PRIVACY POLICY

2. OVERVIEW

Your privacy is important to us. This Privacy Policy explains what information we collect from you and how we use that information. It covers the following:

Sensitive Information

With your consent, and subject to the security measures listed in Section 9, we may process the following categories of sensitive personal Information when you use our Website[s]:

• Geolocation data. We may detect the geolocation data by your IP address when you open a web browser or connect to the Internet, or through the networks service set identifiers;
• Payment Information. Debit or credit card information in combination with any required security or access code collected for purpose of processing payment for our products or services;
• Account login and credentials. This includes account information such as name, email and login credentials such as passwords.

Geolocation data

When you access our Website[s], we may detect the geolocation data by your IP address or through the networks service set identifiers. We use this information to customize your experience on the Website[s] by hiding/showing certain information and contacts based on your geolocation, as well as to analyze traffic and provide you with better customer experience. If you choose not to provide your Information at the point of collection, you may not be able to access certain customized location-based features.

Payment Information

When you purchase products through our Website, we require that you provide us with your payment information (debit or credit card number, expiration, security code). This Information is collected and used to process your order and payment. If you choose not to provide your Information at the point of collection, you will not be able to purchase products through our Website.

Account login and credentials

When you purchase products through certain Website[s], you have the option to create an account with us. The account will enable you to find and track the orders placed through our Website[s], to view order history and manage your orders and/or billing and shipping information. If you chose not to provide your Information required for account creation you may not be able to access certain features offered through the account option.

4. HOW WE USE THE INFORMATION WE COLLECT

We use the Information we collect for purposes associated with the growth, maintenance, and management of our business. Depending on how you interact with us, we use your personal Information and other information for the following purposes:

• Communication with You. This includes using personal Information to send you messages, ship products, provide customer care, and respond to your requests.
• Business Operations. This includes providing you with the services, facilitating product purchases, accounting, auditing, billing, and collection activities as well as security, crime or fraud monitoring and prevention, protecting legal rights, and performing contractual obligations.
• Managing and Developing Products and Services. This includes using Information to offer product testing experience and to carry out internal research to develop and improve existing products and services, as well as using Information about your interactions with our Website[s] or advertisements to improve user experience.
• Advertising and Marketing. This includes providing you with communications, conducting contests and promotional events, and providing you with personalized content, where you have consented, as applicable.
• For any other purposes disclosed to you at the time we collect your Information and/or pursuant to your consent.

5. HOW DO WE SHARE OR DISCLOSE THE INFORMATION THAT WE COLLECT?

We do not share or disclose your personal Information to third parties, except as set forth in this Privacy Policy. We may share and/or disclose certain personal Information and other information about you to the following:

• Affiliates. These are entities that are directly or indirectly controlled by us or who share common control with us.
• Third-Party Service Providers. These are entities that provide services for or on behalf of us, such as providing marketing assistance, fulfilling orders, and providing fraud prevention services, as well as partners who we work with to provide you services.
• Other Parties When Required or Permitted by Law. These entities include government authorities, law enforcement agencies, or other third parties, including where necessary to exercise or defend legal claims on Kingston’s behalf.

• Other Parties in Connection with a Change of Ownership. These entities might include a third party as part of a merger or transfer, acquisition or sale, or bankruptcy.
• Aggregated or Deidentified Information. We may share your Information on an aggregated basis for any purpose in which your specific personal Information is blinded, masked, or otherwise not identifiable.
• Other Parties with Your Consent or at Your Direction. These third parties include those for which you separately consent to and/or request such sharing.

6. HOW LONG DO WE KEEP YOUR INFORMATION?

We will retain your personal Information for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Retention periods can vary based on the type of Information, how it is used, and relevant legal requirements. In accordance with our routine record keeping, we may delete certain records that contain Information you have submitted to us. We are under no obligation to store such Information indefinitely and disclaim any liability arising out of, or related to, the destruction of such Information.

We consider the following factors when determining how long we keep your Information: (1) the amount, nature, and sensitivity of the Information; (2) the potential risk of harm from its unauthorized use or disclosure; (3) the purposes for which we process your Information; and (4) whether we can achieve those purposes through other means, and the applicable legal requirements.

7. CHILDREN’S PRIVACY & INFORMATION FOR PARENTS/GUARDIANS

Our services are intended only for users over the age of eighteen (18). We do not knowingly solicit, collect, maintain, or disclose any Information from children under the age of 18. If you are under the age of 18, please do not:

• create or attempt to create an account on our Website[s];
• sign up for any subscription service via our Website[s];
• buy anything through our Website[s]; or
• otherwise interact with our Website[s].

If we become aware that a user is under eighteen (18) and has provided us with Information, we will take steps to comply with any applicable legal requirement to remove such Information. Contact us if you believe that we have mistakenly or unintentionally collected Information from a child under the age eighteen (18).

10. YOUR CHOICES

If you elect or consent to receive certain communications from us, such as promotional emails, marketing communications, and surveys, you can withdraw your consent or change your preferences by following the opt-out instructions in those communications or by logging into your account.

You can review, update, modify or remove any Information you have submitted through our Website[s], either during your online account registration with Kingston, when you log-in to your Kingston account or by contacting us through any of the methods below. However, if you request a change or removal of your Information, please keep in mind that we may still need to retain some Information for recordkeeping purposes, to comply with applicable laws, and to complete transactions with you.

To exercise choices regarding the marketing information you receive, you may also review the following links:

• You may opt out of tracking and receiving tailored advertisements on your mobile device by some mobile advertising companies and other similar entities by downloading the App Choices app at www.aboutads.info/appchoices.
• You may opt out of receiving permissible targeted advertisements by using the NAI Opt-out tool available at https://optout.networkadvertising.org/?c=1 or visiting About Ads at https://optout.aboutads.info.
• You can opt out of having your activity on our Website[s] made available to Google Analytics by installing the Google Analytics opt-out add-on for your web browser by visiting: https://tools.google.com/dlpage/gaoptout for your web browser.

11. LINKS TO OTHER SITES

Our Website[s] may contain links to other websites or services that are not owned or controlled by us, including links to Social Media Platforms such as Facebook, Twitter, LinkedIn, YouTube, or Instagram, or may redirect you off our website away from our Website[s].

This Privacy Policy only applies to Information collected by our Website[s]. We are not responsible for the privacy and security practices of those other websites or Social Media Platforms or the Information they may collect (which may include IP address). Please check these policies before you provide any Information to these websites. Links to any other websites or content do not constitute or imply an endorsement or recommendation by us of the linked website, Social Media Platform, and/or content.

12. DIFFICULTY ACCESSING OUR PRIVACY POLICY

Individuals with disabilities who are unable to usefully access our Privacy Policy online may contact us to inquire how they can obtain a copy of our policy in another, more easily readable format.

13. “DO NOT TRACK” SIGNALS

We do not support “Do Not Track.” Do Not Track is a preference you can set in your web browser to inform websites that you do not want to be tracked. You can enable or disable “Do Not Track” by visiting the “Preferences” or “Settings” page of your web browser. Do Not Track is different from Global Privacy Controls (“GPC”), which may notify websites of consumers’ privacy preferences regarding the sale or sharing of personal Information, or the use of sensitive personal Information.

14. CHANGES TO PRIVACY POLICY

We may update our Privacy Policy from time to time by posting a new version of it on our website. We encourage you to check our website regularly for information about revisions to this Privacy Policy. Such changes will be effective upon posting.

15. CONTACT INFORMATION

If you wish to request any information or have any questions regarding this Privacy Policy or its implementation, you may email us at [email protected] or call us at 1-800-835-6575. You may also write to us at:

Kingston Technology Company, Inc.
Attention: Privacy Compliance
17600 Newhope Street
Fountain Valley, CA. 92708 USA

If you wish to request any EU specific information, please see the EU, EEA, Swiss, and UK Based Users and the GDPR section below.

International Transfers of Your Personal Information

The Information that we collect from you may be transferred to, stored in, processed in, or accessed from countries outside of the European Economic Area (“EEA”). If we possess your personal Information in the EEA, and we subsequently transfer that Information out of the EEA, we will provide a similar degree of protection it by confirming at least one of the following safeguards is implemented:

• We will only transfer your personal Information from the EEA to countries that have been deemed to provide an adequate level of protection for personal Information by the European Commission; or
• Where we use certain service providers, we may use specific contracts approved by the European Commission which give your personal Information the same protection it has in Europe.

We are operated in the United States, and we may use service providers based in the United States to operate our business and our relationship with you. Please be aware that personal Information that we collect will be transferred to, stored, and processed in the United States or another country outside your country of origin, a jurisdiction in which the privacy laws may not be as comprehensive as those in the country where you reside and/or are a citizen. We maintain measures to address the transfer of your personal Information between us and our third-party providers in accordance with applicable data protection laws and regulations.

B. EU-US and Swiss-U.S. Data Privacy Framework and UK Extension to the EU-U.S. Data Privacy Framework

Kingston and certain of its subsidiaries and affiliated entities listed here comply with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Kingston has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. DPF Principles with regard to the processing of personal data received from the European Economic Areain reliance on the EU-U.S. DPF and from the United Kingdom in reliance on the UK Extension to the EU-U.S. DPF. Kingston has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. DPF Principles with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the DPF program, and to view our certification, please visit https://www.dataprivacyframework.gov/

In cases of onward transfer to third parties, Kingston will only transfer personal data for limited and specified purposes. Kingston complies with the EU-U.S. DPF Principles, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF for all onward transfers of personal data from the EEA, the United Kingdom, and Switzerland, including the onward transfer liability provisions. If Kingston transfers personal data to a third party acting as an agent on its behalf, Kingston will remain liable under the DPF Principles if the agent processes such personal data in a manner inconsistent with the DPF Principles, unless Kingston proves that it is not responsible for the event giving rise to the damage.

Kingston, subject to the EU-U.S. DPF Principles, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF Principles, holds and processes all Personal Data previously received from the EEA, UK, and Switzerland in reliance on our EU-U.S. DPF, UK Extension to the EU-U.S. DPF, and Swiss-U.S. DPF certifications and on the DPF Principles. In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Kingston commits to resolve DPF Principles-related complaints about our collection and use of your personal Information. We respectfully request that any EEA, UK, or Swiss data subject that is located in the EEA, the UK, or Switzerland, respectively, and wishes to submit inquiries or file complaints first contact us by email at [email protected], or by postal mail at the following address:

Kingston Technology Europe Co LLP
Attention: Privacy Compliance
Kingston Court
Brooklands Close
Sunbury-on-Thames
Middlesex
TW16 7EP
UK

Any questions or concerns regarding the use or disclosure of personal Information should be directed to Kingston at the address given above. Kingston will investigate and respond or attempt to resolve complaints and disputes regarding the use and disclosure of personal Information in accordance with the principles contained in this Privacy Policy within a reasonable amount of time, not to exceed thirty (30) days following the receipt of your question or complaint. If you have an unresolved privacy compliant that we have not addressed satisfactorily, please contact the International Centre for Dispute Resolution of the American Arbitration Association (ICDR-AAA), our U.S.-based third-party dispute resolution provider (free of charge), at https://go.adr.org/rs/294-SFS-516/images/ICDR-AAA_DPF_IRM_Service_Notice_of_Arbitration_form.pdf. Further, in compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Kingston commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs), the UK’s Information Commissioner’s Office (“ICO”), and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.

Individuals covered by the DPF program may seek binding arbitration for limited types of claims. For additional information about the DPF arbitration process, please visit the DPF website. To learn more about how you may pursue binding arbitration through the DPF Arbitration Panel, please visit https://www.dataprivacyframework.gov/s/article/How-to-Submit-a-Complaint-Relating-to-a-Participating-Organization-s-Compliance-with-the-DPF-Principles-dpf.

Kingston is subject to the investigatory and enforcement powers of the Federal Trade Commission with regard to Kingston’s compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. In certain circumstances, Kingston may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

D. Virginia Residents and the VCDPA

To the extent any Virginia data privacy law applies to the collection of your Information, this supplemental section of our Privacy Policy outlines the individual rights guaranteed to Virginia residents and how to exercise those rights and applies solely to Virginia residents. We provide the supplemental section below to comply with the Virginia Consumer Data Protection Act (“VCDPA”) and any terms defined in the VCDPA have the same meaning when used below.

Your Rights under VCDPA

Subject to certain exceptions you may be entitled to the following rights:

Right to Access & Data Portability. You have the right to request that we disclose certain information to you about our collection and use of your personal Information at any time. Once we receive and confirm an authenticated consumer request from you, we will, subject to certain exceptions:

• Disclose whether we are processing your personal Information.
• Provide you with access to your personal Information.

Where the processing is carried out by automated means, and subject to certain exceptions, you have the right to request and obtain a copy of your personal Information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the personal Information to another data controller without hindrance.

Right to Correct Inaccurate Information. To the extent that we may maintain inaccurate personal Information, you have the right to request that we correct such inaccurate personal Information taking into account the nature of the personal Information and the purposes of the processing of the personal Information. Once we receive and verify your authenticated consumer request, we will use commercially reasonable efforts to correct your personal Information.

Right to Delete. You have the right to request that we delete certain of your personal Information provided by or obtained about you. To the extent that we can delete your personal Information, once we receive and confirm your authenticated consumer request, we will delete (and direct our service providers to delete) your personal Information, subject to certain exceptions.

Sale of Personal Information, Targeted Advertising, Profiling, and the Right to Opt Out. You have the right to opt out of the processing of your personal Information for the following purposes:

• Targeted advertising.
• Sale of your personal Information.
• Profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

Right to Appeal. You have the right to appeal our denial of any request you make under this section. To exercise your right to appeal, please submit an appeals request via the information in the How To Contact Us section below. Within sixty (60) days of receipt of your appeal, we will inform you in writing of any action taken or not taken in response to your appeal, including a written explanation of the reasons for the decisions. If we deny your appeal, you may contact the Virginia Office of the Attorney General by:

• Contacting Online: https://www.oag.state.va.us/consumer-protection/index.php/file-a-complaint.
• Calling:
  • If calling from Virginia, call the Consumer Protection Hotline at 1-800-552-9963.
  • If calling from the Richmond area or from outside Virginia, call the Consumer Protection Hotline at 1-804-786-2042.

Right to Non-Discrimination. You have a right to not be discriminated against in the services or quality of services you receive from us for exercising your rights. We will not discriminate against you for exercising any of your rights in this section including denying goods or services, charging different prices or rates for goods or services, or providing a different level of quality of goods and services. However, we may offer a different price, rate, level, quality, or selection of goods or services, including offering goods or services for no fee, if you have exercised your right to opt out or the offer is related to your voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program.

You may make an authenticated consumer request under the VCDPA twice within a twelve (12) month period. To exercise the rights described above, see the Exercising Your Rights section below.

Additional Information

To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.

F. Connecticut Residents and the CTDPA

To the extent any Connecticut data privacy law applies to the collection of your personal Information, this supplemental section of our Privacy Policy outlines the individual rights guaranteed to Connecticut residents and how to exercise those rights and applies solely to Connecticut residents. We provide the supplemental section below to comply with the Connecticut Act Concerning Personal Data Privacy and Online Monitoring (“CTDPA”) and any terms defined in the CTDPA have the same meaning when used below.

Your Rights under CTDPA

Subject to certain exceptions you may be entitled to the following rights:

Right to Access & Data Portability. You have the right to request that we disclose certain information to you about our collection and use of your personal Information at any time. Once we receive and confirm an authenticated consumer request from you, we will, subject to certain exceptions:

• Disclose whether we are processing your personal Information.
• Provide you with access to your personal Information where we process it.

Where the processing is carried out by automated means, and subject to certain exceptions, you have the right to request and obtain a copy of your personal Information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the personal Information to another data controller without hindrance.

Right to Correct Inaccurate Information. To the extent that we may maintain inaccurate personal Information, you have the right to request that we correct such inaccurate personal Information taking into account the nature of the personal Information and the purposes of the processing of the personal Information. Once we receive and verify your authenticated consumer request, we will use commercially reasonable efforts to correct your personal Information.

Right to Delete. You have the right to request that we delete certain of your personal Information provided by or obtained about you. To the extent that we can delete your personal Information, once we receive and confirm your authenticated consumer request, we will delete (and direct our service providers to delete) your personal Information, subject to certain exceptions.

Sale of Personal Information, Targeted Advertising, Profiling, and the Right to Opt Out. You have the right to opt out of the processing of your personal Information for the following purposes:

• Targeted advertising.
• Sale of your personal Information.
• Profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

Right to Non-Discrimination. You have a right to not be discriminated against in the services or quality of services you receive from us for exercising your rights. We will not discriminate against you for exercising any of your rights in this section including denying goods or services, charging different prices or rates for goods or services, or providing a different level of quality of goods and services. However, we may offer a different price, rate, level, quality, or selection of goods or services, including offering goods or services for no fee, if you have exercised your right to opt out or the offer is related to your voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program.

Right to Appeal. You have the right to appeal our denial of any request you make under this section. To exercise your right to appeal, please submit appeals request to us by either:

• Emailing us at [email protected]
• Calling us at 1-800-835-6575

Within sixty (60) days of receipt of your appeal, we will inform you in writing of any action taken or not taken in response to your appeal, including a written explanation of the reasons for the decisions. If we deny your appeal, you may contact the Connecticut Office of the Attorney General by:

• Contacting Online: https://www.dir.ct.gov/ag/complaint/e-complaint.aspx?CheckJavaScript=1
• Calling: The Consumer Assistance Unit at 860-808-5420.

You may make an authenticated consumer request under the CTDPA once within a twelve (12) month period. To exercise the rights described above, see the Exercising Your Rights section below.

Authorized Agent

You may use an authorized agent to submit verifiable consumer requests on your behalf. An authorized agent is a natural person or a business entity that you have authorized to act on your behalf. If you use an authorized agent, we will require: (1) proof of written permission for the authorized agent to make requests on your behalf, including through technology means, and identity verification from you; or (2) proof of power of attorney. We may deny a request from an authorized agent that does not submit proper verification proof.

Additional Information

To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.

17. EXERCISING YOUR DATA SUBJECT RIGHTS

To exercise any of the rights described above, please submit a verifiable consumer request to us via the methods described below. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal Information, or an authorized representative; and
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

To help protect your privacy and maintain security, if you request access to or deletion of your personal Information, we will take steps and may require you to provide certain information to verify your identity before granting you access to your personal Information or complying with your request. In addition, if you ask us to provide you with specific pieces of personal Information, we may require you to sign a declaration under penalty of perjury that you are the consumer whose personal Information is the subject of the request. Only you or your authorized agent may make a verifiable consumer request related to your personal Information. If you designate an authorized agent to make a request on your behalf, we may require you to provide the authorized agent written permission to do so and to verify your own identity directly with us (as described above). You may also make a verifiable consumer request on behalf of your minor child.

Do Not Sell My Personal Information

Deletion Request Rights