Effective from: 31 December 2019
Last updated: 8 December 2019
About this supplemental Privacy Notice
A separate supplemental Privacy Notice for prospective, current and former staff members and suppliers (including Bright Horizons’ employees, apprentices, agency workers and contractors) working in the State of California is accessible here.
Information We Collect
We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a California consumer/household or device (“personal information”).
Categories of Personal Information
of California consumers processed by us during the last twelve (12) months:
Excluded from the definition of ‘personal information’ under the CCPA is ‘aggregate consumer information’ that’s defined as data that’s ‘not linked or reasonably linkable to any consumer or household, including via a device,’ as well as information that’s publicly available from federal, state or local government records.
Also excluded from the definition of ‘personal information’ is:
- information excluded by the CCPA including health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), the California Confidentiality of Medical Information Act (CMIA) or clinical trial data; and
- personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act 1994.
Under the definition of ‘personal information’ under the CCPA, Bright Horizons obtains the categories of personal information from the following sources:
- directly from you, for example, when you complete an online form or enter into an agreement with us; or
- indirectly from you, for example, when we track how you utilise our Websites;
- If you receive our service as part of an employee benefit, we may receive personal information from your employer on your eligibility to use the service and other reporting identifiers.
- If you receive government funding, we may receive personal information from the government on your eligibility for the funding and other reporting identifiers.
- Government agencies may provide us with personal information to support their regulatory obligations or investigations.
- Third party marketing companies provide us with contact details for individuals who have consented to receive marketing materials. You have the right to opt-out of these communications at any time.
Use of Personal InformationWe may use or disclose the personal information we collect for one or more of the following business purposes:
- To fulfil or meet the reason you provided the personal information. For example, if you share your name and contact information to ask a question about our services, we will use that personal information to respond to your inquiry. If you provide your personal information to purchase a service, we’ll use that information to process your payment and ensure you receive that service. We may also save your personal information to facilitate new orders for our services.
- To provide, support, personalize, and develop our Website and services.
- To create, maintain, customize, and secure your account with us.
- To process your requests, purchases, transactions, and payments and prevent transactional fraud.
- To provide you with support and to respond to your enquiries, including to investigate and respond to your concerns and monitor and improve our responses.
- To personalize your Website experience.
- For testing, research, analysis, and product development, including to develop and improve our Website and services we deliver to you.
- To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
- As described to you when collecting your personal information or as otherwise provided under the CCPA and its Regulations.
- To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Bright Horizon’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by Bright Horizons about our Website users is among the assets transferred.
Sharing Your Personal Information
We may be required to share your personal information as part of delivering our services to you. This could be with our subsidiaries, affiliates, business lines or other third-party interests. The following lists the categories of third parties whom we may share your personal data as well as the purposes for doing this.
Our affiliates, subsidiaries and business lines
We may share your personal information within our company and subsidiaries insofar as reasonably necessary for the purposes and legal bases as set out under this supplemental privacy notice.
Contractors and service providers
We may disclose your personal information to contractors and service providers, such as our insurers and professional advisors, insofar as reasonably necessary for the purposes of obtaining or maintaining insurance cover, managing risks, obtaining professional advice or the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure in the State of California.
Contractors and service providers
We may disclose categories of personal information as listed in this supplemental privacy notice to our suppliers and subcontractors insofar as reasonably necessary for delivering our services to you.
Third Parties with whom we partner
Financial transactions relating to our website and services may be handled by our payment services providers. Well share transaction data with our payment service providers only to the extent necessary for the purposes of processing your payments, refunding such payments and dealing with complaints and queries relating to such payments and refunds.
Legal, regulatory, federal, state or local government body/agency
In addition to the specific disclosures of personal information as set out in this supplemental privacy notice, we may disclose your personal information where such disclosure is necessary for compliance with a legal obligation under federal law or state/local laws of California to which we are subject. We may also disclose your personal information where such disclosure is necessary for the establishment, exercise or defence of legal claims, whether in court proceedings or in an administrative or out-of-court procedure in the State of California.
Sale of your personal information
Bright Horizons does not sell your personal information.
Your rights and choices
The CCPA provides consumers (California residents) with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.
Access to Specific Personal Information/Right to Data PortabilityYou have the right to request that Bright Horizons disclose certain information to you about the personal information we have collected over the past 12 months. Once we receive your request for access to certain information and are able to verify your identity or the identity of your representative that has the legal authority to act on your behalf, we’ll disclose to you:
- The categories of personal information we collected about you.
- The categories of sources for the personal information we collected about you.
- Our business or commercial purpose for collecting or selling that personal information.
- The categories of third parties with whom we share that personal information.
- The specific pieces of personal information we collected about you.
- Where we disclosed personal information for a business purpose, the categories of personal information that each category of recipient obtained from us.
In addition, you have the right to data portability. This applies where we respond to an access request electronically. In such circumstances, we are required to provide the personal information to you in a portable, technically feasible, and ready-to-use format.
Deletion of Personal Information
You have the right to request that Bright Horizons delete all/any of your personal information that we have collected in the last 12 months.
Once we receive your request for deletion and are able to verify your identity or the identity of your representative that has the legal authority to act on your behalf, we’ll delete (and also direct our service providers to do the same) your personal information from our records, unless an exception under the CCPA applies. If this is the case, we will inform you.
There are circumstances under which we may deny your deletion request under the CCPA. For example, we may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:
- Complete the transaction for which we collected the personal information, provide a service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
- Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
- Exercise freedom of speech and ensuring the right of another consumer to exercise their right to free speech or exercise another right provided for by federal or state laws.
- Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
- Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
- Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
- Comply with a legal obligation under federal, state or local laws in the State of California.
- Make other internal and lawful uses of that personal information that are compatible with the context in which you provided that information.
Exercising Your Access, Data Portability and Deletion Rights
To exercise the access, data portability, and deletion rights as outlined above, please submit your request by either:
Mail: Attn of the Global Privacy Officer, 2 Crown Court, Rushden, Northamptonshire, NN10 6BS, United Kingdom
Webform: Click Here
Toll free: 1-855-853-4204 (8:00-5:00, Pacific Time, Monday-Friday). Outside of office hours, please inquire by using our webform.
Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your child under the age of 16 years old.
You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:
- Provide sufficient information that allows us to reasonably verify you are the person about whom we processed personal information or a legally authorized representative.
- Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
We can’t respond to your request or provide you with personal information if we can’t verify your identity or legal authority to make the request and confirm the personal information relates to you or the subject of the request.
Making a verifiable consumer request doesn’t require you to create an account with us. We’ll only use personal information provided in a verifiable consumer request to verify the requestor’s identity or legal authority to make the request.
Response Timing and Format
We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.
If you have an account with us, we’ll deliver our written response to that account. If you don’t have an account with us, we’ll deliver our written response by mail or electronically in accordance with your preference.
Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we can’t comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that’s readily usable and should allow you to transmit the information from one entity to another entity without any technical difficulty.
We don’t charge a fee to process or respond to your verifiable consumer request unless in exceptional circumstances it’s excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will advise you why we made that decision and provide you with a cost estimate before completing your request.
We’ll never discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we won’t:
- Deny you services.
- Charge you different prices or rates for services, including through granting discounts or other benefits, or imposing penalties.
- Provide you a different level or quality of services.
- Suggest that you may receive a different price or rate for services or a different level or quality of services.
However, at our discretion, we may offer certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.
Other California Privacy Rights
California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our Websites that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please write or email to us at:
Mail: Attn of the Global Privacy Officer, 2 Crown Court, Rushden, Northamptonshire, NN10 6BS, United Kingdom
Will this Supplemental Privacy Notice change?
This Privacy Notice is subject to change in order to remain compliant with data protection and privacy laws in the State of California. We will post revisions to this Privacy Notice on our websites. Please check back periodically, especially before you provide any personal information.
This Notice was last updated in December 2019. Your continued use of our Websites following the posting of changes to this Supplemental Privacy Notice constitutes your acceptance of such changes.
We hope this Supplemental Privacy Notice has been helpful in setting out the way we process your personal information and how we do this in accordance with the CCPA.
If you have any questions that haven’t been covered by this Privacy Notice, please contact our Global Privacy Officer at:
Email: firstname.lastname@example.org; or
Mail: Attn: Global Privacy Officer, 2 Crown Court, Rushden, Northamptonshire, NN10 6BS, United Kingdom.