Revised March 1, 2021
INTRODUCTION TO OUR PRIVACY PRACTICES
In the course of providing its non-profit services, BBB National Programs may collect and process the personal information of individuals, including consumers, website visitors, complainants, arbitrators, and the representatives of businesses that participate in or interact with its programs (collectively, unless otherwise specified, “you,” “your”).
For individual consumers and data subjects:
Collection of personal data. You may choose to submit information to us through forms on our website, when you submit a complaint, or when you apply in an individual capacity. If you submit a complaint, we may also receive information about you from the business involved in the complaint. We collect information about your device and web browser automatically as you use our website or services, but we do not link this information to your identity without your permission.
Use of personal data. In general, personal information you share with us as a consumer is used only to provide the specific service for which you shared the information (e.g., resolving your complaint with a business). See the specific sections of the policy linked above for information about how collected information may be used.
Your choices. Please see below for more information about how to manage your privacy choices.
For business representatives:
Collection of personal data. You may choose to submit information to us through forms on our website, register for an online account, register for an event or conference, submit an application, engage in a dispute resolution procedure, undergo a privacy review, settle an invoice, or sign up for a newsletter. We also collect information automatically as you use our website or services. With your permission, we may link this usage information to other information about you.
Use of your personal data. In general, personal information you share with us as a business representative is used to provide the service(s) you request. We may also contact you with more information about our programs, events, and services, unless you opt out. Further detail on our use of data is provided in each of the sections linked above.
Your choices. Please see below for more information about how to manage your privacy choices.
Cookies and other tracking technologies:
If you are visiting our website from another country, please be aware that your information will be processed and stored in the United States. Please see the special notice below for information about how we handle your data in our role as an independent accountability agent for privacy inquiries and complaints.
BBB National Programs’ websites are not designed with the purpose of attracting any person under age 16. BBB National Programs does not knowingly collect or maintain any personal information from children under the age of 16. If we learn that we have collected personal information from a child under age 16, we will delete that information. Parents, if you believe your child has provided personal information to us, you can request that the information be deleted by contacting us at privacy@BBBNP.org.
If you have an inquiry about BBB National Programs’ privacy practices, please contact us at privacy@BBBNP.org or by postal mail:
I. Our Collection, Use, and Sharing of Your Information
A. Information that you submit to us.
In general, BBB National Programs uses information you affirmatively submit to us for the purpose for which it is submitted, such as to reply to your email, respond to your inquiry, handle your complaint, process billing transactions, register your participation in an event, respond to requests related to program participation, review applications to be a BBB National Programs arbitrator, and communicate with you when appropriate.
BBB National Programs relies on information collected from our users to develop new services and conduct analyses to enhance current content and services. Information collected from you may be used in aggregate form to review usage and operations of our site and address issues with our site. We may also use personal information we collect for operational notices, in program record-keeping, and to conduct research on industry marketplace practices. We may publish aggregate data to report trends and statistics, but the aggregate data will not include personal information.
Specifically, we may collect and process personal data you submit to us under the following circumstances:
1. While you use our public website.
You can affirmatively submit to BBB National Programs certain information as you make use of our online services, which we use for purposes of delivering our website and services to you and for analytics. Such information may include the contents of a search query or other text that you type in our web forms. We do not share this information with third parties except agents we may contract with to deliver our services and for analytics.
2. As part of a consumer complaint regarding a business, advertisement, or online service.
If you submit a complaint to one of our programs through an online form or other method, we may collect your name and contact information as well as any other information you voluntarily provide. Please do not include sensitive information as part of your complaint. We may use information you provide to us in a complaint for purposes of contacting you about your complaint and resolving your complaint. We also use complaint information in aggregated form for purposes of analyzing and reporting complaint trends.
If you submit a complaint to a program in the Global Privacy Division (including Data Privacy Framework ("DPF") Services), you may be asked for further information including that needed to verify your identity for purposes of resolving the complaint. Individuals in the European Economic Area, United Kingdom, and Switzerland, please see the Special Notice for European Individuals below.
If you submit a complaint to the
Digital Advertising Accountability Program
, you do so through the complaint portal hosted by our third-party vendor Freshworks, Inc. In order for us to process and respond to your complaint, the Freshworks complaint portal collects your contact information and may infer additional
information about your device, such as operating system and web-browser version. Any use by Freshworks of collected or inferred data of visitors to its website beyond those purposes directly contracted by BBB National Programs is covered
Under certain circumstances, we may share the contents of your complaint with any business mentioned in the complaint. At our discretion, we may also share complaint information with another appropriate organization for purposes of facilitating the resolution of your complaint. We may publish reports that include aggregate complaint statistics and, if required, anonymized complaint details. We will not otherwise share complaint information with non-agent third parties.
3. When registering for or accessing a user account with the Online Archive.
Individuals who wish to access National Advertising Division (“NAD”), Children’s Advertising Review Unit (“CARU”), Digital Advertising Accountability Program (DAAP) and Electronic Retailing Self-Regulatory Program (“ERSP”) case reports as well as National Advertising Review Board (“NARB”) panel reports, should subscribe to the Online Archive. When you register as an Online Archive subscriber, we collect the name, business name, and job title for each licensed user of your account as well as contact information including email address, phone number, and billing address. We use this information to provide you with the Online Archive service and to contact you in relation to this service. We may also contact you with more information about our programs, events, and services. We do not share your contact information with third parties, except agents who help us provide our service, as identified below.
4. When registering for or sponsoring an event or conference.
When you register for or sponsor a BBB National Programs-hosted conference or other event, we collect your name, business name, title, email address, and phone number. We use this information to keep you informed about the event, to send you information about our programs, services, and future events as well as, if relevant, membership or sponsorship opportunities. You also have the option to provide us with your Twitter handle to facilitate ongoing discussion and, as applicable, the state in which you practice law for purposes of applying for CLE credits.
We may share your name, business name, and title with other conference attendees, speakers, and/or conference sponsors. We do not otherwise share conference registration information with non-agent third parties.
5. When applying to BBB National Programs in an individual capacity.
When you apply to be a BBB National Programs employee, contractor, or intern or to be an arbitrator for the BBB AUTO LINE or DPF Services programs, you submit your name, address and other contact information, and information about your qualifications. We use this information for processing your application and for contacting you in relation to your application. We do not share this information with any non-agent third parties.
6. When applying to or requesting information from BBB National Programs on behalf of a business.
BBB National Programs may collect contact and billing information from a business that enquires about becoming a National Partner or participating with an individual program operated by BBB National Programs (including BBB AUTO LINE, DPF Services, CARU, Cross-Border Privacy Rules Program, Privacy Recognition for Processors Program, Vendor Privacy Program, or Children’s Food and Beverage Advertising Initiative). This may include personal contact information about representatives of the business. We may contact these individuals with more information about our programs, events, and services. We do not share this information with any non-agent third parties, except as described in Section II below. To request to change the personal information associated with your business account, please reach out to the individual program with which you do business.
7. When representing a business in the NAD competitor challenge process.
BBB National Programs may collect contact information from individuals (including outside counsel, if applicable) that participate in a National Advertising Division challenge, either on behalf of a company challenging a competitor’s advertising or having their advertising challenged. We use this information to contact the individuals throughout the challenge process. We may also contact these individuals with more information about our programs, events, and services. We do not share this information with any non-agent third parties.
8. When completing a privacy review as part of a certification or seal.
9. When settling an invoice.
BBB National Programs will use any billing information you have provided in order to contact you for payment of an invoice. In the process, we may ask for payment information, which will be entered directly into our third-party payment processor. BBB National Programs does not directly process or store payment information.
10. When signing up for a newsletter.
At certain points where your information is collected on our site, there may be a box where you may indicate you would like to be on a mailing list to receive information about BBB National Programs or an individual BBB National Programs program. This election box only appears in places where the service collecting your information maintains such lists. We do not sell mailing lists and this information is not shared with any non-agent third parties. You can remove your name from a BBB National Programs mailing list by utilizing the appropriate unsubscribe feature contained in the emails.
B. Information collected automatically through your use of BBB National Programs’ websites and services.
1. Device information.
Like most websites, BBB National Programs may automatically collect certain information from the device you use to visit our website, which we store in log files. This may include your browser type, device type, IP address, region or general geographical location from which your device is accessing the internet, operating system, unique device identifier, software version, and the domain name from which you accessed the site. We may rely on third-party agents to collect or process this analytic information. This information is used solely for our internal business purposes, including to improve the functionality of our site, diagnose problems, and generate statistical reports.
2. Aggregated usage information.
We collect information about how visitors use and interact with the site, including the date and time of site visits, device and browser information, the referring site URL, the areas or pages of the site visited, the amount of time spent viewing or using the site, and other click-stream or site usage data. We rely on third-party agents, including Google Analytics and Crazy Egg, to collect and process this analytic and usability information. This information is used solely for our internal business purposes, including to improve the functionality of our site, diagnose errors, generate statistical reports, analyze trends, understand and improve user experience, and identify aggregate user preferences.
To view an overview of the privacy practices of Google Analytics, please go here: https://support.google.com/analytics/answer/6004245. Google Analytics supports an optional browser add-on that—once installed and enabled—disables measurement by Google Analytics for any site a user visits. You can find the browser add-on here: https://tools.google.com/dlpage/gaoptout.
3. Individual usage information.
With your consent, and if we have a business relationship with you or your organization, we may associate certain usage information as described in Section B2 above with known personal information, including your name, organization, and contact information. Along with this information, we also may associate email usage information, including the links you open in emails that you receive from us. We rely on a third-party agent, HubSpot, to collect and process this information. This information is used solely for our internal business purposes, including to improve the experience of our stakeholders by providing the most relevant and high quality content on our website and other media.
To view an overview of the privacy practices of HubSpot, please go here: https://legal.hubspot.com/product-privacy-policy. If you wish to adjust your preferences about our collection of individual usage information using HubSpot, please see the “Choices about your information” section below.
Please note that personal information about individual consumers (such as complaint information) is never associated with usage information, even if you opt in to cookies on our website.
C. Information collected by third parties and shared with BBB National Programs.
1. In the course of complaint resolution, conciliation, or arbitration.
BBB National Programs may receive information about you from businesses or organizations with which you have interacted for the purposes of facilitating the resolution of a pending complaint, conciliation, or arbitration proceeding. This may include your name, date of birth, account number, or other information used to verify your identity. This may also include account history information, your previous communications with the business or organization related to the matter in your complaint, or any other relevant information.
2. Participating business contact information.
A business participating in a program operated by BBB National Programs may share with BBB National Programs contact information for its employees or designated representatives. BBB National Programs will use this information only for the purposes of fulfilling the contract with the business. Unless the individual opts out, we may also use this information to notify them about our own programs, events, and related services.
II. Other Ways Information May Be Shared
We may use third-party agents to collect or process data on our behalf. Such contractors are obligated to not disclose or use your information for purposes other than for which it was originally collected or subsequently authorized.
BBB National Programs may also share information under the following circumstances:
- We respond to requests from governmental agencies or where required by law (such as by subpoena, investigative demand, court order, or regulation).
- We may share information with appropriate governmental or regulatory authorities, where warranted by a company’s failure to (i) participate in certain BBB National Programs self-regulatory programs including the Children’s Advertising Review Unit and the Digital Advertising Accountability Program; (ii) follow procedures or implement a decision of DPF Services; (iii) substantially comply with its CFBAI pledge or CCAI Core Commitments; or (iv) participate in or honor the recommendations of the National Advertising Division, Children's Advertising Review Unit, National Advertising Review Board, Electronic Retailing Self-Regulatory Program, or Digital Advertising Accountability Program.
- We may share information with appropriate persons or governmental authorities, where your communication suggests possible harm to others.
III. Choices about your information.
A. Mailing Lists
You may unsubscribe from our mailing lists or other routine email communications using the link included at the end of each message or by sending an email to privacy@BBBNP.org.
B. Individual Usage Information
C. Your Ad Choices
BBB National Programs does not share data with third parties for interest-based advertising purposes. However, BBB National Programs adheres to the Digital Advertising Alliance’s Self-Regulatory Principles for Online Behavioral Advertising, and commits to provide consumers with notice and choice about interest-based advertising. To learn more about interest-based advertising, click here. To opt out of future interest-based advertising, click here. You will still see ads, but they will not be tailored to your interests.
IV. Cookies or other persistent identifiers
BBB National Programs and our third-party agents may use persistent identifiers such as cookies, embedded scripts, web beacons, pixel tags, or similar technologies to collect information about our visitors’ interactions with our site and other media. We use these identifiers to generate the data described in “aggregated usage information” above. With your consent, and if we have a business relationship with you or your organization, we also may associate this data with other known information about you, as described in “individual usage information” above. This information is used to understand how visitors use our sites and provide better services to you, provide easier site navigation, access to forms, or to track analytics and certain statistical information that enables us to improve our site and provide you with more relevant content and information on our site and other sites.
You can still use BBB National Programs’ websites if you have set your browser to reject cookies or other tracking technologies, but there is a possibility that this will prevent you from viewing or accessing some of the features of our sites. At this time, we do not respond to “Do Not Track” signals issued by web browsers.
Personal data that you provide to BBB National Programs is stored by BBB National Programs on servers located in third-party data centers in the United States with restricted access, that have implemented reasonable procedures to prevent unauthorized access to, and the misuse of, personal data. BBB National Programs restricts access to your personal data to authorized BBB National Programs employees, independent contractors and service providers who need to access the data in order to provide services in support of BBB National Programs operations and program services.
BBB National Programs has taken steps to ensure the ongoing confidentiality, integrity, availability, and resilience of systems and services processing personal information and will restore the availability and access to information in a timely manner in the event of a physical or technical incident.
VI. International Transfers
If you are visiting our site from outside the United States, be aware that your information will be transferred to, and maintained on, computers located within the United States. The collection, use, retention and any other processing of your information will be governed by U.S. law and further by the specific jurisdictions within the United States where that information is stored, unless otherwise specified. In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
ATTN: Privacy Compliance
BBB National Programs
1676 International Drive, Suite 550
McLean, VA 22102
Special Notice from BBB AUTO LINE
BBB National Programs operates BBB AUTO LINE, a dispute resolution program that assists consumers in certain U.S. states with resolving car warranty complaints against participating automobile manufacturers. BBB AUTO LINE only uses collected personal information for purposes of resolving warranty complaints and as required by law. For example, BBB AUTO LINE may be required to provide access to consumer case files to an independent compliance auditor for purposes of confirming BBB AUTO LINE compliance with applicable laws and regulations.
For BBB AUTO LINE consumers:
What information do we collect? BBB AUTO LINE collects personal data when you submit a claim via our online claim form, phone, mail or fax, and during subsequent interactions with our staff while processing your claim for resolution. Specifically, BBB AUTO LINE may collect your name, phone number, fax number, email address, mailing address, and applicable vehicle information such as your sales/lease agreement, vehicle registration, and repair orders.
Please do not send any additional personal information unless specifically requested. BBB AUTO LINE will never request your Social Security Number or other sensitive financial information unrelated to your vehicle’s purchase or lease (e.g., bank account numbers). For your security, please redact or black out any such information from the documents you are submitting.
What do we do with your information? This information will be entered into your claim file and available on associated BBB AUTO LINE online platforms. Any other information you submit to BBB AUTO LINE through your online consumer account, over the phone, or via fax or mail will also be saved in your claim file. The information you provide will only be used for the purpose of resolving your claim. Information about your complaint, in aggregate form, may also be used for federal and state regulatory reporting and statistics regarding BBB AUTO LINE.
Who else will see your information? The information you provide for your claim file may be shared with the automobile manufacturer mentioned in your warranty dispute. If your claim requires arbitration, the information may also be shared with a local BBB and arbitrator. If your claim requires consultation with a Technical Expert (TE), we may share your contact information and vehicle information including repair history to enable the TE to conduct an inspection and prepare a report of findings. TEs are contractually obligated to use your contact information only for purposes of performing their services as a TE.
For BBB AUTO LINE attorneys:
If relevant, BBB AUTO LINE will collect information about individual attorneys representing consumers. This information includes name, firm name, attorney ID, and contact information. This information is associated with the attorney’s username on the BBB AUTO LINE online portal and is used only for the purpose of resolving disputes with which the attorney is involved.
For BBB AUTO LINE arbitrators:
As described in section 1(e) above, BBB AUTO LINE will collect information about arbitrators who are contracted to resolve disputes within the BBB AUTO LINE program. In addition to name and contact information, BBB AUTO LINE collects information on the arbitrator’s biography and qualifications, including employment history, training history, and language proficiency. This information will be used solely for contacting the arbitrator with regard to pending or possible arbitrations.
Special Notice to Individuals in the European Union, United Kingdom, and Switzerland
BBB National Programs operates the Global Privacy Division, which includes programs that provide dispute resolution services to individual consumers and data subjects around the world. This includes BBB National Programs Data Privacy Framework Services program ("DPF Services"), an independent recourse mechanism ("IRM") supporting the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework (collectively, “DPF”). DPF Services handles privacy complaints from individuals in the European Economic Area ("EEA"), the United Kingdom (“UK”), and Switzerland (“collectively, European Complainants”) regarding their personal data transferred to the United States pursuant to DPF and processed by U.S. organizations that have designated DPF Services as their IRM ("Participating Businesses").
Information we collect about European Complainants
BBB National Programs collects personal data when you submit a privacy complaint using our online complaint form, and during any subsequent contacts you have with our staff by electronic mail or telephone in relation to your DPF complaint. Except as otherwise indicated below, DPF Services does not collect personally identifiable information or personal data unless you voluntarily provide it to us, and limits the personal data it collects to information relevant for the purposes of processing. Types of personal data we collect include your name, full address, phone number, and email address, as well as documents and other information you may provide to us to authenticate your identity or substantiate your complaint. In the course of handling your complaint, we may also collect information about you from the Participating Business against which you filed your complaint.
How DPF Services Uses Your Personal Data
DPF Services may process your Personal Data for the following purposes:
- Effective complaint handling, including verifying your identity and location; making eligibility determinations; and facilitating communications between you and DPF Services, and between DPF Services and the participating business that is a party to your case, as well as any independent Panelist conducting a Data Privacy Review of your complaint, in the conduct of the case.
- Preparing and publishing reports as required under DPF or by the DPF Services Procedure Rules.
- Providing information you may request about the services of DPF Services, and answering your questions.
- Investigating and processing suspected violations of DPF Services' Procedure Rules.
- Complying with DPF Services obligations as an IRM under DPF, including (i) provision of complaint data to the appropriate governmental authorities and (ii) complying with applicable data retention obligations.
When DPF Services transmits complaint-related information over the internet, we protect it through the use of data encryption methods.
Bases for Processing
To process the personal data of DPF Services complainants as described above, BBB National Programs relies on the following independent legal bases: DPF Services carries out tasks in the public interest; processing is necessary for DPF Services' legitimate interests; and DPF Services receives complainants' express consent to process their personal data in the United States.
Public Interest. BBB National Programs is a not-for-profit organization that operates numerous widely recognized self-regulatory and alternative dispute resolution (ADR) programs in North America, including DPF Services. The alternative dispute resolution programs of organizations such as BBB National Programs are sanctioned by the laws of many countries, most of which acknowledge the importance of ADR's role as an important channel in the administration of justice. The personal data collected by DPF Services in processing privacy complaints from EU and EEA individuals is essential to DPF Services' performance of its dispute resolution function under DPF, which constitutes "a task in the public interest" as a basis for collecting and maintaining such information under the EU General Data Protection Regulation (GDPR).
Legitimate interests. Personal data related to complainants is collected only to the extent necessary given DPF Services' legitimate interests as a data controller, in its role as an IRM providing dispute resolution services to individuals in the EU/EEA with privacy complaints against U.S. businesses participating in the DPF that have identified DPF Services as their IRM.
Consent. Before completing the DPF Services online complaint form, DPF Services requests your express consent to our processing of your personal data in the United States. If you withdraw your consent to processing before we make an eligibility determination regarding your complaint and open a case, we will discontinue your complaint and delete your information. After a case has been opened, DPF Services may proceed with processing on the alternative legal bases set forth above, or where legally obligated to do so.
Sharing Your Personal Data with Third Parties
DPF Services may share your Personal Data with (i) a DPF Services Participating Business against which you have submitted a complaint, in order to process the complaint; (ii) independent Data Privacy Panelists we may assign to arbitrate your complaint, should you request a Data Privacy Review; and (iii) BBB National Programs' service providers, including data processors, in order to deliver the services provided by DPF Services.
DPF Services will store your Personal Data for as long as necessary to perform the purposes of processing, which include handling your complaint to its final resolution; producing required reports pursuant to DPF and to the DPF Services Procedure Rules; and otherwise complying with our legal and regulatory obligations.
Data Subject Rights for EU/EEA Individuals
Subject to some limits, individuals in the EU and EEA countries have a number of rights regarding personal data collected by BBB National Programs in the course of DPF Services complaint handling:
- Right of access and portability. The right to obtain access to your personal information, along with certain related information, and to receive that information in a commonly used format and to have it transferred to another data controller;
- Right to rectification. The right to obtain rectification of your personal information without undue delay where that personal information is inaccurate or incomplete;
- Right to erasure. The right to obtain the erasure of your personal information without undue delay in certain circumstances, such as where the personal information is no longer necessary in relation to the purposes for which it was collected or processed;
- Right to restriction. The right to obtain the restriction of the processing undertaken by us on your personal information in certain circumstances, such as where the accuracy of the personal information is contested by you, for a period enabling us to verify the accuracy of that personal information; or where BBB National Programs no longer needs to retain the personal data, but you would like us to keep it in order to establish, exercise or defend a legal claim.
- Right to object. The right to object, on grounds relating to your particular situation, to the processing of your personal information.
If you need further assistance regarding the above rights, please contact us at privacy@BBBNP.org and we will consider your request in accordance with applicable law.
In some cases, our ability to uphold one or more of these rights for you may be limited, in light of BBB National Programs' role as a private organization providing ADR services through DPF Services in the public interest, or for security, safety, fraud prevention reasons, compliance with regulatory or legal requirements, or because processing is necessary to deliver the services you have requested. Where this is the case, we will inform you of specific details in response to your request.
European Union and EEA individuals also have the right to lodge a privacy complaint with the appropriate supervisory authority. Contact information for the EU data protection authorities can be found here: https://edpb.europa.eu/about-edpb/board/members_en.