Consent, tracking & profiling — found from sitemap — Ortto

Cited by

Facts read from this source

• Dsar email Report an error

  “A SAR can also be made using the email address privacy@ortto.com.”

• Dsar webform Report an error

  “A SAR may be made using the webform available on the website https://prighter.com/cc/ortto.”

• Dsar response time Report an error

  “Ortto has thirty (30) days from the initial request date to complete the request. If the company cannot respond within thirty days, it shall provide notice to the consumer. In California, the company may extend the response timeline up to an additional forty-five (45) days.”

• Dsar acknowledgement time Report an error

  “Ortto will acknowledge the SAR within ten (10) days of the initial request and respond to any SAR within 30 days of the initial request.”

• Dsar rights covered Report an error

  “Access (a copy of the personal data undergoing processing) Rectification of personal data (correction of data stored or processed) Erasure (‘right to be forgotten’) Notification regarding rectification or erasure Objection to processing (withdrawal of consent to processing) Right to opt-out of any sale of PII (i.e. Do Not Sell requests)”

• Dsar controller channel Report an error

  “A SAR must be made using the link on Ortto’s website https://ortto.com/gdpr/. If the consumer has a password-protected account on Ortto systems, the company may provide an “interface” or self-service mechanism that the consumer is instructed to use to initiate the SAR process.”

• Dsar processor channel Report an error

  “The SAR must be submitted via the user interface in the Ortto Services.”

• Request records retention Report an error

  “A record of all consumer requests shall be maintained for at least twenty-four (24) months and shall include the following elements:”

• Privacy notice requirements Report an error

  “Ortto shall post a public-facing Privacy Notice (i.e. Privacy Policy). The notice shall be available at or before the point of collection, shall be easy to read and shall:”

• Deidentification allowed Report an error

  “Ortto may de-identify personal information in response to a request for deletion”

• GDPR policy URL Report an error

  “Ortto shall not sell any PII without posting a “Do Not Sell My Personal Information” link on the company homepage and Privacy Policy for consumers to opt-out of any sale.”

• Optout two methods Report an error

  “Ortto shall provide at least two methods for opting out of sales of PII which are consistent with the manner in which the company typically interacts with customers”

• Optout browser plugin Report an error

  “Ortto will allow consumers to opt-out of sales via web browser plugin or other privacy setting”

• Global optout Report an error

  “When Ortto offers an opt-out of a specific use, it shall also offer a global opt-out”

• Minors optin consent Report an error

  “When the company has actual knowledge that it sells the personal information of a consumer under the age of 13, it shall establish, document, and comply with a reasonable method for determining that the person affirmatively authorizing the sale of the personal information about the child is the parent or guardian of that child.”

• Household request conditions Report an error

  “all consumers of the household submit a joint request the company individually verifies all members of the household the company verifies that each requestor is member of the household”

• Service provider purposes Report an error

  “to provide service on behalf of the controller to employ another service provider to improve service quality to detect security incidents and or fraud to comply with the law or law enforcement”

• Optin process steps Report an error

  “Opt-in processes shall have two steps: an opt-in request followed by a verification of the request”

• Requester identity verification Report an error

  “Before providing categories of personal information, the company shall verify the identity of requesters to a "reasonable degree of certainty." Before providing specific pieces of personal information or honoring a deletion request, a company shall verify the identity of requesters to a "high degree of certainty," depending on the sensitivity of the personal information or the risk of harm from an unauthorized deletion request.”

• Dsar search scope Report an error

  “Search all databases and all relevant filing systems (manual files) in Ortto, including all back up and archived files, whether computerized or manual, and including all email folders and archives.”

• Request logging Report an error

  “Provide consumers an online mechanism for making requests and all such requests will be logged.”

• Request records retention elements Report an error

  “request date nature of request request method date of company response nature of company response basis for any denial”

• Request records no sharing Report an error

  “Records of consumer requests shall not be shared with any third party except as necessary to comply with a legal obligation.”

• Verified email for controller Report an error

  “Verify the identity of the consumer by email.”

• Authorized agent proof Report an error

  “When a consumer uses an authorized agent to submit a request to know or a request to delete, a business may require the authorized agent to provide proof that the consumer gave the agent signed permission to submit the request.”

• Minors parental verification methods Report an error

  “Providing a consent form to be signed by the parent or guardian under penalty of perjury and returned to the company by postal mail, facsimile, or electronic scan Requiring a parent or guardian, in connection with a monetary transaction, to use a credit card, debit card, or other online payment system that provides notification of each discrete transaction to the primary account holder; Having a parent or guardian call a toll-free telephone number staffed by trained personnel; Having a parent or guardian connect to trained personnel via video- conference; Having a parent or guardian communicate in person with trained personnel; and Verifying a parent or guardian’s identity by checking a form of government- issued identification against databases of such information,”

• Optout minimal steps Report an error

  “Opt-out processes shall require minimal steps and no multi-step opt-out process shall not have more steps than the opt-in process”

• Minors no sale Report an error

  “Ortto shall not sell the personal information or minors or of persons who have previously opted out of sales, without explicit permission”

• Nondiscrimination Report an error

  “Ortto shall not deny goods or services or otherwise discriminate against (i.e. charge different prices, or offer different levels of service) persons for exercising their privacy rights”

• Optout pii restriction Report an error

  “Ortto shall not use PII provided for the purposes of opting-out of a sale for any other purpose”

• Service provider no sale after optout Report an error

  “Ortto shall ensure that no service providers continue to sell PII after a consumer has opted out”

• Optout alternative methods Report an error

  “offline or alternative methods to opt-out”

• Optout interactive form Report an error

  “an interactive form by which consumers can opt-out”

• Optout authorized agent Report an error

  “Ortto shall establish a process for consumers to submit requests via an authorized agent”

• Privacy policy update frequency Report an error

  “A public-facing Privacy Policy shall include a description of consumers’ rights and shall be updated at least every twelve (12) months”

• Access request lookback Report an error

  “Responses to access requests shall cover at least the preceding twelve (12) months”

• Optin requester info Report an error

  “When a consumer who has opted-out attempts to use a service that requires opt-in, the company shall inform the consumer how to opt-in”

• Just in time notice Report an error

  “When the company collects personal information that a consumer would not reasonably expect from a mobile device then it shall provide a just-in-time notice containing a summary of categories collected and a link to the full notice.”

• Fraudulent request denial Report an error

  “Ortto shall deny fraudulent requests with an explanation as to why they believe the request is fraudulent”

• Denied request explanation Report an error

  “Ortto in any case where the company has a legal basis for denying a consumer request, it shall provide an explanation of its decision to the consumer including a reference to the relevant laws or regulations”

• Individual response required Report an error

  “Ortto shall provide an individual response to each requestor and not refer them to a policy or provide a generic response”

• Identity verification no fee Report an error

  “Ortto shall establish and document a reasonable method for verifying the identity of a requestor which shall not require a fee from the consumer.”

• Existing auth verification Report an error

  “Where a consumer maintains a password protected account with a company, the company may verify their identity using existing authentication practices.”

• Verification data deletion Report an error

  “A company shall delete personal information collected for the purpose of verification as soon as possible after processing the request.”

• Verification method review Report an error

  “The company shall evaluate and document whether a reasonable method can be established at least once every 12 months.”

• Need to know access Report an error

  “All personal data requires a legal basis for processing, and will be accessible on a strict need-to-know basis.”

• Data disposal Report an error

  “Disposal: Paper records must be securely shredded prior to disposal. Electronic media must be securely wiped, sanitized or physically destroyed prior to disposal or reuse”

• Sar acknowledgement content Report an error

  “Ortto will acknowledge any manual requests within 10 business days. The acknowledgement will describe the verification process and when the consumer should expect a response.”

• Sar deadline extension notice Report an error

  “If the company cannot respond within thirty days, it shall provide notice to the consumer.”

• Agent request verification Report an error

  “If a SAR is submitted by an agent, the submission must include the identification of the consumer as well as a signed authorization from the consumer. Ortto must make reasonable efforts to verify the identity of the consumer and legitimacy of all requests submitted by authorized agents.”

• Dsar categories included Report an error

  “Categories of PII collected Categories of PII sold and disclosed to third parties”

• Sar correction guidance Report an error

  “If a SAR is received which does not meet Ortto criteria, the Ortto shall inform the consumer or agent how to correct the SAR in order to receive a response from Ortto”

• Processor sar redirection Report an error

  “Ortto shall direct the consumer to the relevant Controller in accordance with all contractual commitments.”

• Employee sar HR coordination Report an error

  “SARs from employees or previous employees will be coordinated with HR and the employees’ current or previous departmental leadership.”

• Data storage record Report an error

  “Ortto maintains a record that identifies where personal data in Ortto is stored.”

• Processing record dates Report an error

  “Ortto will also keep a record of processing to include dates.”

• Household minor parental consent Report an error

  “If a member of a household is under 13, a company must obtain a verifiable parental consent before complying with a request.”

• Privacy notice homepage link Report an error

  “Ortto shall inform consumers of the company’s privacy practices at or before any PII collection. The Privacy Notice shall be made available via a link titled “privacy” on the company’s homepage.”

• Sar dpo review Report an error

  “The SAR application will be documented and can be audited using Ortto's internal processes.”

31 facts read from this page are not shown because they could not be confirmed on the page as captured.