FLEXFACTOR - PRIVACY POLICY
Last Amended: July 8, 2024
This privacy policy (“Privacy Policy”) describes how FlexCorp Inc., jointly with its subsidiary FlexFactor Operations Inc. (“Flex”, “we”, “us” or “our”) collect, use and disclose certain information, including Personal Data (as defined below) when:
A. Using Flex platform and factoring services ("Services" and "Merchant" respectively);
B. Browsing and engaging with our website, available at: www.flexfactor.io and the content therein ("Website" and "Website Visitor" respectively) ); and
C. Flex purchases a customer's invoice following a failed transaction on Merchant's properties ("End-User").
Merchants, Website Visitors and End-Users shall each be separately and collectively referred as "you" or "your", as applicable.
This Privacy Policy is an integral part of the Merchant Terms and Conditions which govern Merchant's use of the Services and the End-User Terms of Service which govern Flex End-Users interacting with the Services (collectively "Terms").Capitalized terms not defined herein shall have the meaning ascribed to them in the applicable Terms.
This privacy policy applies to residents from all U.S. jurisdictions; however, if you are a resident of California, Colorado, Connecticut, Florida, Montana, Oregon, Texas, Virginia, or Utah, please refer to Section 12. “Additional Specific Disclosures for Certain United States Residents”, which includes supplemental information about privacy rights for residents of such U.S. jurisdictions.
1. POLICY AMENDMENTS
We reserve the right to amend this Privacy Policy from time to time, at our sole discretion. The most recent version of this Privacy Policy will always be posted on the Website and the update date will be reflected in the “Last Amended” heading. We will provide notice to you if these changes are material, and, where required by applicable law, we will obtain your consent. Any amendments to the Privacy Policy will become effective immediately, unless we notify otherwise. We recommend you review this Privacy Policy periodically to ensure that you understand our most updated privacy practices.
2. CONTACT INFORMATION
For any question, inquiry or concern related to this Privacy Policy or the processing of your Personal Data, you may contact as follows:
The Company's data protection point of contact:
By email: legal@flexfactor.io
3. DATA COLLECTED BY FLEX
We may collect two types of information from you, depending on your interaction with us.
The first type of information is non-identifiable and anonymous information (“Non-Personal Data”). We are not aware of the identity of the individual from who we have collected the Non-Personal Data. Non-Personal Data which is being gathered consists of technical information, and may contain, among other things, the type of operating system and type of browser, type of device, your actions in the Website or Services (such as session duration).
The second type of information is individually identifiable information, namely information that identifies an individual or may with reasonable effort identify an individual (“Personal Data” or “Personal Information” as defined under the applicable data protection law).
For the avoidance of doubt, any Non-Personal Data connected or linked to Personal Data shall be deemed as Personal Data as long as such connection or linkage exists.
The table below details the types of Personal Data we process, the purpose, lawful basis, and our processing operations:
Data Collected From Website Visitors
Merchants
End-Users
Please note that the actual processing operation per each purpose of use detailed in the table above may differ. Such processing operation usually includes a set of operations made by automated means, such as collection, storage, use, disclosure by transmission, erasure, or destruction.
In addition, we may use certain Personal Data to prevent potentially prohibited or illegal activities, fraud, misappropriation, infringements, identity thefts, and any other misuse of our services and to enforce our Terms and other policies, as well as to protect the security or integrity of our databases and Properties, and to take precautions against legal liability.
4. HOW WE COLLECT INFORMATION
Depending on the nature of your interaction with us, we may collect the above detailed information from you, as follows:
-
Information you provide us directly – for example, when you register and create an account or correspond with us.
-
Information we receive from third parties - for example, when we receive KYC Data from credit bureaus.
-
Information we receive automatically – certain Usage Data or Behavioral Data which we receive through third-party tools, all as detailed under Section 5 below "Cookies & Tracking Technologies".
5. COOKIES & TRACKING TECHNOLOGIES
We use “cookies” (or similar tracking technologies) when you access the Website or interact with the Services we offer. The use of cookies is a standard industry-wide practice. A “cookie” is a small piece of information that a website assigns and stores on your computer while you are viewing a website. Cookies can be used for various purposes, including allowing you to navigate between pages efficiently, for statistical purposes, as well as for advertising purposes.
If you wish to change the way such tracking tools collect your Personal Data through our Website, please use the ‘cookie settings’ available through our website, as well instructions on how to change your cookies settings and preferences at any time.
Also note that, most browsers will allow you to erase cookies from your device, block acceptance of cookies, or receive a warning before a cookie is stored. You may set your browser to block all cookies, including cookies associated with our website, or to indicate when a cookie is being used by us, by adjusting the privacy and security settings of your web browser. Please refer to the support page of your browser to learn more about how you can adjust your privacy and security settings. Please note that once you choose to opt out or disable cookies, some features of the website may not operate properly, and your online experience may be limited.
6. SHARING DATA WITH THIRD PARTIES
We share your Personal Data with third parties, including our trusted partners or service providers that help us manage our business operations. You can find in the table below information about the categories of such third-party recipients.
7. PRIVACY CHOICES
We acknowledge that different people have different privacy concerns and preferences. Our goal is to be clear about what information we collect so that you can make meaningful choices about how it is used. Depending on your relationship with us, your jurisdiction and the applicable data protection laws that apply to you, we allow you to exercise your rights, choices, and controls in connection with your information.
In the table below you can review your rights depending on your interaction with us, how you can exercise them, and appeal a decision we take in this regard, any specification per geo-location or territory are available below the table:
8. DATA RETENTION
We retain Personal Data we collect as long as it remains necessary for the purposes set forth above, all in accordance with applicable laws, or until an individual expresses a preference to opt-out.
Other circumstances in which we will retain your Personal Data for longer periods of time include: (i) where we are required to do so in accordance with legal, regulatory, tax, or accounting requirements; (ii) for us to have an accurate record of your dealings with us in the event of any complaints or challenges; or (iii) if we reasonably believe there is a prospect of litigation relating to your Personal Data. Please note that except as required by applicable law, we may at our sole discretion, delete or amend information from our systems, without notice to you, once we deem it is no longer necessary for such purposes.
9. SECURITY
We design our Services while your security and privacy in mind. We have implemented physical, technical, and administrative security measures for the Services that comply with applicable laws and industry standards.
Please contact us at: legal@flexfactor.io, if you feel that your privacy was not dealt with properly, in a way that was in breach of our Privacy Policy, or if you become aware of a third party's attempt to gain unauthorized access to any of your Personal Data. We will make a reasonable effort to notify you and the appropriate authorities (if required by applicable law) in the event that we discover a security incident related to your Personal Data.
10. CROSS-BOARDER DATA TRANSFER
Your Personal Data processed by Flex is processed and stored by other entities, services providers, legal authorities, etc. as detailed above. Therefore, your Personal Data might be transferred to jurisdictions other than the jurisdiction from which you accessed our Services; and while the data is in the other jurisdiction, it may be accessed by the courts, law enforcement, and national security authorities. We will take appropriate measures to ensure that your Personal Data receives an adequate level of data protection upon its transfer. You may exercise your rights, where applicable, to receive information regarding the transfer mechanism that was used during such transfer.
11. CHILDREN
Our Website and Services are intended for general audience and is not directed to individuals under 18 years old. If we become aware that a person under 18 years old has provided us with Personal Data, we will delete such data from our databases.
If you become aware that a child has provided us with Personal Data, please contact us immediately at: legal@flexfactor.io.
12. ADDITIONAL SPECIFIC DISCLOSURES FOR CERTAIN UNITED STATES RESIDENTS
Information provided below supplements the information contained in this Privacy Policy and applies solely to consumers who reside in each applicable state. These additional disclosures are intended to provide you with additional information with regard to our handling of your Personal Data and certain consumer rights.
A. Additional Information for California Residents
In this section, we provide information for California residents, as required under California privacy laws, including the California Consumer Privacy Act, as amended by the California Privacy Rights Act (“CCPA”), which requires that we provide California residents certain specific information about our information practices, including how we process their Personal Information. This section of the Privacy Policy does not apply to publicly available information or Personal Information that is otherwise exempt under the CCPA. To the extent you are a resident of California, and we collect “Personal Information” subject to CCPA, the following applies.
Categories of Personal Information Collected and Disclosed:
The table below identifies the categories of Personal Information we may collect about you (and may have collected in the prior 12 months), as defined by the CCPA, as well as the categories of third parties to whom we disclosed Personal Information for a business or commercial purpose.
Sales and Sharing of Personal Information:
The CCPA defines “sale” as disclosing or making available Personal Information to a third-party in exchange for monetary or other valuable consideration, and “sharing” includes disclosing or making available Personal Information to a third-party for purposes of cross-context behavioural advertising. We do not sell your Personal Information. We may however share your Personal Information with a third party to help serve personalized content or ads that may be more relevant to your interests, and to perform other advertising-related services such as enabling our partners to serve such personalized content.
We do not sell or share any Sensitive Personal Information as such terms are defied under the CCPA and above.
Children:
We do not knowingly sell personal information about individuals who we know are under age sixteen (16).
Your CCPA Options:
Subject to certain conditions and exceptions, the CCPA provides California residents with specific rights outlined above under Section 7 “PRIVACY RIGHTS” with respect to their Personal Information,
California residents may exercise their CCPA privacy rights as set forth below:
• Right to Know, Delete, Correct, and Limit. California residents may submit CCPA requests to access/know, delete, and correct their Personal Information, and limit the use/disclosure of their Sensitive Personal Information by using the DSR available here. When you submit a request, we will take steps to verify your identity and request by matching the information provided by you with the information we have in our records. In some cases, we may request additional information in order to verify your identity, or where necessary to process your request. If we are unable to verify your identity after a good faith attempt, we may deny the request and, if so, will explain the basis for the denial.
You may also designate someone as an authorized agent to submit requests and act on your behalf. Authorized agents will be required to provide proof of their authorization in their first communication with us, and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent.
• Right to Opt-Out of Sales and Sharing. To exercise your right to opt-out of the “sale” or “sharing” of your Personal Information, you may do by using the DSR available here. We will apply your opt out request based upon the Personal Information in our records that is linked or reasonably linkable to the information provided in your request. You may also click the “Do Not Sell or Share My Personal Information” link available through the cookies settings on the Website. In addition, if we detect that your browser or device is transmitting an opt-out preference signal, such as the “global privacy control” or “GPC” signal, we will opt that browser or device out of cookies that result in a “sale” or “sharing” of your Personal Information.
Shine the Light
Residents of California may request (i) a list of the categories of Personal Information disclosed by us to third parties during the immediately preceding calendar year for those third parties’ own direct marketing purposes; and (ii) a list of the categories of third parties to whom we disclose such information. To exercise a request, please submit a DSR form available here. We may require additional information from you to allow us to verify your identity and are only required to respond to requests once during any calendar year.
B. Additional Information for Colorado Residents
Under the Colorado Privacy Act (“CPA”), Colorado residents acting in an individual or household context (and not in a commercial, employment context or as a job applicant) or someone on their behalf, are allowed to exercise certain rights regarding their Personal Data.
This disclosure does not apply to the collection, maintenance, disclosure, sale, communication, or use of any Personal Data bearing on a consumer's credit worthiness to the extent such processing is regulated by, and authorized under, the Fair Credit Reporting Act (FCRA).
We will respond to your request within 45 days after receipt of a verifiable Consumer Request (no more than twice in a twelve-month period). We reserve the right to extend the response time by an additional 45 days when reasonably necessary and provided consumer notification of the extension is made within the first 45 days. If we refuse to take action on a request, you may appeal our decision within a reasonable period time by contacting us at legal@flexfactor.io and specifying you wish to appeal. Within 60 days of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, you may submit a complaint as follows: Colorado AG at https://coag.gov/file-complaint/
If you have an account with us, we may deliver our written response to that account or via email at our sole discretion. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. You do not need to create an account for submitting a request.
Any disclosures we provide will only cover the 12-months period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable.
C. Additional Information for Connecticut Residents
Under the Connecticut Data Privacy Act (“CDPA”), Connecticut residents acting in an individual or household context (and not in a commercial or employment context or as a representative of business, non-profit or governmental entity) or someone on their behalf, are allowed to exercise certain rights regarding their Personal Data.
This disclosure does not apply to the collection, maintenance, disclosure, sale, communication, or use of any Personal Data bearing on a consumer's credit worthiness to the extent such processing is regulated by, and authorized under, the Fair Credit Reporting Act (FCRA).
We shall respond to your request within 45 days of receipt. The response period may be extended once by 45 additional days when reasonably necessary, taking into account the complexity and number of requests and we inform you of such extension within the initial 45 days response period, together with the reason for the extension. If we decline to take action on your request, we shall so inform you without undue delay, within 45 days of receipt of your request. If we refuse to take action on a request, you may appeal our decision within a reasonable period time by contacting us at legal@flexfactor.io and specifying you wish to appeal. Within 60 days of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, you may submit a complaint to the Connecticut Attorney General at link: https://www.dir.ct.gov/ag/complaint/ or (860) 808-5318.
We shall provide information in response to your request free of charge, up to twice annually, unless requests are manifestly unfounded, excessive or repetitive. If we are unable to authenticate your request using commercially reasonable efforts, we may request additional information reasonably necessary to authenticate you and your request. If we cannot authenticate you and your request, we will not be able to grant your request.
D. Additional Information for Florida Residents
Under the Florida Digital Bill of Rights (“FDBR”), Florida residents acting in an individual or household context (and not in a commercial or employment context) are allowed to exercise certain rights regarding their Personal Data.
This disclosure does not apply to the collection, maintenance, disclosure, sale, communication, or use of any Personal Information bearing on a consumer's credit worthiness to the extent such processing is regulated by, and authorized under, the Fair Credit Reporting Act (FCRA).
We will respond to your request within 45 days after receipt of your request. We reserve the right to extend the response time by an additional 15 days when reasonably necessary and provided consumer notification of the extension is made within the original 45-day timeframe. If we refuse to take action on a request, you may appeal our decision within a reasonable period time by contacting us at legal@flexfactor.io, specifying you wish to appeal. Within 60 days of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.
If you have an account with us, we may deliver our written response to that account or via email at our sole discretion. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. You do not need to create an account for submitting a request.
Any disclosures we provide will only cover the 12-months period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable.
We shall provide information in response to your request free of charge, up to twice annually, unless requests are manifestly unfounded, excessive or repetitive. If we are unable to authenticate your request using commercially reasonable efforts, we may request additional information reasonably necessary to authenticate you and your request. If we cannot authenticate you and your request, we will not be able to grant your request.
E. Additional Information For Montana Residents
* Effective October 2024
Under the Montana Consumer Data Privacy Act (“MTCDPA”), Montana residents acting in an individual or household context (and not in a commercial or employment context) are allowed to exercise certain rights regarding their Personal Data.
This disclosure does not apply to the collection, maintenance, disclosure, sale, communication, or use of any Personal Information bearing on a consumer's credit worthiness to the extent such processing is regulated by, and authorized under, the Fair Credit Reporting Act (FCRA).
We will respond to your request within 45 days after receipt of your request. We reserve the right to extend the response time by an additional 45 days when reasonably necessary and provided consumer notification of the extension is made within the original 45-day timeframe. If we refuse to take action on a request, you may appeal our decision within a reasonable period time by contacting us at legal@flexfactor.io, specifying you wish to appeal. Within 60 days of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, you may submit a complaint to the Montana Attorney General at: https://app.doj.mt.gov/apps/oscar/complaintstart.aspx.
If you have an account with us, we may deliver our written response to that account or via email at our sole discretion. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. You do not need to create an account for submitting a request.
Any disclosures we provide will only cover the 12-months period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable.
We shall provide information in response to your request free of charge, up to once annually, unless requests are manifestly unfounded, excessive or repetitive. If we are unable to authenticate your request using commercially reasonable efforts, we may request additional information reasonably necessary to authenticate you and your request. If we cannot authenticate you and your request, we will not be able to grant your request.
F. Additional Information For Orogen Residents
Under the Oregon Consumer Data Privacy Act (“OCDPA”), Oregon residents acting in an individual or household context (and not in a commercial or employment context) are allowed to exercise certain rights regarding their Personal Data.
This disclosure does not apply to the collection, maintenance, disclosure, sale, communication, or use of any Personal Information bearing on a consumer's credit worthiness to the extent such processing is regulated by, and authorized under, the Fair Credit Reporting Act (FCRA).
We will respond to your request within 45 days after receipt of your request. We reserve the right to extend the response time by an additional 45 days when reasonably necessary and provided consumer notification of the extension is made within the original 45-day timeframe. If we refuse to take action on a request, you may appeal our decision within a reasonable period time by contacting us at legal@flexfactor.io, specifying you wish to appeal. Within 45 days of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, you may submit a complaint to the Oregon Attorney General at: help@oregonconsumer.gov.
If you have an account with us, we may deliver our written response to that account or via email at our sole discretion. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. You do not need to create an account for submitting a request.
Any disclosures we provide will only cover the 12-months period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable.
We shall provide information in response to your request free of charge, up to once annually, unless requests are manifestly unfounded, excessive or repetitive. If we are unable to authenticate your request using commercially reasonable efforts, we may request additional information reasonably necessary to authenticate you and your request. If we cannot authenticate you and your request, we will not be able to grant your request.
G. Additional Information For Texas Residents
Under the Texas Data Privacy and Security Act (“TDPSA”), Texas residents acting in an individual or household context (and not in a commercial or employment context) are allowed to exercise certain rights regarding their Personal Data.
We will respond to your request within 45 days after receipt of your request. We reserve the right to extend the response time by an additional 45 days when reasonably necessary and provided consumer notification of the extension is made within the original 45-day timeframe. If we refuse to take action on a request, you may appeal our decision within a reasonable period time by contacting us at legal@flexfactor.io, specifying you wish to appeal. Within 60 days of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, you may submit a complaint to the Texas Attorney General at: https://consumerprotection.texasattorneygeneral.gov/consumercomplaintportal/s/flow/TCP_Complaint_Input_Data_Privacy.
If you have an account with us, we may deliver our written response to that account or via email at our sole discretion. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. You do not need to create an account for submitting a request.
Any disclosures we provide will only cover the 12-months period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable.
We shall provide information in response to your request free of charge, up to twice annually, unless requests are manifestly unfounded, excessive or repetitive. If we are unable to authenticate your request using commercially reasonable efforts, we may request additional information reasonably necessary to authenticate you and your request. If we cannot authenticate you and your request, we will not be able to grant your request.
H. Additional Information for Virginia Residents
under the Virginia Consumer Data Protection Act (“VCDPA”) Virginia residents acting in an individual or household context (and not in a commercial or employment context) or someone on their behalf, are allowed to exercise certain rights regarding their Personal Data. This disclosure does not apply to the collection, maintenance, disclosure, sale, communication, or use of any Personal Data bearing on a consumer's credit worthiness to the extent such processing is regulated by, and authorized under, the Fair Credit Reporting Act (FCRA).
We will respond to your request within 45 days after receipt of a verifiable Consumer Request (no more than twice in a twelve-month period). We reserve the right to extend the response time by an additional 45 days when reasonably necessary and provided consumer notification of the extension is made within the first 45 days. If we refuse to take action on a request, you may appeal our decision within a reasonable period time by contacting us at legal@flexfactor.io and specifying you wish to appeal. Within 60 days of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, you may submit a complaint to the Virginia Attorney General at https://www.oag.state.va.us/consumercomplaintform.
If you have an account with us, we may deliver our written response to that account or via email at our sole discretion. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. You do not need to create an account for submitting a request.
Any disclosures we provide will only cover the 12-months period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable.
We shall provide information in response to your request free of charge, up to twice annually, unless requests are manifestly unfounded, excessive or repetitive. If we are unable to authenticate your request using commercially reasonable efforts, we may request additional information reasonably necessary to authenticate you and your request. If we cannot authenticate you and your request we will not be able to grant your request.
I. Additional Information for Utah Residents
Under the Utah Consumer Privacy Act (“UCPA”), Utah residents acting in an individual or household context (and not in a commercial or employment context) are allowed to exercise certain rights regarding their Personal Data.
This disclosure does not apply to the collection, maintenance, disclosure, sale, communication, or use of any Personal Data bearing on a consumer's credit worthiness to the extent such processing is regulated by, and authorized under, the Fair Credit Reporting Act (FCRA).
We will respond to your request within 45 days after receipt of your request (no more than twice in a twelve-month period). We reserve the right to extend the response time by an additional 45 days when reasonably necessary and provided consumer notification of the extension is made within the first 45 days. If we refuse to take action on a request, we will provide with the reasoning for our refusal.
If you have an account with us, we may deliver our written response to that account or via email at our sole discretion. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. You do not need to create an account for submitting a request.
Any disclosures we provide will only cover the 12-months period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable.
We shall provide information in response to your request free of charge, up to twice annually, unless requests are manifestly unfounded, excessive or repetitive. If we are unable to authenticate your request using commercially reasonable efforts, we may request additional information reasonably necessary to authenticate you and your request. If we cannot authenticate you and your request, we will not be able to grant your request.