California Privacy Rights Statement
Effective: July 1, 2024
(Defined terms used but not otherwise defined herein shall have the same meaning as used in the eXp World Holdings, Inc. Privacy Policy and Data Processing Policy, or Attendee Terms (as defined below)).
If you are a California resident, you have additional rights with regards to your Personal Information. Please note this Statement only applies to California residents.
A. Shine the Light Disclosures: Under California Civil Code Section 1798.83 (the “Shine the Light” law), California residents who provide certain personal information in connection with obtaining products or services for personal, family, or household use are entitled to request and obtain the following from us: (i) a list of the categories of personal information (such as name, address, email address, and the type of services provided to the user) that we have disclosed to third parties during the immediately preceding calendar year for the third parties’ direct marketing purposes, and (b) the names and addresses of all such third parties. To request the above information, please contact us using the contact information in Section III (Where to Send Requests), below. We will respond to such written requests within thirty (30) days following receipt at the email or mailing address stated below. Please note that we are only required to respond to each user once per calendar year. Please be aware that not all information sharing is covered by the “Shine the Light” requirements, and only information on covered sharing will be included in our response
B. California Consumer Privacy Act (CCPA) Disclosures: The California Consumer Privacy Act (“CCPA”) (Cal. Civ. Code §1798.100 et seq.), as amended by the California Privacy Rights Act, requires that we inform you of your rights and that we disclose, among other things, the categories of Personal Information we have collected, sold, and/or disclosed for a business purpose from California residents in the previous twelve (12) month period and the source of such collection.
I. Personal Information Collection
In the previous twelve (12) month period, we have collected the Personal Information set forth in the table below:
Category | Source | Business/Commercial Purpose For Collecting | Category of Third Parties to Whom Personal Information is Disclosed | Length of Data |
Identifiers (Examples: name, address, email address, IP address, account username) | Consumer; Agent; Employee, Service providers; computer-monitoring software; public records |
|
| The retention period for identifiers is based on our contractual obligations to you, legal retention periods for the information, your continued interest in a business relationship with us, whether such information is valuable for us to detect and prevent fraud and information security attacks, and whether you are a prospective, current, or former employee of ours. |
California Customer (Examples: education, employment history, bank account number, or other financial information) | Consumer; Employee; Agent |
|
| The retention period for California Customer Records Information is based on our contractual obligations to you, legal retention periods for the information, your continued interest in a business relationship with us, whether such information is valuable for us to detect and prevent fraud and information security attacks, and whether you are a prospective, current, or former employee of ours. |
Protection Information (Examples: race, color, religion, gender, national origin, disability, familial status, sexual orientation) | Employee; Agent |
| We do not disclose or sell this information. | The retention period for Protected Information is based on our contractual obligations to you, legal retention periods for the information, and whether you are a prospective, current, or former employee of ours. |
Commercial Information (Examples: records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies) | Consumer; Agent; Service providers |
|
| The retention period for Commercial Information is based on our contractual obligations to you, legal retention periods for the information, your continued interest in a business relationship with us, whether such information is valuable for us to detect and prevent fraud and information security attacks, and whether you are a prospective, current, or former employee of ours. |
Sensitive Personal (examples: social security number, driver’s license, state identification card, passport number, account login, debit/credit card number in combination with any required security or access code) | Agent, Employee, Consultants |
| We only disclose Sensitive Personal Information to our third party providers to the extent necessary to assist us in fulfilling our obligations to Agents, Consultants, and employees, such as providing employee benefits, processing payment, and tax reporting. | The retention period for Sensitive Personal Information is based on our contractual obligations to you, legal retention periods for the information, your continued interest in a business relationship with us, whether such information is valuable for us to detect and prevent fraud and information security attacks, and whether you are a prospective, current, or former employee of ours. |
Biometric Data (Examples: fingerprints, DNA, etc.) | We do not collect this information. | N/A | N/A | We do not collect biometric data. |
Internet Information (Examples: browsing history, search history, or other information about a consumer’s interaction with eXp Site or Services) | Consumer; Agent; Analytics and website service providers; computer monitoring software |
|
| The retention period for Internet Information is based on our contractual obligations to you, legal retention periods for the information, your continued interest in a business relationship with us, whether such information is valuable for us to detect and prevent fraud and information security attacks, and whether you are a prospective, current, or former employee of ours. |
Geological Data (Geolocation Data collected when using the Services is not considered precise geolocation data as defined under California law) | Derived from IP address or cookies; Agent |
| We do not disclose or sell this information. | The retention period for Geolocation Data is based on our contractual obligations to you, legal retention periods for the information, your continued interest in a business relationship with us, whether such information is valuable for us to detect and prevent fraud and information security attacks, and whether you are a prospective, current, or former employee of ours. |
| Audio, Electrical, or Visual Information | Consumer; Employee; Agent |
| We do not disclose or sell this information. | The retention period for Audio, Electrical, or Visual Information is based on our contractual obligations to you, legal retention periods for the information, your continued interest in a business relationship with us, whether such information is valuable for us to detect and prevent fraud and information security attacks, and whether you are a prospective, current, or former employee of ours. |
Professional Information (Examples: employment-related information and history) | Consumer; Employee; Agent; cookies |
| We do not disclose or sell this information | The retention period for Professional Information is based on our contractual obligations to you, legal retention periods for the information, your continued interest in a business relationship with us, whether such information is valuable for us to detect and prevent fraud and information security attacks, and whether you are a prospective, current, or former employee of ours. |
Inference (Examples: inferences that can be drawn from any of the foregoing information, such as preferences, psychological trends, behavior, attitude, intelligence, or abilities) | We do not collect this information. | N/A | N/A | We do not compile composite profiles of individuals in order to make inferences from such profiles. |
II. Personal Information Disclosure
If you sign up to attend any eXp World Holdings, Inc. virtual event or in-person event, the collection, use, and disclosure of your Personal Information may also be governed by the applicable event’s terms and conditions (the “Attendee Terms”). To the extent that the Attendee Terms and this California Privacy Rights Statement conflict, the Attendee Terms shall govern.
III. Sale of Personal Information
In the preceding twelve (12) months, we have sold the following categories Personal Information, as defined in the table above, to our Affiliates and event sponsors and vendors:
- Identifiers;
- Internet Information; and
- Commercial Information.
Personal Information was sold for the following purposes:
- Marketing of our Services to you based on your interaction with our Sites;
- Displaying advertisements; and
- Marketing the services of Independent Third Parties.
eXp does not knowingly collect, process, disclose or sell the Personal Information of minors.
IV. Your Rights
1. Right to Know
Pursuant to the CCPA and CPRA, California residents have the right to request from us, for the preceding twelve (12) month period: (1) the categories of Personal Information and the specific pieces of Personal Information that we have collected about the resident, (2) the categories of sources from whom the Personal Information was collected, (3) our purposes for collecting the Personal Information, (4) the third parties with whom we have shared or sold the Personal Information, (5) the categories of third parties with whom we have shared or sold the Personal Information, (6) the categories of Personal Information we have shared or sold with third parties, and (7) our purposes for which the Personal Information was shared or sold. To make a request, please review “How to Make a Request” in Section V. below.
2. Right to Delete
You also have the right to request that we delete any Personal Information we have collected from you. To make a request, please review “How to Make a Request” in Section V. below. Once we verify your request, we will delete any Personal Information from our records, unless retaining your Personal Information is necessary for us to:
- complete the transaction for which we have collected the Personal Information, provide you with the Services, or as reasonably anticipated in the context of our business relationship;
- offer employment or provide employment benefits;
- detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for that activity;
- debug to identify and repair errors that impair existing intended functionality;
- exercise free speech, ensure the right of another consumer to exercise that consumer’s right of free speech, or exercise another right provided for by law;
- comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et seq.);
- enable solely internal uses that are reasonably aligned with your reasonable expectations based on your relationship with us;
- comply with a legal obligation; or
- fulfill other internal and lawful uses of your Personal Information that are compatible with the context in which you provided your Personal Information.
3. Right to Correct
You have the right to request correction of inaccurate Personal Information maintained by us about you. Upon receipt of a verifiable request from you, we will use commercially reasonable efforts to correct the inaccurate Personal Information. To make a request, please review “How to Make a Request” in Section V. below.
4. Right to Data Portability
You can request a transfer of Personal Information to you or a third party where we process the data based on your consent or a contract with you, and in a commonly used and machine-readable format.
5. Right to Opt-out of Sale or Sharing
You can opt-out of the sale or sharing of your Personal Information here.
6. Right to Limit Use and Disclosure of Sensitive Personal Information
You have the right to opt-out of the use and disclosure of your Sensitive Personal Information. However, we are permitted by law to use and disclose Sensitive Personal Information as follows:
- To perform services or provide goods reasonably expected by an average consumer (including an employee, Agent, or Consultant) who requests those goods or services.
- To help ensure security and integrity, to the extent the use of the information is reasonably necessary and proportionate for these purposes.
- Short-term, transient use.
- To perform services on our behalf.
- To undertake activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us.
We do not use Sensitive Personal Information for any purpose that is not listed here.
7. Right to Be Protected Against Discrimination
You have the right to not be discriminated against by us because you exercised any of your rights described in this Statement. This means we cannot, among other things:
- Deny goods or services to you;
- Charge different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties;
- Provide a different level or quality of goods or services to you; or
- Suggest that you will do any of the foregoing.
Please note that we may charge a different price or rate or provide a different level or quality of goods or services to you, if that difference is reasonably related to the value provided to us by your Personal Information.
V. How to Make a Request
1. Where to Send Your Request
If you are a California resident and you wish to make any of the above requests, please send a request to:
Webform: Individual Rights Request Form
Email: send request to [email protected] with “California Privacy Information Request” in the subject line
2.Verifying Your Request
When you contact us, you will need to provide us with enough information to verify your identity using Personal Information you have previously provided to us. The specific information we use to verify your identity will depend on how you make a request, what you are requesting, and our relationship with you. You must also provide a description of what right you want to exercise and the information to which your request relates. Your authorized agent can make a request for you, if you provide us with written permission authorizing the agent to act on your behalf. Please note that we will still need to verify your identity.
We are not obligated to comply with a data access, deletion, correction, or data portability request if we cannot verify that the person making the request is the person about whom we collected information or is someone authorized to act on such person’s behalf. Any Personally Identifiable Information we collect from you to verify your identity in connection with your request will be used solely for the purposes of verification.
3. Responding to Your Request
We will confirm receipt of right to know and deletion requests within ten (10) business days of receiving such requests and will provide information as to how we will process such requests. We will respond to verified requests within forty-five (45) days of receipt. Please note that we are only required to respond to a verifiable request for access or portability twice per twelve (12) month period.
We are not required to: (1) retain any Personal Information about you that was collected for a single, one-time transaction if, in the ordinary course of business, that information about you is not retained; or (2) reidentify or otherwise link any data that, in the ordinary course of business, is not maintained in a manner that would be considered Personal Information.
We will comply with your requests free of charge. Please note, however, that we are permitted to charge a reasonable fee if requests are manifestly unfounded or excessive.
Copyright © 2024 eXp World Holdings, Inc. | All Rights Reserved.
