Grotto Aesthetics Privacy Notice
Last Update Date: 01-APR-2022
Grotto Aesthetics and its group entities d/b/a Grotto Wax (“Grotto”) is committed to protecting your privacy. Throughout this notice, the terms “we”, “us”, “our” or “ours” refer to Grotto. And the terms “you”, “your” or “yours” refer to YOU (as the Data Subject). Subscriber refers to any customer or business that uses or subscribes to any Grotto software or services, including but not limited to Subscriber’s employees, advisors, contractors, agents, consultants, or others acting on behalf of the Subscriber. Guest refers to our Subscriber’s customer.
Personal Data collected by third parties during your communications/dealings with those third parties or your use of their products or services (for example, where you follow links to third party websites over which we have no control).
Personal Data processed, stored, or hosted by us when we act as a data processor on behalf of our Subscribers in the course of providing our services, in which case the privacy notice of the relevant Subscriber(s) will apply, and our data processing agreement with such Subscribers will govern our processing of your Personal Data.
What Personal Data We Collect and Process?
The Personal Data we collect directly from you includes identifiers, contact information, professional or employment-related information, commercial information, and internet activity information. We collect such information in the following situations:
If you use our “Contact Us” option on the website; request a demo; sign up for an event, webinar or contest; sign up for a referral program; download certain content such as eBook, case study; enter information in the landing pages used by Marketing teams; use our “Ordering Device” section on the website, we may require that you provide to us your contact information, such as your first name, last name , full name, email, phone, location, country, business name and shipping address.
If you interact with our websites or emails, we automatically collect information about your device and your usage of our websites or emails (such as Internet Protocol (IP) addresses or other identifiers, which may qualify as Personal Data using cookies, web beacons, or similar technologies.
If you use and interact with our services, we automatically collect information about your device and your usage of our services through log files and other technologies, some of which may qualify as Personal Data.
If you communicate with us via a phone call from us, we may record that call.
If you voluntarily submit certain information to our services, such as filling out a survey about your user experience, we collect the information you have provided as part of that request.
If you apply directly through the Grotto online recruitment system and careers page, we collect identifiers (including personal and contact details), professional and employment related information (including the information contained in your resume or CV), educational information, and personal characteristics (where the collection of such data is allowed by law).
We also collect information about you from other sources including third parties and from publicly available information. We may combine this information with Personal Data provided by you. This helps us update, expand and analyze our records and create more tailored advertising to provide services that may be of interest to you.
Some of our services include processing of data, including the Personal Data of Guests, on behalf of our Subscribers and Vendors in relation to applications, tools or software that we provide. The Personal Data we collect and process on behalf of our Subscribers may include the following:
Demographic & Identity Data: We may collect personal data of the Guest (our Subscriber’s guest or customer) such as first name, last name, email, address, contact number, gender, date of birth, photograph, signature, gift card recipient name, gift card recipient address. Additionally, location & device id, are also collected when using mobile apps.
Financial Data: Data collected from the Guest may include name on the card, last 4 digits of the card number, card expiry date, card scheme, card token no.CVV information is also collected but not stored at our end but shared with the payment processor.
Health and Fitness Data: Data collected from the guest may include patient medical history, skin related details, weight, allergies, medical test reports, photographs of health condition, signatures of patient, signatures of doctor, and any other custom information that may be necessary to be collected for the patient’s treatment.
Employee Information: We may collect personal data of the Employee (our Subscriber’s employees, advisors, contractors, agents, consultants, or others acting on behalf of the Subscriber) such as first name, last name, email, address, contact number, gender, date of birth, photograph, signature. Additionally, location, device id and IP addresses are also collected when using mobile apps.
What is the basis of collecting and processing Your Personal Data?
We collect and process your Personal Data by relying on one or more of the following bases:
The processing is necessary for the purpose of performance of the contract we have with you OR our Subscribers or Vendors on whose behalf we are serving you.
You have explicitly agreed to/consented to us processing your Personal Data for a specific purpose.
The processing is necessary for purposes of informing, promoting, and selling our services to you.
The processing is necessary for Purposes of Employment that you may seek with us.
The processing is necessary for the purpose of protecting the Grotto data from threats, violations, and breaches if any.
How Do We Use Your Personal Data?
We use your Personal Data for the following purposes:
To verify your identity
To deliver our products and services to you and on behalf of our Subscribers and Vendors
To communicate with you regarding existing products and services availed by you, including notifications of any alerts or updates
To evaluate, develop and improve our products and services
For market analysis, and product analysis and market research
To send you information about our other products or services which may be of interest to you
To handle enquiries and complaints
To comply with legal and/or regulatory requirements
To investigate, prevent, and/or take action regarding illegal activities, suspected fraud and situations involving potential threats to the safety of any person
If we need to collect and process Personal Data by law, or under a contract we have entered into with you, and you fail to provide the required Personal Data when requested, we may not be able to perform our contract with you.
With whom your Personal Data may be shared?
We DO NOT SELL your personal data.
Affiliates: We may share your Personal Data with the Grotto group entities
Sub-processors: We may use third parties in the provision of our products and services to you. We may share your Personal Data with such third parties. Vendors of such third parties / sub-processors may also have access to your information.
Third Parties Involved in a Corporate Transaction: If Grotto becomes involved in a merger, acquisition, or any form of sale of some or all its assets, then, in accordance with applicable laws, Grotto will use reasonable efforts to notify you of any transfer of Personal Data to an unaffiliated third party.
Subscribers With Whom You Are Affiliated: If you use our services as an authorized user, we may share your Personal Data with your affiliated Subscriber responsible for your access to the services to the extent this is necessary for verifying accounts and activity, investigating suspicious activity, or enforcing our terms and policies.
Grotto may share with third-parties certain pieces of aggregated, non-personal data, such as but not limited to the number of users who clicked on an advertisement on the Site, the number of users that clicked on any page within the Site or aggregated business performance data across a geographical region.
We may also share your personal data with Law enforcement authorities, government authorities, courts, dispute resolution bodies, regulators, auditors, and any party appointed or requested by applicable regulators to carry out investigations or audits of our activities.
Security of Information
Grotto takes all appropriate security measures to protect your personal data.
Cross-Border Data Transfer
All Personal Data we hold about you may be transferred, processed, and stored anywhere in the world, including but not limited to, the United States, India, or other countries, which may have data protection laws that are different from the laws where you live. Our endeavor is to safeguard your personal data consistent with the requirements of applicable laws. Therefore, your Personal Data may be processed outside your jurisdiction, and in countries that are not subject to an adequacy decision by the European Commission or your local legislature or regulator, and that may not provide for the same level of data protection as your jurisdiction, such as the European Economic Area. We ensure that the recipient of your Personal Data offers an adequate level of protection and security, for instance by entering into the appropriate back-to-back agreements and, if required, standard contractual clauses or an alternative mechanism for the transfer of data as approved by the European Commission or other applicable regulator. Where required by applicable law, we will only share, transfer, or store your Personal Data outside of your jurisdiction with your prior consent.
We also use web beacons and pixels on our websites and in emails. For example, we may place a pixel in marketing emails that notify us when you click on a link in the email. We use these technologies to operate and improve our websites and marketing emails.
Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. Please note that we do not respond to or honor DNT signals or similar mechanisms transmitted by web browsers.
Please note, however, that by blocking or deleting cookies and similar technologies used on our websites, you may not be able to take full advantage of the websites.
Your Privacy Rights
You have the following Privacy Rights, and we commit to provide you with the same:
Right of Access: You have the right to get access to your Personal Data that is with us along with other supporting information.
Right to Rectification: You have the right to ask us to rectify your Personal Data that is with us that you think is inaccurate. You also have the right to ask us to complete your Personal Data that you think is incomplete.
Right to Erasure: You have the right to ask us to erase your Personal Data that is with us under certain circumstances.
Right to Restriction of Processing: You have the right to ask us to restrict the processing of your Personal Data under certain circumstances.
Right to Data Portability: You have the right to ask that we transfer the Personal Data you gave us to another organization, or to you, under certain circumstances.
Right to Object: You have the right to object to the processing of your Personal Data under certain circumstances.
Right to not be subjected to Automated individual decision-making: You have the right to not to be subjected to automated individual decision-making including profiling. Automated decision-making currently does not take place on our websites or in our services
Right to lodge a complaint with the Supervisory/Regulatory Authority: You have the right to lodge a complaint with the appropriate supervisory/regulatory authority.
Links to Other Websites
Our website may contain links to websites of other organizations. This privacy notice does not cover how those organizations process your Personal Data. We encourage you to read the privacy policies on the other websites you visit.
Marketing / Promotional communications and Opt-out
If we process your Personal Data for the purpose of sending you marketing communications, You may choose to stop receiving these communications by following the unsubscribe instructions included in these emails or by replying back with your unsubscribe request or by contacting us at firstname.lastname@example.org. Please note that opting out of marketing communications does not opt you out of receiving important business communications related to your current relationship with us, such as communications about your subscriptions or event registrations, service announcements or security information.
Retention of Personal Data
Our websites and online services are not directed at children. We do not knowingly collect Personal Data from children under the age of 16 or such other applicable age of consent for privacy purposes in relevant individual jurisdictions. If you are a parent or guardian and believe your child has provided us with Personal Data, please contact us by using the information in the “Contact Us” section below and we will take steps to delete their Personal Data from our systems.
Notification of Changes
We regularly review and update our Privacy Notice to ensure it is up-to-date and accurate. Any changes we may make to this Privacy Notice in future will be posted on this page. If we make a material update, we may provide you with notice prior to the update taking effect, such as by posting a conspicuous notice on our website or by contacting you directly, or where required under applicable law and feasible, seek your consent to these changes.
If there are any questions regarding this privacy notice, you may contact us at [email protected] or at the below mentioned address
Address: 2205 W 136th Ave Ste 412 Broomfield, CO 80023
You may also contact our Data protection officer / Privacy officer in relation to any privacy or data protection issues through the above email address ([email protected]).
Additional Disclosures for California Residents
The California Consumer Privacy Act (“CCPA”) requires businesses to disclose whether they sell Personal Data. As a business covered by the CCPA, we do not sell Personal Data. We may share Personal Data with third parties or allow them to collect Personal Data from our sites or Services if those third parties are authorized service providers or business partners who have agreed to our contractual limitations as to their retention, use, and disclosure of such Personal Data, or if you use our Services to interact with third parties or direct us to disclose your Personal Data to third parties.
Consistent with the CCPA, job applicants, current and former employees and contractors, and subjects of certain business-to-business communications acting solely in their capacity as representatives of another business, are not considered consumers for purposes of this section or the rights described herein.
Internet activity information;
Professional and employment-related information;
Education information; and
Inferences drawn from any of the above information categories.
California law grants state residents certain rights, including the rights to access specific types of Personal Data, to learn how we process Personal Data, to request deletion of Personal Data, and not to be denied goods or services for exercising these rights.
If you are a California resident under the age of 18 and have registered for an account with us and has posted content or information on or through the services, you can request that such information be removed by contacting us using the information in the “Contact Us” section above. Please note that your request does not ensure complete or comprehensive removal of the content or information, because, for example, some of your content may have been reposted by another user.
For information on how to exercise your rights, please refer to the “Your Privacy Rights” section above. If you are an authorized agent wishing to exercise rights on behalf of a California resident, please contact us using the information in the “Contact Us” section above and provide us with a copy of the consumer’s written authorization designating you as their agent. We may need to verify your identity and place of residence before completing your rights request.
Shine the Light
California law permits customers in California to request certain details about how their personal information is shared with third parties, and in some cases affiliates, if personal information is shared for those third parties’ or affiliates’ own direct marketing purposes. We do not share personal information with third parties or affiliates for those third parties’ or affiliates’ own direct marketing purposes. Californians may request information about our compliance with this law by contacting us at [email protected] or by sending a letter to:
2205 W 136th Ave Ste 412
Broomfield, CO 80023
Attn: Legal Department – Privacy/Shine the Light
Any such request must include your name and “California Shine the Light Privacy Rights Request” in the first line of the description and, if sent by mail, must include your street address, city, state, and zip code.
Please note that “Shine the Light” rights and CCPA rights are granted by different laws and must be exercised separately.