This Privacy Policy and California Notice at
Collection (this “Privacy Policy”) describes how Surefire CPR LLC, a California
limited liability company (“Company,” “we,” “us,” or “our”) collects, uses,
retains, discloses, and otherwise processes personal information through our
websites, mobile experiences, learning-management systems (“LMS”), training
platforms, customer-service channels, marketing programs, physical training
operations, and related services (collectively, the “Services”).
This draft is designed as a working form.
Counsel and client should tailor the categories of information, purposes,
vendors, retention periods, and rights language to actual data practices,
ad-tech configuration, workforce relationships, and whether Company is subject
to the California Consumer Privacy Act, as amended, and other state privacy
laws.
1. Scope
This Privacy Policy applies to consumers, website
visitors, trainees, customers, prospective customers, and business contacts
whose personal information we collect in connection with the Services. This
Privacy Policy does not apply to information subject to a separate employee,
applicant, contractor, or business-to-business privacy notice, if any.
2. Notice
at Collection
At or before the point of collection, Company may
collect the categories of personal information described in this Privacy Policy
for the business and commercial purposes described herein. We do not use
personal information for materially different, unrelated, or incompatible
purposes without providing any required notice and obtaining any required
consent.
3. Categories
of Personal Information We Collect
Depending on how a person interacts with the Services,
we may collect: identifiers and contact information, such as name, email
address, phone number, postal address, username, account credentials, customer
number, and device or network identifiers; customer and commercial information,
such as purchase history, course registrations, scheduling information,
payment-related records, certification status, and support history; internet or
other electronic network activity information, such as browsing activity,
clickstream data, log files, cookie data, and interactions with emails or web
pages; geolocation information derived from IP address or approximate location
data; audio, electronic, visual, or similar information, such as call
recordings, chat transcripts, support communications, access-control logs, and,
where used and disclosed, security-camera footage; professional or
employment-related information, such as employer name, role, or training
requirements; education or certification information; and in limited
circumstances, sensitive personal information or health-related information
voluntarily provided by the individual, such as a request for accommodation,
incident description, or emergency-contact information. Company does not seek
medical histories or treatment records unless specifically necessary for
accommodations, incident response, or compliance purposes.
4. Sources
of Personal Information
We collect personal information directly from
individuals; automatically through browsers, devices, cookies, access-control
systems, and related technologies; from employers or sponsoring organizations
that purchase training for participants; from payment processors and scheduling
platforms; from marketing, analytics, and communications vendors; and from
publicly available or lawfully obtained third-party sources.
5. Purposes
for Collection and Use
We may collect and use personal information to
provide, operate, maintain, secure, and improve the Services; process
registrations, purchases, payments, refunds, and support requests; schedule and
deliver training; provide access credentials and verify attendance or
completion; communicate about transactions, scheduling, service updates, safety
issues, and support matters; personalize user experience; conduct analytics and
measure marketing performance; maintain security, prevent fraud, investigate
incidents, and protect rights and property; comply with law, legal process,
regulatory requirements, and contractual obligations; establish, exercise, or
defend legal claims; and for other disclosed purposes compatible with the
context of collection. We use sensitive personal information only for limited
purposes permitted by law or as reasonably necessary to provide requested
services, accommodations, security, fraud prevention, or legal compliance.
6. How
We Disclose Personal Information
We may disclose personal information to service
providers, contractors, and processors that assist with hosting, cloud storage,
LMS delivery, payment processing, access control, identity verification,
analytics, customer support, communications, fraud prevention, legal
compliance, and business operations; to training sponsors or employers where
they purchase or administer training on behalf of participants; to professional
advisors, insurers, auditors, and financing sources; to authorities or other
parties when required by law or reasonably necessary to protect rights, safety,
and security; and in connection with an actual or proposed corporate
transaction such as a merger, financing, acquisition, reorganization, or sale
of assets.
7. Sales,
Sharing, Targeted Advertising, and Cookies
Based on Company’s current data practices, Company
does not sell personal information and does not share personal information for
cross-context behavioral advertising under California law. Company also does
not engage in targeted advertising in a manner that triggers a consumer opt-out
right under applicable state privacy laws. Company may use cookies and similar
technologies for essential website operations, security, performance,
analytics, fraud prevention, and service improvement.
Company does not use those technologies to sell
personal information or to share personal information for cross-context
behavioral advertising. If Company later adopts advertising, retargeting, or
similar ad-tech practices that trigger additional privacy rights or notice
obligations, Company will update this Privacy Policy and provide any required
opt-out methods. Company may, however, disclose personal
information to service providers, contractors, and other third parties as
described in this Privacy Policy for business and operational purposes.
8. Cookies
and Similar Technologies
Company
uses cookies, pixels, tags, session replay tools, local storage, and similar
technologies only to the extent reasonably necessary for website operation,
security, fraud prevention, performance monitoring, analytics, user
preferences, and service improvement. These technologies may be used to
remember user settings, maintain secure sessions, understand how visitors
navigate the website, measure site performance, troubleshoot technical issues,
and improve the functionality and content of the website and related services.
Company
does not use cookies or similar technologies to sell personal information or to
share personal information for cross-context behavioral advertising based on
Company’s current data practices. Company also does not use such technologies
for targeted advertising in a manner that triggers a consumer opt-out right
under applicable state privacy laws, based on Company’s current practices.
Most web browsers permit you to control cookies
through browser settings, including blocking or deleting cookies. Please note
that disabling certain cookies or similar technologies may affect website
functionality, security features, or your ability to use certain portions of
the website or services. If Company’s use of cookies or similar technologies
changes in a way that triggers additional notice, consent, or opt-out
obligations, Company will update this Privacy Policy and implement any
additional tools or disclosures required by applicable law.
9. Retention
We retain personal information for as long as
reasonably necessary for the purposes described in this Privacy Policy,
including providing Services, maintaining records, resolving disputes,
investigating incidents, enforcing agreements, satisfying legal or regulatory
obligations, and defending against claims. Retention periods vary based on the
category of information, the sensitivity of the information, the context in
which it was collected, whether an account remains active, and applicable law.
10. Data
Security
Company implements and maintains reasonable and
appropriate administrative, technical, organizational, and physical safeguards
designed to protect personal information from unauthorized or unlawful access,
acquisition, use, disclosure, alteration, loss, destruction, or other
compromise. These safeguards are designed in light of the nature and
sensitivity of the information processed, the volume and format of the
information, the purposes for which it is used, and the risks presented by the
processing.
Company’s security measures may include, where
appropriate, access restrictions, role-based permissions, authentication
controls, secure system configurations, monitoring and logging, workforce
training, vendor oversight, incident-response procedures, and other measures
designed to promote the confidentiality, integrity, and availability of
personal information. Company limits access to personal information to
personnel, service providers, and contractors who reasonably need such access
for authorized business purposes.
Company may store or process personal information
using third-party platforms, hosting providers, software providers, payment
processors, communication tools, and other service providers. Company takes
reasonable steps designed to require such parties to protect personal
information in a manner consistent with applicable law and the services they
provide to Company.
Notwithstanding the foregoing, no internet
transmission, electronic storage environment, or security control is guaranteed
to be completely secure or error-free, and Company does not warrant or
guarantee absolute security. You are responsible for maintaining the
confidentiality and security of any login credentials, access codes, passwords,
email accounts, devices, or other means used to access the Services, and for
promptly notifying Company if you believe your information or access
credentials may have been lost, stolen, disclosed, or compromised.
Company reserves the right to suspend access, disable
accounts or credentials, investigate suspected incidents, notify affected
persons or authorities where Company determines such notice is appropriate or
required, and take other actions Company reasonably deems necessary to respond
to actual or suspected security events and to protect the Services, facilities,
systems, users, and information.
11. Children’s
Privacy
The Services are not directed to children under
thirteen, and Company does not knowingly collect personal information directly
from children under thirteen without appropriate consent. If Company becomes
aware that personal information has been collected from a child in a manner
inconsistent with applicable law, Company will take appropriate steps to delete
or otherwise address the information.
12. Your
Privacy Rights
Depending on the jurisdiction in which an individual
resides, that individual may have the right to request to know or access
personal information, request deletion, request correction of inaccurate
personal information, obtain a portable copy of certain personal information,
opt out of sale, sharing, or targeted advertising, limit certain uses of
sensitive personal information, and appeal a denied request where applicable.
Company will not discriminate against an individual for exercising privacy
rights, except as permitted by law.
13. How
to Exercise Rights
Individuals may submit privacy requests by emailing support@surefirecpr.com or calling
888-277-3143. We will take reasonable steps to verify the requestor’s identity
and authority before responding. Authorized agents may submit requests on
behalf of individuals, subject to any verification and authorization
requirements imposed by law.
14. California-Residents
For California residents, this section is intended to
function as part of Company’s Notice at Collection and Privacy Policy under
California law. In the preceding twelve months, Company may have collected and
disclosed for business purposes the categories of personal information
described in Section 3 to the categories of recipients described in Section 6.
California residents may have the right to opt out of sale or sharing, to
request limitation of certain uses of sensitive personal information, and to use
a browser-based preference signal where required by law. If Company offers
financial incentives or bona fide loyalty programs related to data collection,
Company should add the required notice terms here.
15. Nevada
Residents
If you are a Nevada resident, you may have the right
to request that Company not sell certain covered information that Company has
collected or will collect about you, as provided under applicable Nevada law.
Company does not currently sell covered information in a manner that triggers
that opt-out right based on Company’s current data practices. Nevada residents
may nevertheless submit inquiries regarding this topic by contacting Company at
support@surefirecpr.com or 1835 W
Orangewood Ave, Ste #105, Orange, CA 92868.
16. Other
State Residents
Residents of certain U.S. states may have additional
privacy rights under applicable law, which may include, subject to legal
limitations and exemptions, the right to: (a) confirm whether Company processes
personal information about you; (b) access or obtain a copy of certain personal
information; (c) correct inaccuracies in certain personal information; (d)
delete certain personal information; (e) obtain a portable copy of certain
personal information; and (f) opt out of certain types of processing, such as
the sale of personal information, targeted advertising, or profiling in
furtherance of decisions that produce legal or similarly significant effects,
where applicable.
Company will process and respond to verified privacy
rights requests in accordance with applicable law. Company may take reasonable
steps to verify your identity and authority before responding to a request and
may deny or limit requests as permitted by law. If Company denies your request,
you may have the right to appeal that decision depending on your state of
residence. To submit a privacy rights request or appeal, please contact Company
at support@surefirecpr.com or 1835
W Orangewood Ave, Ste #105, Orange, CA 92868.
17. Communications
Consent
Company may use the phone number and email address you
provide to send transactional, operational, and service-related communications,
including without limitation registration confirmations, course reminders,
scheduling updates, access instructions, security alerts, support messages,
safety communications, account notices, and other non-promotional messages
relating to the Services or Training.
If you separately opt in where required, Company may
also use your contact information to send promotional and marketing
communications by email and text message concerning Company’s services,
courses, events, offers, announcements, and related updates. Consent to receive
promotional text messages is not a condition of purchase. Message and data
rates may apply. Message frequency may vary.
You may opt out of promotional text messages at any
time by replying STOP to a message or by contacting Company at support@surefirecpr.com or (888)
277-3143. You may unsubscribe from promotional emails by clicking the
unsubscribe link in the email or by contacting Company at
support@surefirecpr.com. Even if you opt out of promotional communications,
Company may continue to send transactional, operational, and service-related
communications as permitted by law.
Company may retain records of consent, opt-in,
unsubscribe, opt-out, and revocation requests as reasonably necessary for
compliance, operational, and recordkeeping purposes.
18. International
Users
If Company makes the Services available outside the
United States, Company should add appropriate cross-border transfer disclosures
and region-specific rights notices. Otherwise, this section may be removed.
19. Changes
to This Privacy Policy
We may update this Privacy Policy from time to time.
The revised version will be effective as of the posted effective date unless
otherwise stated. Material changes will be communicated as required by law.
20. Accessibility
and Accommodation Communications
If you contact Company to request an accommodation,
reasonable modification, auxiliary aid or service, or other
accessibility-related assistance, Company may collect and use the information
you provide for the purpose of evaluating, processing, documenting, responding
to, and implementing your request, communicating with you about available
options, maintaining records of accessibility-related communications, and
complying with applicable legal obligations. Company requests that you provide
only the information reasonably necessary for Company to understand and respond
to your request. Company will use accessibility- and accommodation-related
information in accordance with this Privacy Policy and applicable law. Company
does not use such information for marketing based solely on the fact that you
requested an accommodation.
Participant understands that certain training content
and instructional materials may be licensed from third parties and may not be
directly modifiable by Company. Nothing in this Privacy Policy is intended to
waive, limit, or impair any non-waivable right relating to disability access,
effective communication, or public accommodations. If Participant requires a
reasonable accommodation, auxiliary aid or service, alternative format, or
other accessibility-related assistance to access or participate in the Training,
Participant should contact Company at support@surefirecpr.com
or (888) 277-3143 as far in advance as reasonably possible. Company will
consider such requests in good faith and on an individualized basis and may
provide accessibility through reasonable and effective alternative means where
direct modification of licensed materials is not available.
21. Contact
Us
Questions about this Privacy Policy may be directed to support@surefirecpr.com or mailed to 1835 W Orangewood Ave, Ste #105, Orange, CA 92868.