Effective September 6, 2019
Personal Information Collected
The personal information we collect about you may include the following. In each case, we identify the grounds that we rely on to process your personal information under the rules of the General Data Protection Regulation (the “GDPR”):
- Account Profile – when you open an account, we may collect your first name, last name, email address, username and password. Applicable legal grounds: contract performance, consent, legitimate interests (to enable us to perform our obligations and provide our services);
- Device Information – information that is automatically collected about your device, such as hardware, operating system, browser, etc. Applicable legal grounds: legitimate interests (to allow us to provide the content and services on the website), consent, contract performance;
- Location Information – information that is automatically collected via analytics systems providers to determine your location, including your IP address and/or domain name and any external page that referred you to us. Applicable legal grounds: legitimate interests (to allow us to provide the content and services on the website), consent, contract performance;
- Server Log Information – information that is generated by your use of the Character Services that is automatically collected and stored in our server logs. This may include, but is not limited to, device-specific information, location information, system activity and any internal and external information related to Character pages that you visit. Applicable legal grounds: legitimate interests (to allow us to provide the content and services on the website), consent, contract performance;
- Correspondence – information that you provide to us in correspondence, such as when you submit questions or inquiries and with respect to ongoing customer support. Applicable legal grounds: legitimate interests (to enable us to perform our obligations and provide our services), consent, contract performance.
Character may also make use of the standard practice of placing tiny data files called cookies, flash cookies, pixel tags, or other tracking tools (“Cookies”) on your computer or other devices used to access the Character Services. Cookies are small bits of information that are automatically stored on the web browser of your device that can be retrieved by us. The type of information we collect includes, but is not limited to, uniquely identifying visitor information and information related to your usage preferences. We use these technologies to help us recognize you as a user and collect information about your use of the Character Services to better customize our services and content for you. By using the Character Services, you acknowledge and agree that we may collect and/or transmit any data collected to our third-party service providers, such as analytics providers, which may also make use of such technologies described above. Please note that if you block or delete cookies you will not be able to use some or all of the Character Services.
How We Use Personal Information
We ensure that only those specific employees who need access to your personal information to fulfill their employment duties will have access to it. We may use the personal information we collect from you to:
- provide you with the Character Services, including billing and technical support;
- evaluate usage of the Character Services, including automatic and/or manual security checks;
- analyze the usage trends and preferences of users of the Character Services;
- create aggregated and anonymized reporting data about the Character Services;
- investigate legal claims;
- optimize and enhance the Character Services, including to develop new products, services, features, and functionality;
- respond to inquiries and other requests;
- provide you with information that we think may interest you, including in regards to our products and services;
- carry out such purposes for which we may obtain consent from time to time; and
- carry out such other purposes as may be permitted or required by applicable law.
Sharing of Personal Information
We may disclose your personal information to law enforcement and governmental entities when required by law or in the good-faith belief that such action is necessary to comply with applicable laws, in response to a facially valid court order, judicial or other government subpoena or warrant, or to otherwise cooperate with law enforcement or other governmental agencies. We may also disclose your personal information to a third party in the event of any potential or completed reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business.
We utilize third party services providers to perform a variety of services on our behalf, such as identity verification, detection of fraud or security threats, telephone or technical support, payment card processing, hosting services, and data storage or processing, and we may transfer your personal information to our service providers for such purposes. Third party service providers have access to and may collect personal information only as needed to perform their functions and are not permitted to share or use the information for any other purpose.
Informational Security Measures
We take your privacy very seriously and have implemented various physical, organizational and technological security mechanisms with the goal of protecting your personal information from loss or theft, unauthorized access, disclosure, copying, use or modification. Specifically, the Character website is encrypted with SSL; we periodically review our information collection, storage, and processing practices; and we restrict access to your information on a need-to-know basis for our employees, contractors, and agents who are subject to strict contractual confidentiality obligations and may be disciplined or terminated if they fail to meet these obligations.
Despite the measures outlined above, no method of information transmission or information storage is 100% secure or error-free, so we cannot guarantee absolute security. If you have reason to believe that any interactions with us are no longer secure from a privacy rights standpoint, please contact us using the contact information in the “Contact Us” section below.
Retention of Personal Information
We will use, disclose or retain your personal information only for as long as necessary to fulfill the purposes for which that personal information was collected and as permitted or required by law.
Rights Regarding Your Personal Information
Under certain circumstances and in accordance with the GDPR or other applicable data protection laws, you as a data subject have the following rights:
- Access – ask if we are processing information and, if we are, request access to your personal information. You may receive a copy of the personal information we hold and certain other information about you;
- Correction – request that any incomplete or inaccurate personal information about you that we hold be corrected;
- Erasure – ask us to delete or remove your personal information in certain circumstances. There are certain exceptions where we may refuse a request for erasure, for example, where the personal information is required for compliance with law or in connection with legal claims;
- Restriction – ask us to suspend the processing of your personal information, for example, to establish its accuracy or the reason for processing it;
- Transfer – request the transfer of certain personal information to another party;
- Objection – challenge our processing of personal information based on a legitimate interest (or those of a third party) or for direct marketing purposes. However, we may be entitled to continue processing information in certain circumstances;
- Automated decisions – contest any automated decision made where it has a legal or similar significant effect and ask for it to be reconsidered; and
- Consent – where we are processing personal information with consent, withdraw your consent.
You also have a right to make a complaint with a data protection supervisory authority, in particular in the Country (as defined below) where you normally reside, where we are based or where an alleged infringement of data protection law has taken place. To exercise any of these rights, please contact us using the contact information in the “Contact Us” section below.
Subject to applicable laws and regulations, we may from time to time send direct marketing materials promoting services, products, facilities, or activities to you using information collected from you. If you no longer want to receive marketing-related communications from us, you may opt-out of such communications by clicking the “unsubscribe” link at the bottom of emails you receive from us. You may also opt-out by contacting us directly using the contact information in the “Contact Us” section below. We will aim to respond to your opt-out request promptly, but we ask that you please allow us reasonable time to process your request. We will not provide your information to third parties for direct marketing or other unrelated purposes without your written consent.
Please note that if you opt-out from receiving marketing-related communications, we may still need to send you communications about your use of our products or services, or other matters, subject to applicable laws and regulations.
Data Transfer Rights
Third Party Websites and Services
Children’s Online Privacy Protection Act (COPPA)
The Character Services are not marketed or aimed toward children under 13 years of age, and we do not knowingly collect personal information from children under the age of 13 without obtaining parental consent. If you are under 13 years of age, then please do not use or access the Character Services at any time or in any manner. If we learn that personal information has been collected on the Character Services from persons under 13 years of age and without verifiable parental consent, then we will take the appropriate steps to delete this information. If you are a parent or guardian and discover that your child under 16 years of age has provided personal information, then you may alert us and request that we delete that child’s personal information from our systems.