1-800 Contacts Privacy Notice for California and Virginia Consumers

Effective Date: November 29, 2023

1-800 Contacts provides this Privacy Notice to supplement the information contained in the 1-800 Contacts Online Privacy Notice. This Privacy Notice sets forth our privacy practices as required by the California Consumer Privacy Act of 2018 and California Privacy Rights Act of 2020 (collectively, “CCPA”) and the Virginia Consumer Data Protection Act (the “VCDPA”) in those circumstances where we collect your information that is not considered protected health information subject to HIPAA.

This Privacy Notice applies only if you are a resident of California or Virginia, are considered a “Consumer” under such laws,  and we collect your “Personal Information” (as defined by the CCPA and VCDPA respectively).  If you are an employee, employee applicant, or contractor, please refer to the 1-800 Contacts Privacy Notice for California Consumers (Company Employees). 

Notice of information we collect

We collect and have collected your Personal Information as described below in a variety of different situations, including, but not limited to, when you use our services (e.g., when you use our website our mobile application), open our emails, or when you call us). More specifically, we collect the following categories of Personal Information from you, depending on the particular Business Purpose (described in How We Use Personal Information below) for which we collect it. This table also sets out the Personal Information we have collected over the last twelve (12) months:

Category	Examples of Personal Information We May Collect	Retention Period (minimum)
A. Identifiers.	A real name, postal address, Internet Protocol address, email address unique personal identifier, device identifier, online identifier, account name	Length of customer Relationship, plus six (6) years
B. Personal Information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	This information comprises any Personal Information that identifies, relates to, describes or is capable of being associated with you or your household in our records. Some Personal Information in this category may overlap with other categories.	Length of customer relationship, plus six (6) years
C. Protected classification characteristics under California, Virginia, or federal law.	Sex or Age.	Length of customer relationship, plus six (6) years
D. Commercial information.	Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	Length of customer relationship, plus six (6) years
E. Biometric information.	None
F. Internet or other similar network activity. This includes information we automatically collect as you browse the Site, including through the use of first and third party cookies.	Information on a consumer’s interaction with a website, application, or advertisement.	Generally for as long as one (1) year, although under certain circumstances the retention may be for a longer time.
G. Geolocation data.	Physical location.	Generally for as long as one (1) year, although under certain circumstances the retention may be for a longer time
H. Sensory data.	None.
I. Professional or employment-related information.	1-800 Contacts Privacy Notice for California Consumers (Company Employees).	See Company Employee Notice
J. Education information, as defined by the Family Educational Rights and Privacy Act	None.
K. Sensitive Personal Information	We do not collect sensitive Personal Information for purposes of inferring characteristics.
L. Inferences drawn from other Personal Information.	Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes, such as inferences related to your website visit.	Length of customer relationship, plus six (6) years

Personal Information does not include deidentified, aggregated or publicly available consumer information, or information that is outside the scope of the CCPA or VCDPA (such as protected health information).

Categories of sources of Personal Information

1-800 Contacts obtains the categories of Personal Information listed above from the following categories of sources:

• Directly from you. For example, from forms you complete or information you provide to us when you interact with us.
• Indirectly from you. For example, from observing your actions within our platforms or your interaction with our platforms from your device if the device is configured to allow such observations. 
• Third parties. For example, we may receive information about you from our affiliates or other third parties we work with to market or provide you our products and services.
• Service Providers. We may receive information from service providers who are providing services to us or to you on our behalf.

How we use Personal Information

• We use your Personal Information for one or more of the following business purposes: To fulfill or meet the purpose for which you provided the information. For example, if you share your name and contact information to ask us a question or inquire about our products or services, we will use that Personal Information to respond to your inquiry.
• To contact you and to inform you about products, services, promotions, special offers, and/or events that may interest you.
• To provide, support, personalize, and develop our Website, products, and services.
• To create, maintain, customize, and secure your account with us.
• To process your requests and prevent transactional fraud.
• To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
• If you provide your information in the context of an employment application or your employment, we will use your information to serve those purposes.
• To personalize your mobile application or Website experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our Website, mobile applications, third-party sites, and via email or text message (with your consent, where required by law).
• To help maintain the safety, security, and integrity of our mobile application or Website, products and services, databases and other technology assets, and business.
• For research, analysis, and business development, including to develop and improve our Website, products, and services.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• As described to you when collecting your personal information or as otherwise set forth in the CCPA or VCDPA or subsequently agreed to by you.
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of 1-800 Contacts assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by 1-800 Contacts about our Consumers is among the assets transferred.

How we share Personal Information

1-800 Contacts may disclose your Personal Information to a third party for a business purpose, including to our service providers.

We share your Personal Information with the following categories of third parties:

• Service providers.
• Third parties with whom you direct us to share your personal information.

Disclosures of Personal Information for a business purpose

In the preceding twelve (12) months, 1-800 Contacts has disclosed the following categories of Personal Information with the corresponding category of third parties for the specified business purpose:

Sales or sharing of Personal Information

In the preceding twelve (12) months, Company has (i) not sold Personal Information, and (ii) has shared Category A (Identifiers) and Category F (Internet activity) for cross-context behavioral advertising or targeted advertising. We do use third party cookies and other online tracking technologies for advertising. For information on the types of tacking technologies and the reasons why we use them, see our How we use cookies and other tracking technologies. If you wish to opt out of such sharing, please email privacydepartment@1800contacts.com.

Your consumer rights and choices

The CCPA and the VCDPA provide Consumers with specific rights regarding their Personal Information. This section describes your CCPA and VCDPA rights and explains how to exercise those rights.

Access to specific information and data portability rights

You have the right to request that 1-800 Contacts disclose certain information to you about our collection and use of your Personal Information over the past 12 months. Once we receive and confirm your verifiable consumer request (see Exercising Access, Data Portability, Data Correction and Deletion Rights), we will disclose to you under your Right to Know:

• The categories of Personal Information we collected about you.
• The categories of sources for the Personal Information we collected about you.
• Our business or commercial purpose for collecting, selling, or sharing that Personal Information.
• The categories of third parties with whom we disclose that Personal Information.
• The specific pieces of Personal Information we collected about you.
• If we disclosed your Personal Information for a business purpose, a list disclosing the disclosures for a business purpose, identifying the Personal Information categories that each category of recipient obtained.
• You have the right to correct inaccurate Personal Information that we have collected.

Deletion request rights

You have the right to request that 1-800 Contacts delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (see Exercising access, data portability, data correction and deletion rights), we will delete (and direct our service providers and third parties (with which we have shared your Personal Information) to delete) your Personal Information from our records, unless an exception applies.

In accordance with the CCPA and VCDPA, we may deny your deletion request under certain circumstances, and will inform you of the basis for the denial, which may include, but is not limited to, if retaining the information is necessary for us or our service provider(s) to:

• Complete the transaction or service for which we collected the Personal Information, provide a good or service that you requested, fulfill the terms of the written warranty, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
• Ensure the security and integrity of your Personal Information is reasonably necessary and proportionate for those purposes.
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us and compatible with the context in which you provide the information.
• Comply with a legal obligation.
• Make other internal and lawful uses of that information that are compatible with the context in which you provided it. You have the right not to receive discriminatory treatment for the exercise of any of these rights. We will not discriminate or retaliate against you because you have exercised your rights.
• Exercising access, data portability, data correction, and deletion rights
• To exercise the access, data portability, data correction, and deletion rights described above, please submit a verifiable consumer request to us by either:
• Calling us at 1-800-266-8228.
• Emailing privacydepartment@1800contacts.com

Only you, a person, or your authorized representative that you authorize to act on your behalf, may make a verifiable consumer request related to your Personal Information.

You may only make a verifiable consumer request for access or data portability, or to know what Personal Information shared, twice within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with Personal Information if we cannot fully verify your identity or authority to make the request and confirm the Personal Information relates to you.

Making a verifiable consumer request does not require you to create an account with us. However, we do consider requests made through your password protected account sufficiently verified when the request relates to Personal Information associated with that specific account.  We will use Personal Information that is provided to verify your identity or the requestor’s identity or authority to make the request.

Response timing and format

We will confirm receipt of requests to know, data portability, to correct inaccurate information or to delete within 10 business days of receiving the request and provide information concerning how we will process the request.

We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to an additional forty-five (45) days), we will inform you of the reason and extension period in writing.

We will deliver our written response by mail or electronically, at your option.

Your request may pertain to the Personal Information collected about you on or after January 1, 2022. If your request covers a time period beyond twelve (12) months from the date of your request, then we may deny your request as to that time period where it would be impossible for us to provide you with the information or involve disproportionate effort. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Children's Privacy

This Website and/or any of our digital services that link to this Privacy Notice is not directed at or intended for use by children under 16 years old. We do not knowingly collect or solicit any information from anyone under the age of 16. If you believe we have such Personal Information relating to your child, please contact us immediately so that we can delete such information.

Other California privacy rights

California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our Website that are California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. We do not disclose your Personal Information to third parties for their direct marketing purposes.

Changes to our CCPA and VCDPA privacy notice

1-800 Contacts reserves the right to amend this privacy notice at our discretion and at any time. When we make changes to this Privacy Notice, we will post the updated notice on our mobile application and Website and update the notice’s last modified date below. Your continued use of our mobile application or Website or interaction with us through other methods following the posting of changes and/or our directing you to an updated version of this Privacy Notice constitutes your acceptance of such changes.

Access by Persons with Disabilities

Persons with disabilities who need assistance accessing this Privacy Notice may contact us as provided for above, and depending on your individual needs, the Company will grant reasonable requests to furnish this Privacy Notice in an alternative format. See Accessibility.

Notice of Financial Incentive

We may, at times, offer you various financial incentives such as loyalty programs, discounts, and special offers when you provide us with your contact Personal Information such as your name and email address. When you sign-up for our loyalty program, email list or other discounts and special offers, you are also opting-in to this financial incentive as consideration for our use of your Personal Information for the purposes described in this Privacy Notice. You may withdraw from a financial incentive at any time, for example by opting out from our email or closing your loyalty member account. Generally, we do not assign monetary or other value to Personal Information, however, California law requires that we assign such value in the context of financial incentives. In such context, the value of the Personal Information is related to the estimated cost of providing the associated financial incentive(s) for which the information was collected.

Contact information

If you have any questions or comments about this notice, the ways in which 1-800 Contacts collects and uses your information described above [and in the Online Privacy Notice], your choices and rights regarding such use, or wish to exercise your rights under California or Virginia law, please do not hesitate to contact us at:

Phone: 1-800-266-8228
Email: privacydepartment@1800contacts.com
Postal Address:
ATTN: Privacy Department
261 Data Dr.
Draper, UT 84020