United StatesEffective (last updated) Date: March 10, 2025
This Kowa U.S. Privacy Policy (“Privacy Policy”) provides notices regarding the U.S. online and offline Personal Information or Personal Data (collectively “PD”)(as those terms are defined under State Privacy Laws (defined below)) practices of the following Kowa entities: Kowa Company, Ltd. (“KCL”), Kowa Holdings America, Inc. (“KHD-AM”), Kowa American Corp. LA Branch (“KAC-LA”), Kowa American Corp. – Chemical (“KAC-Chem”), Kowa American Corp. – Lifestyle (“KAC-Lifestyle”), Kowa Research Institute, Inc. (“KRI”), Kowa Pharmaceuticals America, Inc. (“KPA”), and Kowa Health Care US Company, Ltd. (“KHC”) (collectively referred to in this Privacy Policy as “Kowa,” “we,” “us,” and “our””).
The Kowa entities covered by this Privacy Policy offer different products and services through which they may collect business-to-consumer (“B2C”) PD and/or business-to-business (“B2B”) PD. Accordingly, this Privacy Policy outlines Kowa’s PD practices in the B2C and B2B context for each Kowa entity and notes where practices materially differ.
Although this Privacy Policy reflects the PD practices of various Kowa entities, the entities operate their information governance independently (e.g., a consumer request to KHD-AM is not also a consumer request to KAC-LA).
Section A of this Privacy Policy describes our collection, use, and disclosure of Consumers’ (other than our job applicants, current employees, former employees, or independent contractors (collectively, our “Personnel”)) PD, and serves as our Notice of Collection under the California Consumer Privacy Act, including as amended by the California Privacy Rights Act (together the “CCPA”). The same practices apply to residents of other jurisdictions, excepting our Personnel. Personnel may contact their local human resources (“HR”), or contact us as set forth in Section D, for the applicable HR privacy notice(s).
Section B of this Privacy Policy describes Consumers’ (including our U.S. Personnel’s) privacy rights under State Privacy Laws that apply to us (“State Privacy Rights”) and how to exercise them. Each of the Kowa entities covered by this Privacy Policy have a separate process for responding to Consumer requests to exercise State Privacy Rights. Accordingly, a rights request submitted to one Kowa entity is not a rights request to any of the other Kowa entities. For residents of states without applicable State Privacy Laws, or where we are not subject to a state’s jurisdiction (e.g., we do not meet applicability thresholds) we will consider requests but will apply our discretion with respect to if and how we may process such requests.
Section C includes information regarding changes to this Privacy Policy.
Section D lists our contact information.
Collectively, Sections A-D are our U.S. Privacy Policy, which is supplemented by our U.S. Online Privacy Notice, which provides additional detail about our U.S. online PD practices. KCL has specialized data practices requiring additional notice pursuant to applicable laws. More information is available at the KCL Consumer Health Data Privacy Notice. Other additional notices may be made at the point of collection, in which case those will supplement this Privacy Policy and govern that collection in the event of a conflict with this Privacy Policy. Capitalized terms used but not defined herein will have the meanings given to them in our U.S. Online Privacy Notice and, if not defined there, under State Privacy Laws.
To see and print our full Privacy Policy, click here. You can also request disability access assistance by contacting us as set forth in Section D.
-
Our Privacy Practices
This Privacy Policy Section A is designed to provide Consumers, as defined under State Privacy Laws, other than our Personnel, with notice of our U.S. PD practices over the prior 12 months (from the Effective Date), including through Kowa online and offline U.S. business activities (the “Business Activities”), and to meet the privacy policy and pre-collection notice requirements of the CCPA, the Texas Data Privacy and Security Act, the Nebraska Data Privacy Act, and substantially similar state consumer privacy laws that may hereafter be applicable to us, and all laws implementing, supplementing, or amending the foregoing, including regulations promulgated thereunder (collectively, “State Privacy Laws”). In California, the term “Consumer” is not limited to data subjects acting as individuals in a household goods and services context and also individuals acting in a B2B and HR context; provided, however, that this Section A does not include our Personnel PD practices, notice of which are available from HR or by contacting us as noted in Section D.
This Privacy Policy does not apply to data that is not treated as PD, or to the extent the data is subject to an exemption, under applicable State Privacy Laws. As permitted by applicable law, we do not treat deidentified or aggregate data as PD and we reserve the right to convert, or permit others to convert, your PD into deidentified or aggregate data, and may elect not to treat publicly available information as PD. We will not attempt to reidentify data that we maintain as deidentified.
If our Processing materially changes between updates to this Privacy Policy, Kowa will provide a supplemental notice when or before the changes apply.
-
Generally
Generally, the applicable Kowa entity may collect, retain, use, disclose and otherwise Process your PD in connection with our Business Activities, including to provide you, or to promote, our products and services and as otherwise related to the operation of our respective businesses, which includes both Business Purposes, and Commercial Purposes such as Sharing with Third-Party Digital Businesses, each as more fully explained in Section A.2 below. This may include disclosing or otherwise making available PD to our vendors that perform services for us in their role as “Service Providers” or “Processors,” as the terms are defined under State Privacy Laws (collectively, “Processors”), as well as to third parties, each as more fully explained in Section A.3 below.
The categories of sources from which we may Collect your PD include: you, your employer (in the B2B context), our Processors, other of our vendors, and Third Parties, including Third-Party Digital Businesses (defined below).
To learn about your State Privacy Rights and how to exercise them see Section B, which includes a notice of how to exercise Do Not Sell/Share/Target Opt-out rights.
-
PD Processing Purposes
Generally, we may collect, retain, use, and disclose your PD to provide you our products and services, or information about them, and as otherwise related to the operation of our business, including for one or more of the following “Business Purposes”:
B2C and B2B Processing Purposes Kowa Entities Processing for this Purpose Providing Products or Services (e.g., operating or distributing products/services, processing transactions, administering accounts, customer service, verifying customer information, and processing payments) KCL, KHD-AM, KAC-LA, KAC-Chem, KAC-Lifestyle, KRI, KPA, KHC Managing Interactions and Transactions (e.g., business services, customer service, providing analytics services, and customize customer experience) KCL, KHD-AM, KAC-LA, KAC-Chem, KAC-Lifestyle, KRI, KPA, KHC Security and Debugging (e.g., measures to safeguard systems and data security, identify and repair system errors) KCL, KHD-AM, KAC-LA, KAC-Chem, KAC-Lifestyle, KRI, KPA, KHC Advertising and Marketing (e.g., analyze ad impressions, customize customer experience) KCL, KPA, KAC-LA, KAC-Chem, KAC-Lifestyle, KPA, KHA Quality Assurance (e.g., verify the quality/safety of our products/services, improve our products/services) KCL, KHD-AM, KAC-LA, KAC-Chem, KAC-Lifestyle, KRI, KPA, KHC Research and Development (e.g., internal research for product development) KCL, KRI Operation of Our Business (e.g., for our other legitimate Business Purposes, such as disclosing PD to our Processors, to the Consumer, or to other parties at the Consumer’s direction; for additional purposes explained at the time of collection; as required or permitted by applicable law; to the government or private parties to comply with law or legal process or to protect or enforce legal rights or obligations or prevent harm; and to assignees as part of an acquisition, merger, asset sale, or other transaction where another party assumes control over all or part of our business (“Corporate Transaction”) or otherwise with your consent (“Additional Business Purposes”)). Subject to restrictions and obligations under State Privacy Laws, our Processors may also use your PD for Business Purposes and other purposes permitted by law and may engage their own vendors to enable them to perform services for us. KCL, KHD-AM, KAC-LA, KAC-Chem, KAC-Lifestyle, KRI, KPA, KHC For more detail on processing purposes and activity details in connection with our Online Services, see our U.S. Online Privacy Notice.
We may also use and disclose your PD, regardless of the other purposes for which we may collect it, for “Commercial Purposes,” which may be considered a “Sale” or “Share” or “Targeted Advertising” under applicable State Privacy Laws, when Third-Party Digital Businesses collect your PD, including via third-party cookies, or we otherwise make it available to them. Under State Privacy Laws some of these processing disclosure activities do not qualify as Business Purposes disclosures and are subject to a right to opt-out. The specific purpose for this Selling or Sharing is to help us and others provide you with more relevant content and marketing messages (e.g., Targeted Advertising), and related activities and when we and third parties process your PD for certain advertising purposes (e.g., creating profiles and inferences, measurement, some types of analytics, conversion tracking, audience extension, etc.) and the parties we disclose it to are detailed, by type of PD, in Section A.3 below. For more information on the meaning of Selling, Sharing, and Targeted Advertising and how to adjust your preferences with respect to such processing, please refer to the Do Not Sell/Share/Target Opt-out subsection of the State Privacy Rights Section of this Privacy Policy.
The Business Purposes and Commercial Purposes for processing described above may apply to all categories of your PD, other than Sensitive PD (defined below), but we detail our disclosures (including Selling and Sharing), and also detail our Sensitive PD processing purposes, by PD type in the chart that follows in the next section for additional transparency.
-
Collection, Disclosure and Retention of PD – By Category of PD
The tables below describe the categories of PD we may collect and examples of data types that fit within each category and corresponding categories of recipients of PD to which we may disclose for Business Purposes and/or Sale or Share, if applicable. For Sensitive PD we identify the processing purposes for each type of Sensitive PD.
-
Business-to-Consumer PD Collection:
Category of PD Examples of PD Collected and Retained Categories of Recipients Kowa Entities Collecting PI Identifiers First and last name, postal address, unique personal or online identifier, IP address, email address, and account name. Disclosures for Business Purposes: - Processors (e.g., cloud storage vendors, IT vendors, email/messaging vendors, customer support providers, data analytics and marketing vendors)(“Operational Service Providers”);
- Other members of our corporate group, and/or other parties in connection with a Corporate Transaction (“Corporate Recipients”);
- Governmental entities (e.g., making filings or responding to requests pursuant to legal or regulatory process)(“Government”); and/or
- Other parties (e.g., professional advisors (accountants and lawyers), litigants and where you have directed or caused the disclosure) within the limits of Additional Business Purposes (“Other Business Recipients”).
KCL, KAC-LA, KAC-Lifestyle, KPA, KHC Personal Records Name, signature, address, telephone number, financial information (e.g., payment card information). Some PD included in this category may overlap with other categories. Disclosures for Business Purposes: - Operational Service Providers;
- Corporate Recipients;
- Government; and/or
- Other Business Recipients.
KAC-LA, KAC-Lifestyle, KPA, KHC Personal Characteristics or Traits In some circumstances, we may collect PD that is considered protected under U.S. law, such as age, gender, or information related to medical conditions, but only when the information is relevant for our Business Activities. We abide by the legal requirements imposed under applicable law regarding such information. Disclosures for Business Purposes: - Operational Service Providers;
- Corporate Recipients;
- Government; and/or
- Other Business Recipients.
KAC-LA, KAC-Lifestyle, KPA, KHC Commercial Information Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. Disclosures for Business Purposes: - Operational Service Providers;
- Corporate Recipients;
- Government; and/or
- Other Business Recipients.
KAC-LA, KAC-Lifestyle, KHC Internet or Other Electronic Network Activity Information Browsing or search history, information regarding the Consumer’s interaction with online services or advertisements. Disclosures for Business Purposes: - Operational Service Providers;
- Corporate Recipients;
- Government; and/or
- Other Business Recipients.
KAC-LA, KAC-Lifestyle, KHC Geolocation Data If you interact with us online, we may gain access to the approximate location of the device you are using. Disclosures for Business Purposes: - Operational Service Providers;
- Corporate Recipients;
- Government; and/or
- Other Business Recipients.
KAC-Lifestyle, KHC Audio, Electronic, Visual, or Sensory Information Such as customer service call recordings. Disclosures for Business Purposes: - Operational Service Providers;
- Corporate Recipients;
- Government; and/or
- Other Business Recipients.
KAC-LA, KHC Inferences from PD Collected Inferences drawn from PD to create a profile about a consumer reflecting their preferences. Disclosures for Business Purposes: - Operational Service Providers;
- Corporate Recipients;
- Government; and/or
- Other Business Recipients.
KAC-LA, KAC-Lifestyle, KHC We may collect and process PD that is “Sensitive” under State Privacy Laws (“Sensitive PD”). The table below describes the categories and examples of Sensitive PD we may collect and the processing purposes for and recipients of the same.
Category of PD Examples of PD Collected and Retained Processing Purpose(s) Categories of Recipients Kowa Entities Collecting PI Health Data PD collected and analyzed concerning a Consumer’s health, medical history, mental or physical health, diagnosis/condition, and medical treatment Quality Assurance, Operation of Our Business Disclosures for Business Purposes: - Operational Service Providers;
- Corporate Recipients;
- Government; and/or
- Other Business Recipients
KCL -
Business-to-Business PD Collection:
Category of PD Examples of PD Collected and Retained Categories of Recipients Kowa Entities Collecting PI Identifiers First and last name, postal address, unique personal or online identifier, IP address, email address, and account name. Disclosures for Business Purposes: - Operational Service Providers;
- Corporate Recipients;
- Government; and/or
- Other Business Recipients.
KCL, KHD-AM, KAC-LA, KAC-Chem, KAC-Lifestyle, KRI, KPA, KHC Personal Records Name, signature, address, telephone number, financial information (e.g., payment card information). Some PD included in this category may overlap with other categories. Disclosures for Business Purposes: - Operational Service Providers;
- Corporate Recipients;
- Government; and/or
- Other Business Recipients.
KCL, KHD-AM, KAC-LA, KAC-Chem, KAC-Lifestyle, KRI, KPA, KHC Commercial Information Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. Disclosures for Business Purposes: - Operational Service Providers;
- Corporate Recipients;
- Government; and/or
- Other Business Recipients.
KCL, KHD-AM, KAC-LA, KAC-Chem, KAC-Lifestyle, KRI, KPA, KHC Internet or Other Electronic Network Activity Information Browsing or search history, information regarding the Consumer’s interaction with online services or advertisements. Disclosures for Business Purposes: - Operational Service Providers;
- Corporate Recipients;
- Government; and/or
- Other Business Recipients.
KHD-AM, KAC-LA, KAC-Lifestyle, KHC Geolocation Data If you interact with us online, we may gain access to the approximate location of the device you are using. Disclosures for Business Purposes: - Operational Service Providers;
- Corporate Recipients;
- Government; and/or
- Other Business Recipients.
KAC-Lifestyle Audio, Electronic, Visual, or Sensory Information Such as CCTV recordings in our offices and customer service recordings. Disclosures for Business Purposes: - Operational Service Providers;
- Corporate Recipients;
- Government; and/or
- Other Business Recipients.
KCL, KHD-AM, KAC-LA, KAC-Chem, KAC-Lifestyle, KRI, KPA, KHC Inferences from PD Collected Inferences drawn from PD to create a profile about a consumer reflecting their preferences. Disclosures for Business Purposes: - Operational Service Providers;
- Corporate Recipients;
- Government; and/or
- Other Business Recipients.
KHD-AM, KAC-LA, KAC-Lifestyle, KHC Kowa does not collect Sensitive PD categories in the B2B context.
There may be additional information we may collect that meets the definition of PD under applicable State Privacy Laws but is not reflected by a category above, in which case we will treat it as PD as required, but will not include it when we describe our practices by PD category.
Because there are numerous types of PD in each category, and various uses for each PD type, actual retention periods vary by purpose not by data type and, accordingly, the retention periods cannot be meaningfully provided by category of PD. We retain specific PD pieces based on how long we have a legitimate purpose for the retention, which includes the period of time we need to process the PD to meet the processing purposes, plus limited retention thereafter to comply with law, maintain business and legal records, and defend or bring potential legal claims.
-
Business-to-Consumer PD Collection:
-
Generally
-
State Privacy Rights
Subject to meeting the requirements for a Verifiable Consumer Request (defined below) and limitations permitted by State Privacy Laws, Kowa provides Consumers residing in states with applicable State Privacy Laws (as of the Effective Date, California, Texas, and/or Nebraska, depending upon which Kowa entity is applicable) to which we are subject the privacy rights described in this section. In particular, residents of California are entitled to make requests to KCL, KHD-AM, KAC-LA, KAC-Chem, and KPA and residents of Nebraska and Texas are entitled to make requests to KPA.
For residents of states without applicable State Privacy Laws, or where we are not subject to a state’s jurisdiction (e.g., we do not meet applicability thresholds) we will consider requests but will apply our discretion with respect to if and how we may process such requests. We will consider applying State Privacy Law rights prior to the effective date of such laws but will do so in our discretion. For instance, KRI, KAC-Lifestyle, and KHC are not currently subject to State Privacy Laws and therefore are not required to process Verifiable Consumer Requests for residents of any states but may choose to do so at their discretion. Similarly, KCL, KHD-AM, KAC-LA, KAC-Chem, and KPA may consider requests from residents of states other than those specified above.
To submit a request to exercise your Consumer privacy rights, or to submit a request as an authorized agent, complete our Privacy Rights Request Form (one form per Kowa entity) and return it to Kowa by emailing it to contact@kowa.com.
You may also submit a request by contacting us via phone by calling (888) 710-6525. We do not accept or process Consumer privacy rights requests through other means (e.g., via fax, chats, or social media, etc.). Please respond to any follow-up inquiries we make to help us complete your request.
Each of the Kowa entities covered by this Privacy Policy have a separate process for responding to Consumer requests to exercise privacy rights under State Privacy Laws. Accordingly, a rights request submitted to one Kowa entity is not a rights request to any of the other Kowa entities.
-
Your Consumer Privacy Rights
Subject to state-specific conditions and limitations, we provide Consumers the following rights:
-
Right to Limit Sensitive PD Processing
We only process sensitive PD for purposes that are exempt from Consumer choice under State Privacy Laws.
-
Right to Know/Access
-
Categories / Confirm Processing
California residents have a right to submit a request for any of the following for the period that is 12-months prior to the request date:
- The categories of PD we have collected about you.
- The categories of sources from which we may have collected your PD.
- The Business Purposes or Commercial Purposes for our collecting, Selling, or Sharing your PD.
- The categories of third parties to whom we have disclosed your PD.
- A list of the categories of PD disclosed for a Business Purpose and, for each, the categories of recipients, or that no disclosure occurred.
- A list of the categories of PD Sold or Shared about you and, for each, the categories of recipients, or that no Sale or Share occurred.
Consumers of other states subject to U.S. State Privacy Laws have the right to confirm if we are processing your PD, which we will treat as a Categories request, but our response may not provide the category-level detail as we do for California categories requests.
-
Specific Pieces / Access
Consumers have a right to obtain a transportable copy, subject to applicable request limits, of their PD that we have collected and are maintaining. For Consumers’ specific pieces of PD, as required by applicable State Privacy Laws, we will apply heightened verification standards. We have no obligation to re-identify data or to keep PD longer than we need it or are required to by applicable law to comply with access requests.
-
Categories / Confirm Processing
-
Do Not Sell/Share/Target Opt-out
Consumers of certain states have a right to opt-out of PD “Sales.” California also has an opt-out for “Sharing” for cross-context behavioral advertising (i.e., the use of PD derived from different businesses or services to target advertisements). Non-California State Privacy Laws provide for an opt-out of Targeted Advertising (defined differently but also addressing tracking, profiling and targeting of advertisements).
Third-party digital businesses that provide us with digital services such as, for example, advertising, data, and marketing tools, may associate cookies and other tracking technologies that collect PD about Consumers on our Online Services, or otherwise collect and process PD that we make available about Consumers, including digital activity information and identifiers (“Third-Party Digital Businesses”). We understand that giving access to PD on the Online Service (as defined in our U.S. Online Privacy Notice) or otherwise, to Third-Party Digital Businesses could be deemed a Sale/Sharing under the State Privacy Laws and as such, we will treat such PD (e.g., cookie ID, IP address, and other online IDs and Internet or other electronic activity data) collected by Third-Party Digital Businesses, where not limited to acting as our Processor, as a Sale/Sharing that is subject to a Do Not Sell/Share/Target opt-out request under applicable State Privacy Laws.
Opt-out for Non-Cookie PD: If you would like to submit a Do Not Sell/Share/Target request for your non-cookie PD (e.g., your email address), you must submit an opt-out request, as explained in the How to Exercise Your Privacy Rights section below.
Opt-out for Cookie PD: If you would like to limit our processing of your cookie-related PD for Targeted Advertising or opt-out of the Sale/Sharing of such data, you must exercise a separate opt-out request via our consent management tool, which is accessible via the “Your Privacy Choices” link on the footer of our websites. This is because we must use different technologies to apply your opt-out of cookie PD and opt-out of non-cookie PD. Our consent management tool enables you to exercise such an opt-out request and enable certain cookie preferences on your device. You must exercise your preferences on each of our Online Services you visit, from each browser you use, and on each device you use. Since your browser opt-out is designated by a cookie, if you clear or block cookies, your preferences will no longer be effective, and you will need to enable them again via our consent management tool. Note that if you use ad blocking software, our cookie banner and/or the “Your Privacy Choices” link may not appear when you visit our Online Services. Our Online Services that do not process cookie-related PD for Targeted Advertising or Sale/Sharing of such data may not have a consent management tool.
Opt-out Preference Signals (also known as global privacy control or “GPC”): Some State Privacy Laws require us to process certain types of signals, referred to as opt-out preference signals in California or universal opt-out mechanism in other states, which are signals sent by a platform, technology, or mechanism, enabled by individuals on their devices or browsers, that communicate the individual’s choice to opt-out of the Sale or Sharing of PD, which we understand to include GPC signals. We currently look for and recognize GPC signals. To use a GPC, you can download an internet browser or a plugin to use on your current internet browser and follow the settings to enable the GPC. We process GPC with respect to Sales and Sharing, and Processing of PD for Targeted Advertising, that may occur in the context of collection of cookie PD, discussed above, and apply it to the specific browser on which you enable GPC. We do not process GPC for opt-outs in other contexts (e.g., non-cookie PD) because we lack the ability to match that data to your browser. We do not: (i) charge a fee for use of the Service if you have enabled GPC; (ii) change your experience with any product or service if you use GPC; or (iii) display a notification, pop-up, text, graphic, animation, sound, video, or any interstitial in response to the GPC.
We may disclose your PD for the following purposes, which are not a Sale or Sharing: (i) if you direct us to disclose PD; (ii) to comply with a Consumer rights request you submit to us; (iii) to our Processors, which may include other Kowa entities; (iv) as part of a Corporate Transaction; and (v) as otherwise required or permitted by applicable law.
-
Child-Aged Consumers of Certain States
We do not knowingly Sell or Share, or use for Targeted Advertising, the PD of / from Child-Aged or other similar term (as defined by the applicable State Privacy Law) Consumers who are residents of certain states, unless we receive affirmative opt-in authorization from (i) the applicable Consumer if the Consumer is at least 13 years of age and Consumer consent is required under the applicable State Privacy Law; or (ii) the parent or guardian of the Consumer if the Consumer is less than 13 years of age. If you think we may have unknowingly Sold or Shared PD, or used PD for Targeted Advertising, of / from a Consumer under the threshold age (as set by the applicable State Privacy Law) without the appropriate affirmative opt-in authorization, please report that to us as described in Section D (Contact Us).
-
Right to Delete
Consumers have the right to request that we delete any of your PD that we have collected and retained, subject to certain exceptions; provided, however, that depending on where you reside (e.g., California), we may not be required to delete your PD that we did not collect directly from you. Once we receive and confirm your Verifiable Consumer Request, we will delete (and direct our Processors to delete) your PD, unless an exception applies. If an exception applies, we will limit Processing to permitted purposes and to the duration of those purposes.
We may deny your request to delete your PD if retaining the data is necessary for us or our Processor(s):
- to complete transactions and services, you have requested;
- for security purposes;
- for legitimate internal business purposes (e.g., maintaining business records);
- to comply with law and to cooperate with law enforcement;
- to exercise or defend legal claims; and
- certain other permitted purposes under State Privacy Laws.
Please be aware that making a deletion request does not ensure complete or comprehensive removal or deletion of PD or content that you may have posted.
-
Right to Correct Your PD
Consumers may bring inaccuracies they find in their PD that we maintain to our attention, and we will act upon such complaint as required by applicable law.
-
Automated Decision Making (“ADM”) / Profiling
We do not engage in automated decision making or profiling that is currently subject to Consumer rights under applicable State Privacy Laws.
-
Right to Limit Sensitive PD Processing
-
How to Exercise Your Consumer Privacy Rights
To submit a request to exercise your Consumer privacy rights, or to submit a request as an authorized agent, complete our Privacy Rights Request Form and return it to Kowa by emailing it to contact@kowa.com. You may also submit a request by contacting us via phone by calling (888) 710-6525. However, for cookie-data Do Not Sell/Share/Target you must exercise a separate opt-out request via our consent management tool, which is accessible via the “Your Privacy Choices” link on the footer of our websites or use GPC signals as explained in the section above. Please respond to any follow-up inquiries we make to help us complete your request. We do not accept or process requests through other means (e.g., via fax, chats, or social media, etc.), except that notices of Child-aged PD issues and general privacy inquiries may be directed to us as explained in Section D.
-
Verification of Your Request
We do not verify Do Not Sale/Share/Target opt-outs unless we suspect fraud. As permitted or required by State Privacy Laws, any other request you submit to us must be a “Verifiable Consumer Request,” meaning when you make a request, we may ask you to provide verifying information, such as your name, email, phone number, account and/or transaction information. We will review the information you provided and may request additional information (e.g., customer history) via email or other means to ensure we are interacting with the correct individual. We will not fulfill your Right to Know (Categories/Processing), Right to Know (Specific Pieces), Right to Delete, or Right to Correct request(s) unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we may have collected PD. Only you, or someone legally authorized to act on your behalf (your authorized agent), may make a Verifiable Consumer Request related to your PD or the PD of your child.
We verify each request as follows:
- Right to Know/Access (Categories/Confirm Processing): We verify your request to a reasonable degree of certainty, which may include matching at least two data points provided by you with data points maintained by us that we have determined to be reliable for the purpose of verifying you. If we cannot do so, we will refer you to this Privacy Policy for a general description of our data practices.
- Right to Know/Access (Specific Pieces): We verify your request to a reasonably high degree of certainty, which may include matching at least three data points provided by you with data points maintained by us that we have determined to be reliable for the purpose of verifying you. If you fail to provide requested information, we will be unable to verify you sufficiently to honor your request, but we will then treat your request as a Right to Know (Categories) request.
- Do Not Sell/Share/Target: No specific verification required unless we suspect fraud.
- Right to Delete: We verify your request to a reasonable degree of certainty, which may include matching at least two data points provided by you with data points maintained by us, or to a reasonably high degree of certainty, which may include matching at least three data points provided by you with data points maintained by us, depending on the sensitivity of the PD and the risk of harm posed by unauthorized deletion. If we cannot verify you sufficiently to honor a deletion request, you can still make a Do Not Sell/Share/Target opt-out request.
- Right to Correct: We verify your request to a reasonable degree of certainty, which may include matching at least two data points provided by you with data points maintained by us, or to a reasonably high degree of certainty, which may include matching at least three data points provided by you with data points maintained by us, depending on the sensitivity of the PD and the risk of harm posed by unauthorized correction.
To protect Consumers, if we are unable to verify you sufficiently, we will be unable to honor your request. We will use PD provided in a Verifiable Consumer Request only to verify your identity and authority to make the request and to track and document request responses unless you also gave it to us for another purpose.
-
Authorized Agent Requests
Only you, or someone legally authorized to act on your behalf, subject to our verification of the agent, the agent’s authority to submit requests on your behalf, and of you, in accordance with the Verification of Your Request section above, may make a Verifiable Consumer Request where we need to verify the request as explained above. Once your agent’s authority is confirmed, they may exercise rights on your behalf subject to the agency requirements of applicable laws.
-
Appeals
You may appeal Kowa’s decision regarding a Consumer privacy rights request you submitted (or that was submitted on your behalf by your authorized agent) by following the instructions provided in our response to your request.
-
Verification of Your Request
-
Response Timing and Formats
We endeavor to respond to Verifiable Consumer Requests within the applicable timeframe under the State Privacy Laws. As permitted by State Privacy Laws, if we require more time, we will inform you of the reason and extension period in writing.
Any disclosures we provide will cover the 12-month period preceding our receipt of the Verifiable Consumer Request, or longer if we are able to. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your PD that is readily usable and that allows you to transmit the information from one entity to another without hindrance.
We do not charge a fee to process or respond to your Verifiable Consumer Request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
Consistent with applicable State Privacy Laws and our interest in the security of your PD, we will not deliver you information regarding your Social Security number, driver’s license number, or other government-issued ID number, financial account number, an account password, or answers to security questions in response to a Consumer rights request; however, you may be able to access some of this information yourself through your account if you have an active account with us.
-
Non-Discrimination / Non-Retaliation
We will not discriminate or retaliate against you for exercising any of your Consumer privacy rights. Unless permitted by applicable State Privacy Laws, we will not do the following if you exercise your Consumer privacy rights:
- Deny you goods or services;
- Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
- Provide you a different level or quality of goods or services; or
- Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
-
Notice of Financial Incentives
We may offer discounts or other rewards (“Incentive(s)”) from time-to-time to Consumers who provide us with PD, such as name, phone number, email address, IP address, or location. You may opt-in to Incentives by entering a competition, promotion, or survey or other loyalty Incentive programs we may offer from time-to-time (“Program(s)”). Each Program may have additional terms, available on the Program page or at Program sign-up. The Incentives will be described in the Program page or at Program sign-up.
We measure the value of your PD collected from Programs by the cost of operating the applicable Program (excluding Incentive costs) and/or the cost of providing the Incentive, unless otherwise set forth in the Program terms. We deem the value of the PD to be reasonably related to the value of the Incentive, and by subscribing to these Programs, you indicate you agree. If you do not agree, please do not subscribe to the Programs. If you subsequently wish to withdraw from the Programs, the method for doing so will be explained in the applicable Program terms. We do not limit participation in our financial incentive programs to Consumers who do not exercise their Consumer privacy rights. However, a deletion request will not delete Program PD because the information is necessary to maintain your participation in the Program. If you desire to delete Program PD, terminate your participation in the Program before making a deletion request pursuant to State Privacy Laws.
-
Our Rights and the Rights of Others
Notwithstanding anything to the contrary, we may collect, use, and disclose your PD as required or permitted by applicable law and this may override your rights under State Privacy Laws. In addition, we are not required to honor your requests to the extent that doing so would infringe upon our or another person’s or party’s rights or conflict with applicable law.
-
Additional Notice for California Residents
California’s “Shine the Light” law (Civil Code section 1798.83) permits California residents to request certain information regarding our disclosure of PD to third parties (including our affiliates) for those third parties’ own direct marketing purposes. We do not currently disclose PD to third parties for those third parties’ direct marketing purposes. To make a request about our Shine the Light compliance, please call us at (888) 710-6525. In your request, please attest to the fact that you are a California resident and provide a current California address for your response. This right is different than, and in addition to, the State Privacy Rights detailed in this Section B, and must be requested separately. We will not accept Shine the Light requests by fax and are not responsible for requests not submitted properly, or that are incomplete.
-
Your Consumer Privacy Rights
-
Changes to This Privacy Policy
We reserve the right to change this Privacy Policy prospectively effective upon the posting of the revised Privacy Policy. We also reserve the right to update and modify this Privacy Policy at any time without other form of notice, but from time to time, we may also notify you by email, or otherwise, when appropriate. Additional or different practices may be disclosed at the point of collection. Any modifications will apply only to PD we collect after posting the updated Privacy Policy unless we obtain your consent. Please check frequently to see any updates or changes to this Privacy Policy. To the extent any provision of this Privacy Policy is found by a court of competent jurisdiction to be unenforceable, such provision shall be severed to the extent necessary for the remainder to be valid and enforceable.
-
Contact Us
If you have any questions or comments about this Privacy Policy, please contact us by clicking on the “Contact Us” link on the footer of homepage and complete and submit the form or call us at (888) 710-6525.