Supplemental Information for Residents of California
This supplemental section of Huron’s Privacy Statement is directed at and applies to a limited subset of individuals who interact with Huron, who are verifiable residents of the state of California, and who are not otherwise exempted from the California Consumer Privacy Act (CCPA).
To the extent any California data privacy law applies to the collection of your Personal Data, this supplemental section of our Privacy Statement outlines the rights that California residents may have, and how they can exercise those rights. This notice applies solely to California residents. We provide the supplemental selection below to comply with the California Consumer Privacy Act [as amended by the California Privacy Rights Act (referred to collectively hereinafter as CCPA)] and any terms defined in the CCPA have the same meaning when used below.
Your California Consumer Privacy Rights
If you are a resident of California, you have the following specific additional privacy rights under the law:
- Right to Know and Access Specific Information. You have the right to request that we disclose certain information to you about our collection and use of your Personal Data over the past twelve (12) months. Once we receive and confirm a verifiable consumer request from you, we will disclose to you, to the extent permitted by law:
- The categories of Personal Data we collected about you, and whether we sell or share your information to third parties.
- The specific pieces of Personal Data we hold about you.
- The categories of Personal Data sold within the last twelve (12) months.
- The categories of sources from which Personal Data about you is collected.
- Our business or commercial purpose for collecting, selling, or sharing your Personal Data.
- The categories of third parties with whom your Personal Data is sold, shared, or disclosed for a business purpose.
You have the right to request that the Personal Data described above be provided to you in a portable and readily useable format, to the extent technically feasible (“data portability”).
- Right to Request Deletion of Personal Data. California residents have the right to request that we delete Personal Data about them which we collected from them. Our obligation to delete Personal Data is limited by the law, and we are not required or able to comply with requests in all instances; for example, if it is necessary for us to maintain Personal Data in order to complete a transaction with the consumer, detect or protect against security incidents or other illegal or deceptive activity, exercise our free speech or other rights provided by law or protect the lawful rights of another consumer, comply with other certain legal obligations, or enable internal uses of the personal information in a lawful manner compatible with the context in which the consumer provided the information or would expect it to be used based on their relationship with us. To the extent we can delete your Personal Data, once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your Personal Data, unless an exception applies.
- Right to Correct Inaccurate Information. To the extent that we may maintain inaccurate Personal Data, you have the right to request that we correct such inaccurate Personal Data taking into account the nature of the Personal Data and the purposes of the processing of the Personal Data. Once we receive and verify your verifiable consumer request, we will use commercially reasonable efforts to correct your Personal Data.
- Sale and Sharing of Personal Data and the Right to Opt Out. You have the right to opt out of the processing of your Personal Data for the following purposes:
- Sale of your Personal Data
- Sharing of Personal Data for cross-context behavioral advertising.
The use of online tracking technologies may be considered a “sale” or “sharing” under California law. To the extent that these online tracking technologies are deemed to be a “sale” or “sharing” under California law, you may opt out of these online tracking technologies by submitting a request via Exercising Your Privacy Rights or by broadcasting an opt-out preference signal, such as the Global Privacy Control (GPC).
- Right to Limit Use and Disclosure of Sensitive Personal Information. You have the right to request that we limit the use and disclosure of sensitive personal information (as defined by CCPA) only to that use, which is necessary for us to perform the Services, or deliver the goods reasonably expected and as authorized by law. Once we receive and verify your verifiable consumer request, we will limit our use of your sensitive personal information and will instruct our service providers to do the same.
- Right to Non-Discrimination You have a right to not be discriminated against in the Services or quality of Services you receive from us for exercising your rights. We may not, and will not, treat you differently because of your data subject request activity. As a result of your data subject request activity, we may not and will not deny goods or Services to you, charge different rates for goods or Services, provide a different level quality of goods or Services, or suggest that we would treat you differently because of your data subject request activity.
- Right to Disclosure of Direct Marketers. You have a right to the categories and names/addresses of third parties that have received Personal Data for their direct marketing purposes upon simple request, and free of charge.
You may make an authenticated consumer request exercising your Right to Know and Access Specific Information including Right to Know what Personal Data is being Sold or Shared under the CCPA twice within a twelve (12) month period. To exercise the rights described above, see the How to Submit a Request to Exercise your CCPA Rights section below.
How to Submit a Request to Exercise your CCPA Rights
If you are a consumer and resident of California and you wish to exercise your CCPA rights, please submit a verifiable consumer request to us via the methods described below:
- Online Form: Exercising Your Privacy Rights
- Email us at privacy@hcg.com and include your name, your specific request, and a preferred contact method (e.g., email or mail) for us to follow up with you.
- Call us at 1-866-229-7219 (toll-free) and ask to be connected with Huron’s Chief Privacy Officer. Ultimately though, we may ask that you submit your request in writing, for us to keep appropriate records, and because the law requires us to respond to you in writing.
- Send mail addressed to:
Huron Consulting Group Inc.
Attn: Chief Privacy Officer
550 W Van Buren St, Chicago IL 60607
Please note that if you ask us to provide you with specific pieces of information, we may require you to sign a declaration under penalty of perjury that you are the consumer whose information is the subject of the request.
Authorized Agent
You may use an authorized agent to submit verifiable consumer requests on your behalf. An authorized agent is a natural person or a business entity that you have authorized to act on your behalf. If you use an authorized agent, we may require: (1) proof of written permission for the authorized agent to make requests on your behalf, and identity verification from you, or (2) proof of power of attorney pursuant to California Probate Code sections 4000 to 4665. We may deny a request from an authorized agent that does not submit proper verification proof.
Additional Information
To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.
What to Expect When you Submit a Request to Us
We are a professional services firm, dealing almost exclusively with other companies, as opposed to directly with consumers as that term is usually understood, in business-to-business transactions; and the protection of our clients’ information (past, present, and future) is paramount to our corporate values and our privacy program.
We take data security, in addition to privacy, very seriously, and California law is clear on the need for businesses to protect all consumers from fraudulent requests made by someone other than the actual individual. We mention this to prepare you for the fact that if you request from us specific pieces of Personal Data collected about you, we will do whatever is reasonably necessary (as the law allows and requires) to verify that you are who you say you are; and as such, you should expect a thorough and personalized vetting process from us to ensure that we do not provide one individual’s Personal Data to an imposter. The process may take 45 days (or longer when reasonably necessary) depending on the request, and consistent with our obligations under the law.
Only you or a person registered with the California Secretary of State that you authorize to act on your behalf or is authorized by a person who has power of attorney or is acting as a conservator for the consumer, may make a verifiable consumer request related to your Personal Data. You may also make a verifiable consumer request on behalf of your minor child.
The verifiable consumer request must:
- Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Data or an authorized representative.
- Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.
