Revised July 19, 2024
Your privacy is important to CPI Card Group, Inc. and its affiliated group companies (“CPI”, “we”, “our”, or “us”). We have prepared this privacy policy (“Policy”) to describe to you CPI’s practices for collecting, processing, and sharing your Personal Information, your rights & choices, and other important information about how we handle your Personal Information.
This Policy applies to your use, as an individual, or on behalf of your business or employer, of our “Services,” which include the following:
The Services may contain links to third party websites, products, or services. Except for processing by our service providers (described below), this Policy does not apply to third party websites, products, or services, and CPI is not responsible for the privacy practices or the content of those other websites. Furthermore, this Policy only applies to the extent CPI is acting as a controller and does not apply to the extent that CPI is acting as a processor on behalf of our Business Customers and Partners (defined below).
The following describes how we process data relating to identified or identifiable business-to-business customers, individuals, and households (“Personal Information”).
The categories of Personal Information we process may include:
Audio/Visual Data – Audio files and records, such as voicemails, call recordings, and the like.
Biographical Data – Data relating to professional and employment history, qualifications, and similar biographic information.
Contact Data – Data we can use to contact you or your business, such as email and physical addresses, phone numbers, social media or communications platform usernames/handles.
Device / Network Data – Browsing history, search history, and information regarding your interaction with a website, application, or advertisement (e.g. IP Address, MAC Address, SSIDs, application ID/AdID/IDFA, session navigation history and similar browsing metadata, and other data generated through applications and browsers, including, but not limited to, cookies and similar technologies or other device identifiers or persistent identifiers), online user ID, device characteristics (such as browser/OS version), web server logs, application logs, first party cookies, third party cookies, web beacons, clear gifs and pixel tags.
General Location Data – Non-precise location data, e.g. location information derived from social media tags/posts.
Identity Data – Information such as your name; address; employer, email address; telephone number; gender; date of birth, age and/or age range; account login details, e.g. username and password, avatar, or other account handles/usernames.
Inference Data – Personal Information we create or use as part of a profile reflecting your preferences, characteristics, aptitudes, market segments, likes, favorites or your interests.
Sensitive Personal Information – Personal Information deemed “sensitive” under California or other laws. We may collect the following categories of Sensitive Personal Information:
Transaction Data – Information about the Services we provide to you or your business and about transactions you make with us on behalf of your business and similar information.
User Content – Unstructured/free-form data that may include any category of Personal Information, e.g. data that you give us in free text fields such as comment boxes.
We collect Personal Information from various sources, which include:
Data you provide us – We receive Personal Information when you provide it to us, when you purchase our products or services on behalf of your business, complete a transaction via our Services, or when you otherwise use our Services.
Data we collect automatically – We collect Personal Information about or generated by any device used to access our Services.
Service Providers – We receive Personal Information from service providers performing services on our behalf.
Business Customers and Partners – We receive Personal Information from our business customers and partners if you purchase relevant products and services from them, or when you express interests that relate to CPI products or services.
Social Media Companies – We receive Personal Information from Meta (e.g., Facebook and Instagram) and other social media companies when you interact with that social media company on or in connection with our Services.
Generally
We process Device/Network Data, Contact Data, Identity Data, and General Location Data when you visit our Site. You may also be able to sign up for a profile, submit an order or service request, or enroll in marketing communications through our Site.
We may use this Personal Information as necessary to operate our Site, such as keeping you logged in, delivering pages, etc., for our Business Purposes (described below), and our other legitimate interests, such as:
We may process this Personal Information for our Commercial Purposes (described below).
Cookies and Other Tracking Technologies
We process Identity Data, Device/Network Data, Contact Data, Inference Data, and General Location Data, in connection with our use of cookies, web beacons, and similar technologies on our Site. We may collect this data automatically.
Third parties may view, edit, or set their own cookies or place web beacons on our websites. We, or third party providers, may be able to use these technologies to identify you across platforms, devices, sites, and services. Third parties may engage in Targeted Advertising using this data. Third parties have their own privacy policies and their processing is not subject to this Policy.
We and authorized third parties may use cookies and similar technologies for the following purposes:
We may also process this Personal Information for our Business Purposes and Commercial Purposes. Please see the “Your Rights & Choices” section below for information regarding opt-out rights for cookies and similar technologies.
We process Identity Data and Contact Data when you register with us on the Site and create a profile for our Services.
We use this Personal Information to create and maintain your profile, to verify your identity, to provide the products and services you request, to communicate with you about your account and this Policy, and for our Business Purposes. We may process Identity Data and Contact Data for Commercial Purposes.
We may process Transaction Data, Identity Data, Payment Data, and Contact Data when you request a quote, schedule a demo, or complete a purchase or sale transaction. We do not store your Payment Data, except at your request.
We process this Personal Information as necessary to perform or initiate a transaction with your business, process your business’s order, payment, or refund, carry out fulfillment and delivery, document transactions, and for our Business Purposes.
We may process Identity Data, Transaction Data, and Contact Data for Commercial Purposes.
We process Device/Network Data, Contact Data, and Identity Data in connection with marketing emails, telemarketing, or similar communications, and when you open or interact with those communications. Before this Personal Information is processed, we may offer you the opportunity to choose whether or not to have your Personal Information used in this way. You may receive marketing communications if you consent and, in the United States, you may receive email marketing communications as a result of signing up for a profile or completing a transaction.
We process this Personal Information to contact your business about relevant products or services and for our Business Purposes. We may use this data for our Commercial Purposes. Marketing communications may also be personalized as permitted by applicable law. You may choose to stop receiving our marketing communications by following the unsubscribe instructions included in those communications or you can contact us at privacy@cpicardgroup.com. Please see the “Your Rights & Choices” section below for more information.
We collect and process Identity Data, Contact Data, and User Content when you contact us on behalf of yourself or your business (e.g., through a contact us form or via email). If you call us via phone, we may collect Audio/Visual data from the call recording.
We process this Personal Information to respond to your request, and communicate with you, as appropriate, and for our Business Purposes. If you consent, or if permitted by law, we may use Identity Data and Contact Data to send you marketing communications and for our Commercial Purposes.
We process Identity Data, Contact Data, Government ID Data, Biographical Data, User Content, and Payment Data in connection with your application for employment or to become an independent contractor. We may process Health Data, such as disability accommodations, if you provide it.
We process this Personal Information as necessary to evaluate, establish, and maintain the employment relationship, including, but not limited to, to conduct background checks, to provide employment benefits, and for financial administration. We may also process this Personal Information for human resources purposes, such as managing identity and credentials, administering security and loss prevention, or analyzing and consolidated reporting. We may further process Personal Information in this context for our Business Purposes. We do not sell or share Personal Information processed in this context. We process Sensitive Personal Information only for Business Purposes permitted under applicable law.
We process Identity Data, Contact Data, and User Content collected in connection with customer surveys or questionnaires.
We process this Personal Information as necessary to respond to customer requests/concerns, for our Business Purposes, and other legitimate interests, such as:
We may process this Personal Information for our Commercial Purposes.
We process Identity Data, Contact Data, and User Content you post (e.g., comments and social media posts, blogs, etc.) on our Services. We also process Identity Data, Contact Data, and User Content if you interact with or identify us on social media or communication platforms (e.g., if you post User Content that engages with or tags our official accounts).
We process this Personal Information for our Business Purposes and Commercial Purposes.
Posts may be public, or reposted on our Services. Please note that any information you post in any public forum can be seen, disclosed to, or collected by third parties, and may be used by others in ways we cannot control or predict.
We process Identity Data, Contact Data, and Transaction Data when you register for and attend one of our in-person events, including, but not limited to, webinars, seminars, presentations, and demos. We process User Content if you provide it to us at the event.
We process this Personal Information to tailor the presentation, to respond to your request, and for our Business Purposes and our Commercial Purposes.
We and our Service Providers process Personal Information we hold for numerous business purposes, depending on the context of collection, Your Rights & Choices (described below), and our legitimate interests. We generally process Personal Information for the following “Business Purposes.”
Service Delivery
We process Personal Information as necessary to provide our Services and the products and services you purchase or request on behalf of your business. For example, we process Personal Information to fulfill our contractual obligations to your business, provide your business with the information, features, and services your business requests, and create relevant documentation.
Internal Processing and Service Improvement
We may use any Personal Information we process through our Services as necessary in connection with our legitimate interests in improving the design of our Service, understanding how our Services are used or function, for customer service purposes, for internal research, technical or feature development, to track service use, QA and debugging, audits, and similar purposes.
Security and Incident Detection
We may process Personal Information in connection with our legitimate interest in ensuring that our Services are secure, identify and prevent crime, prevent fraud, verify or authenticate users/individuals, and ensure the safety of our business customers. Similarly, we process Personal Information on our Services as necessary to detect security incidents, and protect against, and respond to, malicious, deceptive, fraudulent, or illegal activity. We may analyze network traffic, device patterns, and characteristics, maintain and analyze logs, and process similar Personal Information in connection with our information security activities.
Personalization
We process certain Personal Information as necessary in connection with our legitimate interest in personalizing our Services. We may personalize based on you and your business’s current interactions with the Services, or obtain it from third parties, using Personal Information we hold about you and your business.
Compliance, Health, Safety, Public Interest
We may process Personal Information as necessary to comply with our legal obligations, such as where you exercise your rights under data protection laws, for the establishment and defense of legal claims, where we must comply with requests from government or law enforcement officials, and as may be required to meet national security or law enforcement requirements or prevent illegal activity. Please see the “Disclosure/Sharing of Personal Information” section below for more information about how we disclose Personal Information in extraordinary circumstances.
We and certain third parties process Personal Information to further our commercial or economic interests (“Commercial Purposes”) depending on the context of collection and Your Rights & Choices (described below).
Please Note – We may require your consent, or we may not engage in processing of Personal Information for Commercial Purposes in some jurisdictions. Some of this processing may involve “sales” or “sharing” of Personal Information as defined by applicable law. For more information and to learn about the specific providers we use for these services, please see the “Regional Supplements” section below.
Consumer Profiles
In order to understand our customers’ preferences, and better recommend products and services to our customers, we may create a “Consumer Profile” by linking together and analyzing Personal Information (excluding Sensitive Personal Information) collected in the various contexts as described in this Policy. We may also augment Consumer Profiles with Personal Information that we create (such as Inference Data) or that we receive from third parties and may include Personal Information such as products you have purchased.
We use Consumer Profiles for market research and in connection with the improvement of our Services. For example, we may analyze the Personal Information of people who have made a purchase for a particular item in the past and compare them with other people in our database. If we identify people in the database who have similar Personal Information to the previous customers, we may then target marketing or content to the new people.
Personalized Marketing Communications
Our marketing communications may be personalized based on your Consumer Profile. Where allowed, our marketing communications may involve targeting, including, but not limited to, targeted marketing.
Targeted Advertising
We and our third party advertising providers may engage in display advertising or place advertisements on third-party sites, including, but not limited to, social media platforms. Such advertising may involve the processing of Personal Information in order to tailor the advertisements you see based on your interests (“Targeted Advertising”). The profiles and interests used for Targeted Advertising may be inferred or derived from Personal Information that we or those third parties obtain or infer from your activities across non-affiliated websites, applications, or services (e.g. through cookies and other tracking technologies, as described above). These third parties, including, but not limited to, Google, may use cookies and/or device identifiers to collect Personal Information such as unique IDs, IP addresses, device information, OS/browser type, and other similar data, as well as information about your visits to our site and the ads you see and view to develop and assess aspects of your Consumer Profile, to deliver more relevant advertisements and offers, and to determine whether and how ads you see are effective. Note that Targeted Advertising includes various parties and service providers, including, but not limited to, third party data controllers, engaged in the processing of Personal Information in connection with Targeted Advertising. These parties may be able to identify you across sites, devices, and over time. In some cases, these third parties may build or augment user profiles using your Personal Information, and may track whether you view, interact with, or how often you have seen an ad, or whether you purchased advertised goods or services.
We may share Personal Information with the following categories of third-party recipients and/or for the following reasons:
Affiliates – we will share your Personal Information with other CPI companies in order to streamline certain business operations, and in support of our Business Purposes and Commercial Purposes.
Service Providers – We may share your Personal Information with Service Providers to provide your business with the Services that we offer, such as providing customer service, performing payment processing, facilitating creation of accounts, providing technical support, and developing and/or distributing newsletters, and in connection with our Business Purposes. It is our practice to require these Service Providers to not use your Personal Information other than to provide the services requested by us for your business. Service Providers may include, but are not limited to, legal and financial advisors.
Public Disclosure – If you use a hashtag or similar link, or otherwise interact with us or our Services via social media, we may make your post available on our Services or to the general public. We may share, rebroadcast, or redisplay Personal Information or other information in the post to the extent permitted by the relevant social media service.
Business Customers and Partner – With your consent, we may share your Personal Information with our business customers and partner, such as when you attend an in-person event or webinar presented in partnership with one of these parties.
Corporate Events – We may share Personal Information if we go through a business transition, such as a merger, acquisition, liquidation, or sale of all or a portion of our assets. For example, Personal Information may be part of the assets transferred, or may be disclosed (subject to confidentiality restrictions) during the due diligence process for a potential transaction.
Lawful Recipients – In limited circumstances, we may, without notice or your consent, access and disclose your Personal Information, any communications sent or received by you, and any other information that we may have about you to the extent we believe such disclosure is legally required, to prevent or respond to a crime, to investigate violations of our Terms of Use policies, in the vital interests of us or any person (such as where we reasonably believe the use or disclosure is necessary to lessen or prevent a serious threat to the life, health or safety of any individual or to public health or safety) or in such other circumstances as may be required or permitted by law. These disclosures may be made to governments that do not ensure the same degree of protection of your Personal Information as your home jurisdiction. We may, in our sole discretion (but without any obligation), object to the disclosure of your Personal Information to such parties.
You may have certain rights and choices regarding the Personal Information we process. Please note, these rights may vary based on the country or state where you reside, and our obligations under applicable law. Please see the “Regional Supplements” section below for more information regarding your rights/choices in specific regions.
You may have certain rights and choices regarding the Personal Information we process. To submit a request, you can contact us in accordance with the “How to Contact Us” section above. We verify your identity in connection with most requests, as described below.
If you submit a request, we typically must verify your identity to ensure that you have the right to make that request, reduce fraud, and to ensure the security of Personal Information. If an agent is submitting the request on your behalf, we reserve the right to validate the agent’s authority to act on your behalf.
We may require that you match Personal Information we have on file in order to adequately verify your identity. If you have an account, we may require that you log into the account to submit the request as part of the verification process. We may not grant access to certain Personal Information to you if prohibited by law.
Marketing Communications
You can withdraw your consent to receive marketing communications by clicking on the unsubscribe link in an email (for email), by responding with “OPT-OUT”, “STOP”, or other supported unsubscribe message (for SMS), or for other communications, by contacting us using the information below. To opt-out of the collection of information relating to email opens, configure your email so that it does not load images in our emails.
Withdrawing Your Consent/Opt-Out
You may withdraw any consent you have provided at any time. The consequence of you withdrawing consent might be that we cannot perform certain services for you, such as location-based services, personalizing or making relevant certain types of advertising, or other services conditioned on your consent or choice not to opt-out. Contact us in accordance with the “How to Contact Us” section above to withdraw your consent.
Cookies, Similar Technologies, and Targeted Advertising
General – If you do not want information collected through the use of cookies and similar technologies, you can manage/deny cookies and certain similar technologies using your browser’s settings menu. You must opt out of the use of some third party site directly via the third party.
To opt-out of Google’s analytic and marketing services, visit Google’s Ads Settings, the Google Marketing Platform opt-out page, the Network Advertising Initiative opt-out page, or your device’s settings.
Targeted Advertising
You may opt out or withdraw your consent to Targeted Advertising by emailing us at privacy@cpicardgroup.com. In some cases, you may be able to opt-out by submitting requests to third-party partners, including for the vendors listed below:
Global Privacy Control (GPC) – Our Site may support certain automated opt-out controls, such as the Global Privacy Control (“GPC”). GPC is a specification designed to allow Internet users to notify businesses of their privacy preferences, such as opting-out of the sale/sharing of Personal Information. To activate GPC, users must enable a setting or use an extension in the user’s browser or mobile device. Please review your browser or device settings for more information regarding how to enable GPC.
Please note: We may not be able to link GPC requests to your Personal Information in our systems, and as a result, some sales/sharing of your Personal Information may occur even if GPC is active. Please see the “Regional Supplement” section below for more information regarding other opt-out rights.
Do-Not-Track – Our Services do not respond to your browser’s do-not-track request.
Our Services are not directed toward children under the age of 16, and we do not knowingly collect any Personal Information from children under the age of 16. If you are between the ages of 16 and 18, please ensure that you use this Site only with the permission of a parent or guardian. If a child under 16 provided this Site with Personal Information, we ask that a parent or guardian contact us at privacy@cpicardgroup.com.
In certain circumstances and to comply with applicable laws, we will retain your Personal Information for as long as needed to provide your business with the Services you request on your business’s behalf. We will also retain your Personal Information as necessary to comply with applicable legal obligations, to resolve disputes, and to enforce our agreements. We generally consider the following factors when we determine how long to retain data (without limitation):
We will review retention periods periodically and may pseudonymize or anonymize data held for longer periods.
US State & California Privacy Rights & Choices
Under the California Consumer Privacy Act (“CCPA”) and other state privacy laws, residents of certain US states may have the following rights, subject to regional requirements, exceptions, and limitations.
Confirm – Right to confirm whether we process your Personal Information.
Access/Know – Right to request any of following: (1) the categories of Personal Information we have collected, sold/shared, or disclosed for a commercial purpose; (2) the categories of sources from which your Personal Information was collected; (3) the purposes for which we collected or sold/shared your Personal Information; (4) the categories of third parties to whom we have sold/shared your Personal Information, or disclosed it for a business purpose; and (5) the specific pieces of Personal Information we have collected about you.
Portability – Right to request that we provide certain Personal Information in a common, portable format.
Deletion – Right to delete certain Personal Information that we hold about you.
Correction – Right to correct certain Personal Information that we hold about you.
Opt-Out (Sales, Sharing, Targeted Advertising, Profiling) – Right to opt-out of the following:
Opt-out or Limit Use and Disclosure of Sensitive Personal Information – Right to opt-out of the processing of certain Sensitive Personal Information, or request that we limit certain uses of Sensitive Personal Information. This right does not apply in cases where we only use Sensitive Personal Information where necessary, or for certain business purposes authorized by applicable law.
Non-Discrimination – California residents have the right to not to receive discriminatory treatment as a result of your exercise of rights conferred by the CCPA.
List of Direct Marketers – California residents may request a list of Personal Information we have disclosed about you to third parties for direct marketing purposes during the preceding calendar year.
Submission of Requests
You may submit requests as follows (please review our “Verification of Rights Requests” section above). If you have any questions or wish to appeal any refusal to take action in response to a rights request, contact us at privacy@cpicardgroup.com. We will respond to any request to appeal within the period required by law.
Categories of Personal Information Disclosed for Business Purposes
For purposes of the CCPA, we may have disclosed to Service Providers for “business purposes” in the preceding 12 months the following categories of Personal Information, to the following categories of recipients:
Category of Personal Information
Category of Recipients
Contact Data
Device/Network Data
General Location Data
Identity Data
Transaction Data
User Content
Audio/Visual Data
Biographical Data
Government ID Data
Health Data
Payment Data
Affiliates; Service Providers; Lawful Recipients
Categories of Personal Information Sold, Shared, or Disclosed for Commercial Purposes
For purposes of the CCPA, we may have “sold” or “shared” in the preceding 12 months the following categories of Personal Information to the following categories of recipients:
Category of Personal Information
Category of Recipients
Transaction Data
Contact Data
Device/Network Data
Identity Data
General Location Data
User Content
Service Providers
Connect with a sales representative for a quote or schedule a demonstration.
Check order status or connect with a representative for assistance with a product.
