Colorado Privacy Act

The Colorado Privacy Act (the “CPA“) confers privacy rights on Colorado consumers and imposes corresponding obligations on businesses subject to the Colorado. The following intends to explain a consumer’s rights and LiftEngine’s obligations under the CPA.

Types of Personal Information LiftEngine Collects

LiftEngine collects personal information for business purposes, including internal operations, auditing, detecting security incidents, improving our services, quality control, and legal compliance.

LiftEngine licenses the categories of personal information (described below) from third-party sources (categorized below) in developing LiftEngine’s marketing and advertising products as previously described. LiftEngine licenses such data products to third-party categories as described below.

Categories of Personal Information Collected

• Personal identifiers (e.g., name, alias, postal address, email address, phone number, or similar identifiers)
• Personal Characteristics (e.g., characteristics of protected classifications under Colorado and federal law like race, religion, language spoken, and gender)
• Personal Property or Buying Activity/Interest (e.g., commercial or transaction information)
• Employment Information (e.g., title or level)
• Education Information (e.g., highest education level completed)
• Inferences (e.g., inferences drawn to create a profile about a consumer reflecting the consumer’s preferences)

Categories of Sources from Which Personal Information Was Collected

• Public Record and Publicly Available Information
• Real Property Recorder Information
• Assessor Information
• Professional License Information
• Voter Records (where allowed by law)
• Demographic Marketing Information
• Surveys and Questionnaires
• Summarized or Aggregated Purchase Information
• Telephone Companies
• Consumer-Provided Contact Information

Categories of Third Parties with Which Personal Information is Sold or Shared

• Automotive (e.g., car manufacturers and dealerships)
• Business Services/Agency (e.g., data brokers)
• Communications (e.g., wireless carriers)
• Construction (e.g., real estate development companies)
• Consumer Packaged Goods (e.g., companies that sell personal and household products)
• Education (e.g., colleges and universities)
• Energy and Utilities (e.g., electric and gas companies)
• Entertainment (e.g., movie and television studios and streaming services)
• Financial Services (e.g., banks and investment companies)
• Government (e.g., state and federal agencies and political parties and candidates)
• Healthcare (e.g., hospitals)
• Insurance (e.g., insurance carriers)
• Manufacturing (e.g., consumer product manufacturers)
• Media and Publishing (e.g., magazines, retail catalogs)
• Non-Profit (e.g., charitable organizations)
• Real Estate (e.g., real estate brokerage companies)
• Retail (e.g., department stores, hardware stores)
• Services-Non Professional (e.g., consulting firms)
• Services-Professional (e.g., advertising agencies and financial planners)
• Sports (e.g., professional sports teams)
• Technology (e.g., software and hardware providers, social media platforms)
• Transportation (e.g., railway companies, airlines, rental car companies)
• Travel and Tourism (e.g., cruise lines, hotels, online travel services)

Categories of Service Providers and Contractors with Whom Personal Information is Disclosed for a Business Purpose

• Cloud computing and storage vendors
• Security contractors
• Consultants
• Analysis providers
• Marketing analytics platforms
• Programmatic advertising marketplaces/platforms
• Onboarding partners

LiftEngine does not collect data directly from consumers for use in our data products. Please also note that LiftEngine does not collect biometric information from consumers. Lastly, LiftEngine does not collect sensory information such as voice, visual, thermal, olfactory, or similar sensory information.

Disclosure and Sale of Personal Information

During the last year, LiftEngine has sold personal information it has collected to our clients (i.e., “third parties” under Colorado) for their business and commercial purposes. More specifically, LiftEngine licenses personal information to our clients for the purpose of enabling and improving their marketing and advertising campaigns, from identifying potentially interested consumers to measuring the effectiveness of the marketing and advertising campaigns. We also license personal information for identity recognition and resolution services (i.e., recognizing different records relating to the same person) and marketing analytics. LiftEngine does not sell personal information to individual consumers.

During the last year, LiftEngine has disclosed personal information to service providers and contractors (e.g., cloud computing and storage vendors, security contractors, and consultants) for LiftEngine’s operational business purposes.

LiftEngine does not sell personal information about consumers younger than 18 for marketing or advertising directly to minors. LiftEngine does use personal information from minors younger than 18 to suppress matching records from marketing lists and to facilitate identity recognition and resolution.

LiftEngine does not engage in profiling in furtherance of “decisions that produce legal or similarly significant effects.”

Request to Access, Correct, and Delete Personal Information

As a consumer under the Colorado, you have the right to request LiftEngine to:

• Disclose what personal information we collect, use, sell, or share about you
• Correct personal information on file
• Delete personal information
• Opt-Out from marketing communications

To take advantage of any option, visit this page for more information and to get started.

You can also submit your request by mail. Print and complete this form and mail it to the following address:

LiftEngine
1 Blue Hill Plaza
Box 1509, Lobby Level
Pearl River, NY 10965
Attention: Consumer Rights Requests

To respond to your request, the Colorado permits LiftEngine to verify your identity, requiring you to provide certain personal information for validation. Information required includes:

• List Name
• Full Name
• Mailing Address
• Date of Birth
• Marital Status

If no list is provided, the default will be “LiftBase.” Email addresses will also be required for the sole purpose of communications regarding a specific request.

LiftEngine utilizes Google’s reCAPTCHA v3 product to filter spam entries. Any entry that scores less than 0.7, indicating a likelihood of spam, will not be processed. In addition, any entry from an unauthorized agency will not be processed. Please see the “Right to use Authorized Agents” section below.

When a user successfully executes either the digital form or mail-in option, they will receive an email confirming their request at the email address provided. Within the specified timeline set forth in Colorado, LiftEngine will attempt to match the user-provided information to a record.

If LiftEngine cannot match an individual’s name and mailing address, the individual will receive an email stating such. If a reasonable match can be made, the individual will receive up to two follow-up emails, depending on their request:

• An email detailing the information requested.
• An email verifying that their data has been deleted.

LiftEngine cannot recall projects in which an individual’s data has already been shared, so it may take six (6) to eight (8) months for a user to stop receiving offers from LiftBase-sourced data.

Even assuming a verifiable request, LiftEngine will retain certain personal information in our data products as necessary to comply with a legal obligation (including ensuring the deletion request is honored and record-keeping obligations), detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for the activity. In such cases, LiftEngine will retain only the minimum amount of information that does not qualify for a statutory or regulatory exception and only use the remaining data for the purposes provided by the statutory or regulatory exception.

Accordingly, LiftEngine will treat opt-out and correction requests in the same manner as deletion requests.

Right to use Authorized Agents

Authorized agents can submit requests to LiftEngine on behalf of a consumer. Before LiftEngine accepts requests from an agency acting on behalf of a consumer, a representative of the agent must complete this form to become authorized.

Once authorized, agents can submit requests on behalf of consumers using the same methods detailed in the section above. After the agent submits a request, LiftEngine will correspond directly with the consumer to minimize the risk of unauthorized access to personal information and potential resulting harm.

Right to Non-discrimination

LiftEngine will not discriminate against consumers who request access to personal information about them, request deletion, or request that Acxiom opt them out of future sales.

How to Contact Us for More Information

If you have questions regarding your rights or LiftEngine’s data collection, use, and disclosure practices, you may contact us by mail or email.

Our email address is dataprivacy@liftbasedata.com. Our mailing address is:

LiftEngine
1 Blue Hill Plaza
Box 1509, Lobby Level
Pearl River, NY 10965
Attention: Consumer Rights Requests

Information for Colorado Consumers

For more information, contact the Colorado Attorney General. Please visit https://coag.gov/resources/colorado-privacy-act/

Privacy Request Record-Keeping Obligations

To comply with privacy regulations, LiftEngine tracks incoming requests and deletions on an annual basis. Results can be found here.