Privacy Center

InComm Payments and Affiliates Privacy Notice

Last updated: 1 July 2023

We respect your concerns about privacy and value the relationship we have with you. This Privacy Notice describes the types of personal information we may collect on our website, how we may use that information, with whom we may share it, and the measures we take to protect the security of the information. In addition, it describes the choices you can make about how we use the information you provide to us. We also provide you direction on how you can reach us to update certain information you gave to us, ask us not to send you future communications, or answer any questions you may have about our privacy practices.

This Privacy Notice applies only to information we collect on our websites (“Website” or “Sites”) and through your interactions with our Sites. This privacy notice summarizes the ways you may provide the information, the types of information you may submit, and the information we may collect from you when you visit or use this website. We also tell you how we may use the information.

Please note: Links to third-party websites are provided solely for your convenience; when you go to those sites, your experience there is subject to the privacy notices and terms of use of those third-party sites, not ours, unless you are explicitly told otherwise.

 

Contact Us

You may choose to contact us through our Website. If you e-mail us via the “Contact Us” link on this site, we ask you for information such as name and e-mail address so we can respond to your questions and comments. You may choose to provide additional information and we use the provided information you provide to respond to your inquiries. If you have any questions or comments about this Privacy Notice, or if you would like us to update certain information you have provided to us or expressed your communication preferences, contact us by:

 

Using the webform available at this Contact Us Link

Calling us at 833-774-8223

Writing us at:

InComm Privacy
250 Williams Street
5th Floor
Atlanta, GA 30303

 

Our Role in Data Collection

InComm’s Role in Data Collection

InComm Payments and its Affiliates (“InComm,” “we,” “us,” or “our”) may act as a Data Processor on behalf of another Data Controller, where we collect, use, and disclose certain personal information only under the Controller’s instruction, and our processing of your personal information is subject to their instructions and privacy policies. For any Site operated by us on behalf of another company, their privacy notice will appear on the site and that privacy notice will be the applicable policy.

Some of InComm’s services are offered through third parties, such as banks, financial institutions or other regulated entities. In those cases, you will see privacy notices provided by those companies alongside the InComm Privacy Notice. The InComm Privacy Notice will apply to your usage of that Site while the privacy notice provided by the third party will apply to their use of their customers’ personal information in the delivery of their services. Please read both notices carefully to understand the differences between the applicability of one policy versus the other.

 

Links to Other Sites

We may provide links to other websites for your convenience and information. These sites operate independently from our Site and are not under our control. These sites may have their own privacy notices in place, which we strongly suggest you review if you visit any linked websites. We are not responsible for the content of these sites, any products or services that may be offered through these sites, or any other use of these sites.

Please note: Links to third-party websites are provided solely for your convenience; when you go to those sites, your experience there is subject to the privacy notices and terms of use of those third-party sites, not ours, unless you are explicitly told otherwise.

Information We Share

We do not sell, rent, trade or otherwise disclose personal information about our Website visitors, except as described here. We share information about our Website visitors with service providers we have retained to perform services on our behalf, such as Website hosting, customer service, and information technology services. These service providers are not authorized by us to use or disclose the information, except as necessary to perform services on our behalf or to comply with legal requirements. We also may share information about you with other members of our corporate family. In addition, we may disclose information about you (i) if we are required to do so by law, (ii) in response to a request from law enforcement authorities or other government officials, (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation of suspected or actual illegal activity, or (iv) to exercise our legal rights or defend against legal claims.

We reserve the right to transfer any information we have about you in the event we sell or transfer all or a portion of our business or assets. Should such a sale or transfer occur, we will use reasonable efforts to try to direct the transferee to use personal information you have provided through this Website in a manner that is consistent with this Privacy Notice.

 

Your Data

Personal Information We Collect

We collect personal information directly from you, through third parties, via publicly available sources (in the context of business-to-business relationships or to comply with applicable laws), or automatically through our Sites and related to our services, subject to applicable laws as set out below. Where the personal information we collect is needed to comply with law, or to enter into or perform an agreement with you, we will inform you at the time of such data collection. If we cannot collect this data, we may be unable to register you as a client, to complete certain transactions, or provide products or Services to you.

Personal Information We May Collect Directly from You

We may collect the following categories of personal information that you provide directly to us:

• Identifiers such as name, email address, mailing address, fax or phone number, profile or account usernames and passwords, account numbers, and online identifiers;
• Other Personal Information including “payment information” such as credit or other payment card information, bank account, or billing address; “demographic information” such as when you provide your age, gender, interests and ZIP or postal code; “preference information” such as product wish lists or marketing                 preferences; “government identifiers” as described below; and “submitted content” such as information you choose to provide via online forms, surveys, contests, promotions, sweepstakes, online chat discussions, blog posts or comments, requests for customer support, reviews, or testimonials;
• Commercial Information such as products or Services purchased, viewed, or received;
• Internet Information such as your browsing, search, and usage details in connection with InComm Sites or when interacting with InComm advertisements online;
• Professional or Employment Information including “application information” such as your resume, employment and education history, name and contact details, background details, and references when you apply to job postings or contact us about employment opportunities, and “company and employer information” about you and your employer when you contact us on behalf of your employer or when your employer uses one of our Services, such as company name, size, or business type; and
• Sensitive Personal Information including “government identifiers” such as driver’s license, passport number, and Social Security/Social Insurance numbers (for InComm business-to-business clients and potential clients, such as when this information must be collected by applicable law); and “account access information” such as a username or account number in combination with a password, security or access code, or other credential that allows access to an account, all of which may be       deemed sensitive personal information under applicable laws.

Personal Information We May Collect Automatically

When you access or use our Sites, we may collect some information automatically which may be collected through cookies, web beacons, java script, log files, pixels, and other technologies (collectively, “Technologies”). For example, we may collect the following categories of personal information automatically:

• Identifiers about you and your device(s), such as your domain name, browser type, browser language preference, device type and operating system, page views and links you click within the Sites, IP address, device ID or other identifiers;
• Geolocation Data of the device(s) you use in connection with the Sites, including for fraud prevention purposes or to help you locate a store offering our products and Services in your area (with your consent). This may be general geolocation data (such as your city or jurisdiction), or precise (with your consent). You may withdraw your consent to the processing of precise location-based information at any time by changing the settings on your device. If you do, you might not be able to use certain features, especially when we use location-based information to prevent fraud; and
• Internet Information such as date and time stamp, and time spent using the Sites, referring URL, your activity within the Site(s), usage patterns, user preferences, peak demand times, preferred content and other information derived from the use of our Sites.

Personal Information We May Create or Generate

We may infer new information from other data we collect, including using automated means, such as:

• Inferencesabout your likely preferences or other characteristics.

Personal Information We May Collect from Third Parties

We may also obtain any of the categories of personal information described above from third parties, such as:

• Publicly available sources, subject to applicable law, such as confirmation of your address with the postal service;
• Service providers that may help operate our Sites, prevent fraud, process payments, provide our products and Services, or otherwise assist us in obtaining any of the categories of personal information described above;
• Third-party partners (such as our clients who use our Services to provide you with incentives), payment processors, and others that may help us to obtain any of the categories of personal information described above; and
• Other customers, such as the name and contact details of recipients of gifts purchased through our sites.

 

Your Data Privacy Rights

You may have legal rights in the jurisdiction where you reside with regard to your privacy and how your personal information is processed by us. This section provides details on what those rights are, how we honor them where required, and the process for exercising them. Regardless of where you reside, InComm may at its sole discretion choose to extend these rights to all individuals, and to comply with reasonable requests in the manner detailed below. We do not charge for these services. Where you are entitled to exercise a right, we will respond to your request within the timeframe set out by applicable law. Where we provide answers on a voluntary basis, we will provide a response within a reasonable timeframe. We will not discriminate or retaliate against you for requesting or exercising these rights.

Notice at Collection, And Right to Know

At or before the time of collection, you may have a right to receive notice of our practices, including the categories of personal information and sensitive personal information to be collected, the purposes for which such information is collected or used, whether such information is sold or shared, and how long such information is retained. You can find those details in this Notice. You may also have a right to request additional information about our collection, use, disclosure, or sale of personal information about you (to “know”). Note that we have provided much of this information in this Notice. You may make such a request to “know” by the means in the Contact Us section.

Access, Correction, Portability, And Deletion

You have the right to access, correct (“rectify”), or delete (”be forgotten”, “erase”) your personal information held by us, or to ask for a restriction of processing. You may also have the right to ask for an overview or copy of your personal information or, where technically feasible, to request that certain of your personal information be exported in a format so that you may take your data to another provider (“data portability”). On some of our Sites, you may exercise your rights to access, correct, or delete your personal information by making the change directly on your account page. You may also make these requests by the means in the Contact Us section. Please note that there are some limitations to these rights. For example, we will not be able to delete your personal information if we are required or permitted by law to keep it or if we hold it in connection with a contract with you. Similarly, access to your personal information may be refused if making the information available would reveal personal information about another person or if we are legally prevented from disclosing such information. If we cannot fulfill your request, we will provide information regarding why we cannot comply with your request.

Withdrawal of Consent

Where we process your personal information based on your consent, you have the right to withdraw your consent at any time without affecting the lawfulness of the processing that occurred based on your consent before its withdrawal. Please keep in mind that certain Services are directly dependent upon our ability to process your personal information, so if you withdraw your consent, request for your information to be deleted, or if you otherwise object to our processing of certain personal information, those Services may no longer be functional.

Object to Processing

You have the right to object to processing (including profiling) that occurs based on legitimate interest grounds, where we are relying upon legitimate interests as the primary basis for processing your personal information. If you object, we must stop that processing unless we can demonstrate that the processing occurs for compelling legitimate grounds that override your interests, rights and freedoms, or that we need to process the personal information for the establishment, exercise or defense of legal claims. Where we rely upon legitimate interest as a basis for processing, we believe that we can demonstrate such compelling legitimate grounds, but we will consider each case on an individual basis.

Opt-Out of Sharing and Targeted Advertising

If you wish to not have cross-site information about you used or shared for the purpose of serving you targeted ads online, you should opt-out by taking the following two steps: (1) using the controls available through our Website cookie banner to decline advertising-related cookies, and (2) submitting a request by the means in the Contact Us section. Both steps (1) and (2) are required to make your choice effective, and you may need to reperform step (1) for each InComm site you visit, and for each browser and device you use.

You can also opt-out of many (but not necessarily all) ad networks by visiting the DAA WebChoices Tool (or if located in the European Union, by visiting Your Online Choices). You will continue to receive ads on the sites you visit, but the ad networks from which you have opted out will no longer target ads to you based upon your activities on other sites. Please note, however, that as with step (1) above, these opt-out mechanisms are also cookie based, so if you delete cookies, block cookies or use another device, your opt-out will no longer be effective. For more information about Interest Based Advertising, please visit Your Ad Choices.

Object to Marketing

You have the right to object to our use of your personal information (including profiling) for direct marketing purposes, such as when we use your personal information to invite you to our promotional events. You may also choose to stop receiving our newsletter or marketing emails at any time by following the unsubscribe instructions included in these emails or accessing the email preferences in your account.

Lodge a Complaint

If you believe that our processing of your personal information infringes your rights or violates applicable data protection laws, you have a right to lodge a complaint with the relevant supervisory authority. If you are in the United Kingdom, you may contact the Information Commissioner’s Office. If you are in the United States, you may contact the US Federal Trade Commission (residents of various states may contact their respective state consumer protection agency). Residents of Canada may contact the Privacy Commissioner of Canada or their provincial data protection commissioner. If you are located in another jurisdiction, you will need to research or contact your local government for further guidance.

Sensitive Personal Information

We do not use or disclose sensitive personal information in ways that require an opt-out right under applicable law.

Exercising your Rights

To exercise your rights as described in this Notice, you may contact us submitting a request by the means in the Contact Us section.

We will respond to your request in accordance with applicable law, and if we are unable to comply with your request, we will provide information regarding why.

When Submitting a Privacy Rights Request

Depending on the nature of your request, we may request further proof of your identity in accordance with applicable law. When sending a request, you can expedite this process by providing the following information with your initial inquiry:

• Full name;
• Email address associated with the relevant transaction(s);
• Postal address associated with your account or transaction;
• Product or Service (for example, which InComm website you used); and,
• Only the last four (4) digits of the card associated with the transaction (if applicable).

WARNING: For security reasons, when corresponding with the Privacy Team regarding a Privacy Rights Request, NEVER send the full card number or other information contained on the card (such as CVV or expiration date), and NEVER send any sensitive personal or financial information associated with you or the card.

We may ask you to respond from the associated email address, or to provide the information above or additional information thereafter, as part of our verification processes. If the nature of your request is unclear, we may ask you for further clarification. In the event that we require additional time to process your request (if allowed by applicable law), we will advise you of that. If you are unable to or refuse to provide satisfactory verification information, we may deny your request in accordance with applicable law. If you do not follow the procedures described in this Notice, including failure to lodge your request through the channels or processes specified above, there may be significant delays in responding to your request. Where permitted by law, you may designate, in writing or through a power of attorney, an authorized agent to make rights requests on your behalf. Before accepting such a request from an agent, we will require the agent to provide proof you have authorized it to act on your behalf, and we may need you to verify your identity directly with us.

Please note that we will only respond directly to you, or your duly authorized agent (with authority documented in strict accordance with applicable law), in cases where we are the Controller of your personal information. Where we are acting as a Processor on behalf of a client or partner, we will refer you to the client or partner who is the Data Controller of your personal information. Our agreements with Data Controllers, as well as applicable laws, require that we process data in strict accordance with the Controller’s explicit instructions, therefore any actions we take to access, edit, or delete your data will only be undertaken with their direct authorization and upon their explicit instructions.

 

How We Use Data and Legal Bases

Use of Your Personal Information

We may use each of the categories of personal information we collect for the following purposes:

• Provide Our Services: To provide our Services, operate our Sites, respond to your inquiries and fulfill your requests and orders, process your payments, report and resolve bugs and errors, and perform upgrades and maintenance;
• Customer Service and Support: To send you important information, such as changes to terms, conditions, policies and/or other administrative information;
• Personalization: To personalize your experience on a Site or using the Services, such as by tailoring the content we send or display to you in order to personalize help and instructions, and to otherwise personalize your experience using the Services;
• Alerts and Required Notices: At your request, to communicate service-related alerts and any notices;
• Marketing and Promotions: Per your preferences, to send you marketing communications;
• Advertising and Referrals: To assist in advertising the Services on third-party websites and to track referrals from partner websites;
• Analytics and Improvement: To better understand how our Services are used and accessed, and for other research and analytical purposes, such as to evaluate and improve our Services;
• Verify Identity and Detect Fraud: To verify your identity and/or location in order to allow access to your accounts, conduct online transactions, and secure your personal information, as well as for risk control, fraud detection and prevention, and compliance with laws and regulations;
• Protect Our Legal Rights and Prevent Misuse: To protect the Services, prevent unauthorized access and other misuse, and where we believe necessary, to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, or violations of our Terms of Use or this Privacy Notice.
• Comply with Legal Obligations: To comply with the law or legal proceedings, such as when required to disclose information in response to lawful requests by public authorities, including responding to national security or law enforcement disclosure requirements; and
• General Business Operations: Where necessary to the administration of our general business, accounting, recordkeeping and legal functions.

Legal Bases for Using Personal Information

Where applicable we may use your personal information as explained elsewhere in this Statement for each of the following lawful bases:

Purposes of Use/Processing	Legal Bases of Processing (where applicable)
To Provide Our Services Customer Service and Support	• Necessary to enter into or perform a contract with you (upon your request, or as necessary to make the Services available) • Our legitimate business interests•
Personalization Marketing and Promotions Advertising and Referrals	• Our legitimate business interests• • With your consent
Analytics and Improvement Generating Other Information	• Our legitimate business interests•
Verify Identity and Detect Fraud Protect Our Legal Rights and Prevent Misuse Comply with Specific Legal Obligations	• Compliance with applicable laws and regulations Establish, defend or protect our legal interests • Our legitimate business interests•
General Business Operations	• Our legitimate business interests• • Establish, defend or protect our legal interests • Compliance with law

* For personal information from the EU, the processing is in our legitimate interests to the extent they are not overridden by your interests and fundamental rights. Our legitimate interests include (i) our interests in verifying identify, (ii) detecting and preventing fraud and crime, (iii) protecting and improving our products and Services, (iv) in support of our general business operations including the growth of our business, and (v) to comply with our legal obligations.

 

HIPAA

To the extent that we process your personal information on behalf of a health insurance company, health care provider, or another entity covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) federal medical privacy law, we will safeguard your information in accordance with HIPAA and our agreements with customers. You can learn more about your rights under HIPAA by obtaining a copy of the HIPAA notice of privacy practices of the health insurance company or health care provider on whose behalf we have your information. To the extent that we maintain your information in accordance with HIPAA, this personal information may be excluded from other privacy laws and exempt from the privacy rights described in this Privacy Notice.

 

Selling and Sharing of Your Data

In this section, we describe the types of disclosures we make and the categories of third parties to whom we may disclose your personal information. We may make disclosures of any of the categories of personal information described in the Personal Information We Collect section above to the types of third parties described below, and might have made such disclosures in the past 12 months.

Sale Of Data

We do not sell your personal information to third parties.  Because we do not sell your personal information, we do not provide any further detail regarding such sales.

InComm Affiliates

We disclose personal information among our affiliated and subsidiary companies in furtherance of the purposes set out in this Notice; their processing of your personal information is subject to the requirements and limitations contained in this Notice.

Third-Party Service Providers

We disclose your personal information to certain companies that provide services to us and on our behalf and subject to our written instructions, such as shipping, payment, hosting, advertising and other support services; these companies may be located in the EU, the United States, and/or other jurisdictions. As noted above, we may also disclose your information to service providers who assist us in the detection or investigation of fraudulent or illegal activities, for verification of identity, and for compliance activities, such as required transaction-related reporting or to verify your address in order to accurately calculate or process tax-related matters.

Clients and Partners

Where we process personal information on behalf of and in conjunction with our clients or partners, we process and share your personal information with that entity. When we process personal information on behalf of a Controller, that Controller’s privacy notice will be presented, and their notice will apply instead of this Notice. In certain circumstances, we may operate a site jointly with another entity and both will function as Controllers; in those instances, you will see both the InComm Privacy Notice and the other entity’s privacy notice, and both will apply with respect to the activities of each Controller individually.

Gramm-Leach-Bliley Product Short Notices (US customers only)

Some products offered in conjunction with banks and financial institutions have unique data sharing agreements. Where relevant, InComm will make available to you short-form privacy notices of each product’s sharing policies on that Website or on this page (see “InComm Financial Services Short-Form Privacy Notice”).

Additional Disclosures

We may also disclose your personal information under the following circumstances:

• As permitted or required by law, such as to comply with a subpoena or court-issued discovery order, a warrant, a government request, or similar legal process;
• When we believe in good faith that disclosure is necessary to respond to claims asserted against us to protect our rights, to protect your safety or the safety of others, or to investigate or prevent fraud;
• If InComm is involved in a merger, acquisition, or sale of all or a portion of its assets, or in the event of a bankruptcy or dissolution of our business, your personal information may be transferred to an acquiring business or third party, including in contemplation of or related to due diligence for such business transactions, subject to any applicable restrictions under applicable laws. You will be notified by email and/or by a prominent notice on our Website of any change in ownership or uses of your personal information, as well as any choices you may have regarding your personal information; and
• To any other third party with your prior consent.

Aggregated and Anonymized Information

We may generate aggregated and/or anonymized information about users for marketing, advertising, research, or other purposes. We may share aggregate and anonymized information about users with certain third parties, including for marketing, advertising, research or similar purposes.

 

Technology and Your Privacy

Cookies, Technologies, and Online Tracking

We and our third-party service providers collect information automatically through Technologies. We, or our service providers, may combine this information with other information, including personal information we collect about you, to record your preferences, gather information about the use of our Sites and Services, identify when our emails are viewed, personalize content and ads and track information about the performance of our advertisements. The “help” portion of the toolbar on most browsers will tell you how to stop accepting new cookies, how to be notified when you receive a new cookie, and how to disable existing cookies. Remember, though, without cookies, you may not be able to take full advantage of all our website features.

Cookies

These are small files with a unique identifier that are transferred to your browser through our Sites. Cookies allow us to collect information such as browser type, time spent on our Sites, pages visited, language preferences, and your relationship with us. We can use this information to analyze trends, administer the Website, track users’ movements around the Site, measure the effectiveness of our communications, tailor our advertising to you, and gather demographic information about our user base as a whole. Cookies may provide us with information about devices and networks you utilize to access our Sites and Services, and other information regarding your interactions with our Sites and Services.

Pixels, Web Beacons, Clear GIFs

These are tiny graphics with a unique identifier, similar in function to cookies that we use to track the online movements of users of our web pages and to identify when our emails are viewed or forwarded. Our third-party partners may use Local Shared Objects, such as Flash cookies, to embed features on our Sites.

Third-Party Analytics

We also use automated devices and applications, such as Google Analytics (more info here) to evaluate use of our Sites and Services. We use these tools to gather information about users to help us improve our Sites, Services and user experiences. These analytics providers may use Technologies to perform their services on our behalf.

Social Media Features

Our Sites include social media features, such as the Facebook “Like” button, either hosted by a third-party or hosted directly on our Website (“Widgets”). Please refer to the privacy policies of the relevant third-party websites or services to find out more about the collection, use, and disclosure of your information through such features. We will comply with any legal obligations placed on the use of these technologies by certain jurisdictions, which may affect how these tools function.

Security

The security of your personal information is important to us. We use organizational, technical, and administrative safeguards to protect the personal information submitted to us. Please note that no data transmission over the Internet can be guaranteed to be 100% secure. As a result, we cannot guarantee or warrant the security of any personal information that we process.

Retention

It is our policy to retain your information only for as long as is necessary to fulfill the purpose for which it was collected and processed.  We will retain your information for as long as your account is active or as needed to provide services to you, and for as long as may be required to comply with our legal obligations, resolve disputes, maintain appropriate business records, and enforce our agreements.  Even if you request for your information to be deleted, laws and regulations may require us to retain a copy of your information in our files for a longer period of time.

International Transfers

The personal information we collect from you may be transferred to, stored at, or processed in other countries, including the United States or outside the European Economic Area, which may not provide equivalent levels of data protection to your home jurisdiction. We will take steps to ensure that your personal information receives an adequate level of protection in the jurisdictions in which we process it, including through appropriate written data processing terms and/or data transfer agreements. For transfers from the EU, United Kingdom (“UK”), or Switzerland, to the US, InComm relies on adequacy decisions by the EU Commission or putting in place standard contractual clauses as approved by the European Commission or another applicable supervisory body.