Privacy and Policy

Onyx Card, LLC, and its parent and subsidiary companies (collectively, the "Company") respect your right to privacy. This Privacy Policy summarizes what personal information we may collect, how we may use this information, and other important topics relating to your privacy and data protection.

It is the Company’s policy to comply with all applicable privacy and data protection laws. This commitment reflects the value we place on earning and keeping the trust of our customers, business partners, and others who share their personal information with us.

This Privacy Policy applies to the Company’s website (the “Website”), located at https://www.onyxprivate.com/. It also applies to personal information we may otherwise collect: (i) through our products and services; (ii) when you interact with us by means other than the Website, for example, in person or by telephone; and (iii) from our customers, distributors, suppliers, vendors, and other business partners (collectively “Business Partners”).

The Company’s Collection, Use and Disclosure of Personal Information

To the extent required by applicable law, whenever the Company collects personal information, we will:

• provide timely and appropriate notice to you about our data practices through this Privacy Policy;
• collect your personal information only for specified and legitimate purposes. The information we collect will be relevant, adequate, and not excessive for the purposes for which it is collected;
• process your personal information in a manner consistent with the purposes for which it was originally collected or to which you have subsequently consented;
• take commercially reasonable steps to ensure that your personal information is reliable for its intended use, accurate, complete, and, where necessary, kept up-to-date;
• not use your personal information for direct marketing purposes without giving you an opportunity to “opt-out”; and
• take appropriate measures, by contract or otherwise, to provide adequate protection for personal information that is disclosed to a third party or transferred to another country, including transfers within the Company.

Personal Information the Company Collects

The Company collects the following types of personal information:

• Information You Provide

  The Company collects personal information you provide us, which may include: (i) contact information, such as your name, company name, job title, address, e-mail address, and phone number; (ii) additional information about how you use our products or services; (iii) comments, questions, requests and orders you may make; (iv) financial information needed to process payments if you make purchases, such as credit card or account information or tax identification number; and (v) information about your preferences, such as your preferred methods of communication and the types of products and services in which you are interested.

• Information Automatically Gathered From Your Device

  The Company may collect technical information about your device, such as device type, browser type, IP address, operating system, and device identifier. The Company collects this information automatically from your device and web browser through cookies and similar technologies.

• Information About How You Interact With Us

  The Company may collect technical data about your usage of the Website and how you interact with our digital advertisements and promotions, such as content viewed or downloaded, features used, links clicked, Company promotional emails opened, and dates and times of interactions.

  The Company collects this information using cookies and similar technologies.

  A “cookie” is a file of information placed on your device when you visit a website. Cookies and similar technologies can enhance your user experience by saving your preferences, personalizing your online experience, and sometimes providing you with advertising which is tailored to your interests.

  The Website uses “session cookies.” A session cookie does not identify you personally and expires after you close your browser.

  The Website also uses “persistent cookies.” These cookies do not expire when you close your browser. Persistent cookies stay on your computer until you delete them or they expire. By assigning your computer a unique identifier, we are able to create a database of your previous choices and preferences which can be provided by us automatically, saving you time and effort on future visits.

  You have the ability to accept or decline cookies by modifying the settings in your browser. However, you may not be able to use all the interactive features of our site if cookies are disabled. You may wish to visit www.allaboutcookies.org which contains comprehensive information on how to modify the cookie settings on a wide variety of browsers. You will also find details on how to delete cookies from your computer as well as more general information about cookies. For information on how to do this on the browser of your mobile phone or tablet you will need to refer to your device manual. Please note that you will not be able to opt out of receiving certain cookies that are strictly necessary for the delivery of a service requested by you.

• Location Information

  The Company may collect location information, including precise real-time location information from your device and imprecise location information derived from, for example, your IP address or postal code.

• Analytics

  The Website uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses cookies. The information generated by the cookie about your use of the Website (including your IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of the Website, compiling reports on website activity for website operators, and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your browser, but please note that if you do this you may not be able to use the full functionality of this website. By using this Website, you consent to the processing of data about you by Google in the manner and for the purposes set out above. To opt out of being tracked by Google Analytics across all websites, visit https://tools.google.com/dlpage/gaoptout

• Information From Business Partners and Other Third Parties

  The Company collects personal information through our Business Partners. This information may include contact information, such as name, company name, job title, address, e-mail address, and phone number.

  The Company may also obtain personal information from other third-party sources, including publicly and commercially available sources. We may combine the information we receive from our Business Partners and other third-party sources with information that we collect from you or your device, as described above.

You have choices about the personal information you provide the Company. You may choose not to provide information that we request, but if you do so, we may not be able to provide you a relevant product or service or a particular feature of the Website.

How the Company Uses Your Personal Information

The Company may use your personal information to:

• Develop and manage our relationships with you and our Business Partners. This may include: (i) delivering services or carrying out transactions that you or our Business Partners have requested; (ii) providing information about the Company’s products, services, transactions, and advertisements, that may be of interest to you; (iii) providing you and our Business Partners a more consistent experience in interacting with the Company, including by learning more about you and how you use and interact with the Website, products, and services; and (iv) planning, managing, and performing under our contractual relationships with our Business Partners.
• Communicate with you or your company. This may include: (i) informing you of the Company’s products, services, and promotional activities that may be of interest to you or your company; (ii) providing information about relevant Company products, services, and transactions, including, for example, pricing information, technical data, invoice, shipping, or production information, warranty or recall information, or information about product or service improvements; (iii) responding to questions or inquiries that you make, including customer service requests; and (iv) inviting you to participate in, or informing you of the results of, customer satisfaction or market research surveys.
• Provide and improve our Company Website, products, and services.This may include: (i) customizing them to your preferences or interests, making them more compatible with your technology, or otherwise making them easier to use; (ii) maintaining the security of and otherwise protecting them; and (iii) developing new Company Websites, products, and services.
• Address legal issues. This may include: (i) complying with our obligations to retain certain business records for minimum retention periods; (ii) establishing, exercising, or defending legal claims; (iii) complying with laws, regulations, court orders, or other legal process; (iv) detecting, preventing, and responding to fraud, intellectual property infringement, violation of our contracts or agreements, violations of law, or other misuse of the Website, products or services; and (v) protecting the Company’s rights or property, or yours or others’ health, safety, welfare, rights, or property.

The Company may also use your personal information for other uses consistent with the context in which the information was collected or with your consent.

The Company may anonymize or aggregate any of the information we collect and use it for any purpose, including for research and product-development purposes. Such information will not identify you individually.

When The Company May Share Your Personal Information

The Company will not disclose your personal information except as described here:

• The Company may share your personal information with other Company entities. When we do so, these other Company entities will use your information in a manner consistent with this Policy and all applicable privacy and data protection laws.
• The Company may also share your personal information with third parties we hire to perform support services for us and to help us use your personal information as described above. These third parties are required to treat your personal information in compliance with all applicable privacy and data protection laws.
• In some cases, the Company may share your personal information with third parties who partner with us to provide products and services to our clients, such as distributors. If so, we will require our Business Partners to use that information in a manner consistent with this Policy and all applicable privacy and data protection laws.
• The Company may share your personal information with third parties when we have a good faith belief that disclosure is necessary: (i) to comply with a law, regulation, court order, or other legal process; (ii) to detect, prevent, and respond to fraud, intellectual property infringement, violation of our contracts or agreements, violation of law, or other misuse of the Website, products or services; (iii) to protect the Company’s rights or property or yours or others’ health, safety, welfare, rights, or property; or (iv) under similar circumstances. If such an event occurs, we will take appropriate steps to protect your personal information.
• The Company may share your personal information with third parties in connection with the sale, purchase, merger, reorganization, liquidation, or dissolution of the Company, or under similar circumstances. If such an event occurs, we will take appropriate steps to protect your personal information.
• The Company may share your information with your permission or at your request.
• The Company may share anonymized or aggregated information internally and with third parties for any purpose. Such information will not identify you individually.

Security of Your Personal Information

Your personal information will generally be stored in the Company’s databases or databases maintained by our service providers. The Company maintains reasonable safeguards to protect the confidentiality, security, and integrity of your personal information. Although we use security measures to help protect your personal information against unauthorized disclosure, misuse, or alteration, as is the case with all computer networks linked to the Internet, we cannot guarantee the security of information provided over the Internet and will not be responsible for breaches of security beyond our reasonable control.

Links to Third Party Internet Sites and Plugins

The Website may contain links to websites or mobile apps that are not operated by the Company and plugins from social media platforms and other third parties. Examples of social media plugins are the Facebook “Like” button and the option to “Share” the Website through your email, Facebook, Twitter, and Pinterest. We provide these links and plugins as a service and do not imply any endorsement of the activities or content of the related websites, apps, or social media platforms, nor any association with their operators. To learn about the information collected by these third-party websites, apps, and plugins, please visit their privacy policies. We encourage you to review the privacy policies for the websites, apps, and social media platforms you visit before using them or providing personal information.

Retention of Your Personal Information

How long we keep your personal information will vary and will depend on the purpose and use of the information collected. There are legal requirements that we keep some types of data for specific periods. Otherwise, we will retain it for no longer than is necessary for the purposes for which the data was collected.

Children

The Website is not intended for children under 13 years of age. The Company will not knowingly solicit or collect personal information from or about children under 13, or the relevant minimum age under applicable local legal requirements, except as permitted under applicable law.

California Residents

We are planning to go live next week. Is production environment already available? Can we get the credentials?Or the one we have currently is also suitable for production?

A. Information we collect

The information we have collected about California residents in the last 12 months is described in Personal Information the Company Collects above. That information corresponds with the following categories of personal information under the CCPA:

B. Use of personal information

In the last 12 months, we have used your personal information for the business and commercial purposes described in When the Company May Share Your Personal Information above.

C. Sharing of personal information

The business and commercial purposes that we have shared your personal information in the last 12 months are described above in When the Company May Share Your Personal Information. More specific information on that sharing is as follows:

Sharing your personal information for business purposes. We have shared the following categories of personal information with affiliated companies, service providers and public or government (including enforcement) authorities for our business purposes:

• Category A: Identifiers.
• Category B: Personal information categories listed in the California Customer Records Statute.
• Category C: Protected classification characteristics under California or federal law.
• Category D: Commercial information.
• Category F: Internet or other similar network activity.
• Category G: Geolocation data.
• Category K: Inferences drawn from other personal information.

Sharing your personal information for commercial or other purposes: We have shared the following categories of your personal information with co-sponsors, business partners and other third parties in a manner that is likely to be considered to be a “sale” under the CCPA:

• Category A: Identifiers.
• Category B: Personal information categories listed in the California Customer Records Statute
• Category C: Protected classification characteristics under California or federal law.
• Category D: Commercial information.
• Category F: Internet or other similar network activity.
• Category G: Geolocation data.
• Category K: Inferences drawn from other personal information.

As described above, this information may be shared for personalization, analytics, marketing, retargeting, and sales. We do not sell personal information of consumers we actually know are less than 18 years of age.

D. Your right to know

You have the right to request that we disclose certain information to you about our collection, use, disclosure, and sale of your personal information over the past 12 months. Once we verify your request, we will disclose to you:

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting or selling that personal information.
• The categories of third parties with whom we share that personal information.
• If we sold or disclosed your personal information for a business purpose, two separate lists disclosing: sales, identifying the personal information categories that each category of recipient purchased; and disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.

We do not provide access rights to B2B information.

E. Your right to obtain a copy of your personal information

You have a right to obtain a copy of the specific pieces of personal information we collected about you (also called a data portability request). Once we verify your request, we will provide you a copy of your personal information that is responsive to your request. We do not provide portability rights to B2B information.

F. Your right to delete your personal information

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we verify your request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies. We do not provide deletion rights to B2B information.

G. Your right to opt-out of sale of your information

We may share information with third parties in a way that is considered a “sale” under the CCPA. Where that is the case, we will comply with California “Do Not Sell” requirements.

H. How to exercise your CCPA rights

To exercise your right to know, right to obtain a copy, or right to delete your personal information as described above, please submit your request to us by either:

Calling us at: +1 (855) 435-4595.

Contacting us at privacy@onyxprivate.com

To exercise the right to opt-out of sale of your personal information, you can submit a request to us by email with the subject: Do Not Sell My Personal Information or filling out this form Do Not Sell My Personal Information

Once you make an opt-out request, we will wait at least twelve (12) months before asking you to reauthorize personal information sales. However, you may change your mind and opt back into personal information sales at any time by email with the subject: Opt-in to Sales of My Personal Information or by filling out this form: Opt-in to Sales of My Personal Information

I. How we verify requests and respond to requests

Before fulfilling your request, we take steps to verify you are who you say you are or that you have authority to act upon someone else's behalf. Therefore, upon receipt of your request, we will request additional information that we need to verify you and, if you are submitting a request on behalf of someone else, to verify that you are permitted to act on that person's behalf.

When we contact you to request verification information, please respond and provide the information that we have requested. Depending on the nature of the request you make, we may require you to verify your identity to either a reasonable degree of certainty or high degree of certainty. This may mean that we need to match two or three pieces of information that we hold about you with information that you provide to us. In some cases, we may require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request or that you are authorized to make the request on behalf of someone else.

In addition to providing the information we need to verify you or your authority, you must provide us with enough information so that we can understand, evaluate, and respond to your request. We cannot respond to your request or provide you with personal information if we cannot confirm the personal information relates to you.

We will only use personal information provided in a verifiable consumer request to verify your identity or authority to make the request and to locate relevant information. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and to understand, evaluate, and respond to your request.

We cannot delete personal information in those situations where our retention is required for our own internal business purposes or otherwise permitted by the CCPA (such as fraud prevention or legal compliance). In these situations, we will retain your information in accordance with our records retention program and securely delete it at the end of the retention period.

J. Who may submit requests?

Only you, or someone legally authorized to act on your behalf, may make a request related to your personal information. You may also make request on behalf of your minor child. You may designate an authorized agent to make a request on your behalf by registering such person or entity with the California Secretary of State.

K. How often you can submit requests?

You may make a CCPA consumer request twice within a 12-month period.

L. Response timing and format

We make every attempt to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time, we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. When you request a copy of your personal information, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity easily.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

M. Non-discrimination

We will not discriminate against you for exercising any of your CCPA rights. You have a right not to receive discriminatory treatment by us for exercising your privacy rights.

N. Other California privacy rights

California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of the Website that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please send an email to privacy@onyxprivate.com

GDPR Privacy Rights

This GDPR Privacy Notice is a supplement to our Privacy Policy and concerns certain personal data we have collected about residents of the countries in the European Union, consisting of the European Economic Area, Switzerland, and to the extent that the United Kingdom is no longer a member of the European Union, the United Kingdom (the “EU” or the “European Union”). It explains why we have that information, how we use and handle it, and your rights to that information, all as required by the European Union’s General Data Protection Regulation (“GDPR”).

a. Data controller

The data controller of such processing is Onyx Card, LLC.

b. Additional information about data we collect about you

We do not collect any special categories of personal data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offenses.

c. Lawful basis

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

 Where we need to perform the contract, we are about to enter into, or have entered into with you.  Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests, potentially including uses such as determining the internal analytics of the products and services and for determining marketing performance to share relevant information and offers about our products with customers and potential customers.  Where we need to comply with a legal obligation.  Where we have obtained your consent. We only rely on your consent as a legal basis for processing your personal data in limited circumstances. If you have provided us consent to use your personal data, you have the right to withdraw consent at any time by contacting us.

d. Your data subject rights

You have the following rights concerning your personal data that we hold and process that you can exercise at any time:

 Right of access – you have the right to request a copy of the information that we hold about you.

 Right of rectification – you have a right to correct personal data that we hold about you that is inaccurate or incomplete.

 Right to be forgotten – in certain circumstances you can ask for the personal data we hold about you to be erased from our records.

 Right to restriction of processing – where certain conditions apply to have a right to restrict the processing.

 Right of portability – you have the right to have the personal data we hold about you transferred to another organization.

 Right to object – you have the right to object to certain types of processing such as direct marketing.

 Right to judicial review - if we refuse your request under rights of access, we will provide you with a reason as to why. You have the right to complain as outlined in the process below.

All of the above requests will be forwarded on to other parties holding and processing your personal data where appropriate.

To exercise any of these rights, including the right to withdraw consent, or to make a complaint about how your personal data is processed, you may address a written communication to

By Mail:

Attention: Data Protection Officer

You may also exercise these rights, including the right to withdraw consent, or to make a complaint about how your personal data is processed, by sending an e-mail to: privacy@onyxprivate.com to the attention of the Data Protection Officer. Please also provide a copy of your identity document or any document proving your identity.

We reserve the right to verify the truthfulness of personal data provided at any time. Onyx does not use any type of automated process for profiling purposes.

e. Data retention

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for Personal Information, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

f. Transfer of Data

Your personal data will be transferred and stored at our servers located in the United States. Your consent to this privacy notice followed by your submission of such information represents your agreement to that transfer.

Your Consent

By using the Website, you signify your acceptance of this Policy and the practices described herein. If you do not agree to this Policy and such practices, please do not use the Website. Your continued use of the Website following the posting of any changes to this Policy will confirm your acceptance of such changes.

Questions About This Policy

If you have any questions about this Policy or our use of your personal information, please contact:

Onyx Card, LLC

790 Oak Lane, Suite 400

Miami Lakes, FL 33016-5888

T +1 (213) 465-8448

info@onyxprivate.com

Changes To This Policy

Changes to this Policy will be posted on this site, along with information on any material changes. The Company reserves the right to update or modify this Policy at any time and without prior notice. Any modifications will apply only to the personal information we collect after the posting.

This Policy was last revised on February 18, 2022.