The California Consumer Privacy Act is a state statute intended to enhance privacy rights and consumer protection for residents of California, United States. Due to the nature of Reach and Reach’s clients, the CCPA is not relevant or applicable to Reach. For more information on Reach’s handling of personal data, please see our Note on Data Privacy and our Privacy Policy. The detailed breakdown of this CCPA analysis is described below as it pertains to the various types of data you’ll work with and encounter when using Reach:
Campaign Data
The CCPA does not apply because neither the customer nor Reach qualifies as a “business.”
A “business” is “a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders” (and meets several other criteria). Reach’s customers are not organized or operated for the profit or financial benefit of their shareholders and therefore do not qualify as a “business.”
A “business” is also the entity that determines the purposes and means of processing consumers’ personal information. For several reasons, the customer, and not Reach, assumes this role: (1) the customer owns all Campaign Data, defined as any data or information uploaded to or input in the software; (2) Reach may only process Campaign Data if “strictly necessary” to perform the services under the agreement; and (3) any use for Reach’s own internal purposes is limited to aggregate data only (which does not qualify as “personal information”). As a result, in this role, Reach does not qualify as a “business.”
Other Data Provided by Customers
Pursuant to the License Agreement, if this data is uploaded to the software by the customer, it is Campaign Data subject to the analysis above. Additionally, to the extent the data is “publicly available” – i.e., “lawfully made available from federal, state, or local government records” – it does not qualify as “personal information” subject to the CCPA.
Direct Collection of Data
This conduct falls within the CCPA if Reach qualifies as a “business.” Because of Reach’s size and the limited and non-commercial uses of personal information by Reach, it does not qualify as a “business” here.
