Effective: June 7, 2021

This California Privacy Notice (“Notice”) applies to “Consumers” as defined by the California Consumer Privacy Act (“CCPA”) as a supplement to Company’s other privacy policies or notices.  This Notice applies to Seriouscigars.com, which is operated by an affiliated corporation of Tabacalera USA Inc.  For purposes of managing Consumer’s CCPA rights and making the disclosures made in this notice, “Company“us” “we” and “our” means collectively the family of companies and brands owned and controlled by Tabacalera USA Inc.  In the event of a conflict between any other Company policy, statement or notice and this Notice, this Notice will prevail as to California Consumers and their rights under the CCPA.  Please see also any general privacy policy or notice posted or referenced on our websites, apps, products, or services. 

Pursuant to the California Consumer Privacy Act of 2018 (CCPA), the Company is providing the following additional details regarding the categories of Personal Information about California residents that we have collected or disclosed within the preceding 12 months: 

1. PERSONAL INFORMATION (“PI”) WE COLLECT.

Based on our 2020 data practices, we give you notice that we collect the following types of PI about California Consumers, and use and share it as set forth below.  This notice will be updated annually, and our current privacy notices at the point of collection, and general privacy policies, may reflect more current practices.

Category of PI

Examples of PI

  1. Identifiers

(as defined in CCPA §1798.140(o)(1)(A))

This may include but is not limited to: a real name, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, and account name.

  1. Personal Records

(as defined in CCPA §1798.140(o)(1)(B))

This may include information such as: telephone number, date of birth, billing address, your account number with our services.

  1. Personal Characteristics or Traits (as defined in CCPA §1798.140(o)(1)(C))

This may include, but is not limited to: gender.

  1. Customer Account Details / Commercial Information

(as defined in CCPA §1798.140(o)(1)(D))

This may include, but is not limited to: products or services purchased or considered, or other purchasing or consuming histories or tendencies.

  1. Internet Usage Information

(as defined in CCPA §1798.140(o)(1)(F))

This may include, but is not limited to: browsing history, search history, and information regarding your interaction with an Internet Web site, application, or advertisement.

  1. Sensory Data

(as defined in CCPA §1798.140(o)(1)(H))

This may include, but is not limited to: audio recordings of customer care calls.

  1. Professional or Employment Information

(as defined in CCPA §1798.140(o)(1)(I))

This may include, but is not limited to: professional, educational, or employment-related information.

  1. Inferences from PI Collected

(as defined in CCPA §1798.140(o)(1)(K))

This may include, but is not limited to: consumer preferences and behavior.

The chart above reflects the categories of PI required by the CCPA. There may be additional information that we collect that meets the CCPA’s definition of PI but is not reflected by a category, in which case we will treat it as PI as required by the CCPA, but will not include it when we are required to describe our practices by category of PI.

As permitted by applicable law, we do not treat deidentified data or aggregate consumer information as PI and we reserve the right to convert, or permit others to convert, your PI into deidentified data or aggregate consumer information, and may elect not to treat publicly available information as PI. We have no obligation to re-identify information or keep it longer than we need it to respond to your requests.

2. USE OF PERSONAL INFORMATION.

Generally, we collect, retain, use, and share your PI to provide you services and as otherwise related to the operation of our business. For more detail on our disclosures and sale of PI, see the next section Sharing of PI.

We may collect, use and share the PI we collect for one or more of the following business purposes:

Additional business purposes include sharing PI with third parties for other than a sale or one of the foregoing business purposes as required or permitted by applicable law, such as to our vendors that perform services for us, to the government or private parties to comply with law or legal process, to the consumer or other parties at the consumer’s request, for the additional purposes explained in our general privacy policies, and to assignees as part of a merger or asset sale (“Other Business Purposes”).

Subject to restrictions and obligations of the CCPA, our vendors may also use your PI for some or all of the above listed business purposes. Our vendors may themselves engage services providers or subcontractors to enable them to perform services for us, which sub-processing is, for purposes of certainty, also an Other Business Purpose, for which we are providing you notice.

In addition, we may collect, retain, and use PI for the purpose of sharing it as set forth in the next section.

3. SHARING OF PI.

We may share PI with our service providers, other vendors including those that facilitate advertising and marketing, and affiliates, including without limitation during calendar year 2020 as follows:

Category of PI

Categories of Recipients

  1. Identifiers

Business Purpose Disclosure:

  • Affiliates
  • External Marketing and Advertising Agencies
  • External Auditors
  • Public Authorities/Government Bodies
  • Service Providers

Sale: Not Sold

  1. Personal Records

Business Purpose Disclosure:

  • Affiliates
  • External Auditors
  • Public Authorities/Government Bodies
  • Service Providers

Sale: Not Sold

  1. Personal Characteristics or Traits

Business Purpose Disclosure:

  • Affiliates
  • Service Providers

Sale: Not Sold

  1. Customer Account Details / Commercial Information

Business Purpose Disclosure:

  • Affiliates
  • External Auditors
  • Public Authorities/Government Bodies
  • Service Providers

Sale: Not Sold

  1. Internet Usage Information

  • Service providers

Sale: Not Sold

  1. Sensory Data

Business Purpose Disclosure:

  • Service Providers

Sale: Not Sold

  1. Professional or Employment Information

Business Purpose Disclosure:

  • Service Providers

Sale: Not Sold

  1. Inferences from PI Collected

Business Purpose Disclosure:

  • Affiliates
  • Service Providers

Sale: Not Sold

 We do not believe that in 2019 we “sold” PI.  For more information on your do not sell rights, see the Do Not Sell subsection of the California Privacy Rights section of this Privacy Notice at Section 3.B

4. CALIFORNIA PRIVACY RIGHTS.

The CCPA is a new law and there remain differing interpretations of it and the regulations that implement it. Accordingly, we may from time-to-time update information in our notices regarding our data practices and your rights, modify our methods for you to make and for us to respond to your requests, and/or supplement our response(s) to your requests, as we continue to develop our compliance program to reflect the evolution of the law and our understanding of how it relates to our data practices.

We provide California Consumers the privacy rights described in this section. You have the right to exercise these rights via an authorized agent who meets the agency requirements of the CCPA and related regulations. As permitted by the CCPA, any request you submit to us is subject to an identity and, at our discretion, a residency verification process (“Verifiable Consumer Request”). We will not fulfill your CCPA request unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected PI. Please follow the instructions at our Consumer Rights Request page here and respond to any follow up inquires we may make.

Some PI we maintain about Consumers is not sufficiently associated with enough PI about the Consumer for us to be able to verify that it is a particular Consumer’s PI when a Consumer request that requires verification pursuant to the CCPA’s verification standards is made (e.g., clickstream data tied only to a pseudonymous browser ID). As required by the CCPA we do not include that PI in response to those requests. If we cannot comply with a request, we will explain the reasons in our response. You are not required to create a password-protected account with us to make a Verifiable Consumer Request. We will use PI provided in a Verifiable Consumer Request only to verify your identity or authority to make the request and to track and document request responses, unless you also gave it to us for another purpose.

We will make commercially reasonable efforts to identify Consumer PI that we collect, process, store, disclose and otherwise use and to respond to your California Consumer privacy rights requests. In some cases, particularly with voluminous and/or typically irrelevant data, we may suggest that you receive the most recent or a summary of your PI and give you the opportunity to elect whether you want the rest or not. We reserve the right to direct you to where you may access and copy responsive PI yourself. We will typically not charge a fee to fully respond to your requests; provided, however, that we may charge a reasonable fee, or refuse to act upon a request, if your request is excessive, repetitive, unfounded or overly burdensome. If we determine that the request warrants a fee, or that we may refuse it, we will give you notice explaining why we made that decision. You will be provided a cost estimate and the opportunity to accept such fees before we will charge you for responding to your request.

Consistent with the CCPA and our interest in the security of your PI, we will not deliver to you your social security number, driver’s license number or other government-issued id number, financial account number, any health or medical identification number, an account password, security questions or answers, or unique biometric data generated from measurements or technical analysis of human characteristics in response to a CCPA request; however, you may be able to access some of this information yourself through your account if you have an active account with us.

Your California Consumer privacy rights are as follows:

A. The Right to Know:

I. Categories:

You have the right to send us a request, no more than twice in a twelve-month period, for any of the following for the period that is twelve months prior to the request date:

  • The categories of PI we have collected about you.
  • The categories of sources from which we collected your PI.
  • The business or commercial purposes for our collecting or selling your PI.
  • The categories of third parties to whom we have shared your PI.
  • A list of the categories of PI disclosed for a business purpose in the prior 12 months and, for each, the categories of recipients, or that no disclosure occurred.
  • A list of the categories of PI sold about you in the prior 12 months and, for each, the categories of recipients, or that no sale occurred. 

To make a request, follow the instructions at our Consumer Rights Request page here, email us here

In order for us to look into your request, we first need to verify your identity, meaning that we need to make sure that you are the consumer we may have collected personal information about or a person who has been duly authorized to make the request on behalf of the consumer. You are not required to create a password-protected account with us to make a Verifiable Consumer Request. We are required to verify a consumer’s request to know categories of PI to a reasonable degree of certainty, which may include matching at least two data points provided by the consumer with data points maintained by us, which we have determined to be reliable for the purpose of verifying the consumer. If you fail to do so we will be unable to verify you sufficiently to honor your request. The information you send for us to verify your identity will be used for this purpose only.

For your specific pieces of information, as required by the CCPA, we will apply the heightened verification standards set forth in subsection (ii) below. Please note that PI is retained by us for various time periods, so we may not be able to fully respond to what might be relevant going back 12 months prior to the request.

II. Specific Pieces:

You have the right to make or obtain a transportable copy, no more than twice in a twelve-month period, of your PI that we have collected in the period that is 12 months prior to the request date and are maintaining.  To make a request, follow the instructions at our Consumer Rights Request page here or email us here.

In order for us to look into your request, we first need to verify your identity, meaning that we need to make sure that you are the consumer we may have collected personal information about or a person who has been duly authorized to make the request on behalf of the consumer.  You are not required to create a password-protected account with us to make a Verifiable Consumer Request.  If you do not have a password-protected account, we are required to verify a consumer’s request to know specific pieces of PI to a reasonably high degree of certainty, which may include matching at least three data points provided by the consumer with data points maintained by us, which we have determined to be reliable for the purpose of verifying the consumer together with a signed declaration under penalty of perjury that the requestor is the consumer whose personal information is the subject of the request. If you fail to provide the data points we will be unable to verify you sufficiently to honor your request. The information you send for us to verify your identity will be used for this purpose only.

Please note that PI is retained by us for various time periods, so we may not be able to fully respond to what might be relevant going back 12 months prior to the request.

B. Do Not Sell:

We do not believe we sell PI as “sell” is defined under the CCPA. However, we reserve the right to do so in the future and accordingly you can opt-out of sale by following the instructions at our Consumer Rights Request page here

There may be cookies and other tracking technologies associated with our online services that may provide data, which may be treated as PI under the CCPA, to other parties that may use it for their own purposes, which in turn may provide that data to other parties for their own purposes. While there is not yet a consensus, we do not believe that data practices of third-party cookies and tracking devices associated with our online services constitute a sale of PI by us and therefore we do not currently treat these activities as a “sale.” Currently, a do not sell request to us will not affect these third-party activities. However, you can exercise control over browser-based cookies by adjusting the settings on your browser, and mobile devices may offer ad and data limitation choices. In addition, third-party tools may enable you to search for and opt-out of some of these trackers, such as the Ghostery browser plug-in available at https://www.ghostery.com/. As the law and an industry consensus may develop regarding cookies and the CCPA, we will reevaluate our approach to cookies and may change the way we treat cookies and other online tracking technologies. You can also learn more about how to exercise certain choices regarding cookies and interest-based advertising at http://www.aboutads.info/choices/, http://www.aboutads.info/appchoices, and http://www.networkadvertising.org/choices/.

We do not represent that these third-party tools, programs or statements are complete or accurate. Clearing cookies or changing settings may affect your choices and you may have to opt-out separately via each browser and other device you use. Cookie-enabled opt-outs signals may no longer be effective if you delete, block or clear cookies. We are not responsible for the completeness, accuracy or effectiveness of any third-party notices or choices.

Some browsers have signals that may be characterized as do not track signals, but we do not understand them to operate in that manner or to indicate a do not sell expression by you so we currently do not recognize these as a do not sell request.

Further, there is not currently a consensus as to how various user-enabled privacy or “do not track” signals or settings should be treated or what they mean, so we will not look for or respond to any that are not expressly listed here as programs in which we participate or otherwise accept, which may change as programs evolve. We understand that various parties are developing do not sell signals and we may recognize certain such signals if we conclude such a program is appropriate.

We do not knowingly sell the PI of Consumers under 16.

We may disclose your PI for the following purposes, which are not a sale: (i) if you direct us to share PI; (ii) to comply with your requests under the CCPA; (iii) disclosures amongst the entities that constitute Company as defined above, or as part of a merger or asset sale; and (iv) as otherwise required or permitted by applicable law.

С. Delete:

Except to the extent we have a basis for retention under CCPA, you may request that we delete your PI that we have collected directly from you and are maintaining. Our retention rights include, without limitation, to complete transactions and service you have requested or that are reasonably anticipated, for security purposes, for legitimate internal business purposes, including maintaining business records, to comply with law, to exercise or defend legal claims, and to cooperate with law enforcement. Note also that we are not required to delete your PI that we did not collect directly from you.

To make a request, follow the instructions at our Consumer Rights Request page here or email us here

In order for us to look into your request, we first need to verify your identity, meaning that we need to make sure that you are the consumer we may have collected personal information about or a person who has been duly authorized to make the request on behalf of the consumer. You are not required to create a password-protected account with us to make a Verifiable Consumer Request. If you do not have a password-protected account, we are required to verify a consumer’s request to delete to a reasonable degree of certainty, which may include matching at least two data points provided by the consumer with data points maintained by us, or to a reasonably high degree of certainty, which may include matching at least three data points provided by the consumer with data points maintained by us, depending on the sensitivity of the PI and the risk of harm to the consumer posted by unauthorized deletion. If you fail to provide the data points, we will be unable to verify you sufficiently to honor your request. The information you send for us to verify your identity will be used for this purpose only.

D. Non-Discrimination and Financial Incentive Programs:

This Financial Incentives and Non-Discrimination Disclosure applies to the Casa Rewards Loyalty Program (the “Program”). A notice for that program follows below. We may add or change programs and/or their terms by posting notice on the program descriptions, so check them regularly. We will not discriminate against you if you exercise any of the rights provided by the CCPA. You can opt-out of non-Program marketing emails, or delete your Personal Information from our active marketing lists, and retain your Program account and benefits.

      1. Rewards Program Financial Incentive Notices
  1. Casa Rewards Loyalty Program

Participating in the Program is entirely optional but is subject to additional Program terms and conditions  . You must opt-in by signing up for a Casa Rewards account, here www.seriouscigars.com/casa-rewards-how.com.

The Program collects Personal Information to facilitate its operations and provide you with Program benefits including Identifiers, Personal records, Personal Characteristics, Commercial information, Online usage information, Sensory data, Professional or Employment information, and Inferences from program data.

We treat the value of any Personal Information collected as the equivalent of relevant expenses related to the collection and retention of Consumers’ Personal Information as part of the Program. We value the benefits of the Program as the value of rewards given to members, which varies from year to year depending on Program participation, which is outlined in the Program terms.

We pay these expenses and provide the Program benefits to foster a positive relationship with our members that is invaluable.

California Consumers may make a PI deletion request under the CCPA, the Consumer will then be required to sign into their password-protected account at SeriousCigars.com or otherwise verify your identity through data points maintained by us. You may, however, terminate Program participation at any time, by calling us at 866-372-4427or emailing us at casarewards@casademontecristo.com . Upon a termination request, some Program data associated with the terminated account may be retained for record keeping, tax reporting, and other legally permissible purposes. You can opt-out of non-Program marketing emails, or delete your Personal Information from our active marketing lists and retain your Program account and benefits.

E. Authorized agents:

Authorized agents of Consumers may make a request by visiting here. As permitted by the CCPA, any request you submit to us is subject to an identification and verification process, and confirmation of the agent’s authority, which may include attestation under penalty of perjury. Absent a power of attorney, we will also require the Consumer to verify their own identity. We may verify identity based on matching information you provided with data we have maintained on you in our systems. This data could include, but is not limited to, email address, mailing address, or phone number.

F. Limitation of Rights:

Notwithstanding anything to the contrary, we may collect, use and disclose your PI as required or permitted by applicable law and this may override your CCPA rights. In addition, we need not honor any of your requests to the extent that doing so would infringe upon our or any other person or party’s rights or conflict with applicable law.

5. ADDITIONAL CALIFORNIA NOTICES

In addition to CCPA rights, certain Californians are entitled to certain other notices, including:

A. Third Party Marketing and Your California Privacy Rights:

Separate from your CCPA “Do Not Sell” rights you have the following additional rights regarding disclosure of your information to third parties for their own direct marketing purposes:

We provide California residents with the option to opt-in to sharing of “personal information” as defined by California’s “Shine the Light” law with third parties, other than with our affiliates, for such third parties’ own direct marketing purposes. We do not share personal information with non-Affiliate third parties for their direct marketing purposes absent your consent. If you are a California resident, you may request information about our compliance with the Shine the Light law and/or withdraw previously given consent to sharing with non-Affiliate third parties for their direct marketing purposes by contacting us here or by sending a letter to us at 5900 North Andrews Ave., Suite 600, Fort Lauderdale, Florida 33309 (Attn: Legal Department). Requests must include “California Privacy Rights Request” in the first line of the description and include your name, street address, city, state, and ZIP code. Please note that we are only required to respond to one request per customer each year, and we are not required to respond to requests made by means other than through the provided e-mail address or mailing address.

As these rights and your CCPA rights are not the same and exist under different laws, you must exercise your rights under each law separately.

B. California Minors:

Although our online service(s) are intended for an audience twenty-one (21) and over, any California residents under the age of eighteen (18) who have registered to use our online services, and who posted content or information on the service, can request removal by contacting us here, detailing where the content or information is posted and attesting that you posted it. We will then make reasonably good faith efforts to remove the post from prospective public view or anonymize it, so the minor cannot be individually identified to the extent required by applicable law. This removal process cannot ensure complete or comprehensive removal. For instance, third parties may have republished or archived content by search engines and others that we do not control.

6. CONTACT US:

For more information on your California privacy rights, email us here. You may also use our California Consumer Rights Portal found here. Or, write to us at: 5900 North Andrews Ave., Suite 600, Fort Lauderdale, Florida 33309 (Attn: Legal Department).