California Privacy Notice

Finastra California Privacy Notice

Updated: September 2, 2024

INTRODUCTION

This document gives notice how Finastra* (”we”, “our”, “us”, “Finastra”) handles Personal Information that is subject to the California Consumer Privacy Act of 2018 and corresponding regulations (the “CCPA”).

This Notice describes the practices we have adopted with respect to processing Personal Information as a “business” under the CCPA including the collection, use, storage or disclosure of Personal Information, without limitation, (i) on our websites that link to this Notice (collectively the "Sites"); or (ii) when you participate in our webinars, events, trade shows and demonstrations of our Services.

This Notice does not apply to information governed under regimes other than the CCPA such as information subject to the Gramm-Leach-Bliley Act or certain information subject to the Fair Credit Reporting Act.

This Notice describes California residents’ data protection rights under the CCPA and describes how California residents may exercise those rights.

For more general disclosures about our information collection and use, please see our Privacy Policy. All terms not otherwise defined herein shall take the applicable meaning assigned in the Privacy Policy.

CCPA RIGHTS

If you are a California resident, you may request certain information from or certain action by us, such as exercising the access and deletion rights described below, or you may authorize an agent to make such a request on your behalf. We will seek to verify your identity and your agent’s authority when we receive an individual rights request from you or on your behalf to ensure the security of your Personal Information and may need to collect additional Personal Information to do so.

Please direct any such rights requests (as further described below) or additional questions that you may have regarding this Notice to privacy@finastra.com or by post to Four Kingdom Street, Paddington, W2 6BD, United Kingdom.

Deletion

California residents have the right to request the deletion of Personal Information, but we may not delete some or all Personal Information, as required or permitted by applicable law, such as if the requested information is necessary to fix our Services in the case of a bug; comply with a legal obligation; or make other internal and lawful uses of the information that are compatible with the context in which you provided it. Upon verifying your identity and the validity of your request, we will delete your Personal Information from our records and instruct our service providers, affiliates, or third parties to delete your information as required by law.

Access

If you are a California resident, you may also request to receive details about how we collect, use, and share your Personal Information. You may also request for us to disclose the following about your information in the preceding 12 months:

The categories of Personal Information we collected;
The categories of sources from which we collected your Personal Information;
The business or commercial purposes for collecting, selling, or sharing your Personal Information;
The categories of third parties to whom we disclose your Personal Information; and
The specific pieces of Personal Information we have collected about you.

Right to Correct Inaccurate Personal Information

You have the right to correct inaccurate Personal Information that we maintain about you. Upon verifying your identity and the validity of your request, we will use reasonable efforts to correct your Personal Information as directed. In certain circumstances, we may not be able to satisfy this request depending on the nature of the Personal Information and purposes for maintaining it.

Opt-out of Sale

If a business sells Personal Information, you have a right to opt-out of that sale. We do not, and do not intend to, sell the Personal Information of California residents and, furthermore, do not have actual knowledge that we sell the Personal Information of consumers under 16 years old.

Opt-out of Sharing

You have the right to opt-out of the sharing of your Personal Information for the purpose of targeted behavioral advertising. If you exercise your right to opt-out of the sharing of your Personal Information, we will refrain from sharing your Personal Information, unless you subsequently provide express authorization for the sharing of your Personal Information.

To opt-out of the sale or sharing of your Personal Information use the opt-out tool located at the bottom of our Site or set the Global Privacy Control (GPC) signal.

The GPC is a browser-based opt-out preference signal that communicates your privacy preferences to the sites you visit. For more information on the GPC, visit its website here.

Note that because the GPC and other choices available to you may be browser-based, your opt-out preferences will apply only to the browser from which you exercised that choice. You can, however, enable the GPC on all of your browsers and devices.

Please note that not all browsers process your opt-out requests in the same manner. Please reference your specific browser options and instructions for more information.

We will honor GPC requests to the extent we are able to, based on the information provided via the signal. Note that we may not be able to tie a browser or device-based preference signal request to all Personal Information we have about you.

Please note these opt-outs work via Cookies, so if you delete Cookies, use a different device, or change web browsers, you will need to opt-out again.

Right to Limit Disclosure of Sensitive Personal Information

We do not use or disclose your sensitive Personal Information outside of the limited purposes set forth below, so you do not have the right to direct us to limit our use and disclosure of such sensitive Personal Information. For example, we may use your sensitive Personal Information for certain limited purposes, such as the following: (1) performing our service or providing goods, (2) detecting security incidents, (3) resisting malicious, deceptive, fraudulent, or illegal actions, (4) ensuring physical safety, (5) maintaining or servicing accounts, providing customer service, verifying customer information, or providing similar services, and (6) to verify and maintain the quality or safety of a service or product to improve, upgrade, or enhance a service or product.

Nondiscrimination

Businesses may not, and we do not, discriminate against you for exercising any CCPA rights, such as the access and deletion rights described above.

SERVICE PROVIDER DESIGNATION

When offering Services to our customers, we may act as a “service provider” under the CCPA and our receipt and collection of any consumer Personal Information is completed on behalf of our customers in order for us to provide our Services. This Notice does not apply to the information, if any, that we collect pursuant to our role as a service provider.

ADDITIONAL CCPA DISCLOSURES Categories of Personal Information Collected and Disclosed

In the past 12 months, we have collected, and disclosed to third parties for our business purposes, the following categories of Personal Information relating to California residents:

Identifiers, such as name and email address;
Commercial information, such as transaction information and purchase history;
Internet or network activity information, such as browsing history and interactions with the Sites;
Geolocation data, such as device location and Internet Protocol (IP) location; and
Professional or employment-related information, such as work history and employer.

Categories of Sources

The categories of sources from which we collected this Personal Information are:

Directly from you or your agent, such as when you attend an event or webinar that we host or fill out a form that we provide;
Passively through tracking technologies regarding your use of the Sites; and
Our service providers and other third parties that provide online tracking and advertising services.

Categories of Recipients

The categories of third parties to whom we disclosed all of the categories of Personal Information that we disclose for our business purposes are:

Vendors and service providers who provide services such as website hosting, data analysis, payment processing, information technology and related infrastructure, customer service, email delivery, auditing, marketing and marketing research activities; and
Partners and third parties who provide services such as legal expertise, tax expertise, and auditors.

We may disclose and exchange information with law enforcement agencies and regulatory bodies to comply with our legal and regulatory obligations.

We may also need to share some Personal Information with other parties, such as potential buyers of some or all of our business or during a re-structuring. The recipient of the information will be bound by confidentiality obligations.

Purposes for Collection and Disclosure

We have collected and disclosed all the categories of Personal Information that we collect for the following purposes:

To market our Services and provide other information about Finastra;
Performing Services and making available other products or information related to our business, processing or fulfilling orders and transactions;
Advertising or marketing Services and performing analytics;
Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity;
Undertaking activities to verify or maintain the quality or safety of our business and Services; and
Complying with laws and other legal process and law enforcement requirements.

In addition, we may use your information for the following business purposes:

To provide our website and services to you.
Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
Helping to ensure security and integrity to the extent the use of the consumer’s Personal Information is reasonably necessary and proportionate for these purposes.
Debugging to identify and repair errors that impair existing intended functionality.
Performing services on behalf of our customers, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.
Supporting our advertising and marketing services as permitted by law.
Undertaking internal research for technological development and analytics.
To improve, upgrade, or enhance the services.

Data Storage and Retention

The length of time that we intend to retain your Personal Information will depend on several criteria including but not limited to: (i) the length of time we are required to retain your Personal Information in order to comply with applicable legal and regulatory requirements, (ii) the length of time we may need to retain your Personal Information in order to accomplish the business or commercial purpose(s) for which such Personal Information is collected, used or disclosed (as indicated in this Notice), and (iii) whether you choose to exercise your right, subject to certain exceptions, to request deletion of your Personal Information.

We have implemented measures designed to secure your Personal Information against unauthorized use, loss, destruction or alteration. We cannot guarantee the security of your Personal Information.

Changes to this CCPA Privacy Notice

We reserve the right to amend this CCPA Privacy Notice at our discretion and at any time. When we make changes, we will post the updated notice on the applicable Sites and update the Notice's date. Your continued use of our Sites following the posting of changes constitutes your acceptance of such changes.

* Turaz Global S.à r.l and its group companies