CALIFORNIA PRIVACY POLICY

CALIFORNIA PRIVACY POLICY

Rack Room Shoes, Inc. (and, its subsidiaries) (“we,” “our,” or “Company”) respects your privacy and is committed to providing a transparent Notice at Collection and Privacy Policy for California Residents. This Notice and Privacy Policy for California Residents applies solely to those who reside in the State of California (“consumers” or “you”). The purpose of this notice and privacy policy is to provide California residents, at or before the time we collect your personal information, with a comprehensive description of our online and offline practices regarding the collection, use, disclosure, and sale of personal information and of the rights of consumers regarding your personal information:

Notice at Collection:
Notice at or before the point of collection, about the categories of personal information which may be collected from you and the purposes for which the personal information may be used.

Privacy Policy:
A comprehensive description of our online and offline practices regarding the collection, use, disclosure, and sale of personal information and of your rights regarding your personal information, including:

• Your right to know about personal information collected, used, disclosed or sold:


• Categories of personal information we may have collected in the preceding 12 months
• Categories of sources from which personal information is collected
• Categories of personal information, if any, we may have disclosed or sold in the preceding 12 months
• For each category identified as disclosed or sold, categories of third parties to whom the information may have been disclosed or sold


• Your right to opt-out of the sale of personal information
• Your right to request deletion of your personal information
• How to submit a verified consumer request for your Right to Know or Right to Delete
• How to use an authorized agent to submit a verified consumer request
• Your right to non-discrimination for the exercise of your privacy rights
• Other California privacy rights
• Changes to our privacy notice
• Our contact information

 

Notice at Collection and Privacy Policy for California Residents

The purpose of this Notice at Collection is to provide you with timely notice, at or before the point of collection, about the categories of personal information that may be collected from you and the purposes for which the personal information may be used. The Categories of Personal Information are listed in the Privacy Policy below.

Please note that Personal Information does not include:

• Publicly available information from government records.
• Deidentified or aggregated consumer information.
• Information excluded from the CCPA's scope, like:
  
  
  • health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
  
  
  • personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (Caliph), and the Driver's Privacy Protection Act of 1994.

 

We use the personal information we collect for one or more of the following business purposes:

• To fulfill or meet the reason for which the information is provided
• For our internal operation purposes
• For auditing relating to consumer transactions including ad impressions and compliance with regulations
• Fraud and security detection
• Debugging to identify and repair errors
• Short-term data use for the current interaction that is not used to build a profile
• Servicing transactions and accounts (e.g., customer service, maintaining and servicing accounts, customer verification, payment processing) and providing services on behalf of business or service provider (e.g., financing, advertising or marketing, analytics)
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of a bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.
• Undertaking internal research for technological development and demonstration
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.
• To share the personal information with service providers to carry out other business purposes.

 

We will not collect additional categories of personal information without providing you a new Notice at Collection disclosing those categories. We will not use your personal information for a purpose materially different from those disclosed in this Notice at Collection unless we directly notify you and obtain explicit consent to use it for the new purpose. Under the California Consumer Privacy Act (CCPA), some sharing of personal information (like your name, email address, shopping preferences, etc.) may be considered a "sale". We don’t sell your personal information for money, although we may allow certain third parties to use that information for purposes that may not directly benefit RRS. For more details, please review our privacy policy, below. If you would prefer to opt out of sharing may be considered a "sale" under the CCPA, just click below and fill out the Opt-out of Sale Data.
Click here to submit the opt-out form.

 

Privacy Policy

The purpose of this privacy policy is to provide you with a comprehensive description of our online and offline practices regarding the collection, use, disclosure, and sale of personal information and of your rights regarding your personal information.

Your Right to Know
You have the right to request that we disclose what personal information we collect, use, disclose, and sell. You can do this through a verified consumer request. That process is described below in the section, "Submitting a Verified Consumer Request"

We collect personal information, which means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“personal information”). The following table includes disclosures for the preceding 12 months of: categories of personal information we have collected about consumers, the categories we have disclosed for a business purpose, and categories of third parties with whom we shared the personal information during that period.

Categories of Personal Information

• Identifiers: For example, a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.


• Personal Information Categories from Cal. Civ. Code § 1798.80(e): For example, a name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.


• Characteristics of CA or Federal Protected Classifications: For example, race, religion, national origin, age (40 and over), gender, sexual orientation, medical condition, ancestry, pregnancy (includes childbirth, breastfeeding and/or related medical conditions), familial status, disability, veteran status, or genetic information.


• Commercial Information: For example, records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.


• Internet or Other Similar Network Activity: For example, browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement


• Geolocation Data: For example, information that can be used to determine a device’s physical location


• Sensory or Surveillance Data: For example, audio, electronic, visual, thermal, olfactory, or similar information that can be linked or associated with a particular consumer or household


• Data: For example, inferences drawn from personal information to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Categories of third parties to whom the information above may have been disclosed: Advertising networks; Internet service providers; Data analytics providers; Government entities; Operating systems and platforms; Social networks; Data brokers; Cloud storage providers: Payment processors; Web hosting service providers; E-mail distribution service providers; Help Desk service providers; Financial and accounting service providers; Cybersecurity service providers; Logistics and planning tool providers; and Customer relationship management tool providers.

The categories identified in the table above were collected from the following categories of sources: You directly; Advertising networks; Internet service providers; Data analytics providers; Government entities; Operating systems and platforms; Social networks; and Data brokers.

The purpose of the notice of Right to Opt-out is to inform you that as a California resident, you have the right to direct us to stop selling your personal information, which is called the “Right to Opt-Out.” You may exercise your Right to Opt-Out by filling out our DSAR Form , or by contacting the company at the email or telephone number at the end of this policy.

Authorized Agent for Opt-Out: If you use an authorized agent to exercise your right to opt-out of the sale of personal information, please note that Company requires that the authorized agent submit proof in the form of an authorization signed by you that the authorized agent has been authorized to act on your behalf.

 

Your Right to Request Deletion of Your Personal Information

You have the right to request that we delete any of your personal information collected by us, subject to certain exceptions. You can do this through a verified consumer request. That process is described below in the section, "Submitting a Verified Consumer Request."
We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

• Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
• Debug products to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
• Comply with a legal obligation.
• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

 

Submitting a Verified Consumer Request

You have the right to submit verified consumer requests to know information or for deletion. The request to know can be for any or all of the following:

• (1) Specific pieces of personal information that we have collected about you;
• (2) Categories of personal information we have collected about you;
• (3) Categories of sources from which the personal information was collected;
• (4) Categories of personal information that we sold or disclosed for a business purpose about you;
• (5) Categories of third parties to whom the personal information was sold or disclosed for a business purpose;
and
• (6) The business or commercial purpose for collecting or selling personal information.

 

The response to a request for any of the categories above will cover the preceding 12 months. Please note that we are not required to provide personal information to you more than twice in a 12-month period. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

To make a request, you can fill out the DSAR Request Form, or call the number in the contact information at the end of this policy. Your request will be verified by matching the information you provide to information that we have collected.

Once we receive your verifiable consumer request, we will confirm receipt of the request within 10 business days describing our verification process. We will respond to your request within 45 calendar days, if we are able to verify your identity. Requests for deletion will require a separate confirmation that you want your information deleted.

If requests from you are manifestly unfounded or excessive in particular because of their repetitive character, we may either charge a reasonable fee or refuse to act on the request, notifying you of our reason for refusing to act. If we determine that the request warrants a fee, we will notify you of the reason for that determination and provide you with a cost estimate before completing your request.

Please note that, in responding to your request, we are not permitted to disclose or provide you with your Social Security number, driver’s license number or other government-issued identification number, financial account number, any health insurance or medical identification number, an account password, security questions and answers, or unique biometric data generated from measurements or technical analysis of human characteristics. However, we will inform you with sufficient particularity that we have collected the type of information without disclosing the actual data.

 

Using an Authorized Agent to Submit a Request

Only you, or a natural person or a business entity registered with the Secretary of State to conduct business in California that you have authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. If you use an authorized agent, you may provide a power of attorney executed pursuant to California Probate Code sections 4000 to 4465. If a power of attorney that meets those provisions is not submitted, you will be required to provide the authorized agent signed permission to submit a request, verify your identity directly with us, and directly confirm with us that you provided the authorized agent permission to submit the request. If you’re an authorized agent making a request, you need to do the following to the e-mail address below in our contact information:

(a) e-mail a copy of a power of attorney provided to you by the consumer pursuant to Probate Code sections 4000 to 4465; or

(b) e-mail proof of signed permission along with a copy of your ID and have the consumer direct confirm with us that they provided you permission to submit the request by sending an e-mail.

 

Your Right to Non-Discrimination for the Exercise of a Privacy Right

You have a right not to receive discriminatory treatment by the business for the exercise of the privacy rights conferred by the CCPA. Unless permitted by the CCPA, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

 

 

Other California Privacy Rights

Other parties may collect personally identifiable information about your activities over time and across different Web sites when a consumer uses our Web site or service.

 

Changes to Our Privacy Notice

We reserve the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on the Website and update the notice’s effective date. Your continued use of our Website following the posting of changes constitutes your acceptance of such changes.

 

Contact for More Information

If you have any questions or comments about this notice, the ways in which we collect and use your information, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:

Phone: 1-800-306-9309
Email: ccpa@rackroom.com

This Privacy Policy was last updated on 1/8/2024.