California Consumer Protection Act (CCPA) Compliance

CivicPlus®’s Compliance with the CCPA 

CivicPlus values its partnerships with those customers located in California and is committed to complying with the California Consumer Protection Act (CCPA). As such, CivicPlus does not sell any customer or end-user data.

Compliance with Individual Data Requests 

CivicPlus has established processes to respond to all CCPA requests from our customers. Please note, however, that since our customers, and not CivicPlus, are the Data Owners per the terms of the CCPA, we cannot respond directly to requests from our customers’ Data Subjects (resident end-users).

Your Municipality’s Role in Responding to Data Subject Requests

To accommodate Data Subject requests in compliance with CCPA, we will direct all incoming Data Subject requests to the appropriate municipal representative. In these instances, the municipal Data Owner is responsible for determining whether or not to respond to a Data Subject’s CCPA-related request. As part of this determination process, we highly recommend that you discuss the following scenarios with your legal counsel:

• As a public entity, is your municipality required to comply with the request?
• Are there any applicable state or local laws that preempt or limit your ability to comply?
• Have you validated the identity of the requesting Data Subject?

How CivicPlus Will Support CCPA Data Requests

If a Data Owner elects to respond to a Data Subject request, CivicPlus will:

• Provide the Data Owner with all the data CivicPlus maintains on the Data Subject
• Delete all the data CivicPlus maintains on the Data Subject upon request
• Correct all the data CivicPlus maintains on the Data Subject upon request

To request one of the aforementioned actions, please email your request to the CivicPlus Privacy Team. You will receive an instructive response from the CivicPlus Privacy Team to which we ask that you reply within ten days with the following information:

• The product suite(s) of interest to the matter
• Your specific data request, including:
  
  • The data subject’s name and email address
• Confirmation that you have verified the data subject’s identity
• If there are any affiliated entities whose data we should search (for instance, if you represent a county with a Parks and Recreation department whose data we should review, please explicitly state each affiliated entity)
• The specific action to be taken with the data:
  
  • Access and provide comprehensive data related to the Data Subject
  • Delete all data related to the Data Subject
  • Correct any data related to the Data Subject

In most instances, CivicPlus will complete your CCPA-related request in 45 days. We will need up to 90 days to complete:

• Any compounded requests (for example: a request to access data and a secondary request to delete the identified data)
• Any request related to Mass Notification (formerly CivicReady) or Process Automation and Digital Services (formerly CivicOptimize), as we must work with third-party service providers and partners to complete the request.

If you and your municipal administration elect to comply with CCPA requests, please know that you will also be responsible for submitting requests to all third-party service providers whose software integrates with your CivicPlus solution and within which the Data Subject’s information may reside. If you have questions as to whether third-party software integrates with your solution, please contact your CivicPlus customer Success Manager.

For more information, please refer to CivicPlus’ Privacy Policy.