CCPA/CPRA & VCDPA Notice of Collection, Disclosure, & Privacy Policy

Effective Date: January 1, 2023

Last Reviewed: January 19, 2023

Revised on: January 19, 2023

Notice at Collection and Privacy Policy for California and Virginia

This California and Virginia Notice at Collection and Privacy Policy (“State Privacy Disclosure”) explains how Bradley Arant Boult Cummings LLP and its subsidiaries and affiliates (“Company”, “us”, “our”, or “we”) collect, use, disclose, sell, share, and/or retain personal information (“Information Practices”) subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act, (“CCPA”) and the Virginia Consumer Data Protection Act (“VCDPA”). This State Privacy Disclosure applies solely to California and Virginia residents (“consumers” or “you”).

The terms used in this State Privacy Disclosure shall have the same or similar meaning as those terms in each of the CCPA and VCDPA, or the closest approximation of such term, as defined in each statute.

Notice at Collection

The following notice identifies the categories of personal information or personal data (collectively, “personal information”) to be collected from you and the purposes for which the personal information will be used, including whether that information is sold to anyone or shared with third parties who are not our vendors or service providers (“Non-Service Providers”).

General Personal Information

We do not collect: Characteristics of CA or Federal Protected Classifications, commercial information, biometric information, sensory or surveillance data, or profile data.

Sensitive Personal Information

We do not collect: precise geolocation, religious or philosophical beliefs, or union membership; the contents of a consumer’s mail, email, and text messages (unless we are the intended recipient of the communication); genetic data; biometric information for the purpose of unique identification; health information; information concerning sex life or sexual orientation; precise geolocation.

Retention Periods

We retain information for different periods of time depending on the purposes for which we collect and use it. We will delete or de-identify information when it is no longer needed to fulfill the purposes listed for each category above, unless a longer retention period is required to comply with applicable laws. There may be technical or other operational reasons where we are unable to fully delete or de-identify your information. Where this is the case, we will take reasonable measures to prevent further processing your information.

We do not sell or share any personal information.

To review our California Privacy Policy, please see below.

Privacy Policy

The purpose of this privacy policy is to provide you with a comprehensive description of our online and offline practices regarding our Information Practices. You have certain rights to control the use of your personal information. This privacy policy describes your rights as it relates to our Information Practices as to your personal information and how you can exercise those rights.

The following table includes disclosures for the preceding 12 months of: categories of personal information we have collected about consumers, the categories we have disclosed for a business purpose, and categories of third parties with whom we shared the personal information during that period.

General Personal Information

We do not collect: Characteristics of CA or Federal Protected Classifications, commercial information, biometric information, sensory or surveillance data, or profile data.

Sensitive Personal Information

We do not use or disclose the below sensitive personal information for purposes other than those business purposes specifically enumerated under CCPA. As a result, we do not offer a right to limit our use or disclosure of these categories of sensitive personal information.

We do not collect: precise geolocation; racial or ethnic origin, religious or philosophical beliefs, or union membership; the contents of a consumer’s mail, email, and text messages (unless we are the intended recipient of the communication); genetic data; biometric information for the purpose of unique identification; health information; information concerning sex life or sexual orientation.

The categories identified as collected in the tables above were collected from the following categories of sources:

• You directly
• Payment systems and platforms

General Personal Information

We do not sell or share sensitive personal information.

We do not have actual knowledge that we sell the personal information of minors under 16 years of age.

Your Right to Know

You have the right to request that we disclose any of the following:

• the categories of personal information we have collected about you
• the categories of sources from which the personal information is collected
• the business or commercial purpose for collecting, selling, or sharing with third parties for cross context behavioral advertising (e.g. targeted advertising)
• the categories of third parties to whom we disclose personal information
• the specific pieces of personal information we have collected about you

You can do this through a verified consumer request. That process is described below in the section, “How to Exercise Your Rights.”

Your Right to Request Correction of Inaccurate Personal Information

You have the right to request correction of inaccurate personal information maintained by us. We may request documentation from you to determine the accuracy of the information. If you provide us documentation either upon our request or through your own initiative, that documentation will only be used for the purpose of correcting your personal information and complying with our recordkeeping requirements. We may deny your request if we have previously denied your same request to correct an alleged inaccuracy in the past six (6) months, unless you provide new or additional documentation that the information at issue is inaccurate.

As an alternative to correction, we may delete the inaccurate information if it does not negatively impact you or if you consent to this deletion. We reserve the right to deny this request if allowed under law, or if we determine that the contested information is more likely than not accurate, based on the totality of circumstances. You can submit a correction request through a verified consumer request. That process is described below in the section, “How to Exercise Your Rights.”

Your Right to Limit Use and Disclosure of Sensitive Personal Information

You have the right to limit our use and disclosure of your sensitive personal information collected by us, which is called the “Right to Limit.” We only allow such requests for our uses and disclosures of precise geolocation, based on the disclosed purposes listed in the chart above.

You do not have the right to limit certain uses and disclosures of your sensitive personal information for the following purposes:

• Providing our goods or services reasonably expected of an average consumer;
• Detecting security incidents affecting personal information, provided that the use of the consumer’s personal information is reasonably necessary and proportionate for this purpose;
• Resisting malicious, fraudulent, or illegal actions against us and prosecuting persons responsible for such actions, provided that the use of the consumer’s personal information is reasonably necessary and proportionate for this purpose;
• Ensuring the physical safety of an individual, provided that the use of the consumer’s personal information is reasonably necessary and proportionate for this purpose;
• Short-term, transient use, including non-personalized advertising shown as part of a consumer’s current interaction with us, provided that we do not build a profile about the consumer or alter the consumer’s experience outside their current interaction with us;
• Performing services on behalf of another business (g., maintaining accounts, processing orders or transaction);
• Verifying or maintaining the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, or improving, upgrading, or enhancing the services or device owned, manufactured, manufactured for, or controlled by us; or
• To collect or process sensitive personal information where such collection or processing is not for the purpose of inferring characteristics about a consumer.

Your Right to Request Deletion of Your Personal Information

You have the right to request that we delete any of your personal information collected by us, subject to certain exceptions. You can do this through a verified consumer request. That process is described below in the section, “How to Exercise Your Rights.”

There may be scenarios where we deny your deletion request. If that occurs, we will provide you with an explanation as to why we could not delete all or some of your personal information.

How to Exercise Your Rights

You have the right to exercise your rights and submit verified consumer requests to know information and to receive your personal information in a portable format, to correct information, or for deletion.

The response to a request to know will provide all personal information collected and maintained about you since January 1, 2022, in a portable format, unless doing so proves impossible or would involve disproportionate effort.  Please note that we are not required to provide personal information to you more than twice in a 12-month period.  We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

You can submit requests by (1) emailing us at privacy@bradley.com, (2) by calling 833.520.0792 or (3) submitting a webform here: https://www.bradley.com/contact. Your request will be verified using information you provide. If you email us or call us at 833.520.0792, you must provide your name, driver’s license number or scan of your ID, and additional verification of your current residence. Your request will be verified by matching the information you provide to information that we have collected.

If you submit a request that is not through one of these designated methods or is deficient in some manner unrelated to verification, we will provide you with information on how to submit the request or remedy any deficiencies. 

Once we receive your verifiable consumer request, we will confirm receipt of the request within 10 business days describing our verification process. We will respond to your request within 45 calendar days, if we are able to verify your identity. Requests for deletion will require a separate confirmation that you want your information deleted.

Requests to Know or Delete for Child Under the Age of 13: We do not knowingly collect information of minors under the age of 13.

Other California Privacy Rights

Using an Authorized Agent to Submit a Request

Only you, or a natural person or a business entity registered with the Secretary of State to conduct business in California that you have authorized to act on your behalf, may make a verifiable consumer request related to your personal information or a request to opt-out. You may also make a verifiable consumer request or a request to opt-out on behalf of your minor child. If you use an authorized agent, you may provide a power of attorney executed pursuant to California Probate Code sections 4000 to 4465. If a power of attorney that meets those provisions is not submitted, you will be required to provide the authorized agent signed permission to submit a request, verify your identity directly with us, and directly confirm with us that you provided the authorized agent permission to submit the request. When submitting a request on behalf of a consumer, please provide the necessary information so we may be able to confirm that you are an authorized agent.

Your Right to Non-Discrimination for the Exercise of a Privacy Right

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services. 

Other Virginia Privacy Rights

Right to Appeal

As a Virginia resident, you have the right to appeal our refusal to take action on, or respond to, a verified consumer request. Upon receipt of our denial or refusal to take action on, or to respond to, a verified consumer request, a Virginia resident has 60 days to submit a request to appeal our decision by 1) emailing privacy@bradley.com, or 2) calling 833.520.0792. Within 60 days of the receipt of your appeal request, we will inform you in writing of any action taken or not taken in response. We will also include a written explanation of the reasons for our decision. If your appeal is denied, you have the right to contact the Virginia Attorney General at https://www.oag.state.va.us/consumer-protection/index.php/file-a-complaint.

Changes to Our Privacy Notice

We reserve the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on the Website and update the notice’s effective date. Your continued use of our Website following the posting of changes constitutes your acceptance of such changes.

Contact for More Information

If you have any questions or comments about this notice, the ways in which we collect and use your information, your choices and rights regarding such use, or wish to exercise your rights under California or Virginia law, please do not hesitate to contact us at:

Phone: 833.520.0792

Email: privacy@bradley.com

Postal Address:

Bradley Arant Boult Cummings LLP
Attn: David Roth, General Counsel
1819 5th Avenue North
Birmingham, AL 35203