California Privacy Notice (CCPA / CPRA)
This Notice supplements our Privacy Policy and applies to California residents under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA).
1. Categories of personal information we collect
| CCPA category | Examples we collect | Source |
|---|---|---|
| Identifiers | Name, email, phone, IP (hashed) | You (forms), automatically (server logs) |
| Customer records | Lead inquiry contents, review submissions | You |
| Commercial information | Lead purchase history (advertisers only) | You |
| Internet activity | Pages viewed, referrers, device type, aggregated analytics | Automatically |
| Geolocation (general) | City/state inferred from IP (never precise GPS) | Automatically |
| Inferences | Event-planning intent (category, city, budget band) | Derived from your lead submissions |
We do not collect: biometric information, sensitive personal information beyond what's listed (no race, religion, union membership, sexual orientation, etc.), education / employment records, or precise geolocation.
2. Purposes of collection
See Privacy Policy §2. In short: provide the directory and lead service, prevent fraud, comply with law, improve the Site.
3. Sale and sharing of personal information
Under CCPA/CPRA definitions, we do not "sell" personal information for monetary value. We do "share" personal information in two narrow ways:
- With venue advertisers who purchase your lead. This is consensual sharing — you explicitly requested quotes from venues in your category and city, and the TCPA consent checkbox covers the disclosure.
- With limited service providers (Cloudflare, Resend, Twilio, Stripe, GA4) acting on our behalf under contractual confidentiality. CCPA does not classify these as "sales" or "sharing".
We do not share information for cross-context behavioral advertising. We honor Global Privacy Control (GPC) signals from California visitors as an opt-out request — see §6 below.
4. Your CCPA / CPRA rights
If you are a California resident, you have the right to:
- Know what personal information we have collected about you, the categories of sources, the purposes, and the categories of third parties we shared it with.
- Delete personal information we have collected from you (subject to legal exceptions, e.g., TCPA retention).
- Correct inaccurate personal information.
- Opt out of the "sale" or "sharing" of personal information.
- Limit use of sensitive personal information (we don't collect any beyond what §1 above lists).
- Non-discrimination — we will not deny service, charge different prices, or provide a different level of service because you exercised any of these rights.
- Data portability — receive your information in a structured, machine-readable format.
5. How to exercise your rights
- Submit a request via the Privacy Requests portal (preferred — fastest).
- Or email book@corporateevents.at with subject "CCPA Request" and your request type.
We verify identity via email magic link plus one additional piece of information (last 4 of phone on file, OR last lead/invoice ID, OR a selfie holding government ID for higher-risk requests). We acknowledge requests within 10 days and fulfill within 45 days. We may extend by another 45 days when reasonably necessary (with notice to you).
You may also designate an authorized agent in writing. Provide written permission and an identity proof for the agent.
6. Global Privacy Control (GPC)
We honor the Global Privacy Control
browser signal (HTTP Sec-GPC: 1 header) as a valid opt-out
of "sale" and "sharing" for California residents. When detected, we
automatically apply the opt-out and display a confirmation in the footer.
No further action required from you.
7. "Do Not Sell or Share My Personal Information"
Use the link in the footer of every page (labeled "Cookie preferences" in our Phase 1 cookie banner; a dedicated "Do Not Sell or Share" link will appear separately if we begin any disclosures that meet the statutory definition of sale/share, which we do not currently do).
8. Retention
See Privacy Policy §6.
9. Children's information
We do not knowingly collect personal information from California residents under 16. If you believe we have, contact book@corporateevents.at and we will delete promptly.
10. Contact
California-specific questions: book@corporateevents.at (subject "CCPA").
11. Annual disclosures
In the prior 12 months, we have not "sold" personal information of California residents. We have "shared" personal information for the purposes described in §3 above. We do not disclose California residents' personal information for direct marketing purposes (no "Shine the Light" disclosures to make).