Privacy Policy – Toyon Research Corporation

1. Who’s This Policy For And What Does It Cover?

Toyon Research Corporation (“Toyon” or “we”) takes your privacy seriously. This Privacy Policy (“Policy”) applies to users of our “Services” (defined below) and individuals we interact with for marketing or other commercial purposes. It describes how we may collect, use, and share your Personal Information. It also explains related rights and choices you may have.

Our Services include our website (www.toyon.com) and any other online service we operate that links or refers to this Policy. By using a Service, you consent to the practices described in this Policy.

You may see other privacy notices when we collect your Personal Information for certain purposes. Those notices supplement this Policy.

2. What is “Personal Information”?

When we say “Personal Information,” we mean information that can reasonably be linked to a particular individual or their household. Generally speaking, your Personal Information includes your unique identifiers (full name, phone number, email address, user name, etc.), and information about your characteristics, conditions or behavior that is associated with one of your identifiers or could otherwise reasonably be linked to you.

“Non-Personal Information,” on the other hand, has been anonymized, aggregated or de-identified such that it cannot reasonably be linked to a particular individual or their household.

3. Personal Information We Collect And How We Collect It

Categories

The categories of Personal Information that we collect about you depends on how you interact with us, and they may include:

“Identifiers,” such as first and last name, address, email address, phone number, user name, signature, IP address, cookie ID and similar information.
“Customer Records Information,” such as your signature or other information designated as customer records information under applicable law
“Demographic Information,” such as age. Demographic Information may include legally protected classifications.
“Financial Information,” such as payment card information. (For your security, we do not store full payment card numbers; transactions are processed on our behalf by a secure payment processor.)
“Commercial Information,” such as products purchased, obtained or considered, or information about how you use our Service
“Professional or Employment Information,” such as job title and business or employer name (if, for example, you interact with us on behalf of an organization that is our customer, vendor or business partner).
“Device/Browser Information” and “Internet Activity,” such as device or browser type and configuration, comments or other content posted to our Service or shared with us via email, browsing activity, social media content, interactions with our Service, and interactions with marketing communications sent on our behalf.
“Geolocation Data,” such as your approximate location when you access our Service
“Audio, Electronic, Visual or Similar Information,” such as a profile picture or other electronic data you may choose to upload to our platform
“Profile Information,” which means inferences about you drawn from other information

Collection Sources

From You When You Provide It. We may collect Identifiers, Professional or Employment Information or other Personal Information from you directly when you fill out a form on the Service; use the Service; subscribe to receive emails or newsletters from us; visit our office; interact with us at an event; or otherwise communicate with us.

Automatically From Your Device. Like most online services, our Services may passively collect some information from users’ devices in order to make features function correctly, customize or improve the user experience, understand how the Service is being used, measure the effectiveness of marketing efforts, or deliver personalized advertising or content. For example, we may gather certain Identifiers and Internet Activity to understand your usage of our Services for the express purpose of identifying usability problems and resolving technical issues. Some of this data may be collected through the use of browser cookies or similar online tracking technologies, which are explained below. In some cases, we limit this type of collection to Non-Personal Information. However, this data may include Personal Information such as online Identifiers, Internet Activity and Commercial Information.

From Third Party Sources. We may obtain information about you from other sources. For example, we may collect Identifiers, Professional or Employment Information, or Internet Activity that you have chosen to share on social media platforms. (To the extent you disclose such information through widely distributed media or on a public platform, we may not be required to treat it as Personal Information under applicable law.)

We may combine information collected from other sources with information collected from you or your device. To the extent the information, alone or in combination, constitutes Personal Information, we will treat it as Personal Information as described in this Policy.

4. How We Use Personal Information

We may use Personal Information for the following purposes:

To present, maintain and improve our Services and analyze how they are used;
To secure our Services against fraud, malicious activity, or conduct that may violate our terms of use;
To personalize and improve your experience with the Service;
To provide you with information, products, or services that you or your organization request from us;
To notify you about changes to our Service and any products or services we offer or provide through them;
To allow you to participate in interactive features on the Service;
To provide you with periodic product newsletters and offers;
To contact you and provide you with help if you have a customer service issues;
To contact you to fill out surveys and participate in other types of market research;
To measure performance of our marketing efforts;
To notify you of new products or services we think you might be interested in;
To comply with our legal obligations
To secure our offices and other physical locations
In any other way we may describe when we collect the information; and
For any other purpose with your consent.

We may use Non-Personal Information for any purpose.

5. How We Share Personal Information

Vendors

We may share Personal Information with contractors, service providers, and other vendors who assist or support us in providing the Services. Examples of these third-party services may include hosting our website, storing data, performing analytics, processing payments, or sending marketing communications. Our agreements with vendors prohibit them from retaining, using or disclosing the Personal Information we share with them for any purpose other than providing services to us.

Analytics or Marketing Partners

We may share your Personal Information with analytics providers or marketing partners to measure performance of our Service or marketing efforts. This sharing may involve the use of browser cookies and similar technologies placed through our Service by our partners, as explained here. For example, when you visit our website, our partner’s Cookie may cause your browser to automatically send a request to our partner’s server and provide our partner with your IP address, other Identifiers, Device Information and Internet Activity. (These types of partners may have a vendor agreement with us that restricts how they use such information.)

Mandatory Disclosures And Legal Proceedings

We may have a legal obligation to disclose Personal Information to government authorities or other third parties pursuant to a valid regulatory request, subpoena or court order. We may also need to disclose and otherwise process your Personal Information in accordance with applicable law to prevent physical harm or financial loss, protect the vital interests of a person, enforce our various policies or terms of use, protect our property, services and legal rights, prevent fraud, support auditing, compliance and corporate governance functions, or comply with applicable law.
Change In Control Or Merger

We may transfer your information in the event of the sale of substantially all of the assets of our business to a third-party or in the event of a corporate merger, consolidation, acquisition or reorganization. However, in such event, any acquirer will be subject to the provisions of our commitments to you or we will not disclose your information.

With Your Direction Or Consent

We will share your Personal Information with other third parties as you may direct or otherwise consent.

6. Children’s Privacy

Our Services are not directed to children (individuals under the age of 18). We do not knowingly collect, maintain, or process children’s Personal Information unless the child’s parent or guardian consents and provides the information. If we determine that we have received a child’s Personal Information from a source other than the child’s consenting parent/guardian, we will immediately delete the information.

7. Cookies And Online Tracking

What Are Cookies?

A browser cookie is a small piece of data that a website stores in your device’s browser. It holds information that the site uses to function properly, remember your preferences, or personalize your experience. A typical cookie contains a cookie ID, which is a unique string of characters used to identify your browser during the browsing session, or in some cases, during subsequent browsing sessions. Cookies, cookie ID’s and similar pieces of data may be considered Personal Information (identifiers or internet activity) under applicable law.

Other online technologies, similar to cookies, may allow users to be identified and tracked across multiple browsing sessions, and in some cases tracked across different websites and online services for marketing or advertising purposes. These technologies include, but are not necessarily limited to, pixels, web beacons and scripts (collectively with browser cookies, “Cookies”).

How Cookies May Be Used On Our Services

Our Service uses “first party” Cookies, which are set by our web domain (toyon.com). Our Service also uses some “third party” Cookies, which are set by other
web domains associated with our vendors. This means that, when you visit our site, your browser may automatically connect to our vendor’s web server, as well as ours, and provide them with access to your online identifiers and information about how you use our site.

Both First Party and Third-Party Cookies may be used on our Services for the following purposes:

Essential: Essential Cookies are necessary for site security and to enable you to move around our site and use its features.
Preferences: Preference Cookies allow us to remember your preferences on the Service during a browsing session or across browsing sessions.
Analytics: Analytics Cookies allow us to analyze use of our Site or Service to evaluate and improve performance or marketing efforts.

Some of the Cookies used on our Services are provided by Google: https://policies.google.com/technologies/partner-sites?hl=en-US

Our Services don’t use any Cookies to track you for cross-site targeted advertising purposes.

How You Can Block Cookies

You can block, disable or delete cookies at any time by changing the settings in your browser. However, blocking, disabling, or deleting cookies may limit your ability to view all the pages of our site or other sites. You can find more information about cookies and other options you may have for restricting them at www.cookiesandyou.com/, and www.aboutads.info/choices.

“Do Not Track” Signals

Your browser may offer a Do Not Track (DNT) setting. If you turn that setting on, your browser sends a signal to websites indicating that you don’t want to be tracked over time or across third party sites. We don’t currently respond to these signals because there is not yet a common understanding of how to process them or a consensus on what “tracking” means.

8. Your Rights And Choices

You may opt-out of our marketing emails by using the unsubscribe link provided in the email.

See Section 7 for options to restrict Cookies.

If you reside in California or certain other U.S. states, you may have additional rights and choices.

9. Links To Third Party Sites

Our Services may contain links to third-party websites, products or services. If you use these links, you will leave our site. Such links do not constitute or imply an endorsement, sponsorship or recommendation by us of the third party, the third-party website or the information contained therein, and we shall not be responsible or liable for your use thereof. Such use shall be subject to the terms of use and privacy policies applicable to those sites.

10. Third Party Direct Marketing

We don’t share Personal Information with third parties for their direct marketing purposes.

11. Security & Retention

The security of your Personal Information is important to us, but remember that no method of transmission over the Internet, or method of electronic storage, is 100% secure. While we strive to use commercially reasonable means to protect your Personal Information, we cannot guarantee its absolute security.
We generally retain Personal Information as long as necessary to complete the purposes for which it was collected.

12. California Residents (CCPA Statement)

This statement makes additional disclosures to California residents (i.e., “consumers”), and describes rights they have, under the California Consumer Privacy Act of 2018, as amended (the “CCPA”). You can learn more about the CCPA here: https://oag.ca.gov/privacy/ccpa

This statement doesn’t cover our California job applicants and employees. If you are applying for a job with Toyon, you can read our Privacy Notice to California Job Applicants here. Our Privacy Notice to California Employees can be found here.

Collection Of Personal Information

The categories of Personal Information we have collected about consumers in the past 12 months include the categories listed in Section 3 of our Privacy Policy

Sale, Sharing Or Disclosure Of Personal Information

Under the CCPA, you can request to opt-out of the “Sale” of your Personal Information—which the CCPA defines very broadly to include some transactions or arrangements that do not involve the exchange of data for money—and the “Sharing” of your personal information, which the CCPA defines as sharing with third parties for purposes of cross-site targeted advertising.

We do not Sell or Share consumers’ Personal Information, and we do not knowingly Sell or Share Personal Information of consumers under the age of 16.

Within the past 12 months, we disclosed categories of Personal Information listed in Section 3 of our Privacy Policy to our vendors or analytics partners for a business purpose.

Your Rights As a Californian

California residents have the right to make the following requests to covered businesses. The requests may be made by a consumer, by a consumer on behalf of the consumer’s minor child, or by a person authorized by the consumer to act on the consumer’s behalf.

Right To Request Information About Collection, Disclosure, Sale or Sharing

You have the right to request that a business disclose to you: (i) the categories and specific pieces of Personal Information the business has collected about you within the past 12 months, (ii) the categories of sources from which the Personal Information is collected, (iii) the business or commercial purposes for collecting, Selling or Sharing Personal Information, and (iv) the categories of third parties to whom the business discloses Personal Information.

If a business Sells or Shares Personal Information, or discloses it for a business purpose, you also have the right to request that the business disclose the following with respect to the 12-month period preceding your request: (i) the categories of Personal Information that the business Sold or Shared about you and the categories of third parties to whom the Personal Information was Sold or Shared, and (ii) the categories of Personal Information that the business disclosed about you for a business purpose.

This type of request may be referred to as a “Request to Know.” Before we can honor a Request to Know, we need to verify that the person making it is the consumer whose Personal Information we have. Our method for verifying any particular request weighs information we receive as part of the request, the sensitivity of the consumer information at issue, and the risk of harm to the consumer from unauthorized disclosure.

Right to Request Deletion
You have the right to request that a business delete any Personal Information that the business has collected from you. This type of request may be referred to as a “Request to Delete.”

Before we can honor a Request to Delete, we need to verify that the person making the request is the consumer whose Personal Information we have. Our method for verifying any particular request weighs information we receive as part of the request, the sensitivity of the consumer information at issue, and the risk of harm to the consumer from unauthorized deletion.

We are not required to delete Personal Information if we still need it in order to complete the transaction for which the information was collected, perform a contract with you, comply with a legal obligation, or accomplish any other objective recognized as an exception to the right to deletion under applicable law.

Right to Request Correction

You have the right to request that we correct inaccurate Personal Information about you. This type of request may be referred to as a “Request to Correct.” By visiting your account settings, you can correct and change certain Personal Information associated with your account.

Right to Opt-Out of Sale or Sharing

You have the right to direct a business that Sells or Shares Personal Information about you to third parties not to Sell or Share your Personal Information. This type of request may be referred to as a “Request to Opt-Out.”

Right to Limit Use and Disclosure of Sensitive Personal Information

If a business collects Sensitive Personal Information* for the purpose of inferring characteristics about you, you have the right to request that the business limit its use and disclosure of your Sensitive Personal Information to that use and disclosure which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests such goods and services. (Toyon does not collect Sensitive Personal Information for the purpose of inferring characteristics about you.)

*Sensitive Personal Information includes social security number; driver’s license or state identification number; complete account log-in credentials; precise geolocation; racial or ethnic origin, religious or philosophical beliefs, or union membership; the contents of a consumer’s mail, email and text messages (unless the business is the intended recipient of the communication); genetic data; biometric information; health information; and information concerning sex life or sexual orientation.

Right to Non-Discrimination
You have the right not to receive discriminatory treatment by a business for the exercise of your privacy rights under the CCPA.

How to Submit a Request To “Know,” “Delete” or “Correct”

You may submit a Request to Know, Delete or Correct in our Privacy Center here. You may also submit a Request to Know, Delete or Correct to privacy@toyon.com. The request must state “CCPA Request” and include:

your first and last name;
an email address at which you can be reached for purposes of the request;
the California county in which you reside;
for a Request to Know, the disclosure(s) you are requesting;
for a Request to Delete, a clear statement that you want us to delete your Personal Information; and
the reason(s) you believe we have collected, disclosed or sold your Personal Information, specifically, within the past 12 months (for example, you registered an account on our platform or received a communication from us)

If you are submitting a request on behalf of another consumer as their authorized representative, you must include the foregoing information about the consumer and provide proof of permission from the consumer to make the request.

After confirming receipt of your request, we’ll contact you if we need more information in order to verify it. If we can’t verify a request, we may deny it.

13. Residents Of Other U.S. States

Residents of Virginia, Colorado, and other U.S. states that have enacted comprehensive consumer privacy legislation have certain rights when they interact with a business in a “consumer” context (as opposed to a business-to-business or employment context), including:

To confirm whether or not a business is processing the consumer’s Personal Information and to access such Personal Information;
To correct inaccuracies in the consumer’s Personal Information;
To delete Personal Information provided by or obtained about the consumer;
To obtain a copy of the consumer’s Personal Information that the consumer previously provided to the business in a portable, and to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another business without hindrance (if the data is processed by automated means)
To opt out of the processing Personal Information for purposes of (i) targeted advertising, (ii) the sale of Personal Information, or (iii) profiling in furtherance of decisions that produce legally or similarly significant effects concerning the consumer.

To exercise one or more rights, please visit our Privacy Center here or submit a request to privacy@toyon.com. The request must state “Data Privacy Request” and include:

your first and last name;
an email address at which you can be reached for purposes of the request;
the county and state in which you reside; and
a description of the rights you are exercising
the reason(s) you believe Toyon has obtained your Personal Information

We will handle such requests in accordance with applicable laws. After confirming receipt of your request, we’ll contact you if we need more information in order to verify it. If we can’t verify a request, we may deny it.

If we decline to act on your request, you may have a right to appeal. To submit an appeal, please contact us at privacy@toyon.com.

14. Data Subjects In The EEA, United Kingdom and Switzerland

Toyon is a California corporation headquartered in Goleta, California that does not have an office, employees or other establishment in the European Economic Area (EEA) or any other country outside the United States (collectively, with EEA countries, the “Other Countries”). Our Services are not targeted to natural persons in Other Countries. If you visit our website or contact us, your Personal Information will be processed in the United States—which has not received a finding of “adequacy” from the European Commission as referenced in Article 25 of the European Union’s General Data Protection Regulation (GDPR)—and will be handled in accordance with this Policy and applicable U.S. law, unless we have agreed otherwise in writing with you or a third party you are affiliated with.

15. Changes To This Policy

We reserve the right to update or change our Privacy Policy at any time and you should check this Privacy Policy periodically. Your continued use of the Service after we post any modifications to the Privacy Policy on this page will constitute your acknowledgment of the modifications and your consent to abide and be bound by the modified Privacy Policy. If we make any material changes to this Privacy Policy, we will notify you either through the email address you have provided us, or by placing a prominent notice on our website.

16. Contact Us

If you have any questions or concerns about this Policy, please contact us via privacy@toyon.com.