California Consumer Privacy Act (CCPA) Addendum

Last Updated: October 2020


Scope of the CCPA Addendum

This statement details Donnelley Financial LLC and its worldwide subsidiaries (“DFIN”, ‘’we’’, ‘’our’’) approach to compliance with the California Consumer Privacy Act of 2018 (‘’CCPA’’). This addendum describes the rights of consumers, visitors, users and others that reside in the state of California in connection with the CCPA. This CCPA Addendum is to be read in conjunction with our Privacy Notice. To the extent that there is any conflict between our Privacy Notice and this statement – this statement shall take precedence in respect of any matters relating to the CCPA and how we handle personal information.
The CCPA Addendum explains:

  • Personal information as defined by the CCPA.
  • Categories of personal information collected by DFIN.
  • How we use your personal information.
  • Categories of personal information shared by DFIN.
  • Sale of personal information.
  • Employee information.
  • California consumer rights and choices.
  • Changes to this addendum.
  • How to contact us.

Personal Information as Defined by the CCPA

Under the CCPA, personal information is defined as any information that could be reasonably linked, directly or indirectly, with a particular California consumer or household. A consumer under the CCPA is defined as a natural person who is a California resident. A household, under the CCPA, is defined as a collective of individuals - such as a family or occupants at a residential address. Personal information does not include:

  • Publicly available information from government records.
  • Information excluded from the CCPA's scope, such as health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (‘’HIPAA’’) and personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (‘’FCRA’’), or the Gramm-Leach-Bliley Act (‘’GLBA’’).
  • De-identified or aggregated consumer information. De-identified information is data that has had all personally identified information removed from it. Aggregated information is numerical or non-numerical information that is compiled into data summaries or summary reports for data statistics or public reporting.

DFIN does not conduct business directly with individual consumers or households. Our business partnerships are business-to-business (“B2B”) with companies. Under the CCPA’s Assembly Bill No. 1355 Amendment, businesses that collect personal information of a consumer that reflects a written or verbal business-to-business communication or transaction in the context of conducting due diligence regarding, or providing or receiving a product or service ("B2B personal information") are exempted from some of the requirements under CCPA. Where noted in this Addendum, consumers personal information that we or our third party affiliates collect within a business and/or B2B context is not required at this time to receive Notice at Collection, the right to access or deletion.

Categories of Personal Information collected by DFIN

Within the last twelve (12) months, we may have collected the following categories of personal information:

Category

Examples

Identifiers.

A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers.

Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).

A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any similar information.

Commercial information.

Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

Internet or other similar network activity.

Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.

Professional or employment-related information.

Current or past job history or, performance evaluations.


We obtain the categories of personal information listed above from the following categories of sources:

  • Directly from you. For example, from forms you complete or products and services you purchase.
  • Indirectly from you. For example, from observing your actions on our Website.

For further information, please refer to DFIN’s Privacy Notice regarding how we collect your personal information.

How We Use Your Personal Information

We may use or disclose the personal information we collect for one or more of the following business purposes:

  • To fulfil or meet the reason you provided the information.
  • To provide, support, personalize, and develop our Website, products, and services.
  • To create, maintain, customize, and secure your account with us.
  • To process your requests, purchases, transactions, and payments.
  • To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
  • To help maintain the safety, security, and integrity of our Website, products and services, databases and other technology assets, and business.
  • For testing, research, analysis, and product development, including to develop and improve our Website, products, and services.
  • To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
  • As described to you when collecting your personal information or as otherwise set forth in the CCPA.

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing notice.

Categories of Personal Information shared by DFIN

We may share your personal information by disclosing it to a third party for a business purpose. In the preceding twelve (12) months, DFIN has disclosed personal information for a business purpose to the following categories of third parties:

Category

Category of Third-Party Recipients

Business Purpose Disclosures

Identifiers.

  • Our affiliates, vendors, consultants and other service providers.
  • Professional advisors or consultants.

California Customer Records personal information categories.

  • Our affiliates, vendors, consultants and other service providers.
  • Professional advisors or consultants.

Commercial information.

  • Our affiliates, vendors, consultants and other service providers.
  • Professional advisors or consultants.

Internet or other similar network activity.

  • Our affiliates, vendors, consultants and other service providers.

Professional or employment related information.

  • Our affiliates, vendors, consultants and other service providers.

For more information, please refer to DFIN’s Privacy Notice regarding how we share your personal information.

Sale of Personal Information

In the preceding twelve (12) months we have not “sold” personal information for the purposes of the CCPA. DFIN does not ever sell or share the personal information of its employees, contractors, customers, third parties, or any other affiliation to others. Your personal information is valuable to both you and us. DFIN works diligently to continuously protect your personal information.

Employee Information

This Notice does not apply to certain workforce-related personal information collected from California-based employees, job applicants, contractors, or similar individuals. An “employee exemption” has been temporarily put in place under CCPA’s Assembly Bill No. 25 amendment which excludes certain employment-related personal information from most of the CCPA’s requirements. DFIN does not sell, lease, or rent any employee personal or family data to any third party.

California Consumer Rights and Choices

Under the CCPA, California residents have specific rights regarding their personal information. 

Right to Know and Data Portability
California residents have the right to request that we disclose certain information to you about our collection and use of your personal information over the past twelve (12) months, including:

  • The right to know which categories of personal information are being collected.
  • The right to know the categories of sources for the personal information being collected.
  • The right to know if personal information is being sold or shared, and to whom.
  • The right to object to the sale of personal information.

A Right to Know request may only be submitted twice within a 12-month period. DFIN does not provide a ‘right to know’ or data portability disclosure for B2B personal information.

Right to Delete
California residents have the right to request the deletion of your personal information that is collected from you and retained by DFIN, subject to certain exceptions.

DFIN is not required to delete personal information if it is still needed in order to complete the transaction for which the information was collected, provide a good or service requested by you (or that we reasonably anticipate based on our relationship with you), perform a contract with you, comply with legal obligations, or accomplish any other objective recognized as an exception to the right to deletion under CCPA.

DFIN does not provide deletion rights for B2B personal information.

Exercising Your Rights
DFIN will never charge you or discriminate against you for choosing to exercise your rights. DFIN will make reasonable efforts to comply with all consumer rights requests. Only you or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. DFIN reserves the right to verify your identity before any request to update or delete your personal information is processed by us. The verifiable consumer request must provide sufficient information that allows DFIN to reasonably verify you are the person about whom we collected personal information or an authorized representative, as well as describe your request with sufficient detail that allows DFIN to properly understand, evaluate, and respond to it. The CCPA grants businesses 45 days to respond to a consumer rights request. An extension period of up to an additional 90 days is allowed.

All California Consumer Rights requests including deletion requests can be emailed directly to dataprivacy@dfinsolutions.com.

Individuals who would like to opt-out of correspondence or modify their online communications preferences with DFIN, should go to DFIN’s online Preference Center at: https://info.dfinsolutions.com/preferencecenter.

Changes to this CCPA Addendum

DFIN reserves the right at its absolute discretion to change this CCPA Addendum from time to time. If this CCPA Addendum changes, the revised version will be posted at the “CCPA Addendum” link on the Site’s home page. In the event that the change is significant or material, we will notify you of such a change by revising the link on the home page to read “Newly Revised CCPA Addendum.” Please check the CCPA Addendum and our Privacy Notice frequently. Your continued use of our sites constitutes acceptance of such changes in the Privacy Notice, except where further steps are required by applicable law.

Under the CCPA, this addendum is required to be reviewed and updated every 12 months.

How to Contact Us

If you have any questions regarding DFIN’s privacy practices, the use of your personal information, or about this CCPA Addendum, please contact us at:

Donnelley Financial Solutions (DFIN)
Global Data Privacy
35 West Wacker Drive
Chicago, IL 60601
United States of America

Email: dataprivacy@dfinsolutions.com
Phone: 855-683-9454