Soliton Systems K.K. / Soliton Systems, Inc.
CCPA Consumer Privacy Notice

Effective Date: March 10, 2020
Last updated on March 31, 2021

This Notice reflects our good faith understanding of the California Consumer Privacy Act and our data practices as of January 1, 2020, but the CCPA’s implementing regulations are not yet final, and there remain differing interpretations of the law. Accordingly, we may update information regarding our data practices and your rights, modify our methods for responding to your requests, and/or supplement our response to your requests, as we continue to develop our compliance program to reflect the evolution of the law and our understanding of how it relates to our data practices.

This California Privacy Notice (“Notice”) applies to “Consumers” as defined by the California Consumer Privacy Act (“CCPA”), and supplements Soliton System K.K.’s and Soliton Systems, Inc.’s (collectively, “Soliton”) other privacy policies and notices. In the event of a conflict between any other Soliton policy, statement, or notice and this Notice, this Notice will prevail as to California Consumers and their rights under the CCPA.

In accordance with the CCPA’s requirements, this Notice covers the calendar year 2019 and describes our collection, use, disclosure, and sale of California Consumers’ “Personal Information” (“PI”), as well as rights California Consumers have under the CCPA. Terms defined in the CCPA that are used in this Notice have the same meanings as in the CCPA.

Consistent with the CCPA, job applicants, current and former employees, contractors, and subjects of certain business-to-business communications action in their capacity as representatives of another business are not considered Consumers for the purposes of this Notice or the rights described herein.

I. COLLECTION AND USE OF PERSONAL INFORMATION

We collect PI about California Consumers, which in the calendar year 2020 included the following:

Category Examples of PI Collected Sources of PI Purposes for PI Collection Categories of Recipients
Identifiers
(as defined in CCPA §1798.140(o)(1)(A))
Name, physical address, telephone number, email address, unique personal identification number, password, IP address, subnet mask, default GW, MAC address, hostname, OS type, device type.

From Consumer, Service Providers (e.g. marketing agency), and the employer of Consumer.

For our “Cyber-Space Analytics” services, we collect email addresses from our vendors that collect email addresses through publicly available sources on the Internet.

Managing interactions and transactions, performing and delivering products and services Subsidiaries and affiliated companies, Service Providers (e.g. delivery firms, marketing service providers), resellers, distributors, and external auditors.
Personal Records
(as defined in CCPA §1798.140(o)(1)(B))
Name, signature, physical address, telephone number, email address, payment card details and bank account information, other financial information

From Consumer, Service Providers (e.g. marketing agency), and the employer of Consumer.

For our “Cyber-Space Analytics” services, we collect email addresses from our vendors that collect email addresses through publicly available sources on the Internet.

Managing interactions and transactions, performing and delivering products and services Subsidiaries and affiliated companies, Service Providers (e.g. delivery firms, marketing service providers), resellers, distributors, and external auditors.
Commercial Information / Accounts Details Internet Usage Information
(as defined in CCPA §1798.140(o)(1)(D))
Records of products and services purchased, obtained, or considered; other purchasing histories or tendencies From Consumer, Service Providers (e.g. marketing agency), and the employer of Consumer. Managing interactions and transactions Subsidiaries and affiliated companies, Service Providers, resellers, distributors, and external auditors.
Internet Usage Information
(as defined in CCPA §1798.140(o)(1)(F))
Information regarding interactions with our website, computer systems, and/or devices From Consumer, and Service Providers Research and development, quality assurance, security, debugging Subsidiaries and affiliated companies, Service Providers, resellers, distributors, and external auditors.
Professional or Employment Information
(as defined in CCPA §1798.140(o)(1)(I))
Job title From Consumer, Service Providers (e.g. marketing agency), and the employer of Consumer. Managing interactions and transactions, performing and delivering products and services Subsidiaries and affiliated companies, Service Providers, resellers, distributors, and external auditors.
Inferences from PI Collected
(as defined in CCPA §1798.140(o)(1)(K))
Customer profiles reflecting preferences From Consumer, Service Providers (e.g. marketing agency), and the employer of Consumer. Managing interactions and transactions, performing and delivering products and services Subsidiaries and affiliated companies, Service Providers, resellers, distributors, and external auditors.

The chart above reflects the categories of PI required by the CCPA. There may be additional information that we collect that meets the CCPA’s definition of PI but is not reflected by a category, in which case we will treat it as PI as required by the CCPA, but will not include it when we are required to describe our practices by category of PI.

In addition, we may collect, use, and disclose your PI as required or permitted by applicable law. We do not treat de-identified data or aggregate consumer information (each as defined by the CCPA) as PI, and we reserve the right to convert, or permit others to convert, your PI into de-identified data or aggregate consumer information.

We may share your PI with our affiliates, service providers, vendors, and other parties as described in the table above. These parties may use your PI for some or all of the above-listed business purposes, subject to the CCPA’s restrictions and obligations.

We may share your PI with our Service Providers, including those that facilitate advertising and marketing, and other categories of recipients as described in the table above, for the same purposes as the collection purposes set forth in that chart. Subject to the CCPA’s restrictions and obligations, our Service Providers also may use your PI for certain permitted business purposes (e.g. security and fraud prevention). Our Service Providers may themselves engage service providers or subcontractors to enable them to perform services for us; such sub-processing is an additional business purpose for which we are providing you notice.

Soliton does not believe it has sold (as the term “sale” is defined by the CCPA) Consumer PI in 2020. As the law evolves we may revisit this conclusion and, if applicable, revise this Notice. See Section II below regarding our current conclusion that data collection by third-party cookies associated with our web sites is not a sale by us under the CCPA.

Soliton does not “sell” (as the term “sale” is defined by the CCPA) Consumer PI.

II. CALIFORNIA PRIVACY RIGHTS

Under the CCPA, California Consumers have certain rights which they may exercise independently or through an authorized agent. As permitted by the CCPA, any request you submit to us is subject to an identification and verification process, which will depend on the nature of the request and the PI requested and will be further explained in response to a request. We will not fulfill your CCPA request unless you have provided sufficient information for us to be satisfied that you are the Consumer about whom we collect the applicable PI. Please promptly respond to any follow-up inquiries so that we may verify your identity. If you request that we provide you with specific pieces of information about you, we may apply heightened verification standards than what we would apply to other types of requests. For a categories request, or a request to delete non-sensitive PI, we require verification to a reasonable degree of certainty. Authorized agents who meet the agency requirements of the CCPA may submit requests on behalf of Consumers.

Some PI we maintain about Consumers (e.g., clickstream data) is not sufficiently associated with enough PI about the Consumer for us to be able to verify that it is a particular Consumer’s PI. Accordingly, we will not include such information in response to Consumer requests. If we cannot comply with a request, we will explain the reasons in our response. We will use PI provided in your request to verify your identity or authority to make the request and to track and document request responses, unless you also provided the PI to us for another purpose.

We will make commercially reasonable efforts to identify Consumer PI that we collect, use, store, disclose, or otherwise process, and to respond to your California Consumer privacy rights requests. In some cases, particularly with voluminous and/or typically irrelevant data, we may provide you with a summary of your PI and give you the opportunity to elect whether you want us to provide the entire data set. Alternatively, we may direct you on how to access and copy responsive PI yourself. We may charge a reasonable fee or refuse to act upon a request if the request is excessive, repetitive, unfounded, or overly burdensome. If we determine that the request warrants a fee, or that we may decline to comply with the request, we will give you notice explaining why we made that decision. In the case of a fee, we will provide a cost estimate and the opportunity to accept such fees before charging you for responding to your request.

We may collect, use, and disclose your PI as required or permitted by applicable law, and this may override your CCPA rights. Please also note we are not obligated to comply with Consumer requests to the extent that doing so would infringe on our, or any other person’s or party’s rights, or conflict with applicable law.

Your California Consumer privacy rights are described below. To make a request, please email us at privacy@solitonsys.com or call us at +1 (855) 415-6970, and provide us with your name, email address, phone number, the nature of your inquiry.

Disclosure Rights (“Right to Know”)

i. Information Rights (“Categories”)

California Consumers have the right to send us a request, no more than twice in a twelve-month period, for any of the following for the twelve-month period prior to the request date:

  • The categories of PI we have collected about you.
  • The categories of sources from which we collected your PI.
  • The business or commercial purposes for our collecting or Selling your PI.
  • The categories of third parties with whom we have shared your PI.
  • A list of the categories of PI disclosed for a business purpose, in the prior twelve months, along with the categories of recipient for each category of PI, or that no disclosure occurred.
  • A list of the categories of PI sold about you in the prior twelve months, along with the categories of recipient for each category of PI, or that no sale occurred.

If we cannot verify your identity to a reasonable degree of certainty, we will not deliver the category information either but will refer you to the disclosures in Section I above.

Please note that PI is retained by us for various time periods, so we may not be able to fully respond to what might be relevant for the twelve-month period prior to your request.

ii. Information Rights (“Categories”)

California Consumers have the right to make or obtain a transportable copy, no more than twice in a twelve-month period, of their PI that we have collected (in the twelve-month period prior to the request date) and maintain. In order to protect the privacy and data security of Consumers, we will require a high degree of certainty that we have verified that a requester is the requesting Consumer or the Consumer’s authorized agent. If you are unable to meet that standard, we will automatically treat the request as a “categories” request and apply the lower verification standard notice above.

In addition, consistent with the CCPA and our interest in the security of your PI, we will not deliver to you your social security number, driver’s license number, or other government-issued identification number, financial account number, any health or medical identification number, an account password, or security questions or answers in response to a CCPA request.

Please note that PI is retained by us for various time periods, so we may not be able to fully respond to what might be relevant for the twelve-month period prior to the request.

“Do Not Sell” Rights

We may disclose your PI for the following purposes, which are not a sale: (i) if you direct us to share PI; (ii) to comply with your requests under the CCPA; (iii) as part of a merger or asset sale; and (iv) as otherwise required or permitted by applicable law.

We do not believe that we sell California Consumer PI as defined under the CCPA and do not offer a “do not sell my personal information” request option. Accordingly, we will not sell PI of California Consumers collected when we did not offer a “do not sell” optout without prior, express consent. Some browsers include features that may be characterized as “do not track” signals. As is the case with many websites, currently the transmission of a “Do Not Track” signal from a visitor’s browser will not alter our practices with respect to data collection on our websites. Further, we do not interpret “do not track” signals to represent a “do not sell” request for CCPA purposes. We understand that various parties are developing “do not sell” signals, and we may recognize certain such signals if we conclude such a program is appropriate.

We do not knowingly sell the PI of Consumers under 16.

Deletion Rights

You may request that we delete your PI that we have collected directly from you. Under the CCPA, we may decline to delete your PI under certain circumstances: for example, if we need the PI to complete transactions or provide services you have requested or that are reasonably anticipated, for security purposes, for internal business purposes (including maintaining business records), to comply with law, or to exercise or defend legal claims. Note also that we are not required to delete your PI that we did not collect directly from you. We require a reasonable or high degree of certainty that the requester is the Consumer for which a deletion request is applicable, depending on the sensitivity of the PI.

Non-Discrimination Rights

California Consumers have the right not to receive discriminatory treatment for the exercise of any of the privacy rights conferred by the CCPA. As of the Effective Date of this California Notice, we did not offer any programs requiring you to limit any of your CCPA rights, or otherwise require you to limit your CCPA rights in connection with charging a different price or rate, or offering a different level or quality of good or service in connection with the collection, use, or retention of PI. If we do so, participation will be optional and we will provide notice of program terms describing the material aspects of any such program and the rights of California participants.

CONTACT US

For more information regarding your California privacy rights, you may email us at privacy@solitonsys.com or call us at +1 (855) 415-6970.