Outgrove Privacy Choices and GDPR Rights Policy

Outgrove generally acts as a business or controller for information collected through our own website, business-development activities, client administration, billing, security and operations.

When Outgrove processes a client’s customer or lead information to conduct a campaign, the client generally determines the purpose of the campaign and the individuals to be contacted. In that context, the client generally acts as the business or controller, while Outgrove acts as its service provider or processor.

If your request concerns a communication sent for an Outgrove client, we may direct or forward the request to that client. Outgrove will assist the client where required by law and our agreement.

Depending on the circumstances, you may be able to:

• reject or withdraw consent for non-essential cookies;
• opt out of sale, sharing or targeted advertising;
• communicate a Global Privacy Control signal;
• unsubscribe from marketing email;
• stop marketing text messages;
• request not to receive marketing calls;
• access personal information;
• correct inaccurate personal information;
• delete personal information;
• obtain a portable copy of personal information;
• restrict or object to processing;
• withdraw consent;
• opt out of certain profiling or automated decision-making;
• limit certain uses of sensitive personal information;
• use an authorized agent;
• appeal a denied U.S. state privacy request; and
• complain to an applicable privacy regulator or supervisory authority.

Where a cookie banner or preference tool is provided, you may use it to:

• accept all cookies;
• reject non-essential cookies;
• choose functional, analytics or marketing cookie categories; and
• change or withdraw a previous choice.

Where European or United Kingdom cookie rules apply, non-essential cookies remain disabled until you provide consent.

Strictly necessary cookies may remain active because they support website operation, security and the recording of privacy choices.

You may also manage cookies through browser and device settings. For more information, review our Cookie Policy.

Outgrove does not sell personal information in exchange for money.

Outgrove does not sell client-provided campaign lists or use those lists for unrelated cross-context behavioral advertising.

If Outgrove uses advertising or analytics technology in a way legally defined as selling or sharing personal information or processing it for targeted advertising, residents of applicable U.S. states may opt out.

Where required, an opt-out may be submitted by:

• using a Your Privacy Choices link or preference tool available on the website;
• enabling a supported Global Privacy Control signal; or
• emailing services@outgrove.co with the subject line Privacy Opt-Out.

An opt-out will apply to the browser, device, account or individual that we can reasonably identify from the request.

Outgrove does not knowingly sell or share personal information belonging to anyone under 16 years old.

Global Privacy Control (“GPC”) is a browser or device signal that may communicate a request to opt out of the sale or sharing of personal information.

Where required by law and technically supported, Outgrove treats a GPC signal as a valid request for the browser or device sending it.

You do not need to create an account to submit a browser-level opt-out. Where we can reasonably associate the signal with a known account or profile, we may apply the choice more broadly as required by law.

The absence of a GPC signal does not mean that you have consented to sale, sharing or targeted advertising.

Email

You may opt out of marketing email by:

• using the unsubscribe link in the email; or
• emailing services@outgrove.co.

We may continue sending non-promotional messages concerning services, transactions, security, billing or legal matters.

Text messages

Where supported, reply STOP to a marketing text. You may receive a confirmation message. Message and data rates may apply.

Telephone calls

You may ask not to receive further marketing calls. Outgrove or the relevant client will add the number to an applicable suppression list.

Client campaigns

If a communication promotes an Outgrove client, use the opt-out method contained in the communication or contact the client identified as the sender.

You may also contact Outgrove and identify the relevant client, communication channel and contact details. We will route or assist with the request where appropriate.

Opting out of one business or communication channel does not necessarily opt you out of every independent business or channel, unless applicable law requires otherwise.

Residents of certain U.S. states may have some or all of the following rights, subject to applicable thresholds, definitions and exceptions:

• Confirmation: Confirm whether Outgrove processes your personal information.
• Access: Obtain information about the categories or specific pieces of personal information processed.
• Correction: Correct inaccurate personal information.
• Deletion: Request deletion of personal information.
• Portability: Receive certain personal information in a portable and usable format.
• Opt-out: Opt out of sale, sharing, targeted advertising or qualifying profiling.
• Limit: Limit certain uses or disclosures of sensitive personal information.
• Authorized agent: Use an authorized agent to submit a request where permitted.
• Appeal: Appeal a refusal to act on a privacy request.
• Non-discrimination: Exercise privacy rights without unlawful discrimination or retaliation.

These rights may not apply to information processed in a business-to-business, employment, regulated or otherwise exempt context under a particular state law.

Where the California Consumer Privacy Act, as amended (“CCPA”), applies, California residents may request:

• access to categories and specific pieces of personal information;
• information about sources, purposes and categories of recipients;
• correction;
• deletion;
• opt-out of sale or sharing;
• limitation of certain uses of sensitive personal information; and
• non-discriminatory treatment.

Outgrove does not sell personal information for money and does not sell or share client campaign lists for cross-context behavioral advertising.

If Outgrove’s website practices constitute sale or sharing under the CCPA, the website will provide a Your Privacy Choices or equivalent mechanism and process supported opt-out preference signals.

Outgrove uses sensitive personal information only as reasonably necessary to provide requested services, maintain security, process transactions, comply with law and perform ordinary business operations. We do not use sensitive personal information to infer characteristics about individuals.

Notice at collection

Our Privacy Policy describes the categories of personal information we may collect, the sources, purposes, recipients and retention criteria.

Where required, forms or collection interfaces will link to an appropriate notice at or before the point personal information is collected.

Authorized agents

An authorized agent may submit a request where permitted. We may require evidence of authorization and may verify the consumer’s identity directly, except where verification is not permitted for the type of request.

Where applicable, residents of Texas, Colorado, Connecticut, Virginia and other states with comprehensive privacy laws may have rights to access, correct, delete or obtain portable personal information and to opt out of sale, targeted advertising or qualifying profiling.

If we decline to act on a request and applicable law provides an appeal right, you may appeal by replying to our decision or emailing services@outgrove.co with the subject line Privacy Appeal.

We will explain the result of the appeal and provide any regulator contact information required by applicable law.

Where the European Union General Data Protection Regulation, European Economic Area law or United Kingdom GDPR applies and Outgrove acts as a controller, you may have the following rights:

Right of access

You may ask whether we process your personal data and request a copy together with information about the processing.

Right to rectification

You may request correction of inaccurate data and completion of incomplete data.

Right to erasure

You may request deletion of personal data in circumstances provided by law, including where the data is no longer required for its original purpose or consent has been withdrawn and no other lawful basis applies.

Right to restriction

You may request that processing be restricted while accuracy, lawfulness or an objection is assessed, or in other circumstances provided by law.

Right to data portability

Where processing is based on consent or contract and carried out by automated means, you may request certain data in a structured, commonly used and machine-readable format and may ask that it be transmitted to another controller where technically feasible.

Right to object

You may object to processing based on legitimate interests, including profiling related to those interests. We will stop the processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms or the processing is required for legal claims.

You may object to direct marketing at any time. If you object to direct marketing, we will stop using your personal data for that purpose.

Right to withdraw consent

Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing conducted before withdrawal.

Automated decision-making

You may have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects, subject to applicable exceptions.

Outgrove does not ordinarily use automated systems to make decisions producing legal or similarly significant effects about individuals.

Right to complain

You may lodge a complaint with the data-protection authority or supervisory authority in the country where you live, work or believe an infringement occurred.

We encourage you to contact Outgrove first so we can attempt to address the concern.

Where GDPR or UK GDPR applies and Outgrove acts as a controller, we may rely on:

• Contract: Processing necessary to enter into or perform a contract.
• Legitimate interests: Operating and improving our business, maintaining security, responding to business inquiries, measuring services and conducting appropriate business-to-business marketing.
• Consent: Processing for a specific purpose where consent has been given.
• Legal obligation: Compliance with laws, regulations and legal process.
• Legal claims: Establishing, exercising or defending legal rights.

Where required, we obtain consent before using non-essential cookies or sending certain electronic marketing communications.

When relying on legitimate interests, we consider the necessity of the processing and balance Outgrove’s or a third party’s interests against the rights and reasonable expectations of the individual.

Outgrove may receive contact information from a client rather than directly from the individual.

When Outgrove acts solely as a processor, the relevant client is generally responsible for the applicable privacy notice, lawful basis and response to individual rights. Outgrove assists the client as required.

When Outgrove independently acts as a controller for indirectly obtained data, we provide the information required by applicable law within the relevant period, unless a lawful exception applies.

Outgrove is based in the United States. Personal data may be processed in the United States and other countries with privacy laws different from those in your location.

Where required for EEA, EU or UK personal data, we use recognized transfer safeguards, which may include:

• adequacy decisions;
• the European Commission’s Standard Contractual Clauses;
• the United Kingdom International Data Transfer Addendum or other approved UK mechanism;
• contractual, technical and organizational safeguards; and
• another legally recognized transfer mechanism.

You may contact us for additional information about applicable transfer safeguards, subject to confidentiality and security limitations.

Email services@outgrove.co with the subject line Privacy Request.

Please include:

• your name;
• the contact information associated with the request;
• your relationship with Outgrove;
• the right you wish to exercise; and
• if the request concerns a campaign, the client or sender identified in the communication.

Do not send Social Security numbers, government identification documents, account passwords or full financial information unless Outgrove specifically requests an appropriate verification method.

We may need to verify your identity and authority before completing certain requests.

Verification may involve matching information you provide with information already maintained by Outgrove or the relevant client. We request only information reasonably necessary for verification.

The level of verification depends on the sensitivity of the information and the risk of harm from unauthorized access or deletion.

Some opt-out requests do not require identity verification. We will not impose verification requirements where prohibited by law.

We respond within the time required by applicable law. Where permitted, we may extend the response period and will explain the reason for the extension.

A request may be denied or limited where:

• we cannot reasonably verify identity or authority;
• an exception applies;
• information must be retained to comply with law;
• information is needed for security, fraud prevention or legal claims;
• deletion would prevent us from honoring a suppression request;
• fulfilling the request would adversely affect another person’s rights; or
• Outgrove processes the information solely for a client and the request must be handled by that client.

If we decline a request, we will provide the explanation and appeal information required by applicable law.

Outgrove will not unlawfully discriminate, retaliate or deny services because an individual exercised an applicable privacy right.

This does not prevent differences reasonably related to the value or availability of data where a lawful financial-incentive program exists and the required notice and consent have been provided. Outgrove does not currently offer a financial-incentive program in exchange for personal information.

We may update this Policy to reflect changes in law, technology, services or business practices.

The updated version will state a new effective date. Where required, we will provide additional notice before materially changing how personal information is used.

For privacy choices, GDPR requests, questions, complaints or appeals, contact:

Outgrove
701 Tillery St
Austin, TX 78702
USA

Email: services@outgrove.co