Spokes Services;
j) to protect the safety or property of us, our stakeholders, or the public;
k) in the event of a sale, merger, or acquisition of some or all of 9Spokes' business, your personal information could be disclosed as a part of the proposed transaction;
l) where you invest in 9Spokes, your personal information may be disclosed to 9 Spokes' share registry (Boardroom Pty Limited ABN 14 003 209 836) and regulators;
m) to printers and other service providers for the preparation and distribution of documents, marketing, and for handling of mail;
n) to market research companies and analytics and search engine providers for product development and planning and assisting us to improve and optimise the 9Spokes Services; and
o) legal and accounting firms, auditors, management consultants and other advisers for the purpose of administering and advising on the 9Spokes Services, 9Spokes' shareholding and shares.
8.4. Any third parties with whom we may share your data are obliged to keep your personal data secure, and to use it only to fulfil the service they provide you directly or on 9Spokes’ behalf. When those third parties no longer need your personal data to fulfil this service, they will dispose of it in line with 9Spokes’ procedures, unless they are themselves data controllers in their own right, or they are under a legal obligation to retain information. If 9Spokes wishes to pass your sensitive personal data onto a third party, we will only do so once we have obtained your consent, unless we are legally required to do otherwise.
8.5. 9Spokes will not share your personal data with any third parties for their marketing or promotional purposes without your permission. However, you should be aware that OSPs may separately collect information from you, and they may use or share that information in accordance with their own policies, which you should review separately.
8.6. We own the database rights in the information collected via the 9Spokes Services. We do not sell, rent, or otherwise share information that reasonably identifies you or your organisation with unaffiliated entities for their independent use except as expressly described in this Privacy Notice, or with your express consent. We may share De-identified Content with 9Spokes Clients and other third parties.
8.7. Information that does not reasonably identify you or your organization may be shared as permitted by applicable law.
8.8. 9Spokes may disclose your personal data in order to comply with any legal obligation, to enforce or apply a contract with the 9Spokes Client through whom you access the 9Spokes Services, or to protect our rights or property (or those of our customers, clients or other third parties). This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
9. DIGITAL ADVERTISING & ANALYTICS
9.1. We may partner with ad networks and other ad serving providers (“Advertising Providers”) that serve ads on behalf of us, 9Spokes Clients and others on non-affiliated platforms. Some of those ads may be personalized, meaning that they are intended to be relevant to you based on information Advertising Providers collect about your use of the 9Spokes Services and other sites or apps over time, including information about relationships among different browsers and devices. This type of advertising is known as interest-based advertising.
9.2. We may also work with third parties that collect data about your use of the 9Spokes Services
and other sites or apps over time for non-advertising purposes. 9Spokes uses Google Analytics and other third-party services to improve the performance of the 9Spokes Services and for analytics and marketing purposes. For more information about how Google Analytics collects and uses data when you use the 9Spokes Services, visit
https://www.google.com/policies/privacy/partners/, and to opt out of Google Analytics, visit https://tools.google.com/dlpage/gaoptout/.
10. IN THE EMPLOYMENT CONTEXT
10.1. If you apply for a job or work placement with 9Spokes, then you may need to provide your contact and identification information, information about your career and any other relevant information you submit to us (including in any correspondence with us). We may also carry out screening checks (including reference, background, directorship, financial probity, identity, eligibility to work, vocational suitability and criminal record checks).
10.2. We collect, use and store your personal data for the reasons set out below:
a) Where necessary for our legitimate interests, as listed below, and where our interests are
(i) Managing and administering the recruitment process you take part in.
(ii) Administering and improving ongoing recruitment processes.
(iii) Protecting our legitimate business interests and legal rights.
(iv) Where necessary and in accordance with applicable law, carrying out background checks to verify the details you have supplied during the recruitment process.
b) Where necessary to establish the employment contract with you.
c) With your consent. For example, we may be required under local law to ask for your consent to:
(i) Carry out background checks to verify the details you have supplied during the recruitment process; and/or
(ii) Consider you for other positions.
10.3. If your application is unsuccessful, we will retain your personal data only for as long as we need it for recruitment processes. We may hold your personal data for longer periods where you give us express permission to do so, for example so you can be considered for other positions that become available. If you accept employment with us, we will retain your personal data throughout your employment in accordance with a separate notice we provide when you accept employment.
10.4. If you work with us and are issued with any type of device, building access card or code, we may also collect information about you from your use of these items (in compliance with any applicable laws).
10.5. For the employment-related reasons described in section 10.2, 9Spokes may exchange your personal data with academic institutions, recruiters, screening check providers, health service providers, professional and trade associations, law enforcement agencies, recruitment analytics providers, referees and your current and previous employers. We may gather personal data from publicly available resources such as LinkedIn or other professional or social media platforms and collate it with the information that you provide to us. 9Spokes will handle any unsolicited information in accordance with law, including destroying or de-identifying such information where we are required to do so.
10.6. Without your personal data, 9Spokes may not be able to progress considering you for positions with us.
11. TRACKING TECHNOLOGIES WE USE
11.1. IP addresses: When you visit 9Spokes’ website, click on one of our links or use the 9Spokes Services, we may automatically record information such as your Internet Protocol (IP) address, operating system, browser version, date and time of your visit, pages you accessed, features or components you interacted with, and information you downloaded. This information may be used to generate usage statistics, ensure that our site and emails are accessible to the widest possible audience and to assist in improving the quality and usability of our website. 9Spokes may also use IP addresses to track abuse of our system.
11.2. Links: When 9Spokes provides you with links in emails, they may include a special tracking
code unique to you, which allows 9Spokes to determine which content and advertisements are most popular. This data may be shared in aggregate form; however, it will never be shared in individual form.
11.3. Cookies: A cookie is a small string of information that we store on your browser or hard drive of your computer for identification purposes, if you agree. Cookies contain information that is transferred to your computer’s hard drive.
11.4. Cookies help us to enhance the navigation and functionality of our website, to securely maintain a session for existing customers accessing password-protected areas, and to personalize aspects of a visitor's experience.
11.5. 9Spokes uses cookies to make interactions with our website or 9Spokes Services easy and meaningful. When you visit our sites, 9Spokes servers send cookies to your computer.
11.6. Standing alone, cookies do not personally identify you, they merely recognize your web browser. Unless you choose to identify yourself to 9Spokes, you may remain anonymous to us (even though we may be able to recognize your browser on your subsequent visits).
11.7. 9Spokes uses cookies that are either session-based or persistent:
(a) “Session Cookies” exist only during one session. They disappear from your computer when you close your browser software or turn off your computer.
(b) “Persistent Cookies” remain on your computer after you close your browser or turn off your computer.
11.8. If you have chosen to identify yourself to 9Spokes, we use Session Cookies containing encrypted information to allow us to uniquely identify you. Each time you log into our website or the 9Spokes Service, a Session Cookie containing an encrypted, unique identifier that is tied to your account is placed in your browser. These Session Cookies allow us to uniquely identify you when you are logged into the website or 9Spokes Services and to process your online
transactions and requests. Session Cookies are required to use the 9Spokes Services.
11.9. 9Spokes uses Persistent Cookies that only we can read and use to identify browsers that have previously visited our website. When you provide us with personal data in this context, a unique identifier is assigned to you. This unique identifier is associated with a Persistent Cookie that we place on your web browser. We are especially careful about the security and confidentiality of the information stored in Persistent Cookies. For example, we do not store account numbers or passwords in Persistent Cookies.
11.10. If you disable your web browser’s ability to accept cookies, you will be able to navigate our website, but you will not be able to successfully use the 9Spokes Services.
Third Party Cookies
11.11. 9Spokes engages third parties to track and analyse usage, behavioural and volume statistical information from individuals who visit our website. 9Spokes may also use other third party cookies to track the performance of our advertisements. The information provided to third parties does not include personal data, but this information may be re-associated with personal data after we receive it.
11.12. 9Spokes may also contract with third party advertising networks that collect IP addresses and other website navigational information on our website and emails and on third-party websites.
Pixel Tags
11.13. A Pixel Tag, also known as a clear GIF or Web Beacon, is an invisible tag placed on certain pages of our website but not on your computer. When you access these pages, Pixel Tags generate a generic notice of that visit. They usually work in conjunction with cookies, registering when a particular computer visits a particular page.
11.14. If you turn off cookies, the Pixel Tag will simply detect an anonymous website visit.
How 9Spokes use Cookies and Pixel Tags
11.15. 9Spokes itself does not use cookies, Pixel Tags or other technologies to track your use of other websites. 9Spokes may, however, contract with other companies that may use cookies, Pixel Tags, and other online tools to collect information regarding your interaction with 9Spokes advertisements and your use of both 9Spokes and third-party websites. This information may be used to provide 9Spokes advertisements and other advertisements that may be of interest to you when you visit other websites.
Control of cookies
11.16. We use cookie banners on our website where you can accept or decline the use of cookies. Web browsers also allow you to exercise some control of cookies through the browser settings. Most browsers enable you to block cookies or to block cookies from particular sites. Browsers can also help you to delete cookies when you close your browser. However, this may mean that any opt-outs or preferences you set on our website will be lost.
12. THIRD-PARTY LINKS
12.1. Our website (and 9Spokes emails) may contain links to other sites, including to those of OSPs. If you follow a link to any of these websites, please note that these websites have their own privacy notices and 9Spokes is not responsible for the privacy practices or the content of these websites. Please check these notices before you submit any personal data to these websites.
13. SECURITY
13.1. 9Spokes stores personal data in electronic storage facilities and uses some physical records. We have taken numerous steps to protect your personal data from misuse, interference and loss, and unauthorised access, modification or disclosure.
13.2. Our information security policy is supported by a variety of processes and procedures, and we store information in access-controlled premises or electronic databases requiring logins and passwords. All employees, officers or contractors of 9Spokes with access to personal data and other confidential information are subject to access controls and confidentiality obligations, and we require our third party data storage providers to comply with appropriate information security industry standards.
13.3. You can help us to keep your information secure by ensuring that any username or password in relation to our online services (including the 9Spokes Services) is kept strictly personal to you and is not shared with any other person. You should stop using your username and password immediately if you suspect that someone else may be using your user details or password to
access the 9Spokes Services or other online services we operate.
13.4. While 9Spokes uses encryption technology and a range of other security measures to protect your personal data, please be aware no security mechanism is 100% secure. Although we will do our best to protect your personal data, including complying with applicable legal requirements, we cannot guarantee the security of your data transmitted to our site. Once we have received your personal data, we will use strict procedures and security features designed to prevent unauthorised access, modification or disclosure.
14. YOUR RIGHTS - ACCESS AND CORRECTION OF YOUR PERSONAL INFORMATION
14.1. Under applicable data protection laws, 9Spokes has a duty to ensure that your personal data is accurate and up to date. You can contact us in accordance with section 17 (Contacting Us), to update or correct your information, or for some 9Spokes Services you can update your details online.
14.2. Where you have consented to our processing of certain personal data, you can at any time withdraw your consent or tell us not to contact you with updates and information about our services, either at the point your information is collected (by checking the relevant box), or by following the unsubscribe instructions on any communications we send to you. You can also exercise this right at any time by contacting us in accordance with section 17 (Contacting Us).
14.3. You can request:
a) access to the personal data we hold about you;
b) a copy of such data and the information referred to in clause 16.1 below (if available under applicable law);
c) corrections or updates to your details;
d) the erasure of your personal data (if available under applicable law); and
e) the portability of personal data that you have provided to us in a structured, commonly used and machine-readable format (if available under applicable law).'
14.4. You also have the right to object to, or request the restriction of, our use of your personal data in certain jurisdictions.
14.5. If you would like to exercise any of the rights set out in this section, please contact us using the details set out in section 17 (Contacting Us). We may refuse to provide access where we have legitimate reasons for doing so under applicable data protection laws, in which case we will provide reasons for our decision. In some circumstances, we may charge a fee for access if the relevant legislation allows us to do so, in which case we will inform you of the fee and obtain your agreement before providing access to the information.
14.6. FOR U.S. RESIDENTS OF CALIFORNIA OR NEVADA
a) If you are a California or Nevada resident, please see below for additional information regarding your rights under state law.
Nevada Privacy Rights
b) Although we do not currently conduct sales of personal information, Nevada residents may submit a request directing us to not sell personal information we maintain about them if our practices change in the future.
c) To exercise this right, please contact us at privacy@9spokes.com or use our secure online privacy form.
California Privacy Rights
d) This section contains disclosures required by the California Consumer Privacy Act (“CCPA”) and applies only to “personal information” that is subject to the CCPA.
Personal Information We Collect
e) In the preceding 12 months, we collected the following categories of personal information about California consumers. We do not sell personal information.
|
Categories of Personal Information |
Collected in the last 12 months: |
Disclosed for business purposes to the following categories of third parties: |
|
Personal and online identifiers (such as first and last name, email address, or unique online identifiers) |
Yes |
All categories listed below. |
|
Categories of information described in Section 1798.80(e) of the California Civil Code (such as physical characteristics or description, insurance policy number, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information) |
Yes |
All categories listed below. |
|
Characteristics of protected classifications under California or federal law (such as race or gender) |
Yes – only for relevant employees |
Not disclosed outside of the Company |
|
Commercial or transactions information (such as records of personal property or products or services purchased, obtained or considered) |
Yes |
All categories listed below. |
|
Internet or other electronic network activity information (such as browsing history, search history, interactions with a website, email, application, or advertisement) |
Yes |
All categories listed below. |
|
Biometric information (such as call recordings) |
Yes |
All categories listed below. |
|
Geolocation information |
Yes |
All categories listed below. |
|
Sensory information (such as audio, electronic, visual, thermal, olfactory, or similar information) |
No |
N/A |
|
Professional or employment- related information |
Yes |
All categories listed below. |
|
Education information |
No |
N/A |
|
Inferences drawn from the above information about your predicted characteristics and preferences |
Yes |
All categories listed below. |
|
Other information about you that is linked to the personal information above |
Yes |
All categories listed below. |
Categories of Sources
(f) We collect personal information from the following categories of sources:
(i) Directly from consumers including users of the 9Spokes Services;
(ii) Internet service providers;
(iii) Data analytics providers;
(iv) Operating systems and platforms; and
(v) Service providers.
Categories of third parties
(g) We disclose personal information to the following categories of third parties:
(i) Our service providers (e.g., hosting providers, payment processors);
(ii) Any 9Spokes Clients through whom you access the 9Spokes Services;
(iii) Advertising partners; and
(iv) Legal authorities (if required by law).
Why we collect, use, and share information for the purposes of the CCPA
(h) We use and disclose the personal information we collect for our commercial and business purposes, as further described in this Privacy Notice. These commercial and business purposes (as identified in the CCPA) include, without limitation:
i) Marketing, advertising, and enabling commercial transactions.
(ii) Auditing related to our interactions with you;
(iii) Legal compliance;
(iv) Detecting and protecting against security incidents, fraud, and illegal activity;
(v) Debugging;
(vi) Performing services (for us or our service provider) such as account servicing, processing orders and payments, and analytics;
(vii) Internal research for technological improvement;
(viii) Internal operations;
(ix) Activities to maintain and improve our services; and
(x) Other one-time uses.
(i) We disclose the categories of personal information designated above to the categories of third parties also listed above for business purposes and subject to all appropriate safeguards.
Your Rights Regarding Personal Information
(j) California residents have certain rights with respect to the personal information collected by businesses. If you are a California resident, you may exercise the following rights regarding your personal information, subject to certain exceptions and limitations:
(i) The right to know the categories and specific pieces of personal information we collect, use, disclose, and sell about you; the categories of sources from which we collected personal information about you; our purposes for collecting or selling personal information about you; the categories of personal information about you that we have either sold or disclosed for a business purpose; and the categories of third parties with which we have shared personal information.
(ii) The right to request that we delete the personal information we have collected from you.
(iii) While we do not sell personal information, you have the right to opt out of the sale(s) of your personal information. Please note that if you opt out of certain types of sales, services that rely on such sales will not be available to you.
(iv) The right not to receive discriminatory treatment for the exercise of the privacy rights conferred by the CCPA.
(v) The right to correct any inaccurate personal information we hold about you.
(k) To exercise any of the above rights, please contact us using the following information and submit the required verifying information at: privacy@9spokes.com
Verification Process and Required Information
(l) Note that we may need to request additional information from you to verify your identity or understand the scope of your request. We will require you to provide, at a minimum, your full name, email address and phone number.
Authorized Agent
(m) You may designate an authorized agent to make a CCPA request on your behalf provided they furnish proof of your consent to them acting as your agent for this purpose.
Your Choices
(n) To opt out of our email marketing, you can use the link provided at the bottom of each marketing message.
(o) You may also opt out or unsubscribe from future emails by sending a request to support@9spokes.com using the subject line "Unsubscribe from email
communications." To ensure your opt-out request is properly processed, be sure to send your message using the same email account to which we sent our correspondence.
15. DATA RETENTION
15.1. 9Spokes will retain your personal data no longer than is reasonably necessary to fulfil the purposes for which the data was originally collected in accordance with our internal data retention polices or to comply with our legal and regulatory obligations.
15.2. A copy of our retention policy is available on request. To review our retention policy, please contact us in accordance with section 17 (Contacting Us).
15.3. If you wish to request that we no longer use your personal data to provide you with services, please contact us in accordance with section 17 (Contacting Us). 9Spokes may retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.
16. FURTHER INFORMATION
16.1. 9Spokes can, at your request, confirm what personal data we hold about you and how it is processed. If 9Spokes does hold personal data about you, you may (if available under applicable law) request the following information by contacting us using the details in section 17 below:
a) the identity and contact details of the person or organisation that has determined how and why to process your data.
b) the purpose of the processing as well as the legal basis for processing.
c) if the processing is based on the legitimate interests of us or a third party, information about those interests.
d) the categories of personal data collected, stored and processed.
e) recipient(s) or categories of recipients that the data is/will be disclosed to.
f) how long the personal data will be stored.
g) the source of personal data if it wasn’t collected directly from you.
h) any details of automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.
16.2. To verify the identity of those who make a request to us, we will accept the following forms of valid ID, as permitted by local laws:
a) Passport;
b) Drivers licence;
c) Birth certificate;
d) Government issued ID.
17. CONTACTING US
17.1. If you have any questions or complaints about this Privacy Notice, 9Spokes' privacy practices, your dealings with 9Spokes, or if you wish to submit a written complaint about how we handle your personal data, please contact our Data Protection Officer at: privacy@9spokes.com.
17.2. 9Spokes will make all reasonable attempts to respond to and resolve your enquiry or complaint.
17.3. If you are unhappy with how we process your personal data, we ask that you contact us first using the details above so that we have the chance to put it right. However, you also have the right to make a complaint to the privacy regulator in your country at any time, for example:
a) UK Information Commissioner's Office https://ico.org.uk/global/contact-us
b) New Zealand Privacy Commissioner’s Office https://www.privacy.org.nz/
c) Canada Privacy Commissioner’s Office https://www.priv.gc.ca/en/
d) Office of the Australian Information Commissioner https://www.oaic.gov.au/