6 Del. Admin. Code § 104-4.0
Current through Register Vol. 28, No. 5, November 1, 2024
Section 104-4.0 - Optional Safe Harbor Language for Privacy Policies4.1 Use of the language and format in this Section 4.0 is not mandatory. Operators are free to use alternative language and formats of their choosing that comply with 6 Del.C. § 1205C (b).4.2 Identification of the Categories of Personally Identifiable Information Collected and the Third-Party Persons to Whom Such Information May Be Disclosed 4.2.1 Under 6 Del.C. § 1205C (b)(1), an operator of a commercial site, service, or application is required to identify in its privacy policy the categories of personally identifiable information it collects from users of its site, service, or application, and the categories of third-party persons to whom such information may be disclosed.4.2.2 An operator shall be deemed to have identified "the categories of personally identifiable information" required by 6 Del.C. § 1205C (b)(1), when the operator provides the following disclosures in its privacy policy, if the operator collects, stores, or uses the specified kind of personal information: Collecting Personally Identifiable Information
We may collect, store, and use the following kinds of personal information:
| * | Information you provide to us when your register with our site/service/application, including your describethe personal information provided by the user upon registration that you collect, store, and use-examples might include first and last names, e-mail address, physical address, telephone number, social security number. |
| * | Information you provide when completing a profile on our site/service/application, including your [describethe personal information provided by the user upon registration that you collect, store, and use-examples might include first and last names, gender, age, date of birth, education status, employment status, relationship status, hobbies and other interests. |
| * | Information you provide when you subscribe to a newsletter or other periodic report or notification that we provide, including describethe personal information provided by the user when they subscribe that you collect, store, and use-such as first and last names and an email address. |
| * | Information about your device or computer, including your IP address, geolocation, browser type, browser version, device type, operating system, referring site/service/application. |
| * | Information about your visits to and use of the site/service/application, including how you use the site/service/application, such as describethe type of information-examples might include the timing, length, frequency, and pattern of use, and the pages, screens, or other displays of information looked at by the user. |
| * | Information relating to any purchases you make of our goods/services or any other transactions that you enter into through our site/service/application, including describethe information-examples might include first and last names, e-mail address, physical address, telephone number, and payment card information. |
| * | Information that you post to our site/service/application for publication on the Internet, including describethe information-examples might include first and last names, user names, profile pictures, and the actual content of what a user posts. |
| . | Information contained in or relating to any communication that you send to us or send through our site/service/application, including describethe information-examples might include the content of the communication and metadata associated with it. |
| * | Identify and describe any other any other personal information thatiscollected by the site, service, or application, including when or how the operator collects it. |
4.2.3 An operator shall be deemed to have identified "the categories of third-party persons" required by 6 Del.C. § 1205C (b)(1), when the operator provides the following disclosures in its privacy policy, if the operator shares a user's personally identifiable information with the specified third-party persons: Disclosing Personally Identifiable Information With Third Parties
We may disclose personally identifiable information we collect from you to the following third parties, for the purposes specified:
| * | Agents.Describethe types ofagents to whom the operator may disclose the information, why the operator may disclose it to them, and whetherthoseagents can retain, store, or use the information for any other purposes-examples might include an outside shipping company used to fulfill and deliver orders, or a credit card company that processes sales transactions. |
| * | Service Providers. We use third parties to provide describethe services provided on our site/service/application. If or When you sign up for specified services, we will share describethe information that will be shared to the extent necessary in order for the third party to provide that service. Statewhether the service providers can retain, store, or use the information for any other purposes. |
| * | Affiliates. We may disclose your personal information to our affiliates, including [describe the types of affiliates, such as the operator's employees, officers, and directors, the operator's subsidiaries, the operator's ultimate parent company, and any other subsidiary of the operator's ultimate parent company, as appropriate, in order to describewhy the operator might disclose the information to affiliates, and whether the affiliates can retain, store, or use the information for any other purposes. |
| * | Other Third Parties. We may disclose to [describeany othertypes of third parties to whom the operator may disclose a user's personal information your describewhat information is disclosed, in order to describewhy the operator may disclose the information to these other types of third parties, and whether these other third parties can retain, store, or use the information for any other purposes. |
| * | Other Disclosures. We may also disclose personally identifiable information we collect from you when we are required to do so by law, or when we believe that disclosure is necessary to protect our rights or to comply with a judicial proceeding, court order, or legal process served on our site/service/application. |
4.3 Description of Process to Review and Request Changes to Personally Identifiable Information Collected 4.3.1 Under 6 Del.C. § 1205C (b)(2), an operator of a commercial site, service, or application is required to describe in its privacy policy whether it maintains a process that allows users of the site, service, or application to request changes to their personally identifiable information collected by the operator through the site, service, or application, and, if it maintains such a process, the operator must also describe that process.4.3.2 An operator that maintains a process that allows users of its site, service, or application to request changes to their personally identifiable information collected by the operator through the site, service, or application, shall be deemed to have made disclosure required by 6 Del.C. § 1205C (b)(2) when the operator provides the following disclosure in its privacy policy: Making Changes To Your Information
This site/service/application permits you to review and make changes to the personally identifiable information we collect from you. You can make changes by describe process for a user to review and make changes-examples of such processes could include logging in to the site, service, or application and using available tools, contacting customer support, or by contacting the operator by specified telephone, postal mail, or email.
4.3.3 An operator that does not maintain a process that allows users of its site, service, or application to request changes to their personally identifiable information collected by the operator through the site, service, or application, shall be deemed to have made disclosure required by 6 Del.C. § 1205C (b)(2) when the operator provides the following disclosure in its privacy policy: Making Changes To Your Information
This site/service/application does not maintain a process by which you can review and make changes to the personally identifiable information we collect from you.
4.4 Description of Process for Notifying Users of Material Changes 4.4.1 Under 6 Del.C. § 1205C (b)(3), an operator of a commercial site, service, or application is required to describe in its privacy policy how it notifies users of its site, service, or application of material changes to its privacy policy.4.4.2 An operator shall be deemed to have made the disclosure required by 6 Del.C. § 1205C (b)(3) when the operator provides the following disclosure in its privacy policy: We may modify this privacy policy at any time. If we do, we will post the revised version here/notify you via email/describe other method of notifying users. You should periodically check here for the most up-to-date version of this privacy policy. Any changes to the privacy policy will not be retroactively applied and will not alter how we handle personally identifiable information we previously collected from you.
4.5 Identification of the Effective Date 4.5.1 Under 6 Del.C. § 1205C (b)(4), an operator of a commercial site, service, or application is required to identify the effective date of its privacy policy.4.5.2 An operator shall be deemed to have made the disclosure required by 6 Del.C. § 1205C (b)(4) when the operator provides the following disclosure in its privacy policy: This privacy policy is effective as of month day, year.
4.6 Description of Response to Web Browser "Do Not Track" Signals 4.6.1 Under 6 Del.C. § 1205C (b)(5), an operator of a commercial site, service, or application is required to disclose how the site, service, or application responds to web browser "do not track" signals or other mechanisms that are intended to give users the ability to exercise choice regarding the collection of personally identifiable information about a user's activities, through the use of persistent identifiers such as "cookies," "pixel tags," and "web beacons," over time and across third-party sites, services, or applications. This applies to all persistent identifiers used on the operator's site, service, or application, regardless of whether those persistent identifiers are placed on the site, service, or application by the operator or a third party such as an advertising service.4.6.2 An operator shall be deemed to have made the disclosure required by 6 Del.C. § 1205C (b)(5) when the operator provides the following disclosure in its privacy policy: Certain web browsers may provide an option by which you may have the browser inform websites or internet services you visit that you do not wish to have personally identifiable information about your activities tracked by cookies or other persistent identifiers across time and across third-party Internet websites, online or cloud computing services, online applications, or mobile applications. These are commonly called "do not track" signals. Our site/service/application responds to such signals by if the site, service, or application takes action in response to such signals, describe the action taken and explain the basis for it; if the site, service, or application is unable to take action, state so and explain why; if the site, service, or application is able to take action but does not take action, state so and explain why.
4.7 Disclosure of Third Party Collection of Personally Identifiable Information 4.7.1 Under 6 Del.C. § 1205C (b)(6), an operator of a commercial site, service, or application is required to disclose in its privacy policy whether anyone other than the operator may collect personally identifiable information about a user's online activities, over time and across different sites, services, and applications, when a user uses the operator's site, service, or application.4.7.2 An operator shall be deemed to have made the disclosure required by 6 Del.C. § 1205C (b)(6) when the operator provides the following disclosure in its privacy policy: We do not allow/may allow allow third parties to collect personally identifiable information about a user's online activities, over time and across different sites, services, and applications, when that user uses our site, service, or application. If "may allow," the operator must describe the kinds of third parties who may be permitted to engage in such collection, the purpose for permitting such collection, and what those third parties may do with the information collected-such as, for example, collection of a user's personally identifiable information by an advertising service for the purpose of directing targeted advertising to the user while using the operator's or a third-party's site, service, or application.
6 Del. Admin. Code § 104-4.0
20 DE Reg. 55 (7/1/2016) (Final)