Privacy Policy

POSTED: DECEMBER 18, 2023
EFFECTIVE: JANUARY 1, 2024

To view our Terms of Use, please click here.

Prior versions of our privacy policy: 2010201120122013201420152017201820202020(2), 2020(3)2022

This RevTrax Privacy Policy is effective on JANUARY 1, 2024. Our Privacy Policy describes the information collection practices of the following: RevTrax’s Company Site, RevTrax’s proprietary technology, and the other sites that RevTrax may own.

Introduction

RevTrax (legally known as OnCard Marketing, Inc., “we, “us”, “our”) is an innovative marketing services company. We use our proprietary offers platform (the “RevTrax Technology“) to help our clients run offers to find new customers and to retain existing ones (the “RevTrax Services“). RevTrax’s clients (each, a “Client“) include companies in the consumer packaged goods, retail, auto, financial services, travel, and other industries.

RevTrax has prepared this Privacy Policy to describe our practices regarding the information we collect from:

  • Individuals who receive a Client’s offer powered by the RevTrax Technology, whether the offer is viewed on a desktop or laptop PC, mobile phone, tablet, or other device, and
  • Visitors to our website at RevTrax.com (the “Company Site“), including all subdomains.

This Privacy Policy does not describe the information collection practices of our Clients. We are a third-party service provider to our Clients, and recommend that you refer to a Client’s privacy policy for information on how it uses marketing information.

Where we collect data about data subjects in the European Union, the European Economic Area, Switzerland, or the UK, the data protection law of these jurisdictions may apply. See Section D of this Privacy Policy for information applicable to personal data collected in these countries.

Changes to this Privacy Policy. RevTrax will update this Privacy Policy to reflect changes to our practices. We will post all Privacy Policy changes on this page and, if the changes are significant, we will provide a more prominent notice. The Privacy Policy posted on this page will say when that version went into effect. Each offer received and each visit to a Company Site after a new version of RevTrax’s Privacy Policy goes into effect will be governed by the new Privacy Policy. You are advised to review our Privacy Policy periodically for any changes. If you visit a RevTrax-owned site after such a change, you will have accepted the new Privacy Policy.

A. RevTrax Technology

1. About Client Offers

Our Clients use the RevTrax Services to present offers to their customers and prospective customers. We implement their offers using the RevTrax Technology, and process the data on our Clients’ behalf. In this Privacy Policy, a “User” is an individual who is presented with a Client offer by the RevTrax Services.

The RevTrax Services currently consist of the following offerings:

  • Web-based offers. A Client’s offer, such as a coupon or other offer, is typically presented to the User digitally, usually via the web, mobile web, or a mobile app. An offer is typically redeemable by the User in store or online, or by taking another action requested by the Client. The vast majority of offers sent by RevTrax are web-based offers.
  • Data Services. RevTrax analyzes the aggregate data produced by the RevTrax Technology to develop statistical models to predict behaviors, such as the likelihood to respond to an offer. These models are based on aggregated interactions with the RevTrax Technology, and are not associated with individual consumers or households. RevTrax does not sell the aggregated data or statistical models to third parties. RevTrax provides modeling services to its Clients for the purpose of optimizing their (or their customers’) marketing offers and messages and modeled audience targeting.

2. Information Collected By the RevTrax Technology About Users

a. Usage Data and Tracking Data Collected by Web-Based Offers.

The RevTrax Technology presents a Client’s Web-based offer to a User using the RevTrax-owned website irxcm.com, and collects Usage Data and Tracking Data, as described below. The Usage Data and Tracking Data collected for the RevTrax Services are maintained separately from those collected for the Company Site.

As used in our discussion about the web-based offers in this Section A.2 .:

  • Usage Data are the information that is sent automatically to RevTrax’s servers when a User is presented with a Web-based offer. This information includes a User’s device type, operating system version, and Internet browser type and version.
  • Tracking Data are the information collected by the RevTrax Technology from a User who is presented with a Web-based offer.

Usage Data. In the table below, RevTrax summarizes the information collected automatically by the RevTrax Technology. Some of this information is considered Personal Information under applicable law, as described in Section A.2.b .

Type of Information Collected Purpose
IP address Standard web HTTP request; used for fraud detection and general location, and to understand general location; stored for a short period by RevTrax
Cookie Standard web cookies, used for matching
Referrer Standard web browser HTTP referrer; may be used for reporting and analytics
Request Standard web HTTP request
Browser Type and Version Standard web HTTP request; used to format the offer to optimize viewability
Application version Metadata feature used for identification and matching
Device model Metadata feature used for identification and matching
Manufacturer Metadata feature used for identification and matching
Operating system Metadata feature used for identification and matching
Operating system version Metadata feature used for identification and matching
Screen size Metadata feature used for identification and matching
Screen resolution Metadata feature used for identification and matching
Mobile network status (WiFi, etc.) Metadata feature used for identification and matching
Device locale (country and language) Metadata feature used for identification and matching
Mobile platform Metadata feature used for identification and matching

Tracking Data. The RevTrax Technology employs tracking technologies, primarily cookies, pixel tags and scripts, to collect information when Users receive and interact with a Client’s offer. Some of the information collected may be considered Personal Information under applicable law.

In the table below, RevTrax summarizes the information collected by the RevTrax Technology’s tracking technology.

Type of Data Collected Purpose
RevTrax ID Unique ID assigned by the RevTrax Technology; used for offer authentication, fraud detection, and Reporting
Whether the User interacts with the offer (e.g., activates an offer, forwards to a friend, or takes another action), and the time and date of such interaction Used for offer authentication, fraud detection, and reporting
Time, date and location when a User redeems an offer Used for offer authentication, fraud detection, and reporting
Proof of purchase and mobile phone number provided by User to satisfy offer conditions Used for to respond to a respond to a User’s request for redemption
Cell phone number or email address provided by User for “forward to a friend” feature Used to forward an offer to the contact information provided by User

As with other Internet services, our web servers gather information automatically each time a User’s browser or device interacts with the RevTrax Technology, and store that information in “log files.” The information stored in our web servers’ log files includes Usage Data and Tracking Data.

b. Personal Information Provided by Users.

Definition. Except in jurisdictions where applicable law requires a different definition, “Personal Information” means information about an individual that can be used to identify that individual. Your Personal Information includes your name, email address, telephone number, and postal address. It also includes any information that we have associated with your Personal Information. For residents of California, Colorado, Connecticut, Virginia, or Utah, or the European Economic Area, Switzerland, or the UK, “Personal Information” will be defined by applicable law.

Social sharing. For many offers, the Client’s digital-based offer has a “share with a friend” feature. When a User provides the email address of another in response to this feature, the RevTrax Technology sends the Client’s digital-based offer to that email address. It is the User’s responsibility to ensure that the email addresses submitted through the “share with a friend” feature are lawfully submitted. An email address is Personal Information, and RevTrax collects the email address on Client’s behalf to forward the offer as requested by the User.

User responses hosted by RevTrax. Our Clients decide how offers are redeemed. Some offers will require a User to provide information. While Clients typically directly receive the User responses, on occasion, a Client will request that RevTrax host and collect the Users’ responses on the Client’s behalf and for the Client’s use. In cases where we host User responses to an offer, the Personal Information collected will be governed by the terms of our Client’s privacy policy.

Proof of purchase. Some offers require proof of purchase and offer the option of uploading a receipt or document via a web page or app. Users are also asked to provide a mobile phone number or other identifier, which RevTrax uses to prevent fraud. We will treat the uploaded information as Personal Information.

3. How We Use Data Collected by the RevTrax Technology

We use the data collected by the RevTrax Technology when we perform the RevTrax Services for the following purposes:

  • Implement the offers designed by our Clients, including to present offers, validate redemptions, and prevent fraud.
  • Prepare reports and analytics, and perform other services, as requested by our Clients.
  • As requested by Users, forward web-based offers to others.
  • Data services.
  • Identifying usage trends, diagnosing technical problems, operating, maintaining, enhancing and improving the RevTrax Technology and RevTrax Service, and developing new products and services.
  • As we believe appropriate (a) to comply with applicable law and legal process, including to respond to valid requests by public authorities (for example, a court, government agency, or law enforcement), (b) to enforce our terms and conditions, (c) to prevent or investigate possible wrongdoing in connection with the RevTrax Technology, RevTrax Services, the Company Site (as defined in Section B below), and the like, (d) to protect our operations or those of our affiliates, (e) to protect our rights, property, privacy, safety, or that of our affiliates, you or others, or (f) to allow us to pursue available remedies or limit the damages that we may sustain (these purposes, collectively, the “Compliance Purposes“).

If a Client requests that the RevTrax Technology collect and store the Personal Information provided by a User responding to an offer, RevTrax transfers that Personal Information to the Client, and is not authorized to use that Personal Information in its own business.

4. When We May Disclose Data Collected by the RevTrax Technology

We may disclose data collected by the RevTrax Technology for the following purposes and to the following parties:

  • To our Service Providers. RevTrax uses third-party service providers for a variety of services, such as hosting, customer relationship management, data analysis, IT infrastructure, IT services, customer service, email delivery, proof of purchase verification, auditing, security, fraud, and other services. Bound by confidentiality obligations to RevTrax, these third parties may have access to Personal Information, Usage Data, and Tracking Data in order to perform these tasks on our behalf.
  • To a Client’s Service Providers. Our Clients use third-party service providers for a variety of marketing and other services. At our Client’s instruction, a third party may have access to the Personal Information, Usage Data, and Tracking Data collected for the Client’s offers.
  • In a Transfer of Business. To a third party to which we have transferred our business, assets or stock if RevTrax is involved in a reorganization, merger, sale, joint venture, assignment, transfer or other disposition of some or all of our business, assets or stock (including in connection with any bankruptcy or similar proceeding). You will be notified if your Personal Information is transferred and becomes subject to a different Privacy Policy.
  • As we believe appropriate for Compliance Purposes.

5. Your Privacy Choices About the Personal Information Collected by the RevTrax Technology

a. State Privacy Compliance Tool. RevTrax offers Users the State Privacy Compliance Tool so that Users can access the Personal Information that the RevTrax Technology has associated with their devices in the preceding twelve (12) months. To use the State Privacy Compliance Tool, please follow the following steps:

  • Navigate a browser on a device that you use to the State Privacy Compliance Tool, and request that the State Privacy Compliance Tool read the RevTrax ID on that browser. In doing so, you will have asked the State Privacy Compliance Tool to compile for your review the Personal Information associated by the RevTrax Technology with that RevTrax ID (such data, the “Compliance Information“). Once you have made you request, the State Privacy Compliance Tool will generate a unique web link (“Information Link“) that you will use to view your Compliance Information once it is compiled. Make note of the Information Link, browser and the device with which you requested the Compliance Information.
  • The Compliance Information for that browser will be available by the tenth (10th) business day after your request. After RevTrax has compiled your Compliance Information, you will be able to review the Compliance Information for that browser and that device by using the Information Link to navigate to the State Privacy Compliance Tool. RevTrax does not have your contact information and would not be able to notify you that your Compliance Information is ready.
  • If you use multiple devices or more than one browser on a device, we recommend that you navigate each browser on each of your devices to the State Privacy Compliance Tool. The RevTrax Technology could have issued a different RevTrax ID to each browser and device, and because the Compliance Information is associated with the RevTrax ID, the Compliance Information returned for a different browser or on a different device could be different.

The Compliance Information will include the Personal Information associated with that RevTrax ID in the preceding twelve (12) months.

Request Deletion. On the web page that presents your Compliance Information, you will have the option to delete the association of your RevTrax ID with the activity collected by the RevTrax Technology about your prior interactions with the RevTrax Technology.

Note that RevTrax can delete the association with your RevTrax ID only for information associated with your RevTrax ID prior to the date of your request. We cannot delete the association for information collected after the date of your request. We suggest that you return to RevTrax’s CCPA page to submit subsequent requests for deletion.

b. Privacy Rights of California Residents.

On January 1, 2020, the California Consumer Privacy Act of 2018 (“CCPA“) took effect. The California Privacy Rights Act (“CPRA“) amendments to the CCPA become effective January 1, 2023. This Section 5.b. describes California residents’ rights under the CCPA.

Access to Collected Information. A User resident in California can request access to the Compliance Information (as defined above) associated with a RevTrax ID in the preceding twelve (12) months by using the State Privacy Compliance Tool. See Section A.5.a. above.

Right to Request Deletion. The CCPA provides the right to request the deletion of the association between a California User’s RevTrax ID and the Compliance Information. Note that the right to request deletion is subject to the exceptions listed in the CCPA. A User resident in California may request such deletion by following the steps under the “Request Deletion” header in Section A.5.a. above.

Selling and Sharing of Personal Information. In connection with performing RevTrax Services for its Clients, RevTrax discloses information collected by the RevTrax Technology to Clients, their Service Providers, and RevTrax’s Service Providers. See Section A.4. (When We May Disclose Data Collected by the RevTrax Technology). Note that this sharing of information as part of the RevTrax Services may qualify as a “sale” and be considered “sharing” under the CPRA and other state privacy laws, even though such sharing is for the purpose of performing RevTrax Services for our clients or fulfilling a User’s request. RevTrax does not knowingly “sell” or “share” the personal information of children under 16.

RevTrax does not have knowledge that it “sells” or “shares” the Personal Information of consumers under the age of 16.

Also, in operating the Company Site (defined in Section B.1), RevTrax discloses to our third-party service providers information that may qualify as Personal Information. See Section B.2.d. (When We May Disclose Personal Information Collected on the Company Site), and Section C (Third-Party Service Providers).

Non-Discrimination. RevTrax will not discriminate against a User for exercising any of his, her or their CCPA rights.

c. Privacy Rights of Virginia, Colorado, Connecticut and Utah Residents.

This Section A.5.c. describes the rights of the residents of Colorado, Connecticut, Virginia and Utah and explains how to exercise those rights. If you are a resident of Colorado, Connecticut, Virginia and Utah, you have the rights to:

  • Use the State Privacy Compliance Tool to confirm whether or not the RevTrax Technology is processing your Personal Information (see Section A.5.a. above);
  • Use the State Privacy Compliance Tool to obtain a copy of your Personal Information collected by the RevTrax Technology (defined in Section A.5.a. as “Compliance Information”);
  • Delete the association of the RevTrax ID with your Personal Information collected by the RevTrax Technology (see Section A.5.a. above); and
  • By deleting the association of your Personal Information with the RevTrax ID, opt out of the processing of Personal Information for purposes of:
    • Targeted advertising;
    • The sale of Personal Information; or
    • For Colorado, Connecticut and Virginia residents only, profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

Colorado, Connecticut and Virginia residents also have the right, where feasible and relevant, to correct inaccuracies in the Personal Information we process. Given the nature of the Personal Information collected by the RevTrax Information and the purpose for which it is used, RevTrax would advise a User to request deletion as a preferred alternative to correcting inaccuracies.

d. Data Subject Rights in the EU, EEA, Switzerland and the UK. See Section D of this Privacy Policy for more information.

B. Company Site at www.RevTrax.com

1. Information Collected by the Company Site

Our Company Site provides information about our company, business, and the services we provide. It is also the portal used by our Clients to sign into the customer dashboard for the RevTrax Services. The Company Site collects Personal Information, Usage Data, and Tracking Data when you visit the site at www.RevTrax.com.

2. Personal Information collected by the Company Site

a. Definition. Except in jurisdictions where applicable law requires a different definition and as described in our discussion of the RevTrax Technology, “Personal Information” collected by the Company Site means information about an individual that can be used to identify that individual, including your name, email address, telephone number, and postal address, and the information that is associated with your Personal Information. For residents of California, Colorado, Connecticut, Virginia, or Utah, or the European Economic Area, Switzerland, or the UK, “Personal Information” will be defined by applicable law.

b. Personal Information Collected by the Company Site. RevTrax, or its service providers on RevTrax’s behalf, collects Personal Information from you when you engage in any of the following activities on the Company Site:

  • Request information about a product or service on the Company Site.
  • Register on the Company Site for emails, reports, newsletters or other communications.
  • As an employee or authorized agent of RevTrax or one of its Clients, use a login account on the Company Site to access the customer dashboard for the RevTrax Technology.

We may combine Personal Information that you submit on or through the Company Site with information that we collect from or about you from other sources, offline and online.

c. How We May Use Personal Information Collected on the Company Site. We use the Personal Information that you provide on the Company Site for the following activities:

  • Provide the services or messages that you request.
  • Send you administrative information, including information regarding changes to the Company Site’s terms, conditions and policies.
  • Personalize your experience on the Company Site.
  • Send you ads and other marketing messages about the RevTrax Services.
  • For our business purposes, such as data analysis, audits, developing new products, enhancing the Company Site, improving our services, and identifying usage trends and determining the effectiveness of our marketing.
  • As we believe appropriate for Compliance Purposes.

Note to visitors to the Company Site from the EU, EEA, Switzerland, or the UK: RevTrax processes, as the data controller, the Personal Information we receive on the Company Site from visitors from the European Economic Area, Switzerland, or the UK on one or more of the following legal grounds:

  • You provided your consent;
  • It is necessary for our contractual relationship;
  • The processing is necessary for us to comply with our legal or regulatory obligations; and/or
  • The processing is in our or a relevant data controllers’ legitimate interest, for instance, to market our services, or where we use data to protect the security and integrity of our systems and to provide services or other benefits.

d. When We May Disclose Personal Information Collected on the Company Site. The Personal Information that you provide to the Company Site may be disclosed:

  • To Our Service Providers. RevTrax uses third-party service providers for a variety of services, including web hosting, customer relationship management, data analysis, IT infrastructure, IT services, customer service, email delivery, auditing, security, fraud, marketing the RevTrax Services, and other services. These third parties may have access to your Personal Information to perform these tasks on our behalf.
  • In a Transfer of Business. To a third party to which we have transferred our business, assets or stock if RevTrax is involved in a reorganization, merger, sale, joint venture, assignment, transfer or other disposition of some or all of our business, assets or stock (including in connection with any bankruptcy or similar proceeding).
  • As we believe appropriate for Compliance Purposes.

e. How Long We Retain Personal Information Collected on the Company Site. We retain the Personal Information collected on the Company Site for the period necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required for the security or integrity of the Company Site, or to comply with our legal obligations, resolve disputes, or enforce our legal agreements or policies.

f. No Sensitive Information. You are prohibited from disclosing to the Company Site any sensitive Personal Information. Examples of sensitive Personal Information include social security numbers, detailed financial information, health information, information related to racial or ethnic origin, political opinions, religion or other beliefs, criminal background, and trade union membership.

3. Usage Data and Tracking Data collected on the Company Site

a. Definitions

“Usage Data” are the information that your browser sends to RevTrax’s servers when you visit the Company Site. “Tracking Data” are the information collected by the cookies, pixel tags, scripts, and other tracking technologies that we use to keep track of visitor activity on the Company Site. (Note that the Tracking Data collected by the Company Site is different from the Tracking Data collected by the RevTrax Technology, as previously described in Section A.2.)

  • Cookies are small files that contain a small amount of data, typically a unique identifier. They are sent to your browser by a web server, and are stored on your device. Our Company Site uses cookies.
  • Other tracking technologies, in the context of the Company Site, include pixel tags and scripts, and are used to track usage and performance. (See Section A.2. for the tracking technologies used by the RevTrax Technology.)

As with other Internet services, our web servers gather information automatically each time your browser or device interacts with the Company Site, and store that information in “log files.” The information stored in the log files of our Company Site includes Personal Information, Usage Data and Tracking Data.

b. Usage Data and Tracking Data Collected by the Company Site.

Usage Data. In the table below, RevTrax summarizes the information collected automatically by the Company Site. Some of this information is considered personal information under applicable law (in other words, information that itself may identify a unique individual or can be linked back to an individual).

Type of Information Collected Purpose
IP address Standard web HTTP request; used for matching and to understand general location
Cookie Standard web cookies
Referrer Standard web browser HTTP referrer; may be used for reporting and analytics
Request Standard web HTTP request
Browser Type and Version Standard web HTTP request
Application version Metadata feature used for identification
Device model Metadata feature used for identification
Manufacturer Metadata feature used for identification
Operating system Metadata feature used for identification
Operating system version Metadata feature used for identification
Screen size Metadata feature used for identification
Screen resolution Metadata feature used for identification
Mobile network status (WiFi, etc.) Metadata feature used for identification
Device locale (country and language) Metadata feature used for identification
Mobile platform Metadata feature used for identification

Tracking Data. In the table below, RevTrax summarizes the information collected by the Company Site. Some of this information is considered personal information under applicable law (in other words, information that itself may identify a unique individual or can be linked back to an individual).

Type of Data Collected Purpose
Cookie ID A cookie that is set by the Company Site that is unique to the User’s browser, operating system and device; used for offer authentication, fraud detection, and reporting. (This Cookie ID is different from the RevTrax ID.)
Time, date, and pages visited Respond to visitor requests; used for reporting and analytics.

As with other Internet services, our web servers gather information automatically each time a visitor visits and interacts with the Company Site, and store that information in “log files.” The information stored in our web servers’ log files includes Usage Data and Tracking Data.

For Company Site visitors resident in the European Economic Area, Switzerland, or the UK, note that RevTrax cookies, IP addresses, unique device IDs, and other elements of Usage Data and Tracking Data are defined as Personal Information under the GDPR, and will be handled by RevTrax as Personal Information. See Section D of this Privacy Policy for more information.

Usage Data and Tracking Data are collected from the Company Site by RevTrax, and by our service providers on our behalf, in the following situations:

  • When your browser or device sends it. Standard information is sent by most browsers. This information includes your IP address, device type, screen resolution, operating system version, Internet browser type and version.
  • Through web technologies. We and our service providers may use cookies, pixel tags, and other similar technologies to, among other things, facilitate your access to the Company Site, present you with more tailored information about our products and services, and collect and store information about your use of the Company Site.
  • When you volunteer it. You may volunteer information, such as your preferred means of communication. Unless combined with Personal Information, this information does not personally identify you or any other visitor of the Company Site.
  • Through activity reports. Information about how you interact with the Company Site is collected with every visit, and is used to determine usage levels, diagnose server problems, and operate and maintain the Company Site.
  • By aggregating information. We may aggregate information collected by the Company Site. Aggregated information will not include information that personally identifies you or any other visitor of the Company Site.

c. How We May Use and Disclose Usage Data and Tracking Data. We use and disclose Usage Data and Tracking Data collected on the Company Site in order to operate the Company Site, host the Client portal to access the RevTrax Services, market the RevTrax Services, and any other purpose permitted by applicable law.

Note: If we are required by applicable law to treat any element of Usage Data or Tracking Data as Personal Information, then we will handle those elements as Personal Information. If we combine any Usage Data or Tracking Data with Personal Information, we will treat the combined information as Personal Information as long as it is combined.

4. YOUR CHOICES ON THE COMPANY SITE

a. Opt-Out and “Do Not Track.” You can choose to decline cookies when presented with the “cookie consent” popup when you first visit the Company Site. You can also choose to set your browser to remove cookies and to reject cookies. Where RevTrax is able to see that a selection has been made, we will not use information collected from that device to target advertising to that browser. Note that if you choose to set your browser to decline cookies, then some or all of the features, functionality and offers available through the Company Site may not be available to you. Please note that the Company Site does not support the Do Not Track browser setting.

b. Opt Out from Receiving Promotional Emails. You can opt out from receiving promotional emails from RevTrax about the company and its services either by using the unsubscribe mechanism provided in the message or by emailing us at Privacy@RevTrax.com. If you opt out from receiving promotional emails from us, we may still send administrative emails to you. You cannot opt out from receiving administrative emails.

c. Privacy Rights of California, Colorado, Connecticut, Virginia and Utah Residents.

Access to Certain Personal Information and Data Portability Rights. Residents of California, Colorado, Connecticut, Virginia and Utah have rights under applicable state statutes to request access to Compliance Information (defined in Section A.5.a) collected about them on the Company Site. To access such information,

  • Email Privacy@RevTrax.com from the email address that you have previously provided to the Company Site. Include the additional information required by the applicable state statute. We reserve the right to ask for additional information in order to verify your request.
  • Within ten (10) business days following your verified request, RevTrax will send to you via the email address you provided the Compliance Information collected about you by the Company Site.

Right to Request Deletion

Residents of California, Colorado, Connecticut, Utah and Virginia have rights under applicable state statutes to request the deletion of the Personal Information collected by the Company Site. To exercise your deletion right,

  • Email Privacy@RevTrax.com if you want to request that RevTrax delete the Personal Information collected by the Company Site prior to your request. We reserve the right to ask for additional information in order to verify your request.
  • Note that if you submit your Personal Information to the Company Site in the future, the Company Site will have again collected your Personal Information.

Non-Discrimination. RevTrax will not discriminate against an individual for exercising any of his, her or their privacy rights under the state statutes described in this Privacy Policy.

C. Third-Party Service Providers

RevTrax uses third-party tools and services on the Company Site to measure how the Company Site is used, and to help RevTrax to market the RevTrax Services using interest-based advertising. RevTrax allows these service providers to use their tracking technologies to collect information on the Company Site. For more information about interest-based advertising and to understand your right to opt-out from these practices, please visit http://www.aboutads.info/choices/ These services are hosted by the third parties who provide them, and your interactions with these features are governed by the privacy policies of the third parties providing them. These services include, but are not limited to, those below.

Pardot. Pardot helps RevTrax to communicate with visitors to the Company Site. For more information about the marketing services provided by Pardot to the Company Site, please visit https://www.salesforce.com/company/privacy/

Google. RevTrax may integrate the features of the Company Site with Gmail and other G Suite applications offered by Google. For more information about Google’s information practices from the Company Site, please visit https://policies.googIe.com/technologies/partner-sites

Note that sharing of information with our third-party analytics and digital advertising vendors may qualify as a “sale” and is considered “sharing” under certain state privacy laws, such as the CPRA. To opt-out of certain sharing of information with our third-party analytics and digital advertising service providers, you can set your preferences to reject cookies when presented with the “cookie consent” popup notice on the Company Site. By following the steps in Section A.5.a., you can also request the deletion of the information associated by the RevTrax Technology with your devices. Additional information about how to control cookies through your browser functionality is provided earlier in this section.

D. Data Subject Rights in the EU, EEA, Switzerland and UK

1. About GDPR and Applicable EU, EEA, Swiss and UK Laws

This Section D presents information for Data Subjects in the European Economic Area and European Union, Switzerland and the United Kingdom. As used in this Section D, “Applicable European Data Protection Law” means the law that applies to a specific Data Subject in the EU, EEA, Switzerland or the United Kingdom, which laws include the EU General Data Protection Regulation (the “GDPR“), a member state’s legislation implementing the GDPR, Switzerland’s Federal Act on Data Protection and the UK’s Data Protection Act 2018. Capitalized terms that are used in this Section D but not defined will have the meaning in the Applicable European Data Protection Law.

2. The Legal Basis and Purposes of Processing

For the purposes of the GDPR and other Applicable European Data Protection Law, User Personal Information is generally processed on the legal basis established by the Controller (our Client), and we are a Processor of such Personal Information.

To the extent that we process any Personal Information as a Controller, we do so on the basis of our legitimate interest in marketing, maintaining, optimizing, researching and improving the RevTrax Services. Where our EU, EEA, Swiss and UK Clients provide any Personal Information of the Client’s personnel with a view to concluding a contract between Client and us, we process such data based on contractual necessity.

We will also process Personal Information, as required, based on the legitimate interest in asserting our legal rights and obligations, and based on any legal obligations to which we are subject.

We may also process Personal Information based on consent.

3. Categories of Personal Information Processed, Purposes of Processing, and Retention

We process Personal Information as a Controller as follows:

  • For Client relationship management; this includes name, contact details, role at customer and related data of our business contacts, including customers and potential customers.
  • For marketing purposes, including managing our corporate website, and related analytics; this includes name, contact details, IP address, cookie and related online identifiers.
  • To comply with the law, regulatory requests, court orders, subpoena, or legal processes; to verify or enforce compliance with our policies and agreements; and to protect the rights, property or safety of RevTrax and/or its Clients or others.

Client relationship data will be retained for the duration of the period of the relationship, or potential relationship, with the customer and will be deleted on the request of the data subject. Marketing and website data will be retained for a period of up to seven years.

4. Recipients of Personal Information

For information about when and to whom RevTrax may disclose Personal Information, see Section A.4 (When We May Disclose Data Collected by the RevTrax Technology), Section B.2.d (When We May Disclose Personal Information Collected on the Company Site), and Section C (Third Party Service Providers).

5. Data Subject Rights

Applicable European Data Protection Law provides Users whose data it governs with rights regarding their Personal Information (“Applicable Data Subject Rights“). If your Personal Information is processed on behalf of a Client, you will need to ask that Client to give effect to your Applicable Data Subject Rights. Data Subjects can also use the  State Privacy Compliance Tool to exercise their rights pursuant to Applicable European Data Protection Law.

If RevTrax is a Controller of your Personal Information and your Personal Information is governed by Applicable European Data Protection Law, you may exercise your GDPR rights by writing to our data protection officer and team at: Privacy@RevTrax.com. Your rights under Applicable European Data Protection Law may include, in different circumstances, rights to: data portability, data access, data rectification, objection to processing, and request data erasure. In addition, Data Subject rights cannot be exercised in a manner inconsistent with the rights of RevTrax employees and staff, our proprietary rights, and third-party rights. In addition, these rights may not be exercisable where they relate to data that is not in a structured form, for example emails, or where other exemptions apply. If processing occurs based on consent, Data Subjects have a right to withdraw their consent. Note that we will undertake a process to verify the identity of a Data Subject exercising his or her rights, and may retain details of such rights exercised for our compliance and audit requirements. Data Subjects in the EU, EEA, Switzerland or the UK may have the right to lodge a complaint with a data protection supervisory authority in the place of their residence. A list of Supervisory Authorities is available here: https://edpb.europa.eu/about-edpb/board/members_en.

6. International Transfers

For Clients and website visitors from the EU, EEA, UK and Switzerland, note that Personal Information is transferred to the United States. We will take all reasonable steps to ensure that your Personal Information is subject to appropriate safeguards, and that it is treated securely and in accordance with this privacy policy and applicable law. To the extent that Clients transfer Personal Information to RevTrax in the United States, and RevTrax undertakes any onwards transfers in the United States, they generally do so subject to GDPR’s Standard Contractual Clauses or another mechanism valid under Applicable European Data Protection Law.

To the extent that under Applicable Law EU, UK, and Swiss individuals have the right to obtain our confirmation of whether we maintain personal information relating to you in the United States, upon request, we will provide you with access to the personal information that we hold about you, and similarly respect any applicable right to correct, amend, or delete the personal information we hold about you. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data transferred to the United States, should direct their query to Privacy@RevTrax.com.

In situations where RevTrax is the data controller, we will provide an individual opt out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents, or before we use it for a purpose other than which it was originally collected or subsequently authorized. To request to limit the use and disclosure of your personal information, please submit a written request to Privacy@RevTrax.com. Where RevTrax is the data processor, however, it would be up to the data controller (normally our client) to offer the opt-out choice or opt-in for sensitive data.

In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

E. Transfer of Information

RevTrax works with global companies and technologies, and we may need to transfer your Personal Information outside of the country from which it was originally provided. This transfer may be between RevTrax-affiliated companies or to third parties that we work with who are likely located outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction. If you are located outside the United States and choose to provide information to us, please note that we process that data, including Personal Information, in the United States.

F. Other Information

1. About Data Security

RevTrax employs commercially reasonable security measures to prevent the loss, misuse or alteration of information collected by the Company Site, and RevTrax Technology. However, no data transmission over the Internet or data security system can be guaranteed to be 100% secure.

2. Links to Other Sites

Our Company Site and RevTrax Technology contain links to other sites that are not operated by us. If you click on a third-party link, you will be directed to that third party’s site. We strongly advise you to review the Privacy Policy of every site you visit. We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

3. Children’s Privacy

The Company Site and RevTrax Technology are not targeted to anyone under the age of 13 (“Child“). We do not knowingly collect Personal Information from Children, unless agreed in writing with a particular Customer and in compliance with applicable law.

4. User Access to Personal Information collected by the Company Site and RevTrax Technology

If you have a login to the Company Site (i.e., you are a RevTrax client), log into your account to make changes to the Personal Information we have on file for your account.

If you do not have a login to the Company Site (for example, a prospective customer or a website visitor) and would like to access, change, or delete the Personal Information that you have previously provided to the Company Site, contact us by emailing us at Privacy@RevTrax.com to make the requested changes. You may be asked to verify your identity for anti-fraud purposes. Once verified, we will comply with your request as soon as reasonably practicable. If you have requested that some Personal Information be deleted, note that we may need to retain some of the information for backup or Compliance Purposes. In addition, there could remain residual traces of the deleted Personal Information in our databases and other records. We are not responsible for changing or deleting information from the databases of third parties that have previously accessed your information.

If you have provided Personal Information to a Client offer that was powered by the RevTrax Technology, please check the Client Site, including its privacy policy, for information about the user choices available to be you. RevTrax is a service provider and data processor for our Clients.

G. How to Contact RevTrax

If you have any questions about this Privacy Policy, please contact us at:

OnCard Marketing, Inc. d/b/a RevTrax
Attention: Privacy
545 Washington Blvd. 8th Floor
Jersey City, NJ 07310
Privacy@RevTrax.com