California Consumer Privacy Act (CCPA) Addendum

Last Updated: January 22, 2020


Scope of the CCPA Addendum

This statement details Donnelley Financial LLC (“DFIN”) and its worldwide subsidiaries (“we”, “our”) approach to compliance with Data Privacy Legislation. This addendum describes the rights of consumers, visitors, users and others that reside in the state of California in connection with the California Consumer Privacy Act of 2018 (“CCPA”). This CCPA Addendum is to be used in conjunction with our Privacy Notice. To the extent that there is any conflict between our Privacy Notice and this statement – this statement shall take precedence in respect of any matters relating to the CCPA and how we handle personal information.

The CCPA Addendum explains:

  1. Personal information as defined by the CCPA.
  2. Categories of personal information collected by DFIN.
  3. Categories of personal information shared by DFIN.
  4. Sale of personal information.
  5. Employee information.
  6. How we use, share, and protect consumer data.
  7. California consumer rights and choices.
  8. Changes to this addendum.
  9. How to contact us.

Personal Information as Defined by the CCPA

Under the CCPA, personal information is defined as any information that could be reasonably linked, directly or indirectly, with a particular California consumer or household. A consumer under the CCPA is defined as a natural person who is a California resident. A household, under the CCPA, is defined as a collective of individuals - such as a family or occupants at a residential address.

Examples of personal information include but are not limited to:

  • An individual’s name.
  • Employee ID number.
  • Home address.
  • Social Security number.
  • Passport number.
  • Driver’s license number.
  • Products/services purchased, obtained, or considered.
  • Biometric information.
  • Audio, electronic, visual, thermal, olfactory, or similar information.
  • Education information that is not publicly available.
  • Internet and other electronic network activity information.
  • Geolocation data.
  • Email address.
  • Network ID, IP Address, and Network Activities.

CCPA does not apply to de-identified or aggregated consumer information that a business may hold. De-identified information is data that has had all personally identified information removed from it. Aggregated information is numerical or non-numerical information that is compiled into data summaries or summary reports for data statistics or public reporting.

DFIN and our third party affiliates do not conduct business directly with individual consumers or households. Our business partnerships are business-to-business (“B2B”) with companies. Under the CCPA’s Assembly Bill No. 1355 Amendment, a “B2B exemption” has been put in place for the first year of CCPA’s enforcement. Businesses that collect personal information of a consumer that acts on behalf of another business rather than themselves are currently out of scope of the CCPA. Consumers personal information that we or our third party affiliates collect within a business and/or B2B context is not required at this time to receive Notice at Collection, the right to access or deletion.

Categories of Personal Information collected by DFIN

Please refer to DFIN’s Privacy Notice regarding how and why we collect your personal information.

Categories of Personal Information shared by DFIN

Please refer to DFIN’s Privacy Notice regarding how we share your personal information.

Sale of Personal Information

DFIN does not sell or share any personal information of its employees, contractors, customers, third parties, or any other affiliation to others. Your personal information is valuable to both you and us. DFIN works diligently to continuously protect your personal information.

Employee Information

An “employee exemption” has been put in place under CCPA’s Assembly Bill No. 25 amendment for the first year of CCPA’s enforcement. The CCPA does not currently apply to employees, contractors and/or job applicants who reside or work in California. DFIN does not sell, lease, or rent any employee personal or family data to any third party.

How We Use, Share and Protect Consumer Data

Please refer to DFIN’s Privacy Notice regarding how we use, share, and protect your personal information.

California Consumer Rights and Choices

Under the CCPA, California residents have the following rights:

  • The right to know which personal information is being collected.
  • The right to know if personal information is being sold or shared, and to whom.
  • The right to object to the sale of personal information.
  • The right to access one's own personal information.
  • The right to equal service and price, even for consumers who exercise their privacy rights.
  • The right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions.

California consumers may exercise their rights under the CCPA twice within a 12-month period. DFIN will not charge you or discriminate against you for choosing to exercise your rights. DFIN will make reasonable efforts to comply with consumer rights requests, unless such requests are prohibited by law, or there is a legitimate business purpose to retain personal information. Only you or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. DFIN reserves the right to verify your identity before any request to update or delete your personal information is processed by us. The verifiable consumer request must provide sufficient information that allows DFIN to reasonably verify you are the person about whom we collected personal information or an authorized representative, as well as describe your request with sufficient detail that allows DFIN to properly understand, evaluate, and respond to it. The CCPA grants businesses 45 days to respond to a consumer rights request. An extension period of up to an additional 90 days is allowed.

Individuals who would like to opt-out of correspondence or modify their online communications preferences with DFIN, should go to DFIN’s online Preference Center at: https://info.dfinsolutions.com/preferencecenter.

All other California Consumer Rights requests including deletion requests can be emailed directly to dataprivacy@dfinsolutions.com.

Changes to this CCPA Addendum

DFIN reserves the right at its absolute discretion to change this CCPA Addendum from time to time. If this CCPA Addendum changes, the revised version will be posted at the “CCPA Addendum” link on the Site’s home page. In the event that the change is significant or material, we will notify you of such a change by revising the link on the home page to read “Newly Revised CCPA Addendum.” Please check the CCPA Addendum and our Privacy Notice frequently. Your continued use of our sites constitutes acceptance of such changes in the Privacy Notice, except where further steps are required by applicable law.

Under the CCPA, this addendum is required to be reviewed and updated every 12 months.

How to Contact Us

If you have any questions regarding DFIN’s privacy practices, the use of your personal information, or about this CCPA Addendum, please contact us at:

Donnelley Financial Solutions (DFIN)
Global Data Privacy
35 West Wacker Dr.
Chicago, IL 60601
United States of America

Email: dataprivacy@dfinsolutions.com
Phone: 855-683-9454