Last Updated: [7/26/2024]
This Privacy Notice (“Notice”) provides additional specific information for “Consumers” as defined in the California Consumer Privacy Act of 2018 (“CCPA”) and the California Privacy Rights Act (“CPRA”). This Notice is a supplement to other privacy policies or notices issued by The Lullabar (“Company”, “We”, “Us”, or “Our”). In the event of a conflict between any other The Lullabar policy, statement, or notice and this Notice, this Notice will prevail as to California Consumers and their rights under the CCPA and CPRA.
In accordance with the CCPA’s and CPRA’s requirements, this Notice describes our collection, use, disclosure of California Consumers’ “Personal Information” or “PI” as defined by the CCPA and CPRA, as well as the rights California Consumers have under the CCPA and CPRA. Terms defined in the CCPA and CPRA that are used in this Notice have the same meanings as the CCPA and CPRA.
The following rights are also available to residents of the following states:
Disclosure of Personal Information, No Sale:
The Lullabar has not sold Personal Information (as defined or as contemplated by the CCPA or CPRA) in the preceding twelve (12) months. As defined and contemplated by the CCPA and CPRA, The Lullabar does not sell Personal Information of minors under the age of sixteen (16).
California Consumer Privacy Rights
As a California Consumer, you have the following rights:
Collection and Use of Personal Information
We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“personal information”).
The following is a description of our data collection practices, including the personal data we may collect, the source of that information, the purposes for which we collect information (in addition to as otherwise set forth herein), and whether we disclose that information to external parties. We may use any and all of the information for any purposes described in this Privacy Notice. We may not collect additional categories of personal information or use personal information collected for additional purposes that are incompatible with the disclosed purposes for which the personal information was collected, without providing consumers with notice.
Our collection, use, retention, and sharing of a consumer’s personal information shall be necessary and proportionate to achieve the purposes for which such information is collected or processed, or for another disclosed purpose that is compatible with the context in which the personal information was collected, and not further processed in a manner that is incompatible with those purposes.
We may not retain a consumer’s personal information or sensitive personal information for each disclosed purpose for which the personal information was collected for longer than is reasonably necessary for that disclosed purpose.
We collect personal information directly from you, from your browser or device when you visit our websites, from third parties that you permit to share your information or from third parties that share public information about you, as stated above.
See the section above, “How We Use Personal Information,” to understand how we use the personal information collected from California consumers.
Below is a list of categories of personal information and a discussion as to whether we have collected any such information within the past twelve (12) months:
PERSONAL IDENTIFIERS
CUSTOMER RECORDS INFORMATION AND PERSONAL DATA PROTECTED AGAINST SECURITY BREACHES (CAL. CIV. CODE § 1798.80(E))
PROTECTED CLASSIFIED INFORMATION
COMMERCIAL INFORMATION
BIOMETRIC INFORMATION
INTERNET OR OTHER SIMILAR NETWORK ACTIVITY
GEOLOCATION
AUDIO/VIDEO DATA
PROFESSIONAL OR EMPLOYMENT RELATED INFORMATION
EDUCATION INFORMATION
SENSITIVE PERSONAL INFORMATION (See Below)
Sharing your Data and the Recipients of your Personal Information
We share personal information with third parties for business purposes. The categories of third parties to whom we disclose your personal information may include: (i) our service providers and advisors, (ii) strategic partners; and (iii) analytics providers.
When we disclose personal information for a business purpose, we enter into a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except in performance of the contract. The CCPA and CPRA prohibit third parties who receive the personal information we hold from selling it unless you have received explicit notice and an opportunity to opt-out of such downstream sales.
Either we or our Service Providers may use your information for the following Business Purposes (as defined in the CCPA and CPRA) on a day-to-day basis:
Do We Sell or Share Your Personal Information?
As mentioned above, we do not sell your personal information as currently defined under the CCPA and as amended by the CPRA, meaning that we do not rent, disclose, release, transfer, make available or otherwise communicate your personal information to a third party for monetary or other consideration. We will not sell your information unless we modify this Privacy Policy and take the additional steps required under the CCPA.
While we do not sell Personal Information for monetary value, we may share it with a third party or disclose it to a service provider or contractor in furtherance of a business purpose. In accordance with the CPRA, you have the right to opt-out of The Lullabar sharing or otherwise disclosing your personal data. If you choose to opt-out of The Lullabar sharing your data, you can do so by emailing us at contact@thelullabar.com.
If we do share your Personal Information with a third party, The Lullabar shall enter into an agreement with such third party, service provider, or contractor that: (1) specifies that the personal information is disclosed by The Lullabar only for limited and specified purposes; (2) obligates the third party, service provider, or contractor to comply with applicable obligations under the CPRA and obligate those persons to provide the same level of privacy protection as required by the CPRA; (3) grants The Lullabar rights to take reasonable and appropriate steps to help ensure that the third party, service provider, or contractor uses the personal information transferred in a manner consistent with the The Lullabar’s obligations under the CPRA; (4) requires the third party, service provider, or contractor to notify us if it makes a determination that it can no longer meet its obligations under the CPRA; and (5) grants The Lullabar the right, upon notice, including under (4), to take reasonable and appropriate steps to stop and remediate unauthorized use of Personal Information.
Under the right to delete provisions of the CPRA, The Lullabar will enter into an agreement with a third party that (1) the service provider or contractor shall cooperate with the Company in responding to a verifiable consumer request; and (2) that at the direction of The Lullabar, shall delete, or enable The Lullabar to delete, and shall notify any of its own service providers or contractors to delete, personal information about the consumer collected, used, processed, or retained by the service provider or the contractor.
Additionally, the service provider or contractor shall notify any service providers, contractors, or third parties who may have accessed personal information (requested for deletion) from or through the service provider or contractor, unless the information was accessed at the direction of The Lullabar, to delete the consumer’s personal information, unless doing so proves impossible. A service provider or contractor shall not be required to comply with a deletion request submitted by the consumer directly to the service provider or contractor to the extent that the service provider or contractor has collected, used, processed, or retained the consumer’s personal information in its role as service provider or contractor to The Lullabar.
How Long Do We Keep Your Data?
For each of the categories of personal data and for the sensitive personal data, below please find information regarding how long we keep such data or how we will decide to dispose of such data.
Do We Use your Data for Automated Decision Making?
We do not use your data for automated decision making (i.e. data profiling) purposes.
How to Exercise Your Rights Under the CCPA/CPRA
Under the CCPA and CPRA you have the right to find out about the personal information that we have collected and how that information has been used or disclosed. You also have the right to request that we delete or correct your personal information (and/or opt-out of the sale or sharing of your personal information).
If you wish to exercise any of these opt-out rights, or if you would like additional information, please contact us at the following email address: contact@thelullabar.com, or call us at the following toll-free number: (888) 700-0096.
You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past twelve (12) months. Once we receive and confirm your verifiable consumer request, we will disclose to you:
For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
Subject to certain exceptions, you have the right to request that we delete any of all of your personal information that we collected from you and retained over the past twelve (12) months. Please bear in mind that deletion of your personal information may not allow The Lullabar to continue to provide the Services to you. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers or contractors to delete) your personal information from our records, unless an exception applies. Additionally, upon receiving a verifiable consumer request, we will notify all third parties to whom The Lullabar has shared such personal information to delete the consumer’s personal information, unless doing so is proven to be impossible or involves disproportionate effort. You may request that only a portion of your information be deleted.
We may deny all or part of your deletion request if retaining the information is necessary for us or our service providers to:
The Lullabar may maintain a confidential record of deletion requests solely for the purpose of preventing the personal information of a consumer who has submitted a deletion request from being sold, for compliance with other laws, or for other purposes solely to the extent permissible under the CPRA.
“DO NOT SELL OR SHARE MY INFORMATION”
The CCPA and CPRA provide you with the right to opt out and stop businesses from selling or sharing your personal information. This right applies to all California consumers ages 16 or older and may be exercised at any time.
The right to opt out of sharing personal information includes sharing with a third party even when there is no exchange of consideration between the parties. This can include the right to opt out of The Lullabar using technologies like cookies and pixels to track you across other websites, apps, or services that then share that information with ad networks to deliver targeted advertisements to you.
If you are 16 years of age or older, you have the right to direct us to not share your personal information at any time (the “right to opt-out”). Our websites and products are not intended for minors. We do not sell or share the personal information of consumers we actually know are less than 16 years of age, unless we receive affirmative authorization to sell or share (the “right to opt-in”) from either the consumer who is at least 13 but not yet 16 years of age, or the parent or guardian of a consumer less than 13 years of age. Consumers who opt-in to personal information sharing may opt-out of future sharing at any time.
How to exercise this right:
Do Not Track. We do not track our customers over time and across third party websites to provide targeted advertising and, therefore do not respond to Do Not Track (DNT) signals.
We will not discriminate against you for exercising any of your CCPA or CPRA rights, and will not engage in the following behaviors:
When you exercise these rights and submit a request to us, we will verify your identity by asking for information about your relationship with The Lullabar, such as an email address on file or other methods of verification as allowed under the CCPA and CPRA.
We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time, we will inform you of the reason and extension period in writing.
Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable.
You shall have the right to request that we correct any inaccuracies in your personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information. If The Lullabar collects your personal information we shall disclose, pursuant to the CPRA, section 1798.130, your right to request correction of inaccurate personal information, which you may do by contacting us at the following email address: contact@thelullabar.com. Or by calling us at the following toll-free number: (888) 700-0096.
If The Lullabar receives a verifiable consumer request to correct inaccurate personal information, we shall use commercially reasonable efforts to correct the inaccurate personal information, as directed by you pursuant to your rights under the CPRA. We shall also ask any third parties and service providers to whom information has been shared with to correct or delete your personal information upon your request.
For purposes of the CPRA, sensitive personal information (“SPI”) includes the following personal information:
Please note that any information that is already publicly available shall not be considered SPI or personal information.
With regard to any of the data from the above-listed categories which The Lullabar does collect, The Lullabar utilizes the data in furtherance of providing Services to you, and will keep the data for as long as it’s needed to provide Services to you, or as may be required under applicable law, and we will decide to dispose of this data when it is no longer needed to achieve our business-related purposes.
Our use and disclosure of your SPI is limited to those uses which are necessary to perform the Services reasonably expected by an average consumer who requests such Services, including the following Services:
The Lullabar only uses SPI to provide the Services. As such, the use of your SPI is already limited to uses in furtherance of the provision of our Services to you, as we do not use it for other non-Services related purposes. As such, since use of your SPI is already limited to the provision of the Services to you and not used for any other purpose, your right to limit the use of your SPI to the provision of Services is already attained and exercised.
Automated decision-making takes place when an electronic system uses personal data to make a decision without human intervention. You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you. We do not foresee that any decisions will be taken about you using automated means, however we will notify you if this position changes.
Authorized Agents
You may authorize a natural person or a business entity registered with the California Secretary of State to act on your behalf to make a request to know or to delete your personal information.
To do so, you must (i) verify your identity to The Lullabar and provide that authorized agent written permission to make such a request or (ii) provide the authorized agent with power of attorney pursuant to the California Probate Code sections 4000 to 4465.
The authorized agent must include those authorizations in the verifiable consumer request.
Security Procedures
The Lullabar shall implement reasonable security procedures and practices appropriate to the nature of the personal information collected about a consumer to protect the personal information from unauthorized or illegal access, destruction, use, modification, or disclosure.
Timeframe for Disclosure
If a consumer requests disclosure of required information, a consumer’s right to request required information beyond a 12-month period, and a business’s obligation to provide such information, shall only apply to personal information collected on or after January 1, 2022.
Children 16 and Under
We do not knowingly collect, solicit, or share personal information from children under the age of 16. If we have knowledge that a child under 16 has submitted personal information in violation of this Policy, we will delete that information as soon as possible. If you believe we may have obtained information in violation of this Policy, please email us at the following address: contact@thelullabar.com, or call at the following toll-free number: (888) 700-0096.
Questions About The CPRA?
If you have questions or concerns regarding this statement, you should first contact us via email at contact@thelullabar.com.
Changes to this Privacy Policy
We reserve the right to amend this Privacy Notice at our discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on the Website and update the notice’s effective date. Your continued use of our website following the posting of changes constitutes your acceptance of such changes. If we are required by applicable data protection laws to obtain your consent to any material changes before they come into effect, then we will do so in accordance with law.
California Shine the Light Law
If you are a California resident and have an established business relationship with us and want to receive information about how to exercise your third party disclosure choices, you must send a request to the following address with a preference on how our response to your request should be sent (email or postal mail). You may contact us in two ways. Send an email to contact@thelullabar.com
Alternatively, you may contact us at:
The Lullabar
7750 El Camino Real Suite M,
Carlsbad, CA 92009
Attn: Your California Privacy Rights
c/o Privacy Administrator
For requests sent via email, you must put the statement “Your California Privacy Rights” in the subject field of your email. All requests sent via postal mail must be labeled “Your California Privacy Rights” on the envelope or post card and clearly stated on the actual request. For all requests, please include your name, street address, city, state, and zip code. (Your street address is optional if you wish to receive a response to your request via email. Please include your zip code for our own recordkeeping.) We will not accept requests via the telephone or by facsimile. We are not responsible for responding to notices that are not labeled or not sent properly, or do not have complete information.
If you are a California resident under the age of 18, and a registered user of any site where this policy is posted, California Business and Professions Code Section 22581 permits you request and obtain removal of content or information you have publicly posted. To make such a request, please send an email with a detailed description of the specific content or information to the following address: contact@thelullabar.com. Please be aware that such a request does not ensure complete or comprehensive removal of the content or information you have posted and that there may be circumstances in which the law does not require or allow removal even if requested.
Changes in this Privacy Policy
We reserve the right to modify and update this Privacy Policy at any time by posting an amended version of the statement on our Sites. Please refer to this policy regularly. If at any time we decide to use personal information in a manner different from that stated at the time it was collected, we will notify you either on the panel homepage of our Sites or via email.
Contact Us
If you have questions or concerns with respect to our Privacy Policy, you may contact us at contact@thelullabar.com.