1. Applicability of Privacy Policy
1.1. Field of Application
The CO2 Privacy Policy (the “Privacy Policy”) applies to CO2, LLC and its affiliates and subsidiaries (collectively referred to as “CO2”).
Except as otherwise noted below, this Privacy Policy applies to the personal information that CO2 collects and processes as a controller or business related to users of the CO2 website at https://www.co2.com (the “CO2 Website”) and the services CO2 provides through the CO2 Website (collectively, the “Services”).
This Privacy Policy is posted on the CO2 Website at the following link: https://www.co2.com/legal/privacy.
1.2. Purpose of the Privacy Policy
This Privacy Policy describes how CO2 collects, uses, discloses and otherwise processes personal information, as well as the rights and choices individuals have regarding such personal information.
1.2.1. Notice to Users of the Services
The use of CO2’s Services and any dispute arising out of this Privacy Policy and/or CO2’s use of personal information is subject to this Privacy Policy and the CO2 Terms of Service, available at https://www.co2.com/legal/terms, including their applicable limitations on damages and the resolution of disputes.
1.2.2. Additional Notices
In some cases, additional or supplemental privacy notices (each an “Additional Notice”) may be provided and will apply to certain personal information collected and processed by CO2. The Additional Notice will control to the extent there is a conflict with this Privacy Policy, with respect to any of your personal information that is subject to that Additional Notice.
Residents of certain states may have additional rights concerning their personal information under the laws of those states. Please refer to the “Additional Privacy Information for Certain Jurisdictions” section below.
2. Personal Information CO2 Collects
As further described below, CO2 collects personal information directly from individuals and businesses using the CO2 Website and Services as well as from third parties where related to the use of the Services or other interactions with CO2.
2.1. Personal Information CO2 Collects Directly
The personal information CO2 collects depends on how you use the Services but generally includes:
Registration information such as when you register for an account with us, CO2 collects certain personal information from you, such as your name and email address.
Government identifiers such as passport and driver’s license number.
Unique identifiers such as an account number, individual or member ID.
Employment and professional-related information such as company name, organization type, company address, and job title.
Payment or financial information such as credit or payment card information.
General location information such as region, sovereign, territory, province, state, and/or city when you provide such information.
Communications and interactions. When you email, call, or otherwise communicate with CO2 and with members of CO2, CO2 collects and maintains a record of your contact details, communications and CO2’s responses.
2.2. Personal Information CO2 Collects Automatically
When you interact with our Services, we (and our partners, advertisers, advertising networks and other third-party service providers) automatically collect certain information. For example, we collect information about the webpages you view and how you move through our Services, how you reached our Services, how you interact with our social media pages, and how you interact with our email communications. To the extent permitted by applicable law, CO2 combines this information with other information CO2 collects about you, including your personal information. Please see the section titled “Our Use of Cookies and Other Tracking Technologies” below for more information.
2.3. Personal Information CO2 Collects from Third Parties
Third party data suppliers from which we purchase demographic data to supplement the data we collect;
Social networks when you reference our Services or grant permission to CO2 to access your data on one or more of such platforms;
Partners with which we offer co-branded services, sell or distribute our products, or engage in joint marketing activities; and
Publicly available sources such as open government databases or other data in the public domain.
CO2 stores the personal information that CO2 receives from third parties with other personal information that CO2 collects. For information about how third parties may use and disclose your personal information, including any information you make public, please consult the third parties’ respective privacy policies. CO2 has no control over how any third party uses or discloses the personal information they collect about you.
2.4. Use of Personal Information
CO2 uses your personal information for the following purposes:
Operating the Services and Providing Related Support. To provide and operate the Services, communicate with you about your use of the Services, provide troubleshooting and technical support, respond to your inquiries, fulfill your requests, process your payments, and for similar service and support purposes.
Responding to Inquiries. To respond to your questions, fulfill your requests, and consider your request.
Analyzing and Improving the Services and CO2’s Business. To better understand how users access and use the Services, and for other research and analytical purposes, such as to evaluate and improve the Services and business operations and to develop additional Services.
Personalizing Experiences. To tailor content CO2 may send or display on the CO2 Website, including to offer location customization and personalized help and instructions, and to otherwise personalize your experiences.
Marketing Communications. To send you information about the Services or any other information that you sign up to receive.
Market Research and Customer Satisfaction. To administer surveys and questionnaires, such as for market research or customer satisfaction purposes.
Protecting CO2’s Legal Rights and Preventing Misuse. To protect the Services and CO2’s business operations, to prevent and detect fraud, unauthorized activities and access, and other misuse, to enforce CO2’s agreements, policies, including this Privacy Policy and the CO2 Terms of Service, to protect the security or integrity of the Services, to protect the property, rights, and safety of CO2, including to investigate and defend ourselves against any third-party claims or allegations, where CO2 believes necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety or legal rights of any person, third party, or the public, or violations of the CO2 Terms of Service or this Privacy Policy.
Complying with Legal Obligations. To (a) as reasonably necessary, comply with any applicable law, regulation, legal process, or governmental request, (b) enforce CO2’s agreements and policies, including but not limited to this Privacy Policy, the CO2 Terms of Service, CO2 Anti-Money Laundering Policy, CO2 Sanctions Policy, CO2 Foreign Corrupt Practices Act Policy, and the CO2 Onboarding Procedures, (c) protect the security or integrity of the Services, (d) protect the property, rights, and safety of CO2, users of the Services, or the public from harm or illegal activities, (e) investigate and defend ourselves against any third-party claims, allegations or legal proceedings, or (f) respond to governmental requests or investigations. For example, CO2 may use information to respond to subpoenas, court orders, and other lawful requests by regulators and law enforcement, including responding to national security or law enforcement disclosure requirements.
Emergency Situations. To respond to an emergency, including for example, to assist in preventing the death or serious bodily injury of any person.
Business Transfers and Transactions. To consider and implement mergers, acquisitions, reorganizations, and other business transactions such as financings, and where necessary to the administration of CO2’s general business, accounting, recordkeeping, and legal functions.
Training CO2’s Customer Service Representatives and Auditing CO2’s Customer Service Practices. The CO2 Website may from time to time include chat capability. If you use such features, you understand that CO2 retains CO2’s chat sessions for history, training, and audit purposes.
Planning and Managing Events. If CO2 plans any events, CO2 uses the personal information that CO2 collects for event planning and management, including registration, attendance, connecting you with other event attendees, and contacting you about relevant events and Services.
Aggregate and De-identified Data. CO2 may use aggregate and de-identified data that cannot reasonably be used to infer information about, or otherwise be linked to, a particular identifiable individual or an identifiable individual’s device (“de-identified data”), including to assess, improve and develop CO2’s business, products and Services, and for research and analytics purposes. CO2 will only use such data in a de-identified manner and will not attempt to re-identify such data or associate it with a particular individual or household; such de-identified data is not personal information.
2.5. How CO2 Discloses Personal Information
CO2 may share the categories of personal information with the following parties:
Service Providers (Processors). CO2 may disclose personal information CO2 collects with CO2’s service providers who perform functions on CO2’s behalf related to the Services. These service providers may include IT service providers, analytics providers, payment processors, including Stripe, Inc., advertising and marketing services, and security vendors.
Affiliates. CO2 may disclose personal information CO2 collects to CO2’s affiliates or subsidiaries.
Business Customers. Any transactional information collected by our business customers through the Services may be available to the business’s account administrators or other account managers, and may, at the direction of our business customers, be shared with third parties as necessary for management purposes. CO2’s business customers may use certain information they collect through our Services for marketing or promotional communications, subject to any appropriate or necessary consents and their own privacy policies.
Screen Name and Posted Information. Your screen name and any information that you post for public consumption to the CO2 Website, including, without limitation such comments and text, will be available to, and searchable by, all users of the Services.
Complying with Legal Obligations. CO2 may disclose personal information (a) if reasonably necessary to comply with any applicable law, regulation, legal process, or governmental requests, (b) to enforce CO2’s agreements and policies, including but not limited to this Privacy Policy, the CO2 Terms of Service, CO2 Anti-Money Laundering Policy, CO2 Sanctions Policy, CO2 Foreign Corrupt Practices Act Policy, and the CO2 Onboarding Procedures, (c) to protect the security or integrity of the Services, (d) to protect the property, rights, and safety of CO2, users of the Services or the public from harm or illegal activities, (e) to investigate and defend ourselves against any third-party claims, allegations or legal proceedings, or (f) to respond to governmental requests or investigations. For example, CO2 may disclose personal information in response to subpoenas, court orders, and other lawful requests by regulators and law enforcement, including responding to national security or law enforcement disclosure requirements.
Emergency Situations. To respond to an emergency that CO2 believes in good faith requires CO2 to disclose information, including for example, to assist in preventing the death or serious bodily injury of any person.
Third-Party Ad Networks. CO2 may disclose personal information to third-party ad network providers, sponsors and/or traffic measurement services. These third parties may use cookies, JavaScript, web beacons (including clear GIFs), and other tracking technologies to measure the effectiveness of their ads and to personalize advertising content to you. These third-party cookies and other technologies are governed by each third party’s specific privacy policy, not this one.
Third-Party Analytics Providers. CO2 may disclose personal information to marketing analytics service providers.
Business Transfers and Transactions. If CO2 or CO2’s affiliates are or may be acquired by, merged with, or invested in by another company, or if any of CO2’s assets are or may be transferred to another company, whether as part of a bankruptcy or insolvency proceeding or otherwise, CO2 may transfer the information CO2 has collected to the other company. As part of the business transfer process, CO2 may share certain personal information with lenders, auditors, and third-party advisors, including attorneys and consultants.
3. CO2’s Use of Cookies and Other Tracking Technologies
CO2 and CO2’s third-party service providers use cookies and other tracking mechanisms to track information about your use of the Services. CO2 may combine this information with other personal information CO2 collects from you. For more information on the types of personal information CO2 collects through these technologies, please see the section above titled “Personal Information CO2 Collects.” For resources and instructions on how to disable tracking technologies, see the section below titled “Tracking and Advertising Choices.”
3.0.1. Cookies
Cookies are alphanumeric identifiers that CO2 transfers to your device’s hard drive through your web browser for record-keeping purposes. Some cookies allow CO2 to make it easier for you to navigate the Services, while others are used to enable a faster log-in process or to allow CO2 to track your activities. There are two types of cookies: session and persistent cookies.
- Session Cookies. Session cookies exist only during an online session. They disappear from your device when you close your browser or turn off your device. CO2 uses session cookies to allow CO2’s systems to uniquely identify you during a session or while you are logged into the Services. This allows CO2 to process your online transactions and requests and verify your identity after you have logged in, as you move through the CO2 Websites and the Services.
- Persistent Cookies. Persistent cookies remain on your device after you have closed your browser or turned off your device. CO2 uses persistent cookies to track aggregate and statistical information about your activity.
3.0.2. Clear GIFs, Pixel Tags, and other Technologies
Clear GIFs are tiny graphics with a unique identifier, similar in function to cookies. In contrast to cookies, which are stored on your computer’s hard drive, clear GIFs are embedded invisibly on web and app pages. CO2 may use clear GIFs (a.k.a. web beacons, web bugs or pixel tags), in connection with the Services to, among other things, track the activities of the CO2 Website visitors, help CO2 manage content, and compile statistics about the CO2 Website usage. CO2 and CO2’s third-party service providers also use clear GIFs in HTML e-mails to our customers, to help us track e-mail response rates, identify when CO2 e-mails are viewed, and track whether CO2’s e-mails are forwarded.
3.0.3. Third-Party Analytics
CO2 uses automated devices and applications, such as Google Analytics, to evaluate usage of the CO2 Website. CO2 also may use other analytic means to evaluate the CO2 Website. CO2 uses these tools to help CO2 improve CO2’s Website’s performance and user experiences. These entities may use cookies and other tracking technologies, such as web beacons, to perform their services. You can download the Google Analytics Opt-out Browser Add-on to prevent their data from being used by Google Analytics at https://tools.google.com/dlpage/gaoptout.
3.0.4. Cross-Device Use
CO2 and CO2’s third-party service providers, including analytics providers, may use the information that CO2 collects about you (whether directly from the CO2 Website or from a third party) to help CO2 and CO2’s third-party service providers identify other devices that you use (e.g., a mobile phone, tablet, other computer, etc.). CO2 and CO2’s third-party service providers also may use the cross-device use and other information CO2 learns about you to serve targeted advertising on your devices and to send you emails. To opt out of cross-device advertising, you may follow the instructions set forth in the “Tracking and Advertising Choices” section below. Please note: if you opt-out of these targeted advertising cookies, the opt-out will be specific to the web browser, app, or device from which you accessed the opt-out. If you use multiple devices or web browsers, you will need to opt out on each browser or device that you use.
3.0.5. Do-Not-Track
Currently, CO2’s systems do not recognize browser “do-not-track” requests. You may, however, disable certain tracking as discussed in this section (e.g., by disabling cookies); you also may opt out of targeted advertising by following the instructions in the “Tracking and Advertising Choices” section.
4. Tracking and Advertising Choices
If you wish to prevent cookies or third-party advertisers from tracking your activity on the CO2 Website or visits across multiple websites, there are tools you can use to disable cookies and opt out of interest-based advertising. Using the resources below does not mean you will no longer receive any advertising through the CO2 Website, Services, or on other websites. You may continue to receive advertisements, for example, based on the particular site that you are viewing (i.e., contextually based ads) and as described above. Your opt-out may not be effective if your browser is configured to reject cookies.
Browser Solutions for Disabling Cookies If you wish to prevent cookies from tracking your activity on the CO2 Website or visits across multiple websites, you can set your browser to block certain cookies or notify you when a cookie is set. The “Help” portion of the toolbar on most browsers will tell you how to prevent your device from accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to disable cookies altogether. Visitors to the CO2 Website and Services who disable cookies will be able to browse the CO2 Website, but some features may not function.
Industry Solutions for Opting Out of Interest-Based Advertising Notwithstanding the above, visitors to the CO2 Website may follow the steps provided by initiatives that educate you on how to set tracking preferences for most online advertising tools. These resources include YourOnlineChoices in the EU ( https://www.youronlinechoices.eu/), the Network Advertising Initiative ( https://thenai.org/about-online-advertising/) and the Digital Advertising Alliance ( https://digitaladvertisingalliance.org/) in the US, the Digital Advertising Alliance of Canada ( https://youradchoices.ca/en/learn), the Data Driven Advertising Initiative in Japan ( http://www.ddai.info/optout), or other similar services. You can use the Digital Advertising Alliance’s AdChoices opt-out tool ( https://youradchoices.com/control) to opt out of the use of your personal information by many third-party ad networks for targeted advertising purpose. The Digital Advertising Alliance also offers an application called AppChoices ( https://youradchoices.com/appchoices) that helps you to control interest-based advertising on mobile apps.
5. Third Party Services
This Privacy Policy applies only to the processing of your personal information by CO2. The Services may contain features or links to websites and services provided by third parties. The policies and procedures described in this Privacy Policy do not apply to third-party sites. Any information you provide on third-party sites or services is provided directly to the operators of such services and is subject to those operators’ policies, if any, governing privacy and security, even if accessed through the Services. CO2 is not responsible for the content or privacy and security practices and policies of third-party sites or services to which links or access are provided through the Services. CO2 encourages you to learn about third parties’ privacy and security policies before providing them with information.
6. Additional Privacy Information for Certain Jurisdictions
Note that these rights only apply to personal information that CO2 collects and processes under the terms of this Privacy Policy.
6.1. Rights of California Customers
This section only applies to the extent that the Personal Information (as that term is defined under the California Consumer Privacy Act of 2018 (the “CCPA”)) collected is currently subject to the CCPA, and not subject to an exemption under the CCPA.
Under the CCPA, California residents have the right to receive certain disclosures regarding CO2’s processing and sharing of Personal Information.
6.1.1. Right to Access
With respect to the Personal Information CO2 has collected about you in the prior 12 months, you have the right to request from CO2 (up to twice per year and subject to certain exemptions):
- Categories of Personal Information about you CO2 has collected;
- The sources from which CO2 has collected that Personal Information;
- CO2’s business or commercial purposes for collecting, selling, or sharing that Personal Information;
- The categories of third parties to whom CO2 has disclosed that Personal Information; and
- A copy of the specific pieces of your Personal Information CO2 has collected.
6.1.2. Right to Delete
Subject to certain conditions and exceptions, you may have the right to request deletion of Personal Information that CO2 has collected about you.
California consumers who are registered users of the CO2 Website and under 18 years of age may request the removal of content or information they posted on the CO2 Website. CO2 will remove such content or information when CO2 is required to do so by law. To request the removal of content or information you posted on the CO2 Website, you may contact CO2 as described below. Please note that even if CO2 removes the content or information that you posted, CO2 cannot prevent further use or disclosure of that content or information by others once you have shared it publicly.
6.1.3. Right to Opt-Out of Sale
Under the CCPA, California residents may have the right to opt-out of the sale of their Personal Information. A “sale” under the CCPA includes disclosing or making available Personal Information to a third party in exchange for monetary or other valuable consideration. CO2 does not “sell” Personal Information under this definition.
6.1.4. Right to Non-Discrimination
CO2 will not discriminate against you for exercising any of the rights described in this section.
6.1.5. Authorized Agent
You may designate someone as an authorized agent to submit requests and act on your behalf. To do so, you must provide CO2 with written permission to allow the authorized agent to act on your behalf.
6.1.6. Right to Know
The chart below describes the categories of Personal Information CO2 collects, the categories of sources from which the Personal Information is collected, CO2’s purposes for processing each category, whether CO2 has disclosed Personal Information for a business purpose in the last 12 months, and the categories of recipients.
To the extent permitted by applicable law, CO2 will retain your personal information only for as long as CO2 believes it is necessary to fulfill the purposes for which it was collected, including for the purpose of meeting any legal, accounting, or other reporting requirements or obligations.
| Categories Collected in the Last 12 Months | Categories of Third Parties Who Receive This Personal Information for a Business Purpose |
|---|---|
| Identifiers, such as name, address, email address, IP address and online identifiers. | Service providers; third-party ad networks; third-party analytics providers; affiliates and subsidiaries; business partners; and government entities and law enforcement. |
| Commercial information, such as records of Climate Benefits obtained. | Service providers; affiliates and subsidiaries; and business partners. |
| Internet or other electronic network activity information, including, but not limited to, browsing history, clickstream data, search history, and information regarding interactions with an internet website, application, or advertisement, including other usage data related to your use of the Services. | Service providers; third-party ad networks; third-party analytics providers; and affiliates and subsidiaries. |
| Geolocation data: location information about a particular individual or device. | Service providers; third-party ad networks; third-party analytics providers; affiliates and subsidiaries; and government entities and law enforcement. |
6.1.7. Use of Personal Information
CO2 processes the Personal Information CO2 collects about you as described above in Section 2.4 of this Privacy Policy.
6.1.8. Sources of Personal Information
In the preceding twelve months, CO2 has collected Personal Information from the following categories of sources: - Directly from users of the Services - Third party data suppliers - Social networks - Publicly available sources - Business partners
Submitting Privacy Rights Requests
If any of the rights described in this section apply to you, you may exercise your rights by any of the following means:
Calling CO2 at 1 (888) 914-9661 PIN 430210; or
Submitting a request through CO2’s “California Access/Deletion Page”.
CO2 will take steps to verify your request by matching the information provided by you with the information in CO2’s records. In some cases, CO2 may request additional information in order to verify your request or, where necessary, to process your request. If CO2 is unable to adequately verify a request, CO2 will notify the requestor.
7. Children
The Services are not designed for children. If CO2 discovers that a child under 13 has provided CO2 with personal information, CO2 will delete such information from CO2’s systems. If a parent believes CO2 has collected their child’s information in violation of applicable law, please contact CO2 using the information provided below.
8. Security
CO2 has implemented precautions designed to protect the personal information CO2 collects from loss, misuse, and unauthorized access, disclosure, alteration, and destruction. Please be aware that despite CO2’s efforts, no data security measures can guarantee security.
9. Changes to this Privacy Policy
This Privacy Policy is current as of the Effective Date set forth above. CO2 may change this Privacy Policy from time to time, so please be sure to check back periodically. CO2 will post any changes to this Privacy Policy on the CO2 Website.
10. Contact Us
If you have questions about the privacy aspects of the Services or would like to make a complaint, please contact CO2 by writing to us at privacy@time.com, or at:
CO2 c/o TIME USA, LLC Attention: Privacy Officer 3 Bryant Park New York, NY 10036
Toll-free: 1-800-843-8463