GeoRiot Privacy Policy

1. Overview

GeoRiot (“we” or “us”) provides a set of services (“Genius Link Services”) to commercial customers (“Clients”) for purposes of online marketing and sales of digital and physical products and services (“Products”) to individual consumers. The Genius Link Services are provided to Clients worldwide, including in the United States (“U.S.”), the member states of the European Union (“EU”), and Switzerland. The Genius Link Services are provided under the names “Genius Link” and “BookLinker.net.” The Genius Link Services are not provided to individuals as consumers.

The Genius Link Services are dynamic links that are used to connect consumers visiting or interacting with a Client’s websites, applications, social media, electronic documents, eBooks, text messages and other online digital properties (“Digital Properties”) to retail websites (“Storefronts”) maintained by international goods and services retailers (“Retailers”) where Products identified on the Client’s Digital Property (“Products”) can be purchased. These dynamic links are called “Geni.us Links.” Digital Properties including Geni.us Links are accessed through a personal computer, laptop, smartphone or other device providing Internet access through a browser (“Device”) when an individual follows the Geni.us Link to a Storefront.

GeoRiot collects information that is or can be associated with a particular individual (“Personal Information”) automatically when an individual using a Device clicks a Geni.us Link in the course of viewing and interacting with content on a Client’s Digital Properties (a “Transaction”). Such an individual is referred to as a “Buyer” in this Policy. GeoRiot also collects Personal Information automatically about individuals who navigate to and browse the GeoRiot’s website(s) (“Site Visitors”). Finally, GeoRiot collects Personal Information about individuals acting as or on behalf of Clients for purposes of the Genius Link Services (“Client Users”) in the course of Client account registration and in communications and transactions between the Client and GeoRiot. This Policy explains our data collection and privacy practices with respect to the Personal Information of Buyers, Site Visitors, and Client Users.

2. Adherence to the Standard Contractual Clauses, GDPR & UK Data Protection Laws, and California Consumer Privacy Act.

GeoRiot's and the Genius Link Services' collection, use, and retention of personal information transferred from the European Union, the United Kingdom, and Switzerland to the United States by GeoRiot and Genius Link is conducted in compliance with the Standard Contractual Clauses for Controllers as approved by the European Commission pursuant to Decision C(2021)3701 (the "SCCs"), Regulation (EU) 2016/679 and Regulation (EU) 2018/1725 ("EU Regulations") and the UK GDPR and Data Protection Act of 2018 (UK Data Protection Laws). If there is any conflict between the terms in this Policy, the SCCs, EU Regulations and the UK Data Protection Laws, the SCCs, EU Regulations and the UK Data Protection Laws shall govern. To learn more about the SCCs, and to view the model agreement text, please visit http://data.europa.eu/eli/dec_impl/2021/915/oj.

While not all data described as Personal Information in this Policy is necessarily within the scope of information covered by the SCCs, the GDPR, EU Regulations and the UK Data Protection Laws, as a matter of prudence and due diligence and to help assure transparency, GeoRiot has elected to attest to its adherence to the SCCs, EU Regulations and the UK Data Protections Laws regarding all Personal Information that it collects and maintains, as described in this Policy. GeoRiot has also implemented policies and procedures to assure its compliance with the EU General Data Protection Directive to the extent it applies to Personal Information.

3. Collection and Processing of Personal Information

Please note that GeoRiot does not provide any products or services to individuals acting in a personal capacity or engage in transactions or communications with them. GeoRiot only collects and uses information such as names, addresses or other contact information, governmental or corporate identification numbers, account numbers or images, or other information in connection with Client Users; and only collects and uses information such as username or email address, IP address, or other information in connection with Site Users who post a comment on our blog. GeoRiot does not combine Personal Information with other data to identify individuals for purposes of the Genius Link Services.

Information collected through Geni.us Links and information collected about Site Visitors and Client Users is transferred to and stored by GeoRiot in the United States, according to GeoRiot's standard Data Retention policies. As a matter of due diligence and prudence, GeoRiot has taken appropriate measures to ensure the security, integrity and ethical use of such information, called "Potential Personal Information" for purposes of this Policy. GeoRiot does not combine Potential Personal Information with other data to identify individuals for purposes of the Services.

Access to potential personal information is limited to only those who have been trained on rules and regulations pertaining to the handling of Potential Personal Information. While Potential Personal Information is not directly accessed, it may at times be shown internally during maintenance and troubleshooting operations.

While Potential Personal Information may not be Personal Data within the meaning of GDPR or the UK Data Protection Laws, as a matter of prudence and due diligence and to help assure transparency, GeoRiot has elected to adhere to policies and procedures to assure its compliance with the E.U. General Data Protection Directive to the extent the GDPR and/or the UK Data Protection Laws apply to Potential Personal Information.

In an effort to minimize the burden on our clients and ourselves, we've stopped storing IP addresses, effective May 9th, 2018, after the initial processing of the click.

Buyers

When a Buyer clicks a Geni.us Link the following information is collected automatically, as determined by the coding of the Geni.us Link by GeoRiot:

• Information identifying the operating system and browser used by the Device for the Transaction (“User Agent Information”), including information identifying and describing the Device used for the Transaction (“Device Data”).
• Information identifying the language used by the Device for the Transaction (“Language Information”).
• The Internet Protocol (“IP”) address of the Device used for the Transaction, which allows identification of the logical and to some extent geographical location of the Device used in the Transaction (“Location Data”).
• The URL of the Client’s Digital Property on which the originating Geni.us Link is sited (“Client URL”).
• Product identification information for Products via the Geni.us Link the Device was used to click (“Product Information”).

In addition, GeoRiot may collect the following information from third party sources:

• Product information including Product price, genre, name, author, publisher, and other general information published by the Retailer, developer or other third party ("Third Party Product Information").
• Limited purchase information obtained by the Retailer in the event a Buyer purchases a Product in the course of a Transaction, such as the number of products purchased, a list of items (or categories of items), purchase prices, and timestamp of the Transaction (“Limited Purchase Information”).

Geni.us Links may support the following uses of Personal Information, for the benefit of Clients:

• Dynamic Links. A Client can use a single link to route Buyers to the appropriate Retailer website based on information such as the user’s location, device, and language set in the browser. This may include dynamic links on a Client’s Digital Property which automatically populate a Storefront customized for the Buyer on the Digital Property. For example, a Client website that reviews technology devices may display related products with links to purchase them on Retailer Amazon’s Storefront. The Geni.us Link may be used to ensure the Amazon link that appears on the Client’s website is directed appropriately based on the Buyer’s location.
• Automatic Product Localization. A Client can use a single link to automatically route Buyers to the appropriate Product in the Buyer’s local Storefront, such as the Amazon, iTunes, or Microsoft online stores. Automatic affiliation may be used to earn commissions from the correct local Retailer’s Storefront. For example, a Buyer in Germany may be sent to the Amazon Germany Storefront by a Geni.us Link from a Client website, and the Client might earn a commission through the Amazon Germany affiliate program.
• Choice Pages. A Client may use a link to provide a mobile-optimized landing page where a Buyer can view different buying options, rather than having an automated process pick for them.
• Retargeting. The Client may use a Geni.us Link to set pixels on behalf of the Client to enable collection of Client activity data by third-parties such as Facebook and Google.

• Data Analytics. The Data Analytics service provides Clients with marketing content based on data identifying the geographical location (“Location Data”), Device data, User Agent Data, Language Data and Transactions Data. The Data Analytics service helps Clients ensure that marketing efforts are relevant to the Buyer and appropriate to the country or region where the Buyer is located.

Site Visitors When a Site Visitor navigates to and engages with the GeoRiot website, GeoRiot collects the following information automatically through external service providers:

• Interaction and usage data, including information about how you reached the website and your navigation of the website.
• Information provided in connection with a comment posted on our blog, including your public Disqus account information or email address, Location Data, and the content of the post.

GeoRiot uses this information for purposes of internal data analytics and first-party marketing and advertising, and to otherwise identify and communicate potential opportunities to promote GeoRiot to Site Visitors. Client Users When a Client creates a Genius Link account, the Client must provide GeoRiot with contact information for an individual user authorized to use the Genius Link Services and communicate with GeoRiot, either as an individual Client or on behalf of an organizational Client (“Client User”). This information may include Client User’s name, email addresses, and other contact information used to communicate with the Client User, the Client User’s IP address, as well as the content of communications between GeoRiot and the Client User and any transactions the Client User engages in with GeoRiot. GeoRiot may use such information to communicate with the Client User and with other individuals acting on behalf of the Client with respect to the Genius Link Services, and to otherwise ensure proper administration of the Genius Link Services (“Administrative Purposes”), and may use it to identify and communicate with respect to potential opportunities for the Client to obtain or use Genius Link Services from GeoRiot, or otherwise promote GeoRiot to the Client and Client User (“Marketing Purposes”). When a Client User engages with the GeoRiot website or the Genius Link platform, GeoRiot collects usage data automatically through external service providers. Cookies and Third-Party Tracking Technologies

GeoRiot relies on partners to provide many features of our sites and Genius Link Services using data about Buyers’ engagement with Geni.us Links, Site Visitors’ navigation to and engagement with the GeoRiot website and blog, and Client Users’ use of our site and the Genius Link platform. Much of the information we automatically collect about Buyers, Site Visitors and Client Users is through cookies, web beacons, and other tracking technologies, as well as through your web browser or device. GeoRiot currently responds to browser “Do Not Track” signals.

Most web browsers automatically accept cookies but, if you prefer, you can usually modify your browser setting to disable or reject cookies. If you delete your cookies or if you set your browser to decline cookies, some features of the Genius Link Services, and our website and blog, may not be available, work, or work as designed. You may also be able to opt out of or block tracking by interacting directly with the other companies who conduct tracking through the Genius Link Services and our website and blog.

Category	Partner	Further Information
Advertising	Bing Ads	Privacy Policy / Opt Out
Functional	Disqus	Privacy Policy / Opt Out
Social Media	Facebook Connect	Privacy Policy / Opt Out
Advertising	Facebook Custom Audience	Privacy Policy / Opt Out
Advertising	DoubleClick / Google AdWords	Privacy Policy / Opt Out
Analytics and Performance	Google Analytics	Privacy Policy / Opt Out
Analytics and Performance	Google Tag Manager	Privacy Policy / Opt Out
Functional	Gravatar	Privacy Policy / Opt Out
Analytics and Performance; Functional	Intercom	Privacy Policy / Opt Out
Analytics and Performance	Pingdom	Privacy Policy / Opt Out
Analytics and Performance	Segment	Privacy Policy

4. Collection and Processing of Client Personal Data

When a Client creates a Genius Link account the Client must provide GeoRiot with contact information for an individual user authorized to use the Genius Link Services and communicate with GeoRiot, either as an individual Client or on behalf of an organizational Client ("Client Users"). This information may include the Client User name, email addresses and other contact information used to communicate with the Client User, as well as the content of communications between GeoRiot and the Client User and any transactions the Client User engages in with GeoRiot. GeoRiot may use Client Personal Data to communicate with the Client User and with other individuals acting on behalf of the Client with respect to the Genius Link Services ("Administrative Purposes"), and may use Client Personal Data to identify and communicate with respect to potential opportunities for the Client to obtain or use Genius Link Services from GeoRiot, or otherwise promote GeoRiot to the Client and Client User ("Marketing Purposes"). GeoRiot will not use Client Personal Data for Marketing Purposes unless the Client or Client User has consented to such use of Client Personal Data. Client Personal Data is transferred to and stored by GeoRiot in the United States, according to GeoRiot's standard Data Retention policies. Client Personal Data is considered Personal Data within the meaning of the SCCs, the UK Data Protection Laws and the GDPR. GeoRiot has elected to attest to its adherence to the SCCs and the UK Data Protection Laws regarding all Personal Information that it collects and maintains, as described in this Policy. GeoRiot has also implemented policies and procedures to assure its compliance with the EU General Data Protection Directive to the extent it applies to Personal Information.

5. GeoRiot as Limited Data Controller and Data Processor

For GDPR purposes GeoRiot may be a Data Processor or a Joint Data Controller with respect to Potential Personal Information subject to this Policy. GeoRiot is a Data Controller with respect to Client Personal Data subject to this Policy. For purposes of this Policy a "Data Controller" is a party which, alone or jointly with others, determines the purposes and means of the processing of Personal Data, while a "Data Processor" is a party which processes Personal Data on behalf of a Data Controller. To the extent the EU SCCs, the GDPR and the UK Data Protection Laws apply to Personal Information, for purposes of the Genius Link Services GeoRiot and the applicable Client are Joint Data Controllers of the Personal Information as follows:

• GeoRiot offers Geni.us Links and the Genius Link Services to Clients, with pre-established coding and design which determine the information which is collected and the means by which information is processed. The Client determines whether to implement Geni.us Link and use the Genius Link Services, and by agreement with GeoRiot determines to utilize the information collection scope and processing means offered by GeoRiot. All Genius Link Services are provided for the benefit of the Client. The Client is therefore the Data Controller with respect to the determination of the scope of the information to be collected and the means of its processing.
• The Client determines where to site Geni.us Link(s) in the Client’s Digital Properties, and the purpose(s) for which the information collected will be used (e.g., available Storefronts, implementation of routing alternatives, support for commissions, etc.). All Personal Information about Buyers is processed for the benefit of the Client. The Client is therefore the Data Controller with respect to the determination of siting of the Geni.us Link(s) and the purposes for which information is collected and processed.
• GeoRiot determines the retention period for information collected via Geni.us Links. GeoRiot is therefore the Data Controller with respect to the retention of the Personal Information.

GeoRiot alone controls the processing of Client Personal Data and is therefore the Data Controller with respect to such information.

6. Provision of Notice to Buyers, Site Visitors, and Client Users

This Policy is published to provide notice of GeoRiot’s data collection and privacy practices to individuals, including Buyers, Site Visitors, and Client Users. GeoRiot interacts directly with Client Users in the course of account registration and communications and transactions with respect to the Genius Link Services. However, GeoRiot does not typically interact directly with individuals, since its presence on its Clients’ Digital Properties is limited to the Geni.us Link(s) in/on the Client’s Digital Properties. GeoRiot therefore contractually requires its Clients to ensure their compliance with any legal requirements for notification to and consent by individuals with respect to their data collection and use practices, as required in their applicable jurisdictions. In addition, GeoRiot contractually requires its Clients to comply with the Network Advertising Initiative Code of Conduct where it is applicable to their business. In particular, if a Client attempts to combine data about an individual from other sources with GeoRiot Personal Information, it is required to notify the affected individuals and obtain their opt-in consent in accordance with the NAI Code of Conduct. If a Client collects data for interest-based advertising, it is required to clearly and conspicuously post a notice consistent with the NAI Code that contains:

• A statement that data may be collected for interest-based advertising;
• A description of types of data that are collected for interest-based advertising purposes;
• An explanation of how, and for what purpose, the data collected will be used or transferred to third parties; and
• A conspicuous link to an opt-out mechanism.

a. Collection of Information

Buyers GeoRiot principally collects information through transactions that occur as part of “Link Localization.” In this process a Geni.us Link which promotes or sells a product is posted on a Client’s Digital Property, and automatically points to a Retailer’s online Storefront designated by the Client. When a Buyer clicks the Geni.us Link, Personal Information is collected and transmitted to GeoRiot’s servers. This information is automatically analyzed to identify the location and type of Device being used to access the link. Based on this information, the Geni.us Link automatically redirects the Device to a web page in regional or country-specific storefront of the Retailer (“Localized Page”) which promotes or sells the product. GeoRiot does not create or administer either its Clients’ Digital Properties or Retailers’ Storefront pages, does not provide content for either, and does not sell or promote products on either. The only information GeoRiot collects from either the Digital Property or the Storefront is that provided in response to the click on the Genius Link. GeoRiot may collect and process the following information from the Device used to click on the Geni.us Link:

• User Agent Information which identifies the Device, operating system and browser used by the Device in use.

• Location Information, which is the IP address of the Device used in the Transaction. The IP address provides network information, which can often be used to determine the country, state and sometimes city and postal code where the Device is in use. Location Information is treated as if it were Personal Information. However, GeoRiot typically deletes Location Information within five minutes of the click, and does not maintain or store such data beyond that time period.
• Language Information, which is the language associated with the Device’s browser.
• The Client URL, which is the URL of the Client’s Digital Property on which the originating Geni.us Link is sited.
• Product Information, which is identification information for Products the Device was used to view.

• Limited Purchase Information such as the number of products purchased, a list of items (or categories of items), purchase prices, and timestamp of the Transaction (“Limited Purchase Information”). Limited Purchase Information is collected and provided to GeoRiot by Clients, who are responsible for ensuring that any individual consent or authorization required for its use by GeoRiot has been obtained.

GeoRiot does not collect any other information that might be considered, or might be used to derive, Personal Information, sensitive or otherwise. GeoRiot’s Genius Link Services are only offered with respect to individuals who are 18 years of age or older. GeoRiot does not knowingly collect or maintain any Personal Information from individuals who are under 13 years of age, and no aspect of the Genius Link Services is designed to attract people under the age of 13. If GeoRiot obtains knowledge that a Buyer is under the age of 13, GeoRiot will remove Personal Information with respect to that individual from its databases. Site Visitors When a Site Visitor navigates to and engages with the GeoRiot website, GeoRiot collects the following information automatically through external service providers:

• Interaction and usage data, including information about how you reached the website and your navigation of the website.
• Information provided in connection with a comment posted on our blog, including your public Disqus account information or email address, Location Data, and the content of the post.

Client Users When a Client creates a GeoRiot account it must provide GeoRiot with contact information for individual users authorized to use the Genius Link Services and communicate with GeoRiot as or on behalf of a Client (“Client Users”). This information may include Client User name, email addresses, and potentially other information used to communicate with the Client User, as well as the content of communications between GeoRiot and the Client User and any transactions the Client User engages in with GeoRiot. When a Client User engages with the GeoRiot website or the Genius Link platform, GeoRiot collects usage data automatically through external service providers.

b. Use and Retention of Personal Information

GeoRiot may use and retain Personal Information about Buyers and Client Users in the following manner:

Buyers

Client Users

For purposes of Link Localization, to redirect Consumers from digital properties to appropriate Storefronts. For purposes of Data Analytics, to create reports of Client marketing activities using Genius Link links. Reports include aggregated information about matters including click trends, geographic information, sales and commissions data, separately or in combination, based on Data collected by GeoRiot. Reports may be filtered based on specified parameters (e.g. number of clicks per day per specific location; clicks from specific referrers or from Devices using specific Software; etc.). For purposes of Data Analytics, in aggregated data sets to support specific marketing strategies and Product and advertising content offerings, based on mashups of various types of data with different Transactions. For purposes of GeoRiot’s internal management and administration, and fulfillment of our legal responsibilities or protection of our legal interests.

To communicate with the Client User and with other individuals acting on behalf of the Client with respect to the Genius Link Services. To identify and communicate potential opportunities for the Client to obtain or use Genius Link Services from GeoRiot, or otherwise promote GeoRiot to the Client and Client User. For marketing or promotional purposes. For purposes of GeoRiot’s internal management and administration, and fulfillment of our legal responsibilities or protection of our legal interests.

GeoRiot may use and retain Personal Information about Site Visitors for purposes of internal data analytics and first-party marketing and advertising, and to otherwise identify and communicate potential opportunities to promote GeoRiot to Site Visitors, internal management and administration, and fulfillment of our legal responsibilities or protection of our legal interests. Subject to Section 6(c), GeoRiot may retain Buyer, Site Visitor, and Client User Personal Information in the following manner: In accordance with our retention policies. For any period we determine is necessary to ensure compliance with our legal responsibilities or to protect our legal interests. IP addresses for Buyers are only processed during the initial click on a Geni.us Link and are not stored thereafter.

c. Your Choices with Respect to Personal Information

Buyers The Personal Information GeoRiot maintains about Buyers after processing a Geni.us Link click is limited to User Agent Information, Language Information, Client URL, Product Information, and Limited Purchase Information. As noted above, GeoRiot typically deletes Location Information within 5 minutes of the click, and does not maintain or store such data beyond that time period. Because GeoRiot lacks the ability to identify a particular Buyer in connection with any Personal Information that we store or maintain, we cannot offer Buyers any choices with respect to Personal Information. GeoRiot retains Device information that is subject to a Buyer’s disclosure opt-in in accordance with GeoRiot’s Data Retention Policy. The purpose of retaining such information is for GeoRiot’s internal management and administration or fulfillment of our legal responsibilities or protection of our legal interests. Residual User Agent information, which GeoRiot de-identifies to the standard of reidentification set forth under applicable law, may also remain within our databases, access logs, and other records. Site Visitors The Personal Information GeoRiot maintains about Site Visitors who navigate to and engage with the GeoRiot website is limited to the following information that we collect in connection with a comment posted on our blog: the author’s email address, Location Data, and post content. GeoRiot uses the Disqus Comment Platform to power and moderate comments on our blog. If you own a registered Disqus account, click here to use the self-service feature in your Disqus Account settings to delete or access your user account data. If you posted your comment as a guest, you can email us here to request that we delete your comment. A Site Visitor may opt-out of automatic information collection by third-party tracking tools by visiting the Cookie Preferences pane and setting the desired privacy preferences. Because GeoRiot lacks the ability to identify a particular Site Visitor in connection with any interaction and usage data that we store or maintain, we cannot offer Site Visitors any choices with respect to that information. GeoRiot retains Personal Information about Site Visitors in accordance with GeoRiot’s Data Retention Policy. The purpose of retaining such information is for GeoRiot’s internal management and administration, first-party marketing and advertising purposes, or fulfillment of our legal responsibilities or protection of our legal interests. Client Users A Client User may request to opt-out of any previously authorized or permitted disclosure of Client User Personal Information by GeoRiot, except disclosure to the Client with which the Client User is associated, by visiting the Cookie Preferences pane and setting the desired privacy preferences. GeoRiot retains Personal Information about Client Users that is subject to a Client User’s disclosure opt-out in accordance with GeoRiot’s Data Retention Policy. The purpose of retaining such information is for GeoRiot’s internal management and administration or fulfillment of its legal responsibilities or protection of its legal interests. GeoRiot is not responsible for updating or removing Client Users’ Personal Information disclosed to third parties before the Client User’s opt-out. GeoRiot provides Client Users with the opportunity to review and request that GeoRiot update or delete their Personal Information. To exercise these rights, email us here.

d. Accountability for Onward Transfer of Consumer's Potential Personal Information

GeoRiot may disclose or provide information about Buyers and Client Users to external parties as follows:

Buyers

Client Users

To a Client for purposes of Data Analytics, as part of aggregated data in a report or data set. To a subsidiary or affiliated company of GeoRiot (“Corporate Affiliate”), subject to their compliance with this Privacy Policy. To service providers, such as a hosting or analysis service or a security consulting firm, for purposes of GeoRiot’s internal management and administration or fulfillment of its legal responsibilities or protection of its legal interests, subject to contractual requirements for protection of the information consistent with this Policy and the SCCs’ requirements. To governmental authorities or their legal designees, if required by applicable law.

To the Client with which the Client User is associated, if applicable, for any purpose. To a subsidiary or affiliated company of GeoRiot (“Corporate Affiliate”), subject to their compliance with this Privacy Policy. To service providers, such as a hosting or analysis service or a security consulting firm, for purposes of GeoRiot’s internal management and administration or fulfillment of our legal responsibilities or protection of our legal interests, subject to contractual requirements for protection of the information consistent with this Policy and the SCCs’ requirements. To governmental authorities or their legal designees, if required by applicable law. In the case of a Client using an affiliate program with the Genius Link Services, GeoRiot may share Client and account information with the affiliate program’s account management teams in order to ensure compliance with the affiliate program.

GeoRiot may disclose or provide information about Site Visitors to external parties as follows:

• To a subsidiary or affiliated company of GeoRiot (“Corporate Affiliate”), subject to their compliance with this Privacy Policy.
• To service providers, such as a hosting or analysis service or a security consulting firm, for purposes of GeoRiot’s internal management and administration, first-party marketing or advertising, or fulfillment of our legal responsibilities or protection of our legal interests, subject to contractual requirements for protection of the information consistent with this Policy and the SCCs’ requirements.
• To governmental authorities or their legal designees, if required by applicable law.

e. Consumer Access to Potential Personal Information

The Potential Personal Information GeoRiot maintains after processing a geni.us Link click is limited to User Agent Information, Language Information, Client URL, Product Information, Limited Purchase Information and Third Party Product Information. The only information maintained by GeoRiot which might in principle allow identification of an individual Consumer is User Agent Information and Limited Purchase information, which would have to be combined with other information from third parties which is not available to GeoRiot in order to allow identification of an individual Consumer. GeoRiot therefore can only provide a Consumer with an opportunity to review and request that GeoRiot update or delete their Personal Data included in Potential Personal Information if the Consumer can provide GeoRiot with additional information regarding the Consumer's association with specific User Agent Information and/or Limited Purchase Information for GeoRiot to identify the Consumer with specific Potential Personal Information in GeoRiot's control, with a reasonably high degree of reliability. In the event a Consumer provides such information, GeoRiot will upon request allow them to review and request that GeoRiot update or delete Potential Personal Information to the extent the information can be identified to the individual Consumer or is identifiable to a specific Device used by the Consumer for the Transaction(s) for which the information was collected. For additional information and to request the opportunity to review and request update or deletion, please email GeoRiot here.

f. Security

GeoRiot maintains reasonable and appropriate physical, electronic and procedural safeguards (E.g. general PII safeguard processes, account ownership verification for client support, Compliance with GDPR/CCPA data deletion requests), considering factors such as the currently available security technologies and the costs to implement those technologies to protect Personal Information from loss, misuse and unauthorized access, disclosure, alteration or destruction, taking into due account the risks involved in the processing and the nature of the Personal Information. With respect to electronically stored information, safeguards that GeoRiot maintain include, but are not limited to: (1) restricting access to servers and other infrastructure to only authorized individuals with VPN credentials; (2) regular installation of software security updates; (3) logging of system activities such as failed login attempts and suspicious behavior; and (4) retention of data for only the duration necessary for processing. Notwithstanding the safeguards maintained by GeoRiot. GeoRiot cannot guarantee that these safeguards will not be penetrated or compromised or that all information will remain secure under all circumstances.

g. Data Integrity and Purpose Limitation

GeoRiot will take reasonable steps to ensure that Personal Information is accurate, complete, current, and reliable for its intended use, and to ensure that it does not process Personal Information in a way that is incompatible with the purposes for which it was collected unless authorized by the individual. GeoRiot will take reasonable and appropriate measures to ensure that it does not retain Personal Information only for as long as is consistent with the purposes for which it was collected.

h. Disclosures for Law Enforcement and National Security Purposes

GeoRiot may be required to disclose Personal Information in response to lawful requests by public authorities with appropriate jurisdiction, including to meet national security or law enforcement requirements, if required by applicable law.

7. YouTube Features

Some Geniuslink features, such as the YouTube Link Optimizer, may use YouTube API Services. By using these features, you are bound by the YouTube Terms of Service. See the Google Privacy Policy. You may revoke Geniuslink access to your data any time in your Google Security Settings.

8. Notice for California Residents

Persons with disabilities may obtain this notice in alternative format upon request by emailing us at hi@geni.us or by mail at: Geniuslink
Att’n: Privacy Policy
P.O. Box 47406
Seattle, WA 98146

Your Privacy Rights

The California Consumer Privacy Act (“CCPA”) provides California residents with rights to receive certain disclosures regarding the collection, use, and sharing of “Personal Information,” as well as rights to know/access, delete, and limit sharing of Personal Information. The CCPA defines “Personal Information” as “information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” Certain information we collect may be exempt from the CCPA because it is considered public information (i.e., it is made available by a government entity) or covered by a specific federal privacy law, such as the Gramm–Leach–Bliley Act, the Health Insurance Portability and Accountability Act, or the Fair Credit Reporting Act. To the extent that GeoRiot collects Personal Information that is subject to the CCPA, that information, our practices, and your rights are described below.

1. Right to Notice at Collection Regarding the Categories of Personal Information Collected

You have the right to receive notice of the categories of Personal Information that GeoRiot collects, and the purposes for which those categories of Personal Information will be used. This notice should be provided at or before the time of collection. The categories we use to describe the information are those enumerated in the CCPA.

• Personal Identifiers:
  • GeoRiot collects Client Users’ name, email address, and other contact information when they create an account. GeoRiot uses this information to provide Genius Link Services, Administrative Purposes, Marketing Purposes.
  • GeoRiot collects Client Users’ IP address when they log into their account. GeoRiot uses this information for Administrative purposes.
  • When Buyers click a Geni.us Link, GeoRiot automatically collects the IP address of the Device used for the Transaction (“Location Information”). However, GeoRiot typically deletes Location Information within 5 minutes of the click, and does not maintain or store it beyond that time period. GeoRiot uses Location Information to provide Data Analytics services for Clients.
  • When Site Visitors post a comment to our blog, GeoRiot collects the Site Visitors’ public Disqus account information or email address, IP address, and the content of the post.
• Protected Classifications: GeoRiot does not collect information relating to gender, racial or ethnic origin, or sexual orientation.
• Commercial Information: GeoRiot does not create records of goods or services purchased or considered by individual consumers, or their purchasing or consuming histories or tendencies.
• Biometric Information: GeoRiot does not collect information relating to physiological, biological, or behavioral characteristics.
• Internet or Other Electronic Network Activity Information: GeoRiot automatically collects information about how Client Users use our website and engage with the Genius Link platform in order to improve and provide Genius Link Services. GeoRiot automatically collects information about how Site Visitors navigate to and engage with the GeoRiot website for purposes of internal data analytics and first-party marketing and advertising.
• Geolocation Data: GeoRiot does not collect precise geographic location information.
• Audio, electronic, visual, thermal, olfactory, or similar information: GeoRiot does not collect images or any thermal, olfactory, or similar information.
• Professional or employment-related information: GeoRiot does not collect information relating to employment or employment history.
• Education information: GeoRiot does not collect information relating to institutional enrollment or education level.
• Inferences drawn to create a profile about a consumer reflecting the consumer’s preferences or characteristics: GeoRiot does not create internal profiles capturing consumer preferences or characteristics.

9. Right to Know About Personal Information Collected, Disclosed, or Sold

You have the right to request that GeoRiot disclose to you the Personal Information that we collect, use, disclose, or sell. In addition to being described below, further information about GeoRiot’s collection, use, disclosure, and sale of Personal Information is available in Sections 3, 4, 5 and 6 of this Privacy Policy. GeoRiot may use any of the categories of information listed above for other business or operational purposes compatible with the context in which the Personal Information was collected. GeoRiot may share any of the Personal Information collected with our Corporate Affiliates and with Service Providers, which are companies that we engage for business purposes to conduct activities on our behalf. Service Providers are restricted from using Personal Information for any purpose that is not related to our engagement. The categories of Service Providers with whom GeoRiot shares information and the services they provide are described above in the section titled “Provision of Notice to Buyers, Site Visitors, and Client Users – Sharing Information With External Parties.” GeoRiot also sells some information about Site Visitors and Client Users to third parties, as described below.

10. Right to Know/Access Information and to Request Deletion of Information

You have the right to request access to Personal Information collected about you and information regarding the source of that information, the purposes for which we collect it, and the third parties and service providers with whom we share it. You also have the right to request in certain circumstances that we delete Personal Information that we have collected directly from you. GeoRiot only maintains the above-listed categories of Personal Information with regard to Client Users, who may submit requests to know/access or deletion as described below. To protect your Personal Information, GeoRiot is required to verify your identify before we can act on your request. We may have a reason under the law why we do not have to comply with your request, or why we may comply with it in a more limited way than you anticipated. If we do, we will explain that to you in our response. How to Submit a Request You may submit a request to exercise your rights to know/access or delete your Personal Information through one of the following means:

1. By e-mailing GeoRiot at hi@geni.us
2. By filling out the Consumer Data Request Form

Verification Procedures To the extent we believe we have information subject to your request, we must verify your identity before we can provide access to or delete that information. We do this by asking you to provide the email address(es) you previously contacted us with or the username assigned when creating your account, so we can match that data against information we may have collected from you previously Authorized Agent You may authorize another individual or a business registered with the California Secretary of State, called an authorized agent, to make requests on your behalf. GeoRiot requires that you and the individual complete affidavits in order to verify the identity of the authorized agent and confirm that you have authorized them to act on your behalf. Parents of minor children may submit a birth of the child certificate in lieu of an affidavit, in order to make requests on the child’s behalf. Please see Please see the CONSUMER AFFIDAVIT TO AUTHORIZE AGENT and the AFFIDAVIT OF AUTHORIZED AGENTS.

11. Right to Opt Out of Sale of Personal Information to Third Parties

You have the right to opt out of any sale of your Personal Information by GeoRiot to third parties. To “sell” information means to disclose it to a company for monetary or other benefit. A company may be considered a third party either because the purpose of sharing is not an enumerated business purpose under California law, or because our contract does not restrict them from using Personal Information for other purposes. GeoRiot sells the following information:

• Internet or Other Electronic Network Activity Information: GeoRiot provides information to vendors that provide data collection and analytics services about (i) how Client Users use our website and engage with the Genius Link platform to vendors that provide data collection and analytics services; and (ii) how Site Visitors navigate to and interact with the GeoRiot website.

To exercise your right to opt out of the sale of your Personal Information, you can visit the Cookie Preferences pane and set your desired privacy preferences, change your browser or device settings to block third-party cookies, or utilize an option for directly opting out of or blocking tracking by a vendor listed above in the subsection titled “Cookies and Third-Party Tracking Technologies.” Because GeoRiot lacks the ability to identify a particular Client User or Site Visitor in connection with any website interaction and usage data that we collect, these are the only mechanisms by which we can receive and implement requests to opt out of the sale of Personal Information. Please note that your right to opt out does not apply to GeoRiot’s sharing of Personal Information with Service Providers or with our Corporate Affiliates. GeoRiot may also disclose information to other entities who are not listed here when required by law or to protect our Company or other persons, as described above in the section titled “Provision of Notice to Buyers, Site Visitors, and Client Users – Sharing Information With External Parties.”

12. Right to Information Regarding Participation in Data Sharing for Financial Incentives]

You have the right to be free from discrimination based on your exercise of your CCPA rights. GeoRiot does not offer any rewards programs or incentives for the collection or sharing of data at this time.

13. Recourse, Enforcement, and Liability

GeoRiot is subject to the jurisdiction of the United States Federal Trade Commission ("FTC") with respect to this Policy. The FTC may investigate violations of this Policy, and enforce compliance with the SCCs, EU Regulations, the UK Data Protection Laws and applicable law. GeoRiot provides assurance of its compliance with this Policy by conducting internal assessments of its relevant practices internally. In the event such an assessment finds non-compliant privacy, corrective action plans will be developed to resolve the identified gaps in compliance, as well as preventive action plans to maintain compliance. Any employee GeoRiot finds has violated this Policy will be subject to disciplinary action up to and including termination of employment. Any complaints, questions or concerns about the use or disclosures of Potential Personal Information or Client Personal Data by GeoRiot or other matters subject to this Policy should be directed to the address given below. GeoRiot will investigate and attempt to resolve complaints and disputes regarding use and disclosure of personal information in accordance with the principles contained in this Policy, and will respond to any complaint within thirty (30) days of receiving a complaint. In the event you are not satisfied with the response to a complaint you may seek independent review by arbitration. In such an event the dispute will be subject to arbitration by the International Centre for Dispute Resolution of the American Arbitration Association ("ICDR"), under the rules of the ICDR, at no cost to you. In the event you have filed a complaint and pursued arbitration for a violation of this Policy, the SCCs, EU Regulations or the UK Data Protection Laws by GeoRiot and are not satisfied with the result, you have the right to seek arbitration by a panel proficient with SCCs, EU Regulations and the UK Data Protection Laws. This panel may impose individual-specific, non-monetary equitable relief to remedy the violation of the Principles with respect to your rights. You may seek such arbitration through your nation's Data Protection Authority ("DPA"). GeoRiot will respond promptly and appropriately to inquiries about this Policy and compliance with the EU Regulations, UK Data Protection Laws and the SCCs from the FTC or the U.S. Department of Commerce, including inquiries from DPAs.

14. Amendment of Policy

GeoRiot reserves the right to modify this Policy at any time without notice. If GeoRiot amends this Policy, notice of the amendment and the amended policy will be posted on the Genius Link website and such other sites as GeoRiot may deem appropriate. Any amendment will be consistent with the requirements of the SCCs and applicable EU law. The terms of this Privacy Policy in effect at the time Personal Information is collected by GeoRiot shall continue to apply to such information notwithstanding such amendment.

15. Contact Information

Please contact us at hi@geni.us with any questions, comments, or concerns. You may also mail us at: Geniuslink
Att’n: Privacy Policy
P.O. Box 47406
Seattle, WA 98146