California Consumer Privacy Notice
Effective Date: January 1, 2020
This notice reflects our good faith understanding of the law and our data practices as of January 1, 2020, but the CCPA’s implementing regulations are not yet final and there remain differing interpretations of the law. Accordingly, we may update information in this and other notices regarding our data practices and your rights, modify our methods for responding to your requests, and/or supplement our response to your requests, as we continue to develop our compliance program to reflect the evolution of the law and our understanding of how it relates to our data practices.
This California Privacy Notice (“Notice”) applies to “Consumers” as defined by the California Consumer Privacy Act (“CCPA”) as a supplement to Spirit Halloween Superstores LLC (“Spirit” “us” “we” our”) other privacy policies or notices. In the event of a conflict between any other Spirit policy, statement, or notice and this Notice, this Notice will prevail as to California Consumers and their rights under the CCPA.
In accordance with the CCPA’s requirements, this Notice covers the calendar year 2019 and describes our collection, use, disclosure, and “Sale” of California Consumers’ “Personal Information” or “PI” as defined by the CCPA, as well as the rights California Consumers have under the CCPA. Terms defined in the CCPA that are used in this Notice have the same meanings as in the CCPA.
Consistent with the CCPA, job applicants, current and former employees and contractors, and subjects of certain business-to-business communications acting solely in their capacity as representatives of another business, are not considered Consumers for purposes of this Notice or the rights described herein.
We collect PI about California Consumers as described in the table below.
Examples of PI Collected
Sources of PI
Purposes for PI Collection
Categories of Recipients
Name, postal address, Internet Protocol address, email address
Directly from the Consumer, through our website, Store Payment Terminal
Managing interactions and transactions; detecting security incidents and protecting against fraud; processing and customizing concurrent Consumer interactions; performing services; and quality/ safety control
Analytics and other Service Providers
Customer / Individual Records
Name, address, telephone number, email address, payment card details
Website, Store Payment Terminals
Managing interactions and transactions; detecting security incidents and protecting against fraud; processing and customizing concurrent Consumer interactions; performing services
Commercial Information / Purchase Details
Account holder purchase history or tendencies
From the Consumer directly; through our website
Managing interactions and transactions; detecting security incidents and protecting against fraud; processing and customizing concurrent Consumer interactions; performing services; internal research and development; and quality/ safety control
Internet Usage Information
Browsing history, search history, information regarding interactions with our website or advertisements
From the Consumer through our website
Processing and customizing concurrent Consumer interactions and performing services
Analytics and other Service Providers
Audio recordings of customer service calls, CCTV footage
From the Consumer when making telephone calls to Guest Services, in-store CCTV cameras
Detecting security incidents and protecting against fraud; processing and customizing concurrent Consumer transactions; internal research and development; and quality control
In addition, we may collect, use, and disclose your PI as required or permitted by applicable law. We do not treat “Deidentified” data or “Aggregate Consumer Information” as PI, and we reserve the right to convert, or permit others to convert, your PI into Deidentified data or Aggregate Consumer Information.
We may share your PI with our service providers, vendors, and other parties as described in the table above.
Under the CCPA, California Consumers have certain rights which they may exercise independently or through an authorized agent. CCPA rights requests are subject to an identification and verification process. We will not fulfill a CCPA request unless we have been provided sufficient information for us to reasonably verify that the requestor is the Consumer about whom we collected PI.
Some PI we maintain about Consumers (e.g., clickstream data) is not sufficiently associated with enough PI about the Consumer for us to be able to verify that it is a particular Consumer’s PI. Accordingly, we will not include such information in response to Consumer requests. If we cannot comply with a request, we will explain the reasons in our response. You are not required to create an account with us to make a verifiable request, but you may use your account to do so. We will use PI provided in your request only to verify your identity or authority to make the request and to track and document request responses, unless you also provided the PI to us for another purpose.
Your California Consumer privacy rights are described below. To make a request, you may, complete the web form here, email Spirit at CCPArequests@spirithalloween.com or call us at 1-844-976-1706. In making a request, you will need to verify that you are the authorized user of the subject email address/account and that you are a current resident of the State of California. Please follow the instructions on our website and promptly respond to any follow-up inquires so that we may confirm your identity. If you request that we provide you with specific pieces of information about you, we will apply the heightened verification standards set forth in this Notice. An authorized agent may submit a request on behalf of a Consumer if the Consumer has provided the authorized agent with power of attorney in accordance with California law; alternatively, the agent must (1) present verifiable written authorization from the Consumer that the agent has the Consumer’s permission to submit the request; and (2) independently verify the agent’s own identity with Spirit.
We may collect, use, and disclose your PI as required or permitted by applicable law. Please note we are not obligated to comply with Consumer requests to the extent that doing so would infringe on our, or any other person’s or party’s rights or conflict with applicable law.
You have the right to request that we disclose your PI that we have collected and are maintaining for the 12-month period prior to your request date. Consumer requests of this nature may be made no more than two times in a 12-month period.
· The categories of sources from which we collected your PI.
· The business or commercial purposes for collecting or selling your PI.
· The categories of third parties to whom we have shared your PI.
· The specific pieces of PI we have collected about you.
· A list of the categories of PI disclosed for a business purpose in the prior 12 months, or that no disclosure occurred.
· A list of the categories of PI sold about you in the prior 12 months, or that no Sale occurred. If we sold your PI, we will explain:
o The categories of your PI we have sold.
o The categories of third parties to which we sold PI, by categories of PI sold for each third party.
You have the right to make or obtain a transportable copy, no more than twice in a twelve-month period, of your PI that we have collected in the period that is 12 months prior to the request date and are maintaining. Please note that PI is retained by us for various time periods, so we may not be able to fully respond to what might be relevant going back 12 months prior to the request.
“Do Not Sell” Rights
We do not knowingly “Sell” PI that we collect from you, in accordance with the definition of “Sell” in the CCPA. There is not yet a consensus as to whether third-party cookies and tracking technologies associated with websites and mobile apps may constitute a “Sale” of PI as defined by the CCPA. You may exercise control over browser-based cookies by adjusting the settings on your browser, and mobile devices may offer ad limitation choices. In addition, third-party tools may enable you to search for and opt out of some of these trackers (for example, the Ghostery browser plug-in available at https://www.ghostery.com/). Further, you can learn more about your choices regarding certain kinds of online interest-based advertising here. Some of these companies may also be members of the Network Advertising Initiative; to learn more about the NAI and your opt-out options for their members, click here. We do not represent that these third-party tools, programs or statements are complete or accurate, clearing cookies or changing settings may affect your choices and you may have to opt-out separately via each browser and other device you use.
Some browsers have signals that may be characterized as “do not track” signals, but we do not understand them to operate in that manner or to constitute a “do not Sell” request. Currently we do not recognize “do not track” signals, nor do we interpret them as a “do not Sell” request. We understand that various parties are developing “do not Sell” signals and we may recognize certain signals if we conclude such a program is appropriate.
Some browsers have signals that may be characterized as “do not track” signals, but we do not understand them to operate in that manner or to constitute a “do not sell” request. Currently we do not recognize “do not track” signals, nor do we interpret them as a “do not sell” request. We understand that various parties are developing “do not sell” signals and we may recognize certain such signals if we conclude such a program is appropriate.
Except to the extent we have a basis for retention under CCPA, you may request that we delete your PI that we have collected directly from you and are maintaining. Our retention rights include, without limitation, to complete transactions and service you have requested or that are reasonably anticipated, for security purposes, for legitimate internal business purposes, including maintaining business records, to comply with law, to exercise or defend legal claims, and to cooperate with law enforcement.
We will not discriminate against you in a manner prohibited by the CCPA because you exercise your CCPA rights.
California’s “Shine the Light” Law
California’s “Shine the Light” law permits California residents to request certain information regarding our disclosure of PI to third parties for their own direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes. If you are a California resident, you may request information about our compliance with the Shine the Light law by contacting us at CCPArequests@spirithalloween.com or by sending a letter to 6826 Black Horse Pike, Egg Harbor Township, NJ 08234 ATTN: Legal Department. Any such request must include “California Privacy Rights Request” in the first line of the description and include your name, street address, city, state, and ZIP code. Please note that we are only required to respond to one request per customer each year.
As these rights and your CCPA rights exist under different legal regimes, you must exercise your rights under each law separately.CCPARequests@spirithalloween.com. You may also write to us at:
Spirit Halloween Superstores LLC
Attention: Legal Department/California Privacy Inquiry
6826 Black Horse Pike
Egg Harbor Township, NJ 08234