Privacy Policy – 2018

POSTED: OCTOBER 1, 2018
EFFECTIVE: OCTOBER 1, 2018

To view our Terms of Use, please click here. 

Prior versions of our privacy policy: 2010201120122013201420152017 

For our 2020 CCPA Compliant Privacy Policy please click here

This RevTrax Privacy Policy is effective October 1, 2018. Our Privacy Policy describes the information collection practices of the following: RevTrax’s Company Site, RevTrax’s proprietary technology, and the other sites that RevTrax may own. Our Privacy Policy has also been updated in light of the General Data Protection Regulation and other applicable law in effect in the European Economic Area (EEA), Switzerland, and the UK.

Introduction

RevTrax (legally known as OnCard Marketing, Inc.) is an innovative promotions services company. We use our proprietary promotions platform (the “RevTrax Technology”) to help our clients run promotions to find new customers and retain existing ones (the “RevTrax Services”). RevTrax’s clients (each, a “Client”) include companies in the consumer packaged goods, retail, auto, financial services, travel, and other industries.

RevTrax has prepared this Privacy Policy to describe our practices regarding the information we collect from:

  • Visitors to our website at www.RevTrax.com (the “Company Site”), including all subdomains,
  • Individuals who receive a promotional offer for a RevTrax Client, whether on a desktop or laptop PC, mobile phone, tablet, or other device, or via the postal mail, and
  • Visitors to our other owned-and-operated websites (each, a “RevTrax Site”).

This Privacy Policy does not describe the information collection practices of our Clients. We are a third-party service provider to our Clients and recommend that you refer to their privacy policies for information on how they use the marketing information.

Changes to this Privacy Policy. RevTrax will update this Privacy Policy to reflect changes to our practices. We will post all Privacy Policy changes on this page and, if the changes are significant, we will provide a more prominent notice. The Privacy Policy posted on this page will say when that version went into effect. Each visit to a RevTrax-owned site or promotion received after a new version of RevTrax’s Privacy Policy goes into effect will be governed by the new Privacy Policy. You are advised to review our Privacy Policy periodically for any changes. If you visit a RevTrax-owned site after such a change, you will have accepted the new Privacy Policy.

A. Company Site at www.RevTrax.com

1. INFORMATION COLLECTED BY THE COMPANY SITE

Our Company Site provides information about our company, business, and the services we provide. It is also the portal used by our Clients to sign into the customer dashboard for the RevTrax Services. The Company Site collects Personal Information, Usage Data, and Tracking Data when you visit the site at www.RevTrax.com.

2. PERSONAL INFORMATION COLLECTED BY THE COMPANY SITE

a. Definition. Except in jurisdictions where applicable law requires a different definition, “Personal Information” collected by the Company Site means information about an individual that can be used to identify that individual. Your Personal Information includes your name, email address, telephone number, and postal address. It also includes any information that we have associated with your Personal Information. For visitors who access the Company Site from the EEA, Switzerland, and the UK, however, “Personal Information” means data that identifies or can identify a particular user or device, and includes elements of Tracking Data and Usage Data as described in Section A.3. below.

b. Personal Information Collected by the Company Site. RevTrax, or its service providers on RevTrax’s behalf, collects Personal Information from you when you engage in any of the following activities on the Company Site:

  • Request information about a product or service on the Company Site.
  • Register on the Company Site for emails, reports, newsletters or other communications.
  • As an employee or authorized agent of RevTrax or one of its Clients, use a login account on the Company Site to access the customer dashboard for the RevTrax Technology.

We may combine Personal Information that you submit on or through the Company Site with information that we collect from or about you from other sources, offline and online.

c. How We May Use Personal Information Collected on the Company Site. We use the Personal Information that you provide on the Company Site for the following activities:

  • Provide the services or messages that you request.
  • Send you administrative information, including information regarding changes to the Company Site’s terms, conditions and policies.
  • Personalize your experience on the Company Site.
  • Send you ads and other marketing messages about the RevTrax Services.
  • For our business purposes, such as data analysis, audits, developing new products, enhancing the Company Site, improving our services, and identifying usage trends and determining the effectiveness of our marketing.
  • As we believe appropriate (a) to comply with applicable law and legal process, including to respond to valid requests by public authorities (for example, a court, government agency, or law enforcement), (b) to enforce our terms and conditions, (c) to prevent or investigate possible wrongdoing in connection with the Company Site, RevTrax Technology, RevTrax Services and the like, (d) to protect our operations or those of our affiliates, (e) to protect our rights, property, privacy, safety, or that of our affiliates, you or others, or (f) to allow us to pursue available remedies or limit the damages that we may sustain (these purposes, collectively, the “Compliance Purposes”).

Note to visitors from the EEA, Switzerland, or the UK: RevTrax processes, as the data controller, the Personal Information we receive on the Company Site from visitors from the EEA, Switzerland, or the UK on one or more of the following legal grounds:

  • You provided your consent;
  • It is necessary for our contractual relationship;
  • The processing is necessary for us to comply with our legal or regulatory obligations; and/or
  • The processing is in our or a relevant data controllers’ legitimate interest, for instance, where we use data to protect the security and integrity of our systems and to provide services or other benefits.

d. When We May Disclose Personal Information Collected on the Company Site. The Personal Information that you provide to the Company Site may be disclosed:

  • To Our Service Providers. RevTrax uses third-party service providers for a variety of services, including web hosting, customer relationship management, data analysis, IT infrastructure, IT services, customer service, email delivery, auditing, security, fraud, marketing the RevTrax Services, and other services. These third parties may have access to your Personal Information to perform these tasks on our behalf.
  • In a Transfer of Business. To a third party to which we have transferred our business, assets or stock if RevTrax is involved in a reorganization, merger, sale, joint venture, assignment, transfer or other disposition of some or all of our business, assets or stock (including in connection with any bankruptcy or similar proceeding).
  • As we believe appropriate for Compliance Purposes (defined above),

e. How Long We Retain Personal Information Collected on the Company Site. We retain the Personal Information collected on the Company Site for the period necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required for the security or integrity of the Company Site, or to comply with our legal obligations, resolve disputes, or enforce our legal agreements or policies.

f. No Sensitive Information. You are prohibited from disclosing to the Company Site any sensitive Personal Information. Examples of sensitive Personal Information include social security numbers, detailed financial information, health information, information related to racial or ethnic origin, political opinions, religion or other beliefs, criminal background, and trade union membership.

3. USAGE DATA AND TRACKING DATA COLLECTED ON THE COMPANY SITE

a. Definitions.

“Usage Data” are the information that your browser sends to RevTrax’s servers when you visit the Company Site.

“Tracking Data” are the information collected by the cookies, pixel tags, scripts, and other tracking technologies that we use to keep track of visitor activity on the Company Site. (Note that the Tracking Data collected by the RevTrax Technology is different, and is discussed in Section B.)

    • Cookies are small files that contain a small amount of data, typically a unique identifier. They are sent to your browser by a web server, and are stored on your device. Our Company Site uses cookies.
    • Other tracking technologies, in the context of the Company Site, include pixel tags and scripts, and are used to track usage and performance. (See Section B below for the tracking technologies used by the RevTrax Technology.)

As with other Internet services, our web servers gather information automatically each time your browser or device interacts with the Company Site, and store that information in “log files.” The information stored in the log files of our Company Site includes Personal Information, Usage Data and Tracking Data.

b. Usage Data and Tracking Data Collected by the Company Site. The Usage Data and Tracking Data collected by the Company Site include:

    • Information collected through cookies, pixel tags and other tracking technologies.
    • Browser type and version.
    • Your Internet Protocol (IP) address.
    • If you are accessing the Company Site through a mobile phone, tablet, or other device:  the type of device, unique device ID, device IP address, device operating system, cell tower location (if accessing using cellular data), and diagnostic data.
    • Information about how you interact with the Company Site, such as the date and time of your visit, the pages that you visit, and the time spent on those pages.
    • Other aggregated information.

Note to visitors from the EEA, Switzerland or the UK: For Company Site visitors from the EEA, Switzerland or the UK, note that RevTrax cookies, IP addresses, unique device IDs, and other elements of Usage Data and Tracking Data are defined as Personal Information under the GDPR, and will be handled by RevTrax as Personal Information.

Usage Data and Tracking Data are collected from the Company Site by RevTrax, and by our service providers on our behalf, in the following situations:

    • When your browser or device sends it. Standard information is sent by most browsers. This information includes your IP address, device type, screen resolution, operating system version, Internet browser type and version.
    • Through web technologies. We and our service providers may use cookies, pixel tags, and other similar technologies to, among other things, facilitate your access to the Company Site, present you with more tailored information about our products and services, and collect and store information about your use of the Company Site.
    • When you volunteer it. You may volunteer demographic information, as well as other information, such as your preferred means of communication.  Unless combined with Personal Information, this information does not personally identify you or any other visitor of the Company Site.
    • Through activity reports. Information about how you interact with the Company Site is collected with every visit, and is used to determine usage levels, diagnose server problems, and operate and maintain the Company Site.
    • By aggregating information. We may aggregate information collected by the Company Site.  Aggregated information will not include information that personally identifies you or any other visitor of the Company Site.

c. How We May Use and Disclose Usage Data and Tracking Data. We may use and disclose Usage Data and Tracking Data collected on the Company Site for any purpose permitted by applicable law.

Note: If we are required by applicable law to treat any element of Usage Data or Tracking Data as Personal Information, then we will handle those elements as Personal Information.  If we combine any Usage Data or Tracking Data with Personal Information, we will treat the combined information as Personal Information as long as it is combined.

4. YOUR CHOICES ON THE COMPANY SITE 

a. Cookies on the Company Site. When you visit the Company Site, you are notified that the Company Site uses cookies.  However, if you choose to set your browser to decline cookies, then some or all of the features, functionality and promotions available through the Company Site may not be available to you.

b. Use of Your Personal Information on the Company Site. You may opt-out from receiving marketing-related email messages from us either by using the unsubscribe mechanism provided in the message or by emailing us at privacy@RevTrax.com. If you opt out from receiving marketing-related messages from us, we may still send administrative messages to you. You cannot opt out from receiving administrative messages.

See Section D.4. of this Privacy Privacy if you wish to review the Personal Information that we have collected from you on the Company Site.

The Company Site does not support the Do Not Track browser setting.

5. THIRD PARTY ADVERTISING COMPANIES 

RevTrax uses third-party advertising companies to advertise RevTrax and the RevTrax Services. We allow these service providers to use their tracking technologies on the Company Site so that we can target ads about RevTrax to you when you are elsewhere on the Internet. This process is sometimes referred to as interest-based advertising or online behavioral advertising. If you want more information about these third-party advertising companies, please visit the ad industry choice mechanism at http://www.aboutads.info/choices/.

6. TRANSFER OF INFORMATION

RevTrax works with global companies and technologies, and we may need to transfer your Personal Information outside of the country from which it was originally provided. This transfer may be between RevTrax-affiliated companies or to third parties that we work with who are likely located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction. If you are located outside the United States and choose to provide information to us, please note that we process that data, including Personal Information, in the United States.

 

B. RevTrax Technology

1. ABOUT CLIENT PROMOTIONS

Our clients (each, a “Client”) use the RevTrax Services to run promotions to find new customers and retain existing ones. Our Clients include companies in the consumer packaged goods, retail, auto, financial services, travel, and other industries. Our Clients decide how their promotions are run using the RevTrax Services. We implement their promotions using the RevTrax Technology, and process the data on our Clients’ behalf. In this Privacy Policy, a “User” is an individual who is presented with a Client promotion by the RevTrax Services.

The RevTrax Services currently consist of the following offerings:

  • Web-based promotions. A promotion, such as a coupon or other offer, is typically presented to the User digitally, usually via the web, mobile web, or mobile app. A promotion is typically redeemable by the User in store or online, or by taking another action requested by the Client. The vast majority of promotions sent by RevTrax are web-based promotions.
  • Postal mail-based promotions. A Client’s postal mail-based promotion is sent to a User by RevTrax’s service partner after the User visits the Client’s website. Postal mail-based promotions are a service offered by RevTrax.

In this Section B, we describe the information that is collected by the RevTrax Technology about Users who are presented with (a) web-based promotions, and (b) postal mail-based promotions.

Note for individuals in the EEA, Switzerland and the UK: RevTrax does not currently offer its postal mail-based promotion service outside the United States and Canada.

2. WEB-BASED PROMOTIONS: INFORMATION COLLECTED BY THE REVTRAX TECHNOLOGY ABOUT USERS

a. Usage Data and Tracking Data Collected by Web-Based Promotions. The RevTrax Technology collects Usage Data and Tracking Data when the RevTrax Technology presents a Client’s Web-based promotion to a User. The kinds of Usage Data and Tracking Data collected for the RevTrax Services are different from that collected for the Company Site.

As used in our discussion about the web-based promotions in this Section B.2.:

Usage Data are the information that is sent automatically to RevTrax’s servers when a User is presented with a Web-based promotion. This information includes a User’s device type, operating system version, and Internet browser type and version.

Tracking Data are the information collected by the RevTrax Technology from a User who is presented with a Web-based promotion.

The Usage Data and Tracking Data collected by the RevTrax Technology from web-based promotions include:

  • Information collected through tracking technologies. Browser type and version.
  • Unique identifiers set by our tracking technologies.
  • If a User is accessing the RevTrax Technology through a mobile phone, tablet, or other device:  the type of device, device IP address, cell tower location (if accessing using cellular data), device operating system, screen resolution, and diagnostic data.
  • Information about the User’s interaction with the promotion, such as whether the User responds to the promotion, and the date and time of the interaction.
  • Information about each redemption of a promotion.
  • User’s Internet Protocol (IP) address, which is stored for a short period.
  • Other aggregated information.

The Tracking Data are collected by the RevTrax Technology using:

  • Proprietary tracking technologies including:
    • A digital fingerprint that the RevTrax Technology uses to identify and authenticate a promotion for fraud prevention and reporting purposes, and
    • A cookie that the RevTrax Technology uses to recognize a User.
  • Other tracking technologies include pixel tags and scripts, and are used by RevTrax for preparing reports for its Clients.

As with other Internet services, our web servers gather information automatically each time a User’s browser or device interacts with the RevTrax Technology, and store that information in “log files.” The information stored in our web servers’ log files includes Usage Data and Tracking Data.

b. Personal Information Collected by Web-Based Promotions.

Social sharing. For many promotions, the Client’s digital-based promotion has a “share with a friend” feature. When a User provides the email address of another in response to this feature, the RevTrax Technology sends the Client’s digital-based promotion to that email address. An email address is Personal Information, and RevTrax collects the email address on Client’s behalf to forward the promotion as requested by the User.

User responses hosted by RevTrax. Our Clients decide how promotions are redeemed. Sometimes a promotion can require a User to provide Personal Information, and on occasion, a Client will request that RevTrax host and collect the Users’ responses to the promotion on the Client’s behalf and for the Client’s use. In cases where we host User responses to a Promotion, any Personal Information collected will be governed by the terms of our Client’s privacy policy.

Proof of purchase. Some promotions require proof of purchase and offer the option of uploading a receipt or document via a web page or app. Users are also asked to provide a mobile phone number or other identifier to prevent fraud. We will treat the uploaded information as Personal Information.

3. POSTAL MAIL-BASED PROMOTIONS: INFORMATION COLLECTED ABOUT USERS

a. Background. In our postal mail-based promotions service, Clients ask RevTrax to mail a direct mail promotion to Users who have visited one or more Client websites (each, a “Client Site”). In this RevTrax Service, a promotion is mailed to the User, even if  Client does not know the User’s name or contact information. The promotion is sent without Client or RevTrax learning the User’s name or contact information.

This service is implemented with the participation of an independent audience information company (“Audience Company”) that operates a proprietary database of consumer addresses, and a direct mail printing company (“Printer”). For data privacy reasons, the Audience Company and Printer are prohibited from disclosing to RevTrax or its Clients the Personal Information of any User recipient to which a direct mail promotion is mailed.

b. Usage Data and Tracking Data Collected by Postal Mail-Based Promotions. As used in our discussion about the web-based promotions in this Section B.3.:

Usage Data are the information that is sent automatically to RevTrax’s servers when a User visits a Client Site. This information includes a User’s device type, operating system version, and Internet browser type and version.

Tracking Data are the information collected by the RevTrax Technology when a User visits a Client Site.

The RevTrax Technology collects Usage Data and Tracking Data when a User visits a Client Site. In addition, the Audience Company collects tracking data on the Client Site about that User visit. The Usage Data and Tracking Data collected by the RevTrax Technology and Audience Company’s technology do not include a User’s name, address or other contact information.

The Client decides on the kinds of Users to whom a direct mail promotion should be mailed (the “Selected Users”), based in part on User behavior on the Client Site observed by the Tracking Data.

c. Personal Information Collected by Postal Mail-Based Promotions. As instructed by RevTrax, the Audience Company uses the tracking data that it has collected about a Selected User’s visits to the Client Site to match that Selected User to a record in the Audience Company database. If there is a match, then the Audience Company pulls the Selected User’s address, and sends the address to Printer. Printer uses the Selected User addresses to print and mail the designated direct mail promotion. The Audience Company and Printer are prohibited from providing Personal Information about the Selected Users to RevTrax or its Clients. Audience Company is the controller of the addresses and other Personal Information about the Selected Users in its database.

d. Information Collected When a Promotion is Redeemed. When a selected User responds to a promotion (whether online, in a store, by phone, or other means), the information submitted is received by our Client and RevTrax. Among other things, the submitted information is used to measure the effectiveness of the promotion and for reporting and analysis.

4. HOW WE USE DATA COLLECTED BY THE REVTRAX TECHNOLOGY

We use the data collected by the RevTrax Technology when we perform the RevTrax Services for the following purposes:

  • Implement the promotions designed by our Clients, including to present promotions, validate redemptions, and prevent fraud.
  • Prepare reports and analytics, and perform other services, as requested by our Clients.
  • Forward web-based promotions to others, as requested by Users.
  • For our other business purposes, such as audience modeling, data analysis, identifying usage trends, diagnosing technical problems, operating, maintaining, enhancing and improving the RevTrax Technology and RevTrax Service, and developing new products and services.
  • As we believe appropriate for Compliance Purposes.

If a Client requests that the RevTrax Technology collect and store Personal Information provided by a User in response to a promotion, RevTrax transfers that Personal Information to the Client, and is not authorized to use that Personal Information in its own business.

5. WHEN WE MAY DISCLOSE DATA COLLECTED BY THE REVTRAX TECHNOLOGY 

We may disclose data collected by the RevTrax Technology for the following purposes:

  • To our Service Providers. RevTrax uses third-party service providers for a variety of services, such as hosting, customer relationship management, data analysis, IT infrastructure, IT services, customer service, email delivery, proof of purchase verification, auditing, security, fraud, and other services. These third parties may have access to Personal Information, Usage Data, and Tracking Data in order to perform these tasks on our behalf.
  • To our Client’s Service Providers. Our Clients use third-party service providers for a variety of marketing and other services. At Client’s instruction, these third parties may have access to the Personal Information, Usage Data, and Tracking Data collected for Client’s promotions.
  • In a Transfer of Business. To a third party to which we have transferred our business, assets or stock if RevTrax is involved in a reorganization, merger, sale, joint venture, assignment, transfer or other disposition of some or all of our business, assets or stock (including in connection with any bankruptcy or similar proceeding). You will be notified if your Personal Information is transferred and becomes subject to a different Privacy Policy.
  • As we believe appropriate for Compliance Purposes (defined above).

6. USER CHOICES FOR THE REVTRAX TECHNOLOGY 

RevTrax is a service provider and data processor for our Clients. Users interact with the RevTrax Technology, because our Clients use one or more RevTrax Services to implement their promotions. We recommend that Users check the Client Site, including its privacy policy, for information about the user choices available for a particular promotion.

 

C. RevTrax Sites

From time to time, RevTrax may create and run owned-and-operated websites. These owned-and-operated websites (each previously defined as a “RevTrax Site”) generally provides Users with our Clients’ web-based promotions.

A RevTrax Site is powered by the RevTrax Technology. The RevTrax Technology collects Usage Data and Tracking Data when a User visits a RevTrax Site. Please refer to Section B for information about the Usage Data and Tracking Data collected by the RevTrax Technology.

The RevTrax Sites do not support the Do Not Track browser setting.

D. Other Information

1. ABOUT DATA SECURITY.

RevTrax employs commercially reasonable security measures to prevent the loss, misuse or alteration of information collected by the Company Site, RevTrax Sites, RevTrax Technology. However, no data transmission over the Internet or data security system can be guaranteed to be 100% secure.

2. LINKS TO OTHER SITES. 

Our Company Site and RevTrax Technology may contain links to other sites that are not operated by us. If you click on a third-party link, you will be directed to that third party’s site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

3. CHILDREN’S PRIVACY.

The Company Site, RevTrax Sites, and RevTrax Technology are not targeted to anyone under the age of 13 (“Child”). We do not knowingly collect Personal Information from Children, unless agreed in writing with a particular Customer and in compliance with applicable law.

4. USER ACCESS TO PERSONAL INFORMATION COLLECTED BY THE COMPANY SITE AND REVTRAX TECHNOLOGY.

If you have a login to the Company Website (i.e., you are a RevTrax client), log into your account to make changes to the Personal Information we have on file for your account.

If you do not have a login to the Company Site (for example, a prospective customer or a website visitor) and would like to access, change, or delete the Personal Information that you have previously provided to the Company Site, contact us by emailing us at privacy@RevTrax.com to make the requested changes. You may be asked to verify your identity for anti-fraud purposes. Once verified, we will comply with your request as soon as reasonably practicable. If you have requested that some Personal Information be deleted, note that we may need to retain some of the information for backup or Compliance Purposes. In addition, there could remain residual traces of the deleted Personal Information in our databases and other records. We are not responsible for changing or deleting information from the databases of third parties that have previously accessed your information.

If you have provided Personal Information to a Client promotion that was powered by the RevTrax Technology, please check the Client Site, including its privacy policy, for information about the user choices available to be you. RevTrax is a service provider and data processor for our Clients.

E. How to Contact RevTrax

If you have any questions about this Privacy Policy, please contact us at:

OnCard Marketing, Inc. d/b/a RevTrax
Attention: Privacy
132 West 31st Street Suite 702
New York, NY 10001
privacy@revtrax.com