Tenerity Privacy Notice

Last Updated: October 5, 2023

This Privacy Notice explains how we collect, use, disclose, and otherwise process personal data in connection with our services. This Privacy Notice is not, however, a contract and does not create any legal rights or obligations not otherwise provided by law. For individuals based outside the United States, this Privacy Notice applies solely to their browsing and actions on our website accessible at: https://www.tenerity.com.

Who We Are: Tenerity creates compelling customer engagement solutions for clients and manages endto-end engagement and membership programs and products that may be available to you. When we use the terms “Tenerity”, “we”, “us”, or “our” in this Privacy Notice, we are referring to Tenerity, LLC, its parent company, Tenerity, Inc., and their respective business units, operating companies, and subsidiaries in the United States.

Our Services: When we use the term “services”, we are referring to our Internet websites and our end-to-end engagement and membership programs and products we offer and manage on our own behalf, including:

Our corporate websites that link to this Privacy Notice;
Our retail and entertainment services;
Our travel services;
Our automotive services; and
Our credit and identity protection services.

This Privacy Notice does not cover or address:

Disclosures or rights we may provide to you in relation to the United States Fair Credit Reporting Act (FCRA);
Disclosures or rights we may provide to you in relation to the United States Gramm-Leach-Bliley Act (GLB);
Disclosures or rights we may provide to you in relation to U.S. state-specific financial privacy laws;
Offerings that we provide solely on behalf of our clients; and
Personal data and privacy practices relating to job applicants, employees, and other Tenerity personnel.

We make FCRA-related disclosures available on certain service-specific websites, and we separately provide GLB notices containing GLB and state-specific financial privacy law disclosures by mail or email in connection with GLB-covered services. If you would like to obtain another copy of a GLB notice
previously provided, please contact us at privacy@tenerity.com.

For offerings provided on behalf of our clients, please refer to the privacy notice of the client with which you have a relationship for information on how they engage service providers, like us, to process personal data on their behalf.

What is Personal Data?

When we use the term “personal data” in this Privacy Notice, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual or household. It does not include aggregated or deidentified information that is maintained in a form that is not capable of being associated with or reasonably linked to an individual or household.

Our Collection and Use of Personal Data

The personal data we collect, the way we collect it and how we use it will depend on how you are interacting with us and the type of services you use.

Website & Online Services

Collection of Personal Data

As is true of most digital platforms, we and our third-party providers collect certain personal data automatically when individuals visit or interact with our websites and other online services:

Log Data: Including internet protocol (IP) address, operating system, browser type, browser ID, the URL entered and the referring page/campaign, date/time of visit, the time spent on our services and any errors that may occur during the visit to our services.
Analytics Data: Including the electronic path taken to our services, through our services and when exiting our services, as well as usage and activity on our services, such as the links, objects, products and benefits viewed, clicked or otherwise interacted with (also known as “Clickstream Data”).
Location Data: Including general geographic location based on the Log Data we collect or more precise location when permitted by law.
Application Data: Some of our services offer mobile or browser applications to allow individuals to take advantage of our service offerings on the go and/or when visiting third-party websites and other online services. Certain of these applications also allow us to access more precise Location Data and collect information about use of and interactions with third-party websites and online services (including the products or services an individual is interested in or purchases) to better serve our users.

For information about our and our third-party providers’ use of cookies and related technologies to collect information automatically on our online services, and the choices you may have in relation to those practices, please visit our Cookie Notice.

In addition to the personal data we collect automatically, we also collect personal data directly from individuals through our websites and online services:

Newsletters and Email Communication: Many of our websites and online services provide individuals an opportunity to sign up for our newsletters and email communications by providing their email address. We use the individual’s email address to communicate with them about our services and exciting developments at Tenerity, which may include marketing communications. Please see the Your Communication Preferences section below for additional information about opting out of our marketing communications.
Contact Us: Our websites and online services provide individuals and representatives of prospective business customers and partners the ability to connect with us through different communication channels, including email, phone and, for certain of our websites and online services, an online web form that collects contact information (such as first and last name, email address, phone number, company name, and title with company), area(s) of interest or concern, and a custom message. We use this information to communicate with those individuals and representatives in connection with their request, including corresponding with them about Tenerity’s services, offerings, customer service, business partnership opportunities or media inquiries.

Although we often collect the personal data described above directly from the individual, we also collect this information through service providers and other third parties that collect it on our behalf, such as communications providers, analytics providers, website hosting providers and marketing providers. Please note that our systems may record personal data that an individual types into our websites and other online services even if they do not choose to submit it.

Use of Personal Data

We use the personal data we collect through our websites and other online services to:

Help to optimize visitor experience with our websites and other online services;
Administer, develop and improve our websites and other online services;
Test different configurations of our websites and other online services;
Diagnose errors and problems with our websites and other online services;
Conduct research and analytics on visitor usage and activity trends relating to our websites and other online services;
Remember visitors and the choices they have made in relation to our services;
Connect individuals to the requests and transactions they make on our websites and other online services;
Identify how individuals use our websites and other online services, determine
products/services that may be of interest to them and customize our personalized offerings and marketing efforts accordingly;
Provide individuals with news about products and services we offer;
Deliver marketing communications and advertisements;
Assess the performance of marketing campaigns; and
Respond to comments and questions and provide customer service.

Please note that we link the personal data we collect through our websites and online services with the other personal data that we collect and may use it for the purposes we describe in more detail in the other sections of this Privacy Notice.

Survey, Contest, Sweepstakes and Promotion Entries

Collection of Personal Data

From time to time we may provide individuals the opportunity to participate in surveys, contests, sweepstakes and/or promotions. If they choose to participate, we will request personal data from them in connection with their entry, which typically includes:

Contact Information: Such as full name, email address, mailing address, telephone number, company name and title.
Demographic Information: Such as specific or approximate date of birth, age, gender or annual income.
Survey, Contest or Promotion Entry: Including any personal data an individual may choose to provide in connection with the survey, contest or promotion entry, such as products/services of interest or satisfaction with us.

Although we often collect the personal data described above directly from survey, contest, sweepstakes and promotion participants, we also collect this information through service providers and other third parties that collect it on our behalf, such as communications providers, analytics providers, survey, contest, sweepstakes and promotion entry providers and marketing providers.

Use of Personal Data

We use the personal data we collect in connection with surveys, contests, sweepstakes and promotions to:

Learn how we can improve experience with our services;
Understand our customer/member base and the users of our services, including the service configurations and products that may be of interest to our customer base in the aggregate;
Conduct research and analytics on our customer base, users of our services, and the performance of us and our services;
Incorporate ideas from individual responses into our business operations and customer service models;
Improve and customize our services and product offerings to address the needs and interests of our aggregate customer/member base;
Develop new services and product offerings;
Contact and announce contest, sweepstakes and promotion winners;
Provide individuals with news about products and services we offer; and
Deliver marketing communications and advertisements based on individual interests and interactions with us.

Unless noted otherwise in our initial request, we may link the personal data we collect through contest, promotion, sweepstakes and survey responses with the other personal data that we collect and for the purposes we describe in the other sections of this Privacy Notice.

The survey, contest, sweepstakes or promotion request may contain additional details about how any personal data provided may be used or otherwise processed.

Service Enrollment and Account Management

Collection of Personal Data

When an individual enrolls in our services or creates/maintains an account with us, we collect certain personal data from the individual, which may include:

Contact Information: Including full name, email address, mailing address and telephone number.
Joint Account Holder and Family Information: Including the names of joint account holders and/or family members, when needed for the service, as well as the household indicator used to connect an individual to their family members in our systems.
Account Identifiers: Including a username and password and/or member number, as well as artificial internal identifiers we assign to individual accounts to allow our systems to connect account information stored in different databases and tables.
Security/Authentication Information: Including an enrollment access code, username and password, order entry security pin, mother’s maiden name, date of birth and city of birth.
Payment Information: Including payment status, billing address, billing phone number, credit/debit card name, number, expiration date and security code (CVV), check number, bank account number, transit routing number, payment dates, renewals and renewal period, billing history, card number history, and third-party payment identifiers and confirmations.
Account History: Including the services of interest/purchase, the date and type of enrollment and/or account creation, account status, log in activity, account transactions and benefits, the services we provide, the rewards earned in connection with our services, the alert messages received in connection with the services, enrollment and account errors, and the cancellation date and associated cancellation confirmation code if an individual chooses to cancel their services.
Customer Service and Communication History: Including name, address, email, proof of purchase, Account Identifiers, Account History and the contents of requests and correspondence with us (including recordings of phone calls, where permitted by law).
Communication Preferences: Including preferences for the ways in which we contact each individual (e.g., physical mail, email, text messages) and the frequency at which we reach out.

Although we often collect the personal data described above directly from the individual, we may also collect certain information through our business partners when an individual enrolls through a partner that they already have a relationship with. In addition, we may also collect this information through service providers and other third parties that collect it on our behalf, such as communications providers, payment processors, payment system providers, and information technology providers.

Note about Biometric Information: Some of our mobile applications require users to log in to access their account. We may provide users the ability to log in using facial, fingerprint or other biometric recognition technology available through their mobile device. If a user chooses to utilize these login features, information about their facial geometry, their fingerprint or other biometric information will be collected or processed by their mobile device for authentication purposes. We do not store or have access to this biometric information. Instead, the user’s mobile device will perform the biometric authentication process and only let us know whether the authentication was successful. If the authentication was successful, the user will be able to access the applicable mobile application without separately providing their account credentials.

Use of Personal Data

We use the personal data we collect in connection with an individual’s enrollment and/or account to:

Determine the individual’s eligibility for and/or proof of enrollment in our services;
Create an account for the services the individual chooses to enroll in or interact with;
Authenticate the individual’s identity when they choose to log in or interact with us or our services;
Process payment for the services the individual enrolled in and/or signed up for;
Provide our services to the individual, including allowing the individual to place orders, redeem coupons and rewards, utilize benefits and incentives and make service requests;
Coordinate with business partners and other relevant third parties to provide our services and the day-to-day operations relating to the individual’s enrollment and/or account;
Communicate with the individual, including to provide them with customer service, answer their questions, share news about Tenerity with them, market our products and services to them, and notify them about their membership; and
Prevent fraudulent or other harmful activity, which may result in certain individuals being unable to re-enroll in our services.

Please note that we link the personal data we collect in connection with an individual’s enrollment and/or account with the other personal data that we collect about them and may use it for the purposes we describe in more detail in the other sections of this Privacy Notice.

Retail and Entertainment Services

Scope of Retail and Entertainment Services

Our retail and entertainment services include (but are not limited to):

Discounts and coupons for savings on products, gift cards, card linked offers, dining, entertainment and other activities;
Cash back and rewards points on purchases made through our services or using a linked card; and
Price, delivery and return guarantees, product protection plans and warranty extensions.

Collection of Personal Data

When an individual uses and interacts with our retail and entertainment services, we collect personal data from them, our merchants, product/service vendors, payment processors, service providers and other third parties who collect personal data on our behalf, which may include:

Account Information: If an individual has an account with us, we collect and use
information, as described in the Service Enrollment and Account Management section above, from their account for enrollment in and facilitation of the services.
Contact Information: Including full name, email address, mailing address and telephone number.
Payment Information: Including payment status, billing address, billing phone number, credit/debit card name, number, expiration date and security code (CVV), gift card numbers and redemptions, and third-party payment identifiers and confirmations.
Transaction Information: Including transaction description, order number, date, time and location of purchase/transaction, merchants ordered from, products and services purchased, sale amount, and discount amount.
Shipping Information: Including the recipient’s name, email address, mailing address, and telephone number, the shipping number, estimated delivery date, actual delivery date and gift message, if any.
Coverage Information: Including the products and activities covered by guarantees, protection plans and warranty extensions, the type and length of coverage provided, and claims made under the coverage.
Rewards Information: Including cash back, points and other rewards earned/redeemed, earning/redemption statements, rewards status, rewards expiration dates, rewards earning cap status, and transaction identifiers used to connect an individual’s transactions to them to provide the associated benefits and rewards.
Service Profile Information: Including products and services of interest, favorite merchants, wish list, cart activity, recently viewed products and services, and our understanding of individual preferences and interests.
Feedback Information: Including feedback and ratings an individual provides relating to our services, products and rewards.

Use of Personal Data

We use the personal data we collect in connection with our retail and entertainment services to:

Provide, develop and improve the services, offerings, products and rewards that each individual requests and we facilitate;
Communicate with individuals regarding our services, offerings, products and rewards (including by sending them service-related emails);
Determine individual preferences and interests to better serve each individual;
Personalize individual experience, including providing tailored promotions and marketing offers;
Process payment for the services, offerings, products and rewards that an individual requests;
Facilitate transactions with our merchants, vendors, service providers and other third parties;
Fulfill orders and shipping requests;
Process claims available under an individual’s existing coverage;
Process the cash back, points and other rewards an individual earns and/or redeems;
Provide customer support relating to the services, offerings, products and rewards;
Conduct research and analytics on our customer base, users of our services, and the performance of us and our services;
Improve and customize our services and product offerings to address the needs and interests of our aggregate customer/member base;
Audit transactions conducted in connection with our services; and
Investigate and prevent fraud in connection with accounts and/or transactions.

Please note that we link the personal data we collect in connection with retail and entertainment services with the other personal data that we collect and may use it for the purposes we describe in more detail in the other sections of this Privacy Notice.

Travel Services

Scope of Travel Services

Our travel services include (but are not limited to):

Bookings and savings for flights, hotels, rental cars, cruises and travel activities;
Rewards accrual and redemption on travel products made available through our services; and
Price guarantees, travel protection plans and insurance.

Collection of Personal Data

When an individual uses and interacts with our travel services, we collect personal data from them, our travel booking providers, travel partners, payment processors, service providers and other third parties who collect personal data on our behalf, which may include:

Account Information: If an individual has an account with us, we collect and use
information, as described in the Service Enrollment and Account Management section above, from their account for enrollment in and facilitation of the services.
Contact Information: Including full name, email address, mailing address and telephone number.
Traveler Information: Including travel companions’ names and relationships, as well as the traveler and their travel companions’ full legal name, age, date of birth, sex, gender, travel membership numbers, driver’s license number, passport number and passport details (such as expiration date, country of nationality and issuing country), special accommodations or restrictions and events that they report occurring during their travel.
Payment Information: Including payment status, billing address, billing phone number, credit/debit card name, number, expiration date and security code (CVV), and third-party payment identifiers and confirmations.
Flight Information: Including flight confirmation numbers, frequent flyer number, airline name, airline brand name, flight number, departure date & time, arrival date & time, flight origin, flight destination, flight duration, departure airport code, arrival airport code, and seat number.
Hotel Information: Including hotel confirmation numbers, hotel membership number, hotel name, hotel chain, check-in date, check-out date, and number of guests.
Rental Car Information: Including rental car confirmation numbers, rental car membership number, rental car company, rental car, car pickup date & time, car drop-off date & time, car pickup location, and car drop-off location.
Cruise Information: Including cruise confirmation numbers, cruise line, cruise ship, cruise departure date & time, cruise arrival date & time, cruise departure location and cruise arrival location.
Travel Activity Information: Including travel activity confirmation number, travel activity name, travel activity description, travel activity start date, travel activity end date, and travel activity locations.
Coverage Information: Including the travel and activities covered by guarantees, protection plans and warranty extensions, the type and length of coverage provided, and claims made under the coverage.
Rewards Information: Including cash back, points and other rewards earned/redeemed, earning/redemption statements, rewards status, rewards expiration dates, rewards earning cap status, and transaction identifiers used to connect an individual’s transactions to them to provide the associated benefits and rewards.
Service Profile Information: Including flights, hotels, rental cars, cruises and travel activities of interest, favorite travel providers, recently viewed travel opportunities and our understanding of individual preferences and interests.
Feedback Information: Including feedback and ratings provided relating to our services, products and rewards.

Use of Personal Data

We use the personal data we collect in connection with our travel services to:

Provide, develop and improve the services, offerings, travel opportunities and rewards that each individual requests and we facilitate;
Communicate with individuals regarding our services, offerings, travel opportunities and rewards (including by sending them service-related emails);
Determine individual preferences and interests to better serve each individual;
Personalize individual experience, including providing tailored promotions and marketing offers;
Determine an individual’s eligibility to travel and participate in travel activities, including fulfilling travel provider requirements;
Process payment for the services, offerings, travel opportunities and rewards that an individual requests;
Facilitate travel bookings with our travel booking providers, travel partners, service providers and other third parties;
Fulfill travel itineraries in accordance with travel provider requirements;
Process claims available under an individual’s existing coverage;
Process the cash back, points and other rewards an individual earns and/or redeems;
Provide customer support relating to the services, offerings, travel opportunities and rewards;
Conduct research and analytics on our customer base, users of our services, and the performance of us and our services;
Improve and customize our services and travel offerings to address the needs and interests of our aggregate customer/member base;
Audit transactions conducted in connection with our services; and
Investigate and prevent fraud in connection with accounts and/or transactions.

Please note that we link the personal data we collect in connection with travel services with the other personal data that we collect and may use it for the purposes we describe in more detail in the other sections of this Privacy Notice.

Automotive Services

Scope of Automotive Services

Our automotive services include (but are not limited to):

Roadside assistance;
Auto repair, maintenance and insurance discounts; and
Car research services.

Collection of Personal Data

When an individual uses and interacts with our automotive services, we collect personal data from them, our automotive service partners, payment processors, service providers and other third parties who collect personal data on our behalf, which may include:

Account Information: If an individual has an account with us, we collect and use information, as described in the Service Enrollment and Account Management section above, from their account for enrollment in and facilitation of the services.
Contact Information: Including full name, email address, mailing address and telephone number.
Automotive Information: Including driver’s license number, vehicle year, vehicle make, vehicle model, vehicle condition, covered drivers/passengers (including family members), automotive events the individual is seeking assistance with and the automotive services, products, and offerings purchased.
Payment Information: Including payment status, billing address, billing phone number, credit/debit card name, number, expiration date and security code (CVV), and third-party payment identifiers and confirmations.
Location Information: If an individual chooses to use our LocateMe® Technology in connection with our roadside assistance offerings, we will record their vehicle’s breakdown location when they call us from any wireless or landline phone, so we can dispatch one of our service providers to them faster and get them back on the road.
Service Profile Information: Including automotive services, products and offerings of interest, recently viewed products and services, and our understanding of individual preferences and interests.
Feedback Information: Including feedback and ratings provided relating to our automotive services, products and offerings.

Use of Personal Data

We use the personal data we collect in connection with our automotive services to:

Provide, develop and improve the automotive services, products and offerings that each individual requests and we facilitate;
Communicate with individuals regarding our automotive services, products and offerings (including by sending them service-related emails);
Determine individual preferences and interests to better serve each individual;
Personalize individual experience, including providing tailored promotions and marketing offers;
Process payment for the automotive services, products and offerings that an individual requests;
Facilitate the automotive services, products and offerings each individual purchases with our automotive partners, service providers and other third parties;
Provide customer support relating to the automotive services, products and offerings;
Conduct research and analytics on our customer base, users of our services, and the performance of us and our services;
Improve and customize our automotive services, products and offerings to address the needs and interests of our aggregate customer/member base;
Audit transactions conducted in connection with our services; and
Investigate and prevent fraud in connection with accounts and/or transactions.

Please note that we link the personal data we collect in connection with automotive services with the other personal data that we collect and may use it for the purposes we describe in more detail in the other sections of this Privacy Notice.

Credit & Identity Protection Services

Scope of Credit & Identity Protection Services

Our credit and identity protection services include (but are not limited to):

Credit monitoring and credit reports;
Credit/debit card monitoring; and
Identity theft and fraud monitoring and support services (including our ID MobileProtect, Sentinel mobilesafe and Digital Protection mobile applications).

Collection of Personal Data

When an individual uses and interacts with our credit and identity protection services, we collect personal data from them, our credit and identity protection providers, payment processors, service providers and other third parties who collect personal data on our behalf, which may include:

Account Information: If an individual has an account with us, we collect and use
information, as described in the Service Enrollment and Account Management section above, from their account for enrollment in and facilitation of the services.
Contact Information: Including full name, email address, mailing address and telephone number.
Payment Information: Including payment status, billing address, billing phone number, credit/debit card name, number, expiration date and security code (CVV), and third-party payment identifiers and confirmations.
Credit and Identity Information: Including Social Security number, account numbers and status, and other credit/identity-related information needed to facilitate the delivery of credit reports, driver’s record reports, publicly available record reports and other available reports for each individual’s review and the provision of the credit and identity protection services they request.
Coverage Information: Including the credit and identity protections covered by our credit and identity monitoring services, the type and length of coverage provided, and claims made under the coverage.
Service Profile Information: Including products and services of interest, recently viewed products and services, and our understanding of individual preferences and interests.
Feedback Information: Including feedback and ratings relating to our services, products and rewards.

Use of Personal Data

We use the personal data we collect in connection with our credit and identity protection services to:

Provide, develop and improve the credit and identity protection services, products and offerings that each individual requests and we facilitate;
Communicate with individuals regarding our credit and identity protection services, products and offerings (including by sending them service-related emails);
Determine individual preferences and interests to better serve each individual;
Personalize individual experience, including using personal data other than Credit and Identity Information to provide tailored promotions and marketing offers;
Process payment for the credit and identity protection services, products and offerings that an individual requests;
Facilitate the credit and identity protection services, products and offerings an individual purchases with our credit and identity partners, service providers and other third parties;
Process claims available under an individual’s existing coverage;
Provide customer support relating to the credit and identity protection services, products and offerings;
Conduct research and analytics on our customer base, users of our services, and the performance of us and our services;
Improve and customize our credit and identity protection services, products and offerings to address the needs and interests of our aggregate customer/member base;
Audit transactions conducted in connection with our services; and
Investigate and prevent fraud in connection with accounts and/or transactions.

Please note that we link the personal data we collect in connection with credit and identity protection services with the other personal data that we collect and may use it for the purposes we describe in more detail in the other sections of this Privacy Notice.

Other Collection of Personal Data

In addition to the personal data collected above, we may also collect personal data as follows:

Referrals: We offer a referral service that allows an individual to tell one of their friends about our services by forwarding certain marketing communications and/or emails to the friend they believe may be interested in our products and services. We use personal data collected in connection with these referral services to communicate with the friend being referred and to provide the referring individual any benefits, incentives and/or rewards they may be eligible for as a result of their referral.
Social Media: If an individual chooses to interact with us on social media, we may collect personal data about them from their social media account that they make public. We use personal data collected in connection with their social media account to communicate with them, better understand their interests and preferences, and better understand our customer base in the aggregate.
Business Partners: Our business partners, such as our travel providers and product merchants, collect personal data in connection with our services and often share some or all of this information with us. For example, we receive information about transactions an individual completes on our business partners’ websites through our services in order to count those transactions toward the individual’s cash back, bonus points or other rewards programs.
Business Representatives: We collect professional personal data about representatives of third-party businesses, including representatives of our customers and business partners, in connection with our services and the operation of our business, which may include:
- Contact Information: Including full name, email address, mailing address and telephone number.
- Professional Information: Including job title, job function, company name and characteristics, professional background, and nature of the relationship with us.
- Tax and Payment Information: Including a personal tax identification number, bank account information, and payment information where the individual is a representative of a sole proprietor or similar legal structure that uses personal tax and account information in lieu of separate business information.
- Website & Online Services Information: Including the personal data described in the Website & Online Services section above when the business representative interacts with our websites and online services.
- Inquiry Information: Including the contents of emails, texts, and other
  communications and, where permitted by law, recordings of calls with us.
- Feedback Information, including information provided in response to surveys we may conduct with customers or business partners, or unsolicited feedback received regarding our services and business.
Office and Event Visitors: We collect personal data about visitors to our physical offices and events, which may include:
- Contact Information: Including full name, email address, mailing address and telephone number.
- Professional Information: Including job title, job function, company name and characteristics, professional background, and nature of the relationship with us.
- Visit Information: Including the purpose of the visit and any restrictions or preferences while on premise (such as dietary restrictions).
- Security Information: Including a copy of a government ID (such as a driver’s license), a record of the visitor’s access to our office or event, any use by the visitor of our computer systems, and images or audio/video recordings of the visitor while on premises (where permitted by law).
- Website & Online Services Information: Including the personal data described in the Website & Online Services section above when the visitor interacts with our websites and online services.
- Inquiry Information: Including the contents of emails, texts, and other
  communications and, where permitted by law, recordings of calls with us.
Service Providers: Our service providers, such as payment processors and marketing providers, collect personal data and often share some or all of this information with us. For example, we receive personal data from payment processors to confirm that an individual’s payment for the services was accepted.
Information Providers: We may from time to time obtain information from third-party information providers to correct or supplement personal data we collect. For example, we may obtain updated contact information from third-party information providers to reconnect with an individual.
Inquiry Information: If an individual chooses to contact us, we will collect personal data in connection with their inquiry and correspondence with us. We may need additional information to fulfill their request or respond to their inquiry. We may provide additional privacy disclosures where the scope of the inquiry/request and/or personal data we require fall outside the scope of this Privacy Notice. In that case, the additional privacy disclosures will govern how we may process the information provided at that time. Where permitted by law, we may also record our calls with those individuals.
Publicly Available Information: We may collect personal data from publicly available sources, such as government records or public review websites, to supplement the personal data identified above.
Inferences: We may generate inferences or predictions about individuals and their interests and preferences based on the other personal data we collect and the interactions we have with the individuals.

Other Uses of Personal Data

In addition to the uses identified above, we use the personal data we collect to:

Facilitate our day-to-day business operations, such as maintaining accounts and processing transactions;
Develop new products and services, and improve existing products and services;
Aggregate information we receive from individuals and third parties to help understand individual needs, customize our services and offerings for each individual, and provide all individuals better service;
Conduct research and analytics designed to understand our customer base and improve our products, services and customer experience;
Prevent, investigate or provide notice of fraud or unlawful or criminal activity;
Enforce and carry out contracts and agreements;
Facilitate business transactions and reorganizations impacting the structure of our business; and
Comply with legal obligations.

Our Disclosure of Personal Data

We disclose personal data in the following ways:

Within Tenerity: We are able to offer the products and services we make available because of the hard work of the entire Tenerity team. Tenerity entities disclose personal data to other Tenerity entities for purposes and uses that are consistent with this Privacy Notice and applicable law. For example, the Tenerity entity providing our services to an individual may share personal data relating to transactions with another Tenerity entity that provides the system used to review available offerings and complete transactions for the services we are providing.
Business Partners: We may share personal data of business representatives with other business partners for purposes of facilitating our services or operating our business. We also often make our services available to customers and/or employees of our business partners. We may provide personal data to the relevant business partner to confirm an individual’s enrollment in the service.
Data Analytics Providers: We share personal data with data analytics providers who analyze statistics and trends relating to the usage of and activity relating to our services. These data analytics providers produce reports and make suggestions for our customer and business strategy based on the personal data and other information analyzed.
Affiliate Networks and Merchants: In order to facilitate an individual’s orders and provide them the rewards they are eligible to receive, we may disclose personal data to affiliate networks and merchants to enable them to fulfill orders and identify which of their customers are connected to our services. For example, we often provide affiliate networks and merchants an online identifier showing that an individual was referred from our services to the affiliate network’s and/or merchant’s site and connecting their purchases to their rewards account.
Payment Processors and Online Payment Systems: We share personal data with payment processors, online payment system providers and other billing agents to process payments for the services and products an individual orders, as well as to provide refunds, cash back and/or rebate checks.
Transaction Fulfillment and Delivery Providers: We share personal data with transaction fulfillment and delivery providers in order to fulfill an individual’s transactions through our services and deliver the products and experiences that an individual orders through our services.
Insurance and Coverage Providers: We often engage insurance companies, financial institutions and other third parties to provide the guarantees, protection plans and extended warranties made available through our services. In order for these third parties to administer and service an individual’s coverage in connection with the services, we share personal data about the individual with them.
Credit and Identity Protection Providers: In order to provide our credit and identity protection services, we often engage partners and service providers who specialize in different aspects of credit and identity monitoring and protection. We share personal data with these providers in order to facilitate their provision of credit and identity protection services to individuals, including providing them sufficient personal data to compile the relevant reports needed for the service.
Marketing Partners: We coordinate and share personal data with our marketing partners, including advertisement networks, social networks, and marketing communication providers, in order to communicate with individuals about our products and services and market our products and services to them. We may also share aggregated demographic information with third parties interested in advertising on our online services to assist them in understanding the audience they would be reaching, but this information is not designed to be identifiable to a specific individual.
Customer Service and Communication Providers: We share personal data with third parties who assist us in providing our customer service experience and facilitating our communications with individuals, including third parties that provide call center, email and chat support services.
Other Service Providers: In addition to the third parties identified above, we engage other third parties to perform certain functions on our behalf in connection with the uses of personal data described in the Our Collection and Use of Personal Data section above, including rewards tracking, communication printing, website hosting, information technology support, content development and fraud monitoring. Depending on the function the third party serves, the service provider may process personal data on our behalf or have access to personal data while performing functions on our behalf.
Public Disclosure: With an individual’s consent or at their direction, we may disclose certain personal data about them, such as first name/initial, last name and city of residence, publicly as an example of representative savings and/or to identify the individual as a user of our service.
Business Transaction or Reorganization: We may take part in or be involved with a corporate business transaction, such as a merger, acquisition, joint venture, or financing or sale of company assets. We may disclose personal data to a third party during negotiation of, in connection with or as an asset in such a corporate business transaction. Personal data may also be disclosed in the event of insolvency, bankruptcy, or receivership.
Legal Obligations and Rights: We may disclose personal data to third parties, such as legal advisors and law enforcement:
- In connection with the establishment, exercise, or defense of legal claims;
- To comply with laws and regulations or to respond to lawful requests and legal process;
- To protect our rights and property and the rights and property of our agents, customers, and others, including to enforce our agreements, policies, and terms of use;
- To detect, suppress, or prevent fraud;
- To reduce credit risk and collect debts owed to us;
- To protect the health and safety of us, our customers, or any person; or
- As otherwise required by applicable law.
Otherwise with Consent or Direction: We may disclose personal data about an individual to certain other third parties or publicly with the individual’s consent or direction.

Your Communication Preferences

In connection with our services, we may send email messages, direct mail offers, SMS messages, push notifications or other communications, including telephone calls, regarding our services. You may ask us not to send you marketing communications or request a change to the method or frequency of communication by:

Following any available opt-out or communication preferences instructions in the marketing communications;
When available, accessing the “Unsubscribe” or “Communication Preferences” settings in the account profile page;
Sending a request to service@tenerity.com with the words “Opt Out” or “Communication Preferences” in the subject line, the address or number at which we contacted you and your request; or
Sending a request to the following address identifying the address or number at which we contacted you and your request:

Tenerity
Data Privacy Office
6 High Ridge Park
Stamford, CT 06905
1-877-346-8803

Please allow up to 10 days for your request to be processed. If you request to opt out of marketing communications, please note that we may continue to send you non-marketing communications, such as those directly related to the fulfillment of a specific transaction you requested, maintenance of your account or status of our ongoing business relations.

Children’s Personal Data

Our websites and online services are not directed to, and we do not intend to, or knowingly, collect or solicit personal data from children under the age of 13. If you are under the age of 13, please do not use our websites or online services or otherwise provide us with any personal data either directly or by other means. If a child under the age of 13 has provided personal data to us, we encourage the child’s parent or guardian to contact us to request that we remove the personal data from our systems. If we learn that any personal data we collect has been provided by a child under the age of 13, we will promptly delete that personal data.

We do, however, process personal data about children, including their Social Security numbers, when it is necessary for the services we are offering and you provide it to us. This personal data is used to provide you the full benefit of the service you have chosen, such as the protection of your child’s bank card or
identity, coverage for your child under insurance products or for travel services such as flights, hotels or cruises.

Region-Specific Disclosures

We may choose or be required by law to provide different or additional disclosures relating to the processing of personal data about residents of certain countries, regions or states. Please see below for disclosures that may be applicable to you:

If you are a resident of the State of California, Colorado, Connecticut, Utah, or Virginia in the United States, please click here for additional U.S. state-specific privacy disclosures.
If you are a resident of the State of Nevada in the United States, Chapter 603A of the Nevada Revised Statutes permits a Nevada resident to opt out of potential future sales of certain covered information that a website operator has collected or will collect about the resident. To submit such a request, please contact us at privacy@tenerity.com.
If you are based in the European Economic Area (EEA) or United Kingdom (UK), please click here for additional European-specific privacy disclosures.

Third-Party Websites

Our websites and online services may include links to or redirect you to third-party websites, plug-ins and applications, including social media services where you may connect with us. Third-party websites may also reference or link to our websites and online services. Except where we post, link to or expressly adopt or refer to this Privacy Notice, this Privacy Notice does not apply to, and we are not responsible for, any personal data practices of third-party websites and online services or the practices of other third parties. To learn about the personal data practices of third parties, please visit their respective privacy notices or policies.

Updates to this Privacy Notice

We will update this Privacy Notice from time to time. When we make changes to this Privacy Notice, we will change the “Last Updated” date at the beginning of this Privacy Notice. If we make material changes to this Privacy Notice, we will notify you by prominent posting at the beginning of this Privacy Notice. All changes shall be effective from the date of publication unless otherwise provided in the notification.

Contact Us

If you have any questions or requests in connection with this Privacy Notice or other privacy-related matters, please send an email to privacy@tenerity.com.

Alternatively, inquiries may be addressed to:

Tenerity
Data Privacy Office
6 High Ridge Park
Stamford, CT 06905
1-877-346-8803

Additional U.S. State Privacy Disclosures

These Additional U.S. State Privacy Disclosures supplement the information contained in our Privacy Notice by providing additional information about our personal data processing practices relating to individual residents of the States of California, Colorado, Connecticut, Utah, and Virginia. For a detailed description of how we collect, use, disclose, and otherwise process personal data in connection with our services, please visit our Privacy Notice. Unless otherwise expressly stated, all terms defined in our Privacy Notice retain the same meaning in these U.S. State Privacy Disclosures.

Additional Personal Data Disclosures

No Sales or Targeted Advertising

We do not sell personal data, and we do not process or otherwise share personal data for the purpose of displaying advertisements that are selected based on personal data obtained or inferred over time from an individual’s activities across non-affiliated businesses or websites, applications, or other services (otherwise known as “targeted advertising” or “cross-context behavioral advertising”).

Sensitive Information

The following personal data elements we collect may be classified as “sensitive” under certain privacy laws (“sensitive information”):

Social Security number, driver’s license number, and passport number;
Credit/debit card number plus expiration date and security code (CVV), and financial account number and routing number;
Username and password; and
Precise geolocation data.

We use this sensitive information for the purposes set forth in the Our Collection and Use of Personal Data section of our Privacy Notice.

We do not sell sensitive information, and we do not process or otherwise share sensitive information for the purpose of targeted advertising. However, depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to limit, or withdraw your consent for, our processing of sensitive information (as described in the Your Privacy Choices section below).

Deidentified Information

We may at times receive, or process personal data to create, deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual or household. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by law.

Your Privacy Choices

Depending on your state of residency and subject to certain legal limitations and exceptions, you may be able to exercise some or all of the following rights:

The Right to Know

The right to confirm whether we are processing personal data
about you and, under California law only, to obtain certain personalized details about the personal data we have collected about you, including:

The categories of personal data collected;
The categories of sources of the personal data;
The purposes for which the personal data were collected;
The categories of personal data disclosed to third parties (if any), and the categories of recipients to whom the personal data were disclosed;
The categories of personal data shared for targeted advertising purposes (if any), and the categories of recipients to whom the personal data were disclosed for those purposes; and
The categories of personal data sold (if any), and the categories of third parties to whom the personal data were sold.

The Right to Access & Portability

The right to obtain access to the personal data we have collected about you and, where required by law, the right to obtain a copy of the personal data in a portable and, to the extent technically feasible, readily usable format that allows you
to transmit the data to another entity without hindrance.

The Right to Correction

The right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of the personal data.

The Right to Control Over Sensitive Information

The right to exercise control over our collection and processing of certain sensitive information.

The Right to Deletion

The right to have us delete the personal data we maintain about you.

Depending on your state of residency, you may also have the right to not receive retaliatory or discriminatory treatment in connection with a request to exercise the above rights. However, the exercise of the rights described above may result in a different price, rate or quality level of product or service where that difference is reasonably related to the impact the right has on our relationship or is otherwise
permitted by law.

Submitting Privacy Rights Requests

To submit a request to exercise one of the privacy rights identified above, please:

Complete our online form; or
Call 1-877-346-8803.

Before processing your request, we will need to verify your identity and confirm you are a resident of a state that offers the requested right(s). In order to verify your identity, we will generally either require the successful authentication of your membership, or the matching of sufficient information you provide us to the information we maintain about you in our systems. As a result, we require requests to include first and last name, email address, member number (if applicable), and the name of the relevant product or service relating to your request. We may at times need to request additional personal data from you, taking into consideration our relationship with you and the sensitivity of your request.

In certain circumstances, we may decline a privacy rights request, particularly where you are not a resident of one of the eligible states or where we are unable to verify your identity.

Submitting Authorized Agent Requests

In certain circumstances, you are permitted to use an authorized agent to submit requests on your behalf through the designated methods set forth above where we can verify the authorized agent’s authority to act on your behalf. In order to verify the authorized agent’s authority, we generally require evidence of either (i) a valid power of attorney or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a statement of authorization for the request. Depending on the evidence provided and your state of residency, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to verify your identity in connection with the request.

Appealing Privacy Rights Decisions

Depending on your state of residency, you may be able to appeal a decision we have made in connection with your privacy rights request. All appeal requests should be submitted by replying to the communication resolving your original request, using our online form or calling 1-877-346-8803.

California-Specific Disclosures

The following disclosures only apply to residents of the State of California.

California Categories of Personal Data

California law requires we provide disclosures to you about what personal data we collect by reference to the enumerated categories of personal data set forth within California law. To address this obligation, we have identified the relevant enumerated California personal data category for the personal data described
in the Our Collection and Use of Personal Data section of our Privacy Notice below:

Identifiers, including Account Identifiers, Credit and Identity Information relating to data used to identify an individual, full name, IP address, and government identification number (including Social Security number, passport number and driver’s license number).
Customer Records, including Contact Information, Security/Authentication Information, Joint Account Holder and Family Information, Traveler Information, Automotive Information, Credit and Identity Information relating to individual accounts, Account History relating to individual accounts, Payment Information, Shipping Information relating to individual accounts, Rewards Information relating to individual accounts, Referrals, and approximate income level.
Protected Classification Characteristics, including age, date of birth, gender, and sex.
Commercial Information, including Account History relating to an individual’s purchases, Transaction Information, Shipping Information relating to an individual’s purchases, Coverage Information, Flight Information, Hotel Information, Rental Car Information, Cruise Information, Travel Activity Information, Rewards Information relating to an individual’s purchases or redemption, Service Profile Information relating to an individual’s purchases and interests, and Feedback Information.
Internet/Network Information, including Log Data, Analytics Data and Application Data.
Geolocation Data, including general geographic location or more precise location when permitted by law (such as in connection with an individual’s use of our LocateMe® Technology for our automotive services).
Sensory Information, including, where permitted by law, recordings of phone calls between us and individuals and audio, image and video recordings of visitors to our offices or events.
Profession/Employment Information, including the business or organization an individual represents, their title with that business or organization and information relating to their role with the business or organization.
Sensitive Information, including Social Security number, driver’s license number, passport number, credit/debit card number plus expiration date and security code (CVV), financial account number and routing number, username and password, and precise geolocation.
Other Personal Data, including Communication Preferences, Customer Service and Communication History, personal data an individual permits us to see when interacting with us through social media, and personal data an individual provides us in relation to a question, request, inquiry, survey, contest or promotion.
Inferences, including our predictions about interests and preferences and related Service Profile Information.

We disclose all of these categories of personal data for a business purpose to service providers or other third parties at the consumer’s direction, as outlined in the Our Disclosure of Personal Data section of our Privacy Notice.

Retention of Personal Data

We retain personal data only for as long as is reasonably necessary to fulfil the purpose for which it was collected. However, if necessary, we may retain personal data for longer periods of time, until set retention periods and deadlines expire, for instance where we are required to do so in accordance with legal, tax and accounting requirements set by a legislature, regulator or other government authority.

To determine the appropriate duration of the retention of personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of personal data and if we can attain our objectives by other means, as well as our legal, regulatory, tax, accounting and other applicable obligations.

Notice of Financial Incentives

A core part of our business involves the design and implementation of programs and other offerings intended to provide benefits to eligible participants. Most of the programs and other offerings we manage are provided on behalf of our clients. For these programs and other offerings, please refer to the terms and privacy notice of the client with which you have a relationship for information regarding any financial incentives they may offer through our services.

Apart from the programs and other offerings we provide on behalf of our clients, we also provide our own programs and other offerings directly to interested individuals that may qualify as financial incentives. For example, the programs and other offerings we may make available to interested individuals include:

Access to exclusive content, research, and insights; or
Discounts, coupons, cash back, and other special offers for shopping with our partners.

To obtain access to certain of these programs and other offerings, we may ask to collect or share an interested individual’s personal data, including name, contact information, professional information, account information, and shopping transaction information. We consider the value of these programs and other offerings to be reasonably related to the value of the personal data we receive and otherwise process in connection with these programs and offerings, based on our reasonable but sole determination and taking into consideration the expenses related to facilitating the program or offering.

The terms applicable to each program and other offering are provided at the time an eligible individual is offered an opportunity to participate. Interested individuals can opt-in to these financial incentives by following the instructions presented at the time the offer is made. Participating individuals may withdraw from our programs and other offerings at any time by following the instructions provided in connection with each offering, emailing us at privacy@tenerity.com, or calling 1-877-346-8803. Participating individuals may also opt out of receiving marketing communications by following the instructions set forth in the Your Communication Preferences section of our Privacy Notice.

Additional European Privacy Disclosures

These Additional European Privacy Disclosures supplement the information contained in our Privacy Notice by providing additional information about how we may collect, use, disclose, and otherwise process the personal data of individuals based in the European Economic Area (EEA) or United Kingdom (UK) who visit the website https://www.tenerity.com (“Website”). Unless otherwise expressly stated, all terms defined in our Privacy Notice retain the same meaning in these Disclosures and all other terms defined in the European Union General Data Protection Regulation 2016/679 (GDPR) and not otherwise defined in these Disclosures have the same meaning when used in these Disclosures.

For the services described in our Privacy Notice, Tenerity, LLC is the data controller responsible for the collection and use of personal data. Contact details for the data controller are available in the Contact Us section below.

Additional Personal Data Disclosures

When we use the term “personal data” in these Disclosures, we mean any information relating to an identified or identifiable natural person.

Legal Bases for Processing

We process personal data:

When it is necessary for the performance of any contractual relationship we may have with an individual, such as payment information where it is necessary to conclude a transaction with the individual;
Where it is necessary for us to comply with our legal obligations, such as tax reporting or for anti-money laundering purposes; or
Where it is necessary for the purposes of the legitimate interests pursued by us, where those interests are not overridden by the interests or fundamental rights and freedoms of the data subject.

We may also process personal data based on an individual’s explicit consent (i.e., freely given, specific, informed and unambiguous consent). Where this is the case, we will clearly request the individual’s consent prior to collecting or processing their personal data. Individuals should be aware that they have the right to withdraw their consent at any time.

Individuals are not required to provide personal data to us, but we do rely on personal data to enter into a contract for or to provide certain of our services and products. For example, we need an individual’s personal data to facilitate and deliver a service that they request. If an individual chooses not to provide us with their personal data, we may not be able to provide them with a service or product they request.

Data Retention

Therefore, we retain personal data for as long as the individual continues to use our services for the purposes explained in our Privacy Notice. When an individual discontinues the use of our services, we will retain their personal data for as long as necessary to comply with our legal obligations, to resolve disputes and defend claims, as well as, for any additional purpose based on the choices they have made,
such as to receive marketing communications that the individual provided their consent to. In particular, we will retain call recordings, the personal data supplied when joining our services, including complaints, claims (for insurance products) and any other personal data supplied during the duration of an individual’s contract with us for the services until the statutory limitation periods have expired, when this is necessary for the establishment, exercise or defense of legal claims.

Once retention of the personal data is no longer necessary for the purposes outlined above, we will either delete or anonymize it or, if this is not possible (for example, because personal data has been stored in backup archives), then we will securely store the personal data and isolate it from further processing until deletion or anonymization is possible.

International Data Transfers

We may transfer personal data among us and to our subsidiaries or affiliates, as well as to the categories of third parties identified in the Our Disclosure of Personal Data section of our Privacy Notice. Personal data may be transferred to, stored and processed in a country other than the one in which it was collected, including, but not limited to, the United States. The country to which personal data is transferred may not provide the same level of protection for personal data as the country from which it was transferred.

We may transfer personal data outside of the EEA or the UK, and when we do so we rely on appropriate or suitable safeguards recognized under the GDPR including adequacy decisions and standard contractual clauses.

Adequacy Decisions

We may transfer personal data about you to countries that the European Commission or the UK Government have deemed to adequately safeguard personal data.

Standard Contractual Clauses

The European Commission has adopted Standard Contractual Clauses, which provide safeguards for personal data transferred outside of the EEA. The UK Government has endorsed the continued use of the EU’s Standard Contractual Clauses for personal data transferred outside of the UK. We may use these
Standard Contractual Clauses when transferring personal data from the UK or from a country in the EEA to a third country that has not been deemed to adequately safeguard personal data.

Your Privacy Rights

You may be able to exercise the following rights in relation to the personal data about you that we have collected (subject to certain limitations at law):

Access

The right to access and obtain a copy of personal data about you, as well
as information relating to its processing.

Portability

The right to obtain a copy of personal data about you in an easily accessible format and the right to transmit that personal data to another controller.

Rectification

The right to correct or update any personal data about you that is
inaccurate or incomplete.

Restriction of Processing

The right to require us to limit the purposes for which we process your personal data if the continued processing of the personal data in this way is not justified, such as where the accuracy of the personal data is contested by you.

Objection to Processing

You also have the right to object to any processing based on our legitimate interests where there are grounds relating to your particular situation.
There may be compelling reasons for continuing to process your personal data, and we will assess and inform you if that is the case. You can object to marketing activities for any reason.

Withdrawal of Consent

Where we rely on your consent for processing of your personal data, you also have the right to withdraw your consent to such processing, subject to certain limitation at law.

Erasure

The right to request the deletion or erasure of personal data about you without undue delay if the continued processing of that personal data is not justified.

Please note that if the exercise of these rights limits our ability to process personal data, we may not be able to provide our products or services to you, or otherwise engage with you going forward.

Submitting Requests

To submit a request to exercise your rights, please contact us as set forth in the Contact Us section below. We may need to verify your identity before processing your request, which may require us to obtain additional personal data from you. In certain circumstances, we may decline a request to exercise the rights describe above.

Right to Lodge a Complaint

If you have any complaints regarding our privacy practices, you have the right to lodge a complaint with your national data protection authority. We would, however, appreciate the chance to handle your concerns directly prior to a complaint being filed, so please contact us directly as set forth in the Contact
Us section below if you have any concerns.

Contact Us

If you have any questions or requests in connection with these Additional European Privacy Disclosures or other privacy-related matters in relation to the European Economic Area (EEA) or United Kingdom (UK), please send an email to DPO@tenerity.com. If you have any questions or requests for our Data Protection Officer, please contact them by email at DPO@tenerity.com.

Alternatively, inquiries may be addressed to:

Tenerity
Sentinel House
Airspeed Road
Portsmouth
Hampshire
PO3 5RF