Privacy Policy

 

Who We Are and Why We Collect Your Information

 

Connected Bits LLC (“CB,” “we,” “us,” “our”) provides software and services that allows cities and their residents to crowdsource reports of issues and concerns around the community. We collect information for many reasons. For example, the information you provide to CB enables us to, among other things: identify your location (and the location of any issue you report through our apps), save a history and record of your reports, provide you with alerts and information relevant to your community and location, manage your online account, provide relevant information about reported issues to your local government, and provide you with the best possible customer service.

 

CB is committed to protecting the confidentiality, integrity, and security of your personal information. We take this responsibility seriously. This Privacy Policy is intended to help you understand how we collect and safeguard your information. By accepting the terms of this Privacy Policy, you hereby consent to our collection, use, and sharing of your information in the following ways.

 

I. What Does This Privacy Policy Cover?

 

This Privacy Policy covers our treatment of (1) personally identifiable information, as defined by numerous statutes in the United States (such statutes, the “PII Laws”), (2) information protected by the California Online Privacy Protection Act (“CalOPPA”), California Consumer Privacy Act (the “CCPA”), and California Privacy Rights Act (the “CPRA”), (3) personal information and private information, as defined by the New York Stop Hacks and Improve Electronic Data Security Act (the “SHIELD Act”); (4) personal data, as defined by the European Union General Data Protection Regulation (the “GDPR”), (5) personal information, as defined by Canada’s Personal Information Protection and Electronics Documents Act (“PIPEDA”), and (6) personal information the confidentiality, availability, or integrity of which is protected by applicable law (such laws collectively with the PII Laws, CalOPPA, CCPA, CPRA, the Shield Act, GDPR, and PIPEDA, the “Privacy Laws”) (collectively, “Personal Information”), which we gather when you are accessing, viewing, completing, or using our website, mobile applications, and services, including those provided through third-party platforms, marketplaces, organizations, governments, websites, processors, and services (collectively the “Services”). Where noted, the terms of this Privacy Policy are limited by the Privacy Laws that govern an individual’s or user’s jurisdiction, such that requirements created by the Privacy Laws of one jurisdiction with regard to Personal Information are not incorporated herein and made to apply to the Personal Information of an individual or user of another jurisdiction if such Privacy Laws would not otherwise govern. Notwithstanding the foregoing, this policy does not apply to the practices of companies that we do not own or control, or to individuals that we do not employ or manage.

 

A. Privacy Policies of Municipalities and Other Government Clients

 

CB uses the Services to provide information to municipalities and other government clients regarding issues that users report in their jurisdictions. Please note that by providing any information through the Services, including Personal Information, you acknowledge that such information will be governed by the privacy policy of the receiving municipality or other government client, if such a policy exists. Please consult with the municipality or other government client regarding the terms of its privacy policy.

 

            B. Project-Specific Documentation

 

Although this Privacy Policy is intended to govern our treatment of Personal Information generally, some parts of our Services may have specific documentation that provides additional terms and conditions governing our treatment of your Personal Information in relation to your use of such parts of the Services (such documentation, the “Project-Specific Documentation”). When that is the case, we will provide such Project-Specific Documentation to you prior to collecting Personal Information that may be treated in a manner different from that set forth in this Privacy Policy. In the event of a conflict between the terms of such Project-Specific Documentation and the terms of this Privacy Policy, the terms in the Project-Specific Documentation will govern.

 

II. What Information Does CB Collect?

 

CB does not collect Personal Information indiscriminately. We limit the type of Personal Information and the amount of Personal Information to what is necessary to fulfil the purposes identified in this Privacy Policy. With that in mind, we collect the following types of information:

 

A. Information You Provide to Us:

 

We may collect Personal Information from you (i) when you contact us with questions, concerns, requests, and general inquiries, or otherwise submit information through a contact form or other means provided in our Services, (ii) when you use the features and functionalities of our Services, including when you submit reports of issues in your community, and (iii) when you submit reviews about our Services. The information we collect depends on the purpose, nature, and parameters of the transaction and/or communication between you and us. Examples of Personal Information we may collect, depending on the transaction and/or communication, include the following: your name and contact information; your address and/or location; or a user name or e-mail address in combination with a password or security question that would permit access to a CB account you may establish. You can choose not to provide us with certain information, although that may disqualify you from using certain parts of our Services.

 

B. Information Collected Automatically:

 

When you use our Services, certain information is passively collected (that is, gathered without your actively providing the information) using various technologies and means, such as Internet Protocol (IP) addresses and cookies. These are described in more detail below:

 

• IP Addresses. The Services uses IP addresses. An IP address is a number assigned to your device by your internet service provider to access the internet. In most consumer cases an IP address is dynamic (changing each time you connect to the internet), and not static (unique to a particular user’s device).

 

• Cookies are small text files that are placed on your device by websites that you visit. They are widely used to make websites work, or work more efficiently, and to provide information to the owners of the site. Most web browsers allow some control of cookies through browser settings. We collect the following information via cookies when you visit a website or web portal provided by CB (including websites and portals with third-party branding, such as the official “311” portal for your municipality): aggregate statistical information, information related to your use of our Services (including your password, the links you click on, your movement around our websites and portals, the pages you visit, the number of times you open a page, and which information is consulted), your IP address, and your browser type. You may be able to change the preferences on your browser or mobile device to send “do not track” signals or to prevent or limit your computer or device’s acceptance of cookies, but this may affect the functionality of the Services or prevent you from using parts of the Services. If you click on a link to a third-party website, such third party may also transmit cookies to you. This Privacy Policy does not cover the use of cookies by any third parties.

 

Additionally, CB may passively collect the advertising ID of your device. An advertising ID is a user resettable identification assigned by a device or operating environment. Third parties use it to send advertisements to your device and to track your movements and application usage. In the event CB collects your advertising ID, we will only do so to the extent permitted by the terms and conditions that govern that device.

 

C. E-mail and Other Communications:

 

We may contact you, by email or other means; for example, we may communicate with you about your requests and inquiries. When we do this, we may receive a confirmation when you open an email from us. This confirmation helps to improve our service. If you do not want to receive email or other mail from us, please indicate your preference by clicking on the unsubscribe link in any of our emails or by contacting us at privacy@connectedbits.com.

 

Please note that if you do not want to receive legal notices from us, those legal notices will still govern your use of the Services, and you are responsible for reviewing such legal notices for changes.

 

D. Information Received from Third Parties

 

CB receives (but does not purchase) Personal Information from third parties, such as the municipalities and other government agencies that use our Services. Although we generally request that our third‑party partners provide notice to their users prior to sharing Personal Information with us, we have no control over whether our partners actually provide such notices.

 

E. Special Categories of Personal Information and Sensitive Personal Information:

 

Except as stated otherwise in this Privacy Policy, we do not knowingly collect any sensitive Personal Information or special categories of Personal Information, including (1) Personal Information revealing racial or ethnic origin, political opinion, religious or philosophical beliefs, or trade union membership, (2) genetic data, biometric data, data concerning health, and data concerning a natural person’s sex life or sexual orientation, and (3) government identifiers (such as Social Security numbers and driver’s licenses), financial account and login information (such as credit or debit card number together with login credentials), precise geolocation, or content of nonpublic communications (mail, email and text messages). Where we collect and use such information as a processor (as defined in the GDPR) or as a contractor or service provider (as those terms are defined in the CCPA and CPRA), we rely on the controller (as defined in the GDPR) or business (as defined in the CCPA and CPRA) to obtain your informed consent.

 

            F. Personal Information CB Has Collected in the Last 12 Months

 

CB has collected the following categories of Personal Information in the 12 months immediately preceding the Effective Date of this Privacy Policy, listed at the bottom of this document: names; contact information; demographic information; user locations; content of communications, including reports; preferences; user names and e-mail addresses in combination with user-selected passwords and security questions needed to access user accounts; IP addresses; information related to the use of the Services; users’ browser types; and confirmation when users have read CB emails. Please see the other portions of Section II above for an explanation of the categories of sources from which we collect the information described in the previous sentence. The business purposes of this information are described in Section III below. The categories of third parties we share this information with are described in Section IV.

 

III. What Does CB Do With Personal Information?

 

A. Use of Information

 

CB collects your information to respond to your communications, facilitate reports and other activities on our Services, perform internal analysis to improve our services, and conduct market research. We store Personal Information with third-party cloud-based service providers and on our own servers.

 

We may:

 

·       Share certain Personal Information with third parties (as described in this Section and in Section IV below);

·       Retain Personal Information for research, analytic, and development purposes, which may include the development of new proprietary products.

 

We may use Personal Information to infer other Personal Information about you, including your behaviors and interests, the advertising ID of your mobile device, and the location of your home, work, and/or school. We may use information collected by cookies to retrieve certain information you have previously provided (e.g., passwords), to help to determine what areas of our Services you and other visitors find most valuable, to customize our Services based on your preferences, to tell our Services server information such as your IP address and your browser type, to improve navigation on the Services, to improve the Services and our other services, to communicate information to visitors, to administer our Services, and to track users’ activities within our Services. We may also use that information for market research purposes.

 

We may convert Personal Information to nonpersonal information and store and use the nonpersonal information. For example, we may permanently delete the connection between a person’s identifying information and their experiences with our Services, and retain the experiential information and knowledge it pertains to a single (unidentifiable) individual and/or aggregate such information from multiple individuals.

 

B. Storage of Information

 

Unless noted otherwise in this Privacy Policy, we store and process all electronic Personal Information that we collect from you on electronic information systems in the United States. Some nonpersonal information may remain on data storage systems in the country or territory where the information was originally provided. Hard copies of personal information generally remain in the country of origin.

 

IV. Will CB Share Any of the Personal Information It Collects?

 

We share your Personal Information with third parties as described below.

 

A. Clients

 

CB enters into contracts with municipalities and other government clients, which permit those clients to use the Services to receive information regarding their jurisdictions, including some Personal Information from users.

 

B. Third Party Businesses We Do Not Control that Facilitate Our Services

 

In certain situations, we will share Personal Information with third-party businesses that facilitate certain aspects of our Services. The third party businesses described in this section are typically based in the United States.

 

C. Business Transfers

 

We may choose to buy or sell assets. In these types of transactions, customer information is typically one of the business assets that is transferred. Also, if we (or substantially all of our assets) are acquired, or if we go out of business, enter bankruptcy, or go through some other change of control, Personal Information would be one of the assets transferred to or acquired by a third party.

 

D. Legal Obligations, Our Protection, and the Protection of Others

 

We reserve the right to access, read, preserve, and disclose any information that we reasonably believe is necessary to comply with law or court order; enforce or apply our conditions of use and other agreements; or protect the rights, property, or safety of CB, our employees, our users, or others. This includes exchanging information with other companies and organizations for fraud protection and risk reduction.

 

            E. With Your Consent

 

Except as set forth above, we will obtain your consent before disclosing your Personal Information with third parties, and you will be able to prevent the sharing of this information.

 

            F. Personal Information CB Has Sold to in the Last 12 Months

 

CB does not sell Personal Information, however, CB shares Personal Information with its government clients as part of the services provided to those clients, as described in Section IV.G below, which may qualify as a sale of Personal Information under the terms of the CCPA and CPRA.

 

G. Personal Information CB Has Disclosed to Third Parties in the Last 12 Months

 

CB has disclosed the following categories of Personal Information to municipalities and other government clients in the 12 months immediately preceding the Effective Date of this Privacy Policy, listed at the bottom of this document: names; contact information; user locations; and contents of communications, including reports, submitted by users. CB relies on a cloud environment for all its data storage. Therefore, all Personal Information collected and described in Section II has been disclosed to our third party cloud storage provider in the 12 months immediately preceding the Effective Date.

 

V. CB’s Legal Basis for Collecting and Using Your Personal Information

 

CB collects and uses your Personal Information pursuant to your informed consent, which you have granted by (a) confirming the prompts produced by the Services, and (b) continuing to use the Services, consistent with this Privacy Policy, any Project-Specific Documentation, and any other documentation we may provide. Please note that without your consent to collect and use the Personal Information required in any particular transaction, CB may disqualify you from using the Services. If you have any questions concerning the terms of this Privacy Policy and the conditions of your consent, please contact us using the contact information in Section XV.

 

To the extent that you provide CB with the Personal Information of other people, you warrant and represent that each such person who is required under the Privacy Laws to give consent, or the person who is required to give consent, if the Privacy Laws require the consent of another person, has granted his or her consent to you sharing his or her Personal Information with CB for the use described in this Privacy Policy.

 

For individuals and Personal Information Subject to the GDPR: In addition to relying on informed consent, CB reserves the right to process your Personal Information (1) in order to pursue our legitimate business interests and/or (2) in order to carry on a transaction to which you are a party. Where the processing is based on a transaction, your failure to provide the relevant Personal Data may result in CB’s inability to continue the transaction. Any one or more of these bases are the legal basis for CB’s collection and use of your Personal Information, depending on (x) how you use this Services and (y) your relationship with CB.

 

VI. How Long Will CB Retain Your Personal Information?

 

Except upon the request of an individual, as explained in Section VII below, and except as the law permits and requires, CB determines the retention period of Personal Information based on the following considerations:

 

1.     The nature of the Personal Information;

2.     The purpose for which the Personal Information was collected;

3.     The existence of (i) other transactions or communications with the person who provided the Personal Information, and (ii) ongoing or expected projects with the relevant government client; and

4.     Our internal research and analytic needs.

 

VII. What Are Your Rights to Control Your Personal Information?

 

To the extent required by the Privacy Laws, except where permitted or required by law (including, but not limited to, compliance with a legal obligation, to further a public interest, and establishing and/or exercising a legal claim or defense), you have the following rights regarding CB’s collection and use of your Personal Information.

 

A. Requests to CB

 

You may request the following from CB with respect to your Personal Information:

 

(1)  The correction, updating, deletion, or restriction of collection and use of your Personal Information;

(2)  The categories of Personal Information CB has collected about you;

(3)  The categories of sources from which CB has collected your Personal Information;

(4)  The envisaged period for which the Personal Information will be stored, or, if not possible, the criteria used to determine that period;

(5)  The business or commercial purpose(s) for collecting and disclosing your Personal Information;

(6)  An account of how CB has used or is using your Personal Information;

(7)  A copy of your Personal Information retained by CB, to be delivered in a structured, commonly used and machine readable format to review or to transfer or transmit to another entity without hindrance, to the extent that that is technically feasible;

(8)  The categories of third parties with whom CB shares your Personal Information;

(9)  The categories of your Personal Information that we have shared with third parties, including clients, and the categories of third parties to which we have shared each particular category of Personal Information;

(10) The Personal Information CB collects, uses, discloses, and sells;

(11) A list of all third parties that have received your Personal Information from CB;

(12) The specific pieces of Personal Information CB has collected about you.

 

We will confirm receipt of all such requests and provide information about how CB will process the request within 10 days of receipt. We will substantively respond to all such requests within 30 days, subject to lawful extension of that period, and there may be a delay in processing a request while we verify that the request is valid and originates from you as opposed to an unauthorized third party. Our verification process varies based on the source and nature of the request, but may include: comparing data in the request against Personal Information we retain; contacting you using other contact information; requesting further information, although we will avoid doing so to the extent possible; and the consideration of certain factors, including the type, sensitivity, and value of your Personal Information, the risk of harm to you posed by an unauthorized request, the likelihood that fraudulent or malicious actors would seek your Personal Information, the manner in which we interact with you, the available technology, and whether the information you have provided to verify your identity is sufficiently robust to protect against fraudulent requests. To the extent permitted by the Privacy Laws, CB retains the right to deny any request if we cannot verify that it originated from you.

 

CB retains records of all of the above requests and our responses for 24 months, unless otherwise prohibited by the Privacy Laws.

 

Any of the above requests may be made by contacting us using the contact information in Section XV.

 

If you request that your Personal Information be erased or deleted or that CB otherwise restrict its collection and use of Personal Information, CB may terminate or limit your access to the Services. If CB has not collected or used your Personal Information, or has not disclosed your Personal Information to another party, we will inform you of that in response to any of the above requests. Some information may remain in CB’s backup media after erasure or deletion for a period of time. When you update information, we may maintain a copy of the unrevised information in our records. Please note that some information may remain in our private records after your deletion of such information from your account. We may use any aggregated data derived from or incorporating your Personal Information after you update or delete it, but not in a manner that would identify you personally.

 

B. Authorized Agent

 

You may authorize an agent to take any of the acts permitted in this Section VII on your behalf. To do so, you must provide written and signed authority to the agent, and written and signed notice to CB that CB may act on such requests by that agent.

 

C. Withdrawal of Consent

 

You may withdraw your consent at any time by contacting us using the contact information in Section XV.

 

Please be aware that such withdrawal does not affect the lawfulness of CB’s use of your Personal Information before such withdrawal. Withdrawal of consent may affect the functionality of this Services. We reserve the right to terminate and/or limit your access to the Services in the event that you withdraw your consent.

 

D. Object or Challenge

 

You may object, on grounds relating to your particular situation, at any time to the collection and use of your Personal Information based on CB’s legitimate interests or based on public interests, or otherwise challenge our compliance with the Privacy Laws, by contacting us using the contact information in Section XV.

 

CB will respond consistent with the requirements of the Privacy Laws.

 

E. Filing a Complaint

 

Regulatory authorities that oversee the Privacy Laws, including the Office of the Privacy Commissioner of Canada, advise individuals to file an objection or challenge with the relevant company before lodging a formal complaint with a regulatory authority. If you are dissatisfied with CB’s response to an objection or challenge filed under Section VII.D above, or wish to file a complaint with a regulatory authority first, you may do so, including as follows:

 

Under PIPEDA: You may file a complaint with the Office of the Privacy Commissioner of Canada.

 

Under GDPR: You may file a complaint with a supervisory authority in the relevant European Union member state.

 

Under PII Laws: You may file a complaint with the relevant state’s Attorney General’s office.

 

Under the CCPA or CPRA: You may file a complaint with the California Attorney General’s Office.

 

Please note that the links above are subject to change by the relevant regulatory authorities and that you may need to go to another site or contact the relevant authority in another way in order to properly file a complaint.

 

F. Prohibit Automated Processing

 

At your request, CB will terminate any automated decision making or profiling that is the sole source of decisions that produce a legal effect concerning you or similarly significantly affect you. Please note that consistent with Section XII, CB does not employ any such automated decision making or profiling at this time.

 

            G. “Do Not Sell or Share My Personal Information”

 

You may opt out of all disclosures of your Personal Information by contacting us using the contact information in Section XV or by completing the form at the following link:

 

https://connectedbits.com/privacy/opt-out

 

If you exercise your right to opt out of all disclosures of your Personal Information, CB will cease disclosing your Personal Information to clients and other third parties as of the date CB receives the form at the link above. CB will not contact you about opting in to disclosing your Personal Information for at least 12 months following receipt of the form.

 

            H. Accessibility for Users with Disabilities

 

If you are unable to review this Privacy Policy or any portion of this Policy, please contact us to request an alternative format by using the contact information in Section XV.

 

I. Non-Discrimination

 

CB will not discriminate against you because you have exercised any of the rights above or any other rights you retain pursuant to Privacy Laws, including, but not limited to by:

 

1.     Denying services to you;

2.     Charging different prices or rates for services, including through the use of discounts or other benefits or imposing penalties;

3.     Providing a different level or quality of services to you; and

4.     Suggesting that you will receive a different price or rate for services or a different level or quality of services.

 

Consistent with Privacy Laws, CB: (i) may offer financial incentives, including payments to you as compensation, for the collection, disclosure, or deletion of your Personal Information; (ii) may enter you into a promotional program only if CB clearly describes the material terms of such program, so long as you give CB prior opt-in consent, which you may revoke at any time; and (iii) shall not use incentive practices that are unjust, unreasonable, coercive, or usurious in nature.

 

VIII. Is Personal Information About Me Secure?

 

We use appropriate technical, administrative, and physical safeguards to protect against loss, unauthorized access, destruction, misuse, modification, and improper disclosure of the personal information we collect, in both physical and electronic format. To that end, we use Secure Sockets Layer (SSL) encryption and third-party applications and services that comply with various globally recognized security practices and standards to protect the personal information submitted to us, both during transmission and once we receive it. We take reasonable and appropriate steps to contract for and monitor the services we use to determine that they remain compliant with such practices and standards. We also provide information security awareness training to our staff and conduct periodic risk assessments and audits. We endeavor to protect the privacy of your Personal Information that we hold in our records, but we cannot guarantee complete security. Unauthorized entry or use, hardware or software failure, and other factors, may compromise the security of information at any time.

 

At times, your access to the Services is protected by a password for your privacy and security. You must prevent unauthorized access to your account and Personal Information by protecting your password and/or other sign-on mechanism appropriately and limiting access to your computer or device and browser.

 

Our Services may contain links to other sites and services. We are not responsible for the privacy policies and/or practices on other sites. When following a link to another site you should read that site’s privacy policy.

 

IX. Children’s Privacy

 

Except as stated otherwise in Project-Specific Documentation, we do not knowingly collect or solicit personal information from anyone under the age of 16. If you are under 16, please do not attempt to send any information about yourself to us, including your name, telephone number, or email address. No one under age 16 may provide any Personal Information to us or through the Services. In the event that we learn that we have collected Personal Information from a child under age 16 without verification of parental consent, we will delete that information as quickly as possible, except as provided below. If you believe that we might have any information from a child under age 16, please contact us using the contact information in Section XV.

 

Upon request, we will provide a parent or guardian who has provided proper identification with the following: (1) a description of the specific types of Personal Information collected from the child, (2) the opportunity to refuse or permit CB’s further collection and use of Personal Information from the child, and (3) a reasonable means for the parent or guardian to obtain any Personal Information collected from the child. If a parent or guardian does not permit CB’s continued collection and use of Personal Information from a child, CB will delete the child’s Personal Information and terminate the account of the child, as applicable.

 

X. Contractual or Statutory Requirement

 

Except as noted in this Privacy Policy or in Project-Specific Documentation, CB’s collection and use of Personal Information is not a contractual or statutory requirement or a requirement necessary to enter into a contract.

 

XI. Failure to Provide Personal Information

 

You can always opt not to disclose information to us, but keep in mind some information may be needed to use the Services.

 

XII. Automated Decision Making

 

CB does not rely on automated decision making, including profiling, that will produce legal effects concerning you or similarly significantly affect you. Per Article 4(4) of the GDPR, profiling is defined as “any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.”

 

XIII. Transfer of Data

 

When we transfer personal information from a country of origin to the United States, we do so in compliance with all laws of the originating country.

 

XIV. Changes to this Privacy Policy

 

We may amend this Privacy Policy from time to time. Use of information we collect now is subject to the Privacy Policy in effect at the time such information is used. If we make changes in the way we use Personal Information, we will notify you by posting an announcement on our website, sending you a notice through the Services, or sending you an email. You are bound by any changes to the Privacy Policy when you use the Services after such changes have been first posted.

 

XV. Questions or Concerns; Contact Information

 

If you have any questions or concerns regarding our privacy policies, please contact our data protection officer by sending a detailed message to privacy@connectedbits.com. Alternatively, you may contact us by telephone or postal service as follows:

 

Attn: Data Protection Officer
Connected Bits LLC
One Hardy Road, Suite 208

Bedford, NH 03110
+1 603.889.2200

 

We will make every effort to resolve your concerns.

 

Effective Date: February 1, 2021