We at Civic and our affiliates are committed to protecting your privacy. This Privacy Policy applies to the personal information and data collected by Civic when you interact with our websites, product and services, and any other sites or services that link to this Privacy Policy. This includes when you:
This Privacy Policy describes how we collect, receive, use, store, share, transfer, and process your Personal Data. This Privacy Policy also describes your choices and rights with respect to your Personal Data, including your rights of access and correction of your Personal Data. For the purposes of this Privacy Policy "Personal Data" means any information relating to an identified or identifiable individual. If you do not agree with this Privacy Policy, you should not use our websites, product and services, or any other sites or services that link to this Privacy Policy.
For this Privacy Policy, you are considered a “user” if you use any Civic Service, whether as a “Customer,” as defined in the Civic Services Agreement, or as an “End User,” as defined in the Civic End User Terms of Service. Additionally, for this Privacy Policy, “Service” refers to the product or service provided by Civic under the Civic Services Agreement and the Civic End User Terms of Service.
Depending on the activity, Civic assumes the role of a “data controller” and/or “data processor” (or “service provider”) based on the activity. For more details about our role and our legal bases for processing your Personal Data, please see our Data Processing Agreement for more information.
We update this Privacy Policy from time to time and we encourage you to review this Privacy Policy periodically. We will post any Privacy Policy changes on this page and, if the changes are material, we will provide a more prominent notice by sending you an email notification.
If you have any questions about this Privacy Policy or to exercise the privacy rights and choices we offer please contact us at privacy@civic.com.
1. What Information We Collect and Process
a. Information You Provide to Civic
When you interact with us via our websites or any sites or services that link to this Privacy Policy (including Civic.me) or use the Service, we may collect Personal Data and other information from you, as further described below.
When You Visit Our Websites
We collect Personal Data from you when you submit web forms or interact with our websites, for example by subscribing to a Civic blog, signing up for a webinar, subscribing to one of our services or requesting customer support. We may ask for your email address, first and last name, and other similar business information. You are free to explore some of our websites without providing any Personal Data about yourself.
Account and User Information
We collect Personal Data when a Customer signs up for a Civic account, and when a Customer creates or modifies user information, sets preferences, or provides any other related information to access or utilize our Service. When a Customer utilizes our services via the API or it is an End User, we do not collect account information, but may collect user information when using either the API or your wallet to access the Service.
Contact Information
We may collect your name, email address, postal address, phone number, username, and other contact information. If you are representing a company, we may collect the company name, company website URL, company representative’s contact information, company address, registration number, and information about the owners.
Payment Information
We collect payment and billing information when you register for paid products or services. For example, we may ask you to provide a billing address, or a billing contact for your Civic account. If you give us payment information, we use it solely as authorized by you in accordance with this Privacy Policy.
You may also provide payment information, such as a credit card number or bank account numbers, when purchasing products or services. We use secure third-party payment service providers to manage payment processing, which is collected through a secure payment process.
b. Information We Process on Behalf of Customers When They Use the Service
When Customers use our identity verification services, they may collect Personal Data such as first and last name, email address, or other information about End Users. We call the information that our Customers collect via the product ‘Customer Data’ under our Customer Services Agreement.
We store our Customers' information on our service providers' servers but process it as a processor under our Customers’ instructions and in accordance with our Customer Services Agreement, which prohibits us from using the information except as necessary to provide and improve the Service and as required by law.
Our Customers control and are responsible for correcting, deleting or updating the information they process using the Service and for complying with any regulations or laws that require providing notice, disclosure, and/or obtaining consent prior to transferring the Personal Data to Civic for processing purposes.
c. Information We Collect and Process When You Use the Service
Our product, or the Service, provides identity verification services that enable secure access to digital platforms and services. By verifying the identities of End Users, our Service helps Customers confidently authenticate the identities of their users. When Customers use our Service, we collect the Personal Data they input, such as name, email, billing address, and payment information. When End Users use our product, we may collect Personal Data, depending upon which Service is being used.
Identity Information
Civic provides a variety of identity verification services that allow our Customers to verify Personal Data about End Users. During this process, Civic collects certain Personal Data, which may include government-issued identification documents (e.g., passport, driver’s license), Social Security number, and other similar documents and information. Additionally, Civic may collect Personal Data contained in these documents (e.g., birthdate, gender, address, government-issued identifiers).
Selfie Images
We may ask you to submit selfie images to verify your identity and provide our services.
Biometric Information
We use facial recognition technology to extract biometric information from the images you provide for identity verification and fraud prevention. When you use our Service, you are required to provide a facial image. This image is used to create a unique digital representation of your facial features. This representation is securely stored in our system and cannot be used to regenerate your original image. We ensure that no additional biometric data is retained beyond what is necessary for providing our services. Our third-party tools are employed to assist in capturing and processing this biometric information; however, these tools do not have access to your biometric data nor do they collect any personally identifiable information from us. Your biometric data is processed exclusively for the purpose of providing the Service, and your privacy is safeguarded throughout this process.
IMPORTANT: By providing us with your selfies and identification documents, you consent to the extraction and processing of the biometric data contained therein as set forth in this Privacy Policy and our Biometric Privacy Notice.
Wallet Information
As you use the services, we may collect information about your cryptocurrency wallet(s) to link your Civic Pass (as defined in the End User Terms) or to perform proof of wallet ownership checks.
Company Documents
We may collect entity formation documents and related information to perform due diligence on a company. This typically involves collecting government-issued identification documents for executive officers, directors, shareholders, and individuals managing the account on behalf of the company.
Usage Data
We collect usage data when you or your users in your Civic account interact with the Service. Usage data includes metrics and information regarding your use and interaction with the Service such as what product features you use the most and how often certain features are triggered in your account.
We engage third party providers to collect usage data. For more information about how we protect your information with these service providers, please see Section 3 "How We Share Personal Data."
d. Information We Collect From Other Sources
Personal Data From Different Sources
To deliver our identity verification services, Civic may cross-check the information you provide with data collected from identity verification services, publicly available sources, and other third party providers. We may also combine your Personal Data with information from these other sources to enhance our Service. The collection and use of your Personal Data by these third parties is subject to their own privacy policies.
Log Files
Like most websites and technology services delivered over the Internet, we automatically collect and store information about your computer hardware and software when you visit our websites, use our product and services, or visit other sites or services that link to this Privacy Policy. This information can include your IP address, browser type, domain names, internet service provider (ISP), and the files viewed on our websites (e.g., HTML pages, graphics, etc.), the files viewed on our websites, your operating system, access times and referring website addresses.
2. How We Use Personal Data
a. To Communicate with You About the Product and Services
We use the account information you provide to Civic when signing up for the Service to send you transactional emails about billing, account management, and other administrative matters. We may also send you updates regarding our Customer Services Agreement, End User Terms of Service, or other legal agreements, and may also communicate with you about security incidents via email.
We use your information to provide support, such as resolving technical issues you encounter and analyzing product outages or bugs.
b. To Provide the Service
We use your account information and Personal Data to provide the product and services to you. For example, we use the email address you provide when signing up for the product to create your user account, we use your payment information to process payments for paid use of the service, and we may use your driver license and biometric information derived from a selfie to verify your identity.
c. To Improve and Develop Our Product and Services
We collect usage data about how you or your users interact with our product and services. We use this data to develop and improve our products and services. For example, we use usage data to assess trends and usage across the product to help us determine what new features or integrations our users may be interested in.
We may publish data about how our product and services are being used across our User base. When we share statistical information externally in this way, the data will be aggregated and we will not identify individual users. For example, we may publish blog posts on trends or insights into how users are interacting with our product.
d. To Secure and Protect our Product and Users
We use your account information to investigate and help prevent security incidents. We may also use this information to meet legal requirements. We use your information to verify user accounts, new product sign-ups, and to detect and prevent product abuse.
We use log files to provide general statistics regarding use of the websites by you, including how you use our websites, what country you are logging in from (for analytics, export control and regulatory purposes) and to help improve the navigation experience. Your IP addresses are also collected and logged for security and debugging purposes.
e. To Market and Promote the Services
We may use the information you provide to Civic to market and promote the products, services, and other offerings. For example, we use Customer information, like the Customer’s email, to send information which we think may be of interest to the Customer and send them marketing communications relating to our business. We may also send marketing communications to End User if they choose to sign up for our newsletter or blog.
You may opt out of receiving this promotional content by following the instructions contained in each communication that we send to you or by contacting us at privacy@civic.com. If you unsubscribe from our marketing lists, we will continue to contact you regarding administrative matters, and to respond to your requests.
Where required by law, we will only send marketing communications with your consent. Otherwise, we will market and advertise our products and services on the basis of our legitimate business interests.
f. Other Purposes if We Obtain Your Consent
We share your data with third parties when you give us consent to do so.
g. Legal Basis for Processing Personal Data (EEA and UK visitors only)
Our legal basis for collecting and using the Personal Data described above will depend on the Personal Data concerned and the specific context in which we collect it. However, we will normally collect Personal Data from you only where we have your consent to do so, where we need the Personal Data to perform a contract with you, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect Personal Data from you.
If we ask you to provide Personal Data to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your Personal Data is mandatory or not (as well as of the possible consequences if you do not provide your Personal Data). Similarly, if we collect and use your Personal Data in reliance on our legitimate interests (or those of any third party), we will make clear to you at the relevant time what those legitimate interests are.
3. How We Share Personal Data
a. Service Providers
We may share Personal Data with third-party service providers to support our websites, products, and services. These service providers help us with data hosting, application development, marketing, sales support, and customer support. Additionally, specialized third-party service providers assist us in the processing and secure storage of biometric data used for identity verification purposes.
While these providers help analyze service usage data, perform statistical analysis, assist with marketing, process payments, and enhance service delivery, they are also crucial in ensuring the secure and efficient processing of biometric data. All service providers are prohibited from using your Personal Data for purposes other than those contracted and are required to maintain its confidentiality. In all cases where we share your information, we require the third party service providers to adhere to privacy and data protection policies and standards that are no less protective than ours.
b. Corporate Events
If we (or our assets) are acquired by another company, whether by merger, acquisition, bankruptcy or otherwise, that company would receive all information gathered by Civic on the websites and the Service. In this event, you will be notified via email and/or a prominent notice on our website, of any change in ownership, uses of your Personal Data, and choices you may have regarding your Personal Data.
c. Compelled Disclosure
We reserve the right to use or disclose your Personal Data if required by law or if we reasonably believe that use or disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or comply with a law, court order, or legal process.
d. Notice Regarding Use of Blockchain
The holdings and transactions associated with a wallet address are publicly available on the blockchain. Therefore, information about your holdings and transactions will be accessible to third parties due to the nature of the blockchain.
4. How We Transfer Personal Data Internationally some text
a. International Transfers to Third Parties
Some of the third parties described in this Privacy Policy, which provide services to us under contract, are based in other countries that may not have equivalent privacy and data protection laws to the country in which you reside. When we share Personal Data of individuals in the EEA, Switzerland or UK with third parties, we use the European Commission-approved Standard Contractual Clauses. For transfers to or from the United Kingdom, we make use of the UK Addendum. Please contact us if you need more information about the legal mechanisms we rely on to transfer personal data outside the EEA, Switzerland, and UK.
5. How We Store and Secure Personal Data
We use a variety of security technologies and procedures to help protect your Personal Data from unauthorized access, use or disclosure. We secure the Personal Data you provide on computer servers in a controlled, secure environment, protected from unauthorized access, use or disclosure. All Personal Data is protected using appropriate physical, technical and organizational measures.
a. Data Storage and Security
How long we keep information we collect about you depends on the type of information and how we collect and store it. After a reasonable period of time, we will either delete or anonymize your information or, if this is not possible, then we will securely store your information and isolate it from any further use until deletion is possible.
b. Retention of Personal Data
We retain Personal Data that you provide to us where we have an ongoing legitimate business need to do so (for example, as needed to comply with our legal obligations, resolve disputes and enforce our agreements).
When we have no ongoing legitimate business need to process your Personal Data, we securely delete the information or anonymize it or, if this is not possible, securely store your Personal Data and isolate it from any further processing until deletion is possible. We will delete this information at an earlier date if you so request, as described in the section "Privacy Rights and Choices" below.
If you have elected to receive marketing communications from us, we retain information about your marketing preferences for a reasonable period of time from the date you last expressed interest in our content, products, or services, such as when you last opened an email from us or ceased using your Civic account. We retain information derived from cookies and other tracking technologies for a reasonable period of time from the date such information was created.
The data our Users process in connection with the Service is retained according to the Customer Services Agreement, End User Terms of Service and Data Processing Agreement.
6. Cookies and Similar Technologies
When you visit our websites, sign up for a Civic account, or request more information about Civic, we collect information automatically using tracking technologies, like cookies and tracking pixels.
Civic uses cookies or similar technologies (such as web beacons and JavaScript) to analyze trends, administer the website, monitor how visitors navigate around the website, and to gather demographic information about our user base as a whole.
What are cookies?
A cookie is a small file containing a string of characters that is sent to your computer when you visit a website. When you visit the site again, the cookie allows that site to recognize your browser. Cookies may store user preferences and other information.
Cookies provide a convenience feature to save you time, or tell the Web server that you have returned to a specific page.
Cookies set by the website owner (in this case, Civic) are called "first party cookies". Cookies set by parties other than the website owner are called "third party cookies". Third party cookies enable third party features or functionality to be provided on or through the website (e.g. like advertising, interactive content and analytics). The parties that set these third party cookies can recognize your computer both when it visits the website in question and also when it visits certain other websites.
Why do we use cookies?
We use first party and third party cookies for several reasons. Some cookies are required for technical reasons in order for our website to operate, and we refer to these as "essential" or "strictly necessary" cookies. Other cookies also enable us to track and target the interests of our users to enhance the experience on our websites and Service. For example, Civic keeps track of the website and pages you visit within Civic, in order to determine what portion of the website or service is the most popular or most used. This data is used to deliver customized content and promotions within the website and Service to users whose behavior indicates that they are interested in a particular subject area. Third parties serve cookies through our website for advertising, analytics and other purposes. This is described in more detail below.
What types of cookies do we use and how do we use them?
The specific types of first and third party cookies served through our website and the purposes they perform include:
How can I control cookies? You have the right to decide whether to accept or reject cookies. You can exercise your cookie preferences by clicking on the appropriate opt-out links provided below.
You can set or amend your web browser controls to accept or refuse cookies. If you choose to reject cookies, you may still use our website though your access to some functionality and areas of our website may be restricted. As the means by which you can refuse cookies through your web browser controls vary from browser-to-browser, you should visit your browser's help menu for more information.
In addition, most advertising networks offer you a way to opt out of targeted advertising. If you would like to find out more information, please visit http://www.aboutads.info/choices/ or http://www.youronlinechoices.com. You may opt out by clicking here: http://optout.aboutads.info/ or http://optout.networkadvertising.org/ (or if located in the European Union, by clicking here: http://www.youronlinechoices.eu/). Please note this does not opt you out of being served advertising. You will continue to receive generic advertisements.
Essential website cookies: Because these cookies are strictly necessary to deliver the website to you, you cannot refuse them. You can block or delete them by changing your browser settings however, as described above.
7. Your Privacy Rights and Choices
a. Personal Data Requests
You have the following data protection rights:
We do not sell personal information.
To exercise any of these rights contact us at privacy@civic.com or through mail at:
Civic Technologies, Inc.
Attn: Legal
548 Market St #45306
San Francisco, CA 94104-5401
Please note that to protect personal information, we may verify your identity by a method appropriate to the type of request you are making. Depending on where you reside, you may be entitled to empower an “authorized agent” to submit requests on your behalf. We will require authorized agents to confirm their identity and authority, in accordance with applicable laws. You are entitled to exercise the rights described above free from discrimination.
We will respond to your request to change, correct, or delete your data within a reasonable timeframe and notify you of the action we have taken. In some instances, your rights may be limited, such as where fulfilling your request would impair the rights of others, our ability to provide a service you have requested, or our ability to comply with our legal obligations and enforce our legal rights.
If you are a User, prospect, or otherwise interact with a Civic Customer that uses our Service and would like to access, correct, amend or delete your data controlled by the Customer, please contact the relevant Customer directly. Civic acts as a processor for our Customers and will work with our Customers to fulfill these requests when applicable.
b. To Unsubscribe From Our Communications
You may unsubscribe from our marketing communications through one of the following methods:
Users cannot opt out of receiving transactional emails related to their account with us or the Service.
8. California Privacy Rights
a. Applicability
This section applies only to California consumers. For purposes of this section "Personal Information" has the meaning given in the California Consumer Privacy Act (“CCPA”). It describes how we collect, use, and share California consumers' Personal Information in our role as a business, and the rights applicable to such residents. The California Consumer Privacy Act ("CCPA") requires businesses to disclose whether they sell Personal Information. Civic is a business, and does not sell Personal Information. We may share Personal Information with authorized service providers or business partners who have agreed to our contractual limitations as to their retention, use, and disclosure of such Personal Information.
If you are unable to access this Privacy Policy due to a disability or any physical or mental impairment, please contact us and we will arrange to supply you with the information you need in an alternative format that you can access.
b. How We Collect, Use, and Share your Personal Information
We have collected the following statutory categories of Personal Information in the past twelve (12) months:
The business and commercial purposes for which we collect this information are described in Section 2 of this Privacy Policy. The categories of third parties to whom we "disclose" this information for a business purpose are described in Section 3 of this Privacy Policy. The period of time for which we retain this information is described in Section 5 of this Privacy Policy.
c. Your California Rights
You have certain rights regarding the Personal Information we collect or maintain about you. Please note these rights are not absolute, and there may be cases when we decline your request as permitted by law.
The right of access means that you have the right to request that we disclose what Personal Information we have collected, used and disclosed about you in the past 12 months.
The right of deletion means that you have the right to request that we delete Personal Information collected or maintained by us, subject to certain exceptions.
The right of correction means that you have the right to request that we correct any inaccurate personal information that we maintain about you.
The right to non-discrimination means that you will not receive any discriminatory treatment when you exercise one of your privacy rights.
Civic does not sell or share Personal Information to third parties (pursuant to California Civil Code §§ 1798.100–1798.199, also known as the California Consumer Privacy Act of 2018).
d. How to Exercise Your California Rights
You can exercise your rights yourself or you can alternatively designate an authorized agent to exercise these rights on your behalf. Please note that to protect your Personal Information, we will verify your identity by a method appropriate to the type of request you are making. We may also request that your authorized agent have written permission from you to make requests on your behalf, and we may also need to verify your authorized agent's identity to protect your Personal Information.
Please use the contact details below, or see Section 7 "Your Privacy Rights and Choices" above, if you would like to:
9. Other Important Privacy Information
a. We Never Sell Personal Data
We will never sell your Personal Data to any third party.
b. Information About Children
The websites, product and services are not intended for or targeted at children under 16, and we do not knowingly or intentionally collect Personal Data about children under 16. If you believe that we have collected Personal Data about a child under 16, please contact us here, so that we may delete the information.