Privacy Policy | Good Face Project

Privacy Policy

Effective Date: August 20, 2021

The materials on this website or mobile application are provided by The Good Face Project, Inc., (hereinafter, “ Good Face”, “ GFP”, “ we” or “ us”). The Good Face website at www.thegoodfaceproject.com (including all content under “ thegoodfaceproject.com” domain name) is owned by Good Face, and is referred to herein as the “ Website.” This notice (“ Privacy Policy”) is included with and supplements our Website Terms and Conditions. The services that we may provide to you via the Website or Good Face mobile application (“ App”), as well as the Website and App themselves, are referred to herein and in the Terms and Conditions as the “ Services.” This Privacy Policy explains our online information collection and use practices, and the choices you can make about the way we use such information. It is important that you take the time to read and understand this Privacy Policy so that you can appreciate how we use your personal information.

REMEMBER IF YOU USE OR ACCESS THE SERVICES, YOU AGREE TO THIS PRIVACY POLICY. AS WE UPDATE OR EXPAND THE SERVICES, WE MAY CHANGE THIS PRIVACY POLICY UPON NOTICE TO YOU, HOWEVER, PLEASE REVIEW IT FROM TIME TO TIME.

1. Important Notices

A. EU Privacy Rights. For users that are citizens of the European Union (" EU"), this Privacy Policy is subject to the provisions of the General Data Protection Regulation (" GDPR") and other applicable privacy laws. In such case, we are a data “ Controller” and you are a “ Data Subject” with certain protected privacy rights concerning your “ Personal Data.” We will take commercially reasonable steps to maintain compliance with GDPR requirements. Your Personal Data may identify you as a person, and thus is often referred to as Personally Identifiable Information (" PII").

B. California Privacy Rights. The California Consumer Privacy Act (“ CCPA”) of 2018 enhances privacy rights and consumer protection for residents of California. Under the CCPA, California residents have the rights to: 1) know what Personal Data are being collected about them; 2) know whether their Personal Data are sold or disclosed, and to whom; 3) say 'no' to the sale of their Personal Data; 4) access their Personal Data; and 5) not be discriminated against for exercising their privacy rights under the CCPA. California law allows California residents to request information regarding our disclosures in the prior calendar year, if any, of their PII to third parties. To make such a request, please contact us at privacy@thegoodfaceproject.com. Please include enough detail for us to locate your file; at a minimum, your name, email and username, if any. We will attempt to provide you with the requested information within thirty (30) days of receipt. We reserve our right not to respond to requests sent more than once in a calendar year, or requests submitted to an address other than the one posted in this notice. Please note that this law does not cover all information sharing. Our disclosure only includes information covered by the law.

2. Who Collects Your Information?

We do. We collect information from you via the Services, and we are responsible for protection of that information.

3. What Information Do We Collect?

A. Requested Information. On various pages on the Services, we may request specific PII about you in order to register you for an account to use our Services (e.g., Good Face Formulator), provide you with a demonstration, add you to our email list, facilitate your payments for products and Services, or fulfill your requests for information. We also request your PII when you subscribe to a GFP blog, sign up for a webinar, or request customer support. You may choose not to provide your PII, but then you might not be able to take advantage of some of the features of our Services. We only collect basic Personal Data about you that does not include any special types of information as defined by GDPR (e.g., biometric, health-related). The types of Personal Data we collect and save include:

B. Anonymous and Aggregate Information. We may use data capture, syndication, analysis and similar tools to extract, compile, synthesize and analyze non-PII data collected via your access and use of the Service (“ Anonymous Data"). We may further aggregate and combine your de-identified Anonymous Data (such as age, gender, race, religion, marital status, net worth, household income, the type of browser you are using, device type, the operating system you are using, and the domain name of your Internet service provider) with the Anonymous Data of others (“ Aggregated Data"). To the extent that we collect any Anonymous Data or Aggregated Data, we shall own such Anonymous Data or Aggregated Data and may use it for any lawful business purpose without a duty to account for such use to you, provided that Anonymous Data is used only in an aggregated form, without specifically identifying the source of the Anonymous Data. Without assuming any obligations or liabilities to you, we will use commercially reasonable efforts to comply with applicable laws and regulations respecting the dissemination and use such Anonymous Data or Aggregated Data.

C. Navigational Information. “ Navigational Information” refers to information about your computer and your visits to the Website, such as your IP address, geographic location, browser type, referral source, length of visit and pages viewed (please see the "Use of Navigation Information" section below). We may collect, maintain, process and use your Navigational Information, including the real-time geographic location of your mobile device (“ Location Data”) as necessary to provide the Services’ full functionality. By using or activating any location-based services on a mobile device, you agree and consent to our collection, maintenance, publishing, processing and use of your Location Data in order to provide you with the Services. We do not collect Location Data in a form that personally identifies you. You may withdraw your consent to our use of your Location Data at any time by turning off the location-based services on the mobile device you are using, or by not using any location-based features. Turning off or not using location-based features may impact the functionality of the Services as delivered to you.

D. Information Collected From Third Parties. From time to time, we may receive Personal Data about you from third party sources including our partners with which we offer co-branded services or engage in joint marketing activities, and other sources such as social media websites.

4. Why Is My Information Being Collected?

A. We need to collect your Personal Data so that we can provide the Services, respond to your requests for information and demonstrations, add you to our emailing lists, process your purchases and other transactions with us, and process your requests for access to our Services.

B. We also collect Aggregate Data to help us better design the Services. We collect log information for monitoring purposes to help us to diagnose problems with our servers, administer and troubleshoot the Services, calculate usage levels, and provide support to you.

C. Legal Basis for Processing Personal Data (EEA visitors only). The GDPR requires businesses to have a legal basis for collecting and processing the Personal Data of residents of the European Economic Area (" EEA"). For EEA visitors, our legal basis for collecting and using your Personal Data depends on the Personal Data concerned and the specific context in which we collect it. In accordance with GDPR requirements, we collect Personal Data from you only where we have your consent to do so, where we need the Personal Data to perform a contract with you, or where the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a legal obligation to collect Personal Data from you. If we ask you to provide Personal Data to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you as to whether or not the provision of your Personal Data is mandatory (as well as of the possible consequences if you do not provide your Personal Data). Similarly, if we collect and use your Personal Data in reliance on our legitimate interests (or those of any third party), we will make clear to you at the relevant time what those legitimate interests are.

5. How Do We Use the Information We Collect?

A. We use the Personal Data you provide for the purposes for which you have submitted it including:

B. Anonymous Data and Aggregate Data. We may use Anonymous Data and Aggregate Data to improve the design and content of our Services, enable us to personalize your Internet experience, analyze how our Services are used, analyze industry trends, as well as offer new products. We may also use Anonymous Data and Aggregate Data to provide our business partners with statistical information about our users.

C. Use of Navigational Information. We may use Navigational Information to operate and improve the Website and to provide you with a better experience when you interact with us. We may also use Navigational Information alone or in combination with Personal Data to provide you with personalized content and features. Navigational Information, such as IP address, is used to approximate your location. For example, we may use your approximate location to provide content that has been translated to the local language, or send emails at certain times using your local time zone. You may disable the collection and use of your location data via browser, operating system or device-level settings. Your consent concerning your location data may be withdrawn at any time by contacting us at privacy@thegoodfaceproject.com.

D. Use of Payment Information. We may use financial or payment information that you provide to us to process your purchase transactions (e.g., to use the Good Face Formulator), and to check your financial qualifications and collect payment from you. We use a third-party payment processor to manage credit card processing, however, such payment processor is not permitted to store, retain, or use your information except for the sole purpose of credit card processing on our behalf.

6. Do We Share Your Personal Data?

A. In general, we will not share your Personal Data except: (a) for the purposes for which you provided it; (b) with your consent; (c) as may be required by law (e.g., in response to a court order or subpoena, or in response to a law enforcement agency request); (d) as we think necessary to protect our organization or others from injury (e.g., when we believe that someone is causing, or is about to cause, injury to or interference with the rights or property of another); or (e) on a confidential basis with persons, partners or organizations with whom we contract to carry out internal operations or as necessary to render the Services (“ Service Providers").

B. Although it is not our practice to sell your Personal Data, the CCPA further restricts us from selling your Personal Data if you click the “Do Not Sell My Personal Information” link on the Services.

C. We may partner with trusted third-party partners to provide you with co-marketing content that we think may be relevant to you. When you engage with these co-marketing partners, we will tell you with whom we are sharing your data, and provide a link to the co-marketing partner’s privacy policy so you can learn more about how to opt-out of the partner’s communications. These co-marketing partners are required to adhere to our privacy and data protection policies. If you do not want us to share your Personal Data with these companies, please contact us at privacy@thegoodfaceproject.com.

D. We may share Anonymous Data or Aggregate Data with others, including affiliated and non-affiliated organizations such as advertisers.

E. Finally, we may transfer your Personal Data to our successor-in-interest in the event of an acquisition, sale, merger or bankruptcy. In this event, you will be notified via email and/or a prominent notice on our Website, of any change in ownership, uses of your Personal Data, and choices you may have regarding your Personal Data.

7. Are There Other Ways My Personal Data Could Be Shared?

A. Our Services may include third party social media features, including, but not limited to, the Facebook ‘Like’ button and widgets, such as the ‘Share’ button; as well as interactive mini-programs that run within our Services. These features may collect your IP address and which page you are visiting on our Website; and may set a cookie to enable the feature to function properly. Third party social media features and widgets may be hosted by a third party or integrated with our Website. This Privacy Policy does not apply to these features. Your interactions with these social media features are governed by the privacy policy and other policies of the third-party companies that provide them.

B. You may elect to share certain Personal Data with individuals (e.g., other members) or with the public via your use of the Services. In this case, you will control such sharing via settings that we provide. For example, the Services may make it possible for you to publicly share information via social media such as Facebook or Twitter. Be aware that when you choose to share information with friends, professionals, public officials, or with the public at large, you may be disclosing sensitive information, or information from which sensitive information can be inferred. Always use caution when sharing information through the Services. You understand and agree that we are not responsible for any consequences of your sharing of information through and beyond the Services.

8. How Can You Access and Control Your Information?

A. We provide you with the following data access and control rights:

B. After registering for an account within the Services, you may log-in to the account and edit your Personal Data in your profile. The Services also provide you with checkboxes to "opt out" of data sharing activities or receipt of marketing communications from us or our alliances that you may have previously selected. We do not automatically add you to any marketing emails lists, but rather must obtain your consent via your “opt in” choices before doing so. You may have your name placed on our do-not-share list to specifically prohibit us from sharing your Personal Data with our business partners for marketing purposes.

C. You may unsubscribe from our marketing communications by clicking on the "unsubscribe" link located on the bottom of our e-mails, updating your communication preferences in your account, or by contacting us as described below. Note that you may not opt out of receiving transactional emails related to your account or use of the Good Face Formulator.

D. For instructions on how you can further access your Personal Data that we have collected, or how to correct errors in such information, please send an e-mail to privacy@thegoodfaceproject.com or by mail to The Good Face Project, Inc., 5667 Linda Rosa Avenue, La Jolla, CA 92037, Attention: Privacy. We will promptly stop using your information and remove it from our servers and database at any time upon your request. To protect your privacy and security, we will take reasonable steps to help verify your identity before granting access, making corrections or removing your information.

E. If you are an EU citizen and believe that we have misused your Personal Data, you have the right to contact the European Data Protection Supervisor (“ EDPS”) to ask the EDPS for advice on how to exercise your rights or to ask the EDPS to investigate a complaint. For more information, see EDPS Complaints.

9. How Do We Store and Protect Your Information?

A. After receiving your Personal Data, we will store it on our systems for future use. We have physical, electronic, and managerial procedures in place to safeguard and help prevent unauthorized access, maintain data security, and correctly use the information we collect. Unfortunately, no data transmission or data storage solution can ever be completely secure. As a result, although we take industry-standard steps to protect your information (e.g., strong encryption), we cannot ensure or warrant the security of any information you transmit to or receive from us or that we store on our or our Service Providers' systems.

B. If you are using the Services from outside of the USA, you understand that your connection may be through servers located in the USA, and the information you provide may be securely stored in our web servers and internal systems located within the USA. By accessing or using the Services or otherwise providing information to us, you consent to the processing, transfer and storage of information in and to the USA, where you may not have the same rights and protections as you do under your local law.

C. We store Personal Data for as long as reasonably required for its purpose or for any additional period required by law (if any). We and our Service Providers will delete your account information and Personal Data when you or when we delete your account. We may store information longer for legitimate business reasons (for example, Personal Data may remain in backups for a reasonable period of time), or as legally required. Otherwise, we store your Personal Data until you request us to remove it from our servers. We store our logs and other technical records indefinitely.

D. If you have elected to receive marketing communications from us, we retain information about your marketing preferences for a reasonable period of time from the date you last expressed interest in our content, products, or services, such as when you last opened an email from us or ceased using your account. We retain information derived from cookies and other tracking technologies for a reasonable period of time from the date such information was created.

10. How Do We Use Cookies And Other Network Technologies?

A. Cookies. To enhance your online experience with us, our web pages may presently or in the future use "cookies." Cookies are text files that our web server may place on your hard disk to store your preferences. Cookies, by themselves, do not tell us your e-mail address or other PII unless you choose to provide this information to us. Once you choose to provide PII, however, this information may be linked to the data stored in a cookie. You can set your browser to notify you when you receive a cookie, providing you with as much control as you wish as to the decision to accept/reject the cookie, and deletion of the cookie upon leaving our Services. Please note, however, that if your browser does not accept cookies, you may not be able to take advantage of all of the features of our Services. If you would like more information about cookies and how to control and delete cookies in various browsers, such as Internet Explorer, Firefox, Safari and Chrome, please visit https://aboutcookies.org/.

B. GIFs. We or our service providers may also use "pixel tags," "web beacons," "clear GIFs," “embedded links” and other commonly-used information-gathering tools such as JavaScript in connection with some Services pages and HTML-formatted email messages. We use these tools for such purposes as compiling aggregate statistics about Services usage and response rates. A pixel tag is an electronic image (often a single pixel), that is ordinarily not visible to website visitors, and may be associated with cookies on visitors’ hard drives. Pixel tags allow us and our Service Providers to count users who have visited certain pages of the Services, to deliver customized services, and to help determine the effectiveness of our Services. When used in HTML-formatted email messages, pixel tags can inform the sender of the email whether and when the email has been opened.

C. Clickstreams. As you use the Internet, you leave a trail of electronic information at each website you visit. This information, which is sometimes referred to as "clickstream data", can be collected and stored by a website's server. Clickstream data can reveal the type of computer and browsing software you use and the Uniform Resource Locator (“ URL”) or IP address of the website from which you linked to the Services. We may use clickstream data as a form of non-PII to determine how much time visitors spend on each page of our Services, how visitors navigate through the Services, and how we may tailor our web pages to better meet the needs of visitors. We will only use this information to improve our Services.

D. Do Not Track. Many modern web browsers give you the option to send a “Do Not Track” signal to the websites you visit, indicating that you do not wish to be tracked. At this time, the Services do not specifically respond to “Do Not Track” signals.

E. Advertising. Note that we may use cookies and other technologies for purposes of online advertising. This means that when you use the Services, we or third-party ad servers, ad network providers or advertisers (collectively “ Ad Providers”) may use cookies that they collect or that we provide to them. Such Ad Providers may collect information about your use of the Services (including mobile applications) or your online activities over time and across different websites and devices. Collected information may include the content you viewed, the date and time that you viewed this content, and the website that referred you to the Services. This information may be associated with your unique browser, device identifier or IP address. Ad Providers may provide you with advertisements that you may see on the Services or on affiliated websites. To improve the relevancy and help measure the effectiveness of such advertisements, the Ad Providers may use cookies, web beacons, clear GIFs or similar technologies to provide you with targeted advertising based upon your interests. These practices help tailor advertisements that are relevant and of use to you. You may control or opt-out of such advertising by changing the cookie settings in your browser as described above. If you wish to not have this information used for the purpose of serving you targeted ads, you may opt-out by contacting us at privacy@thegoodfaceproject.com. Please note this does not opt you out of being served all advertising. You will continue to receive generic ads.

F. User Behavior Tracking. We may track the webpages and links our users visit within our Services, in order to determine what Services are most popular. We may use such tracking data to deliver customized content and advertising to users whose behavior indicates they are interested in a particular subject area. We may also collect user data to enable “heat mapping” capabilities that track the areas of a webpage where users most frequently move the mouse or click. These tracking activities make it possible to monitor and analyze web traffic and evaluate user behavior to customize our Services.

11. Collection of Information by Others

We may provide links to certain third-party websites that you may click-on from our Services. We do not control, and are not responsible for, the content or practices of these other websites. Our provision of such links does not constitute our endorsement of these other websites, their content, their owners, or their practices. This Privacy Policy does not apply to these other websites. Please check the privacy policies of these other websites to learn how they collect, use, store and share information that you may submit to them or that they collect.

12. Children and Young People’s Information

We do not knowingly collect any information from any minors, and we comply with all applicable privacy laws including the GDPR, CCPA, USA Children's Online Privacy Protection Act (“ COPPA”) and associated Federal Trade Commission (“ FTC”) rules for collecting Personal Data from minors. Please see the FTC's website (www.ftc.gov) for more information. Our Services will not knowingly accept Personal Data from anyone under 16 years old in violation of applicable laws, without consent of a parent or guardian. In the event that we discover that a person under the age of 16 has provided PII to us without parental consent, we will make efforts to delete the person’s information in accordance with the COPPA. If you have concerns about the Services, wish to find out if your child has accessed our Services, or wish to remove your child's Personal Data from our servers, please contact us at privacy@thegoodfaceproject.com.

13. Changes to this Policy

Because our business needs may change over time, we reserve the right to modify this Privacy Policy. If at any time in the future we plan to use your PII in a way that differs from this Privacy Policy, we will revise this Privacy Policy as appropriate. In the event of a change to our Privacy Policy, we will email the updated policy to the email address that you provided to us. Your continued use of the Services following our notice of changes to this Privacy Policy means you accept such changes.

14. Our Contact Information

If you have any questions about this Privacy Policy or our treatment of the information you provide us, please use this form or write to us by mail to The Good Face Project, Inc., 5667 Linda Rosa Avenue, La Jolla, CA 92037, Attn: Privacy.

Copyright © The Good Face Project, Inc. All rights reserved. The Services are protected by United States and international copyright, trademark, and other applicable laws. This includes the content, appearance, and design of the Services, as well as the trademarks, product names, graphics, logos, service names, slogans, colors, and designs.