PRIVACY POLICY
Welcome to www.acord.org (the “Site”), a website provided by ACORD Corporation, a not-for profit, Delaware corporation that enables the success of the global insurance industry by leveraging the flow of data and information across all insurance stakeholders through relevant and timely data standards ("ACORD"). ACORD respects your privacy, and this policy covers ACORD’s handling, use and disclosure of information collected from you through the Site, your use of software products licensed from ACORD (“Software”) or other sources in the ordinary course of ACORD’s business.
1) Acceptance
You should review this policy carefully, and be sure you understand it, prior to using the Site or any Software, or otherwise providing any information to ACORD. Your use of the Site or any Software, or your otherwise providing any information to ACORD, is deemed to be irrevocable acceptance by you of this policy. If you do not agree to this policy, you should not use, and should immediately terminate your use of, the Site or such Software, as applicable, and not otherwise provide any information to ACORD. For purposes of this Section, accessing the Site only to review this policy or any terms of use is not deemed to be use of the Site.
2) Privacy Shield
Some of the information collected by ACORD may relate to residents of the European Union or Switzerland. The European Union and Switzerland have adopted requirements for the protection of certain information, and in order to satisfy such requirements, ACORD has (a) agreed to comply with the E.U.-U.S. Privacy Shield Framework Principles, including the Supplemental Principles, designed by the U.S. Department of Commerce and the European Commission and the Swiss-U.S. Privacy Shield Framework Principles, including the Supplemental Principles, designed by the U.S. Department of Commerce and Swiss Administration and (b) elected to self-certify under the E.U.-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework administered by the U.S. Department of Commerce (the “Privacy Shield”). In particular, ACORD has agreed, with respect to all Shield Information, to adhere to the Privacy Shield’s principles of notice, choice, accountability for onward transfer, security, data integrity and purpose limitation, access and recourse, enforcement and liability. For purposes of enforcing compliance with the Privacy Shield, ACORD is subject to the investigatory and enforcement authority of the U.S. Federal Trade Commission, which can impose sanctions consisting of administrative orders and civil penalties. ACORD is listed at https://www.privacyshield.gov/list as having certified to its compliance with the Privacy Shield. For more information regarding the Privacy Shield, please see the U.S. Department of Commerce’s website at http://privacyshield.gov.
3) Information
In this policy:
(a) “Analytical Information” means all Non-Personal Information obtained through the use of cookies (or other code) and server log files (including, but not limited to, (i) your search terms, (ii) your computer’s access date and time, browser, connection speed, Internet protocol address, Internet service provider, language, location, manufacturer, visit details, and operating system, and (iii) whether or not you opened email messages or other electronic communications from ACORD, and if you did, the times they were opened);
(b) “Collected Information” means all (i) Personal Information (including, but not limited to, name, e-mail address, physical address, phone number, photographs, credit card processing information, human resource data from employees and independent contractors of ACORD, and insurance information relating to third-party individuals provided by clients of ACORD), and (ii) Non-Personal Information (including, but not limited to, Analytical Information);
(c) “Non-Personal Information” means all information collected by ACORD, whether electronically or manually, through (i) the Site, (ii) any Software, (iii) e-mail messages and other electronic communications that you may send to ACORD, and (iv) other sources in the ordinary course of ACORD’s business, that is not Personal Information;
(d) “Personal Information” means all information collected by ACORD, whether electronically or manually, through (i) the Site, (ii) any Software, (iii) e-mail messages and other electronic communications that you may send to ACORD, and (iv) other sources in the ordinary course of ACORD’s business, that relates to an individual and that identifies, or can be used in conjunction with other readily-accessible information to identify, such individual (including, but not limited to, any such information relating to employees of ACORD residing in the United States or the United Kingdom);
(e) “Sensitive Information” means all Shield Information of an individual that specifies (i) health data, (ii) racial or ethnic origin, (iii) political opinions, (iv) religious or philosophical beliefs, (v) union membership, (vi) genetic data, (vii) biometric data or (viii) the sex life or sexual orientation of such individual; and
(f) “Shield Information” means all Personal Information collected by ACORD, whether electronically or manually, through (i) the Site, (ii) any Software, (iii) e-mail messages and other electronic communications that you may send to ACORD, and (iv) other sources in the ordinary course of ACORD’s business, that relates to individuals residing in the European Union or Switzerland and that is covered by the Privacy Shield.
4) Collected Information
No Collected Information is obtained from you, unless it is voluntarily provided, except for any Collected Information (i) obtained automatically through the Site as set forth in this policy or any Software in connection with its intended functionality, (ii) obtained pursuant to a separate written policy unrelated to the Site and of which you are provided notice, or (iii) obtained through legal process. Regardless of the method used to obtain Collected Information, ACORD will collect and retain Personal Information in its primary and backup files only to an extent that is relevant to the purposes for which it is provided by you, and except for Shield Information, for ACORD's other legitimate business purposes (including, but not limited to, marketing). You are responsible for obtaining any approvals, authorizations, consents and permissions that are required in connection with your providing ACORD with any information (including, but not limited to, any information relating to a third party).
5) Choice
You may refuse to provide any information to ACORD at any time by terminating your use of the Site and all Software, or in all other cases not involving use of the Site or any Software, by notifying ACORD as set forth in Section 22. If you refuse to provide any information when requested to do so by ACORD, the Site or any Software, you may not be able to access, or otherwise enjoy the benefits of, certain services from ACORD, features of the Site or functionality of such Software.
6) Electronic Communications
Whether or not you have previously sent ACORD an e-mail message, you consent to ACORD's sending you e-mail messages and other electronic communications (a) in connection with your use of the Site or any Software, (b) in the ordinary course of business, or (c) for any other legitimate business purpose (including, but not limited to, marketing). Since ACORD endeavors to send e-mail messages and other electronic communications only to individuals desiring to receive them, you can unsubscribe to such e-mail messages or other electronic communications at any time by contacting ACORD as set forth in Section 22 or by following the directions contained in such e-mail messages or other electronic communications.
7) Analytical Information
When you access the Site or use any Software that is licensed as “software as a service” or otherwise hosted by ACORD, ACORD will collect Analytical Information. Your browser may provide you with the ability to not accept cookies, as well as the ability to delete already-existing cookies. If you refuse, or delete previously existing, cookies, you may not be able to enjoy some features of the Site or functionality of any Software.
Analytical Information will only be used by ACORD (a) to record your use of the Site or any Software, (b) to diagnose problems with the Site or any Software, (c) to improve the Site or any Software and make the Site or such Software, as applicable, more useful to you and other users, and (d) for other legitimate business purposes of ACORD (including, but not limited to, marketing). ACORD will collect Analytical Information either directly or through third parties acting on its behalf.
8) Sensitive Information
Any provision of this policy to the contrary notwithstanding, if ACORD collects any Sensitive Information from you, your explicit consent (i.e. among other things, you must “opt in”) will be obtained before such Sensitive Information is (a) disclosed to a third party or (b) used for a purpose other than the purposes for which such Sensitive Information was originally collected or subsequently authorized by such individual through the exercise of an “opt-in” choice. ACORD will also treat as Sensitive Information any Personal Information of an individual received by ACORD from a third party if the third party identifies it in writing to ACORD, and treats it, as sensitive.
9) Controller
All electronic Personal Information is controlled by ACORD on servers residing at ACORD’s place of business in Pearl River, New York, and on servers residing at off-site data centers in the United States and other locations. ACORD may transfer Collected Information to a third-party controller, except that, in the case of Shield Information only, (a) you will be provided with notice of such transfer or this Section is amended to reflect such transfer pursuant to Section 20 and ACORD complies with the choice principles of the Privacy Shield, and (b) ACORD enters into an agreement with such third party providing that (i) Shield Information may only be processed for limited specified purposes consistent with the consent provided by you, (ii) any such third party will provide the same level of protection as the Privacy Shield, (iii) such third party will notify ACORD if it makes a determination that it can no longer meet its obligation to do so and (v) when such a determination is made, such third party must cease processing Shield Information or takes other commercially reasonable steps to remediate such third party’s inability to meet such obligation.
10) Protection
Except as provided in the immediately following sentence, ACORD will use commercially reasonable efforts to protect Personal Information from loss, misuse and unauthorized access, alteration, destruction and disclosure. Certain Personal Information posted by you on the Site may be accessible to the general public, and ACORD is not responsible for protecting such Personal Information from loss, misuse or unauthorized access, alteration, destruction or disclosure. For example, if you participate in a public forum on the Site, any information disclosed by you when doing so may be available to the general public. Also, since no transmission of information over the Internet or electronic storage of information is completely secure, it is possible that Collected Information could be lost, misused or accessed, altered, destroyed or disclosed without authorization, even if ACORD uses such reasonable efforts. In providing information to ACORD, you must assume the risk that Collected Information could be lost, misused or accessed, altered, destroyed or disclosed without authorization.
11) Use and Transfer of Collected Information
All Collected Information may be used by ACORD for any legitimate business purpose (including, but not limited to, marketing), except that, in the case of Shield Information only, such purpose (a) is relevant to the purpose for which Shield Information has been provided by you or (b) has been subsequently authorized by you. If ACORD expressly states in this policy or in another writing that any Collected Information will only be used for a specific purpose, ACORD will only use such Collected Information for such purpose, unless you subsequently consent to its being used for another purpose.
Any Collected Information obtained by ACORD, whether or not for a specific purpose, may be disclosed to third parties retained by ACORD (including, but not limited to, any distributors, sub-contractors or vendors of ACORD) for any purposes for which ACORD could use such Collected Information, except that, in the case of Shield Information only, (a) such third party’s right to use Shield Information is limited to such purposes, (b) such third party is obligated to provide at least the same level of privacy protection as is required by the Privacy Shield, (c) ACORD takes commercially reasonable steps to ensure that such third party effectively processes Shield Information in a manner consistent with ACORD’s obligations under the Privacy Shield, (d) such third party is required to notify ACORD if such third party makes a determination that it can no longer meet its obligation to provide the same level of privacy protection as required under the Privacy Shield, (e) upon such notice, ACORD must take commercially reasonable steps to stop and remediate unauthorized processing of Shield Information, and (f) upon the request of the U.S. Department of Commerce (or its designee), ACORD must provide a summary or representative copy of the relevant privacy provisions of its agreements with such third party. In cases of onward transfers to third parties of Shield Information, ACORD is potentially liable for the failure of such third party to comply with the Privacy Shield.
ACORD may also at any time, in its sole discretion, disclose and use any Collected Information (including, but not limited to, a computer’s Internet protocol addresses), whether or not you furnished such Collected Information for a specific purpose, to (a) comply with, or as permitted by, any applicable law or government request, (b) cooperate with law enforcement, and other third parties, in investigating a claim of fraud, illegal activity or infringement of intellectual property rights, (c) protect the rights, property or legitimate business interests of ACORD or a third party, or (d) transfer such Collected Information to a third party purchasing all, or substantially all, of ACORD’s assets. If Collected Information is so transferred, ACORD will have no responsibility for any action of the third party to whom or which such Collected Information is transferred.
12) Third-Party Sites
The Site and any Software may contain links to, or be accessible from, websites provided by third parties (individually a “Third-Party Site”). Your use of a Third-Party Site will be subject to its terms of use and other provisions, and you are responsible for complying with such terms and other provisions. This policy does not cover the privacy policies or practices of any Third-Party Site, and ACORD is not responsible for any information you submit to, or otherwise collected by, any Third-Party Site. ACORD is only responsible for Collected Information obtained by it (a) through your authorized use of the Site or any Software, or (b) from other sources in the ordinary course of its business. You should consult each Third-Party Site for its privacy policy or practice before submitting any information to, or otherwise using, such Third-Party Site.
13) Access
ACORD does not warrant or represent that any Collected Information will be accurate or error-free. However, upon your request, ACORD will grant you access to your Shield Information in the possession, or under the control, of ACORD solely for the purpose of your correcting or deleting such Shield Information that is inaccurate or has been processed in violation of the Privacy Shield, except where the burden or expense of providing such access would be disproportionate to the risks to your privacy or where the rights of a third party would be violated. If you desire access to any Shield Information, you must contact ACORD in writing as set forth in Section 22.
14) Children
The Site is not intended for children under 13 years of age. However, if a parent or guardian of a child who is under 13 years of age discovers that the child’s personal information has been submitted to ACORD through the Site without the parent’s or guardian's consent, ACORD will use commercially reasonable efforts to remove such information from the Site and ACORD’s servers at the parent’s or guardian's request. To request the removal of personal information of a child under 13 years of age, the parent or guardian must contact ACORD as set forth in Section 22, and provide all information requested by ACORD to assist it in identifying the information to be removed.
15) Applicable Law
This policy shall be governed by, and construed and interpreted in accordance with, (a) the laws of the state of New York, without regard to its principles of conflict of laws, and in the case of Shield Information, (b) the Privacy Shield. If there is any conflict or inconsistency between any provision of this policy and any provision of any applicable law or the Privacy Shield, the latter shall control.
16) Complaints
Except as provided in Section 17, regarding Shield Information, any complaint by you regarding any Collected Information, or otherwise relating to this policy, must first be submitted to ACORD as set forth in Section 22, and ACORD must be given a reasonable opportunity of not less than 30 days to investigate and respond to your complaint. Upon ACORD's completing such investigation and so responding, ACORD and you must then attempt, in good faith, to promptly resolve any remaining aspects of your complaint. In addition to the rights you may have under Section 17, regarding Shield Information, if any aspect of your complaint remains unresolved after an additional reasonable period of time of not less than 30 days, (a) you may commence litigation against ACORD in connection with the unresolved portion of your complaint only in a court located in Westchester County, New York, and having subject matter jurisdiction over your complaint, and (b) you consent to any such court’s being, and waive any objection (including, but not limited to, any such objection based on inconvenience) to such court’s not being, a proper venue for your complaint.
17) Independent Recourse Mechanism
If you have a complaint that relates to any Shield Information, ACORD offers an independent recourse mechanism to resolve your complaint that you may use in lieu of the process described in Section 16. The independent recourse mechanism offered by ACORD is more fully described at http://privacyshield.gov. In order to access the independent recourse mechanism, you must file a complaint with the International Centre for Dispute Resolution of the American Arbitration Association (“ICDR”), and after receiving your complaint, ICDR will resolve the dispute between you and ACORD by following the ICDR Dispute Resolution Procedures located at http://go.adr.org/privacyshield.html. All fees of ICDR in connection with your use of its independent recourse mechanism described in this Section will be paid by ACORD.
If all other options available to you for resolving a complaint are unsuccessful, and upon satisfaction of certain other conditions, you can lodge your complaint with the Privacy Shield Panel, which is an “arbitration mechanism” of three neutral arbitrators. Any decision of the Privacy Shield Panel is binding and enforceable in courts of the United States.
With respect to human resources data that is Shield Information and that is used in the context of the employment relationship, ACORD will, as applicable, (a) cooperate with, and comply with the advice given by, the E.U. data protection authorities, and (b) cooperate with, and comply with the advice given by, the Swiss Federal Data Protection and Information Commissioner.
18) Entire Agreement
Except as set forth in this Section, this policy contains the entire agreement, and supersedes all prior oral and written agreements, proposals and understandings, between you and ACORD, with respect to Collected Information. If you use the Site or any Software, or otherwise have business dealings with ACORD, such use or dealings will be subject to this policy, plus any other written agreement between the parties that is applicable thereto (including, but not limited, any applicable terms of use and license agreements). To the extent there is any conflict or inconsistency between any provision of this policy and any provision of such other agreement, the former shall control.
19) Severability
Whenever possible, each provision of this policy shall be interpreted to be effective and valid under applicable law. If, however, any such provision shall be prohibited by or invalid under such law, it shall be deemed modified to conform to the minimum requirements of such law, or if for any reason it is not so modified, it shall be prohibited or invalid only to the extent of such prohibition or invalidity without the remainder of such provision, or any other provision of this policy, being prohibited or invalid.
20) Revisions
ACORD may revise any provision of this policy from time to time by posting the revised provision on the Site so long as such revision does not conflict with the Privacy Shield. Any such revision will take effect immediately upon such posting, and will apply to all Collected Information obtained by ACORD after such posting. It is your responsibility to periodically check this policy on the Site for revisions to this policy.
21) Expenses
Except as provided in this policy or in the Privacy Shield or other applicable law, you are solely responsible for all fees and disbursements of any attorney or other advisor retained by you in connection with your enforcing your rights under this policy.
22) Additional Information
If you have any questions or complaints, or desire additional information, regarding ACORD’s handling of any Collected Information or otherwise relating to this policy, please promptly contact:
ACORD Corporation
Attn: General Counsel
1 Blue Hill Plaza, 15th Floor
Pearl River, New York 10965
United States of America
legalwork@acord.org
Effective Date: June 27, 2018