Align Technology, Inc. – CCPA Privacy Statement

Last Updated: August 27, 2020

This California Consumer Privacy Act (“CCPA”) privacy notice (this “CCPA Notice”) is included in our Privacy Policy and applies to Align Technology, Inc. and its affiliates ( ‘we’ or "Align") processing of ‘personal information,’ as defined in the CCPA, of California residents (collectively, “Consumers,” “you,” or “your”). Any capitalized terms or other terms not defined herein shall have the meaning ascribed to them in the Privacy Policy or, if not defined herein or in the Privacy Policy, the CCPA. To the extent of any conflict between this CCPA Notice and the rest of our Privacy Policy, this CCPA Notice shall control only with respect to Consumers and their personal information. If you are located elsewhere, please see our Privacy Policy [here].

You may find a copy of this Privacy Policy in PDF format [here]. For individuals with disabilities, alternative methods of viewing or receiving this privacy policy, please contact Privacy@aligntech.com.

General

This CCPA Notice provides further detail regarding (a) how we have processed Consumers’ personal information within the past twelve (12) months and (b) your rights under the CCPA.

Personal Information We May Collect, Use, and Share

We collect and disclose the following personal information for our business purposes. Business purposes may include:

Detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activity, and prosecuting those responsible for that activity;
Short-term, transient use, such as contextual customization of ads;
Improving, upgrading or enhancing our Services;
Debugging to identify and repair errors with our Services; and
Auditing relating to interactions, transactions and other compliance activities.

For more information regarding the purposes for which we use personal information that we’ve collected (and the categories of entities we share with for such purposes), please see [here].

Categories of Personal Information	Examples	Source of Personal Information	Category of Third Parties Information is Disclosed to for a Business Purpose (if any)
Identifiers	Name Alias Postal address Online identifier Internet Protocol address E-mail address Phone number Account name Driver’s license number, passport number or other similar identifiers (for identity-verification purposes) Health Insurance Information Unique personal identifier (i.e. – persistent identifier such as device identifier, cookies, beacons, pixel tags, mobile ad identifiers or similar technology; customer number, unique pseudonym or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers)	Websites, Mobile Applications, Member Registration, On-line Forms, Transactions, or Services (information collected directly from user) Other Sources (Healthcare Providers, Social Media, Public Databases, or Other Third Parties)	Advertising networks Internet service providers Data analytics providers Government entities Operating systems and platforms Social networks Consumer data resellers Service providers
Legally Protected Characteristics	Gender (via photographs you may submit to Align) National origin (via photographs you may submit to Align)	Websites, Mobile Applications, Member Registration, On-line Forms, Transactions, or Services (information collected directly from user) Other Sources (Healthcare Providers, Social Media, Public Databases, or Other Third Parties)
Commercial Purchasing Information	Products or services purchased, obtained, or considered Other purchasing or consuming histories or tendencies	Websites, Mobile Applications, Member Registration, On-line Forms, Transactions, or Services (information collected directly from user) Other Sources (Healthcare Providers, Social Media, Public Databases, or Other Third Parties)	Advertising networks Data analytics providers Social networks Service providers
Biometric Information	Biological characteristics (via photographs you may submit to Align)	Websites, Mobile Applications, Member Registration, On-line Forms, Transactions, or Services (information collected directly from user) Other Sources (Healthcare Providers, Social Media, Public Databases, or Other Third Parties)
Internet or Network Activity	Browsing history Search history Interaction with an internet website, application, or advertisement	Websites, Mobile Applications, Member Registration, On-line Forms, Transactions, or Services (information collected directly from user) Other Sources (Healthcare Providers, Social Media, Public Databases, or Other Third Parties)	Advertising networks Data analytics providers Social networks Service providers
Geolocation	Physical location of personal or mobile device	Websites, Mobile Applications, Member Registration, On-line Forms, Transactions, or Services (information collected directly from user) Other Sources (Healthcare Providers, Social Media, Public Databases, or Other Third Parties)	Advertising networks Data analytics providers Social networks Service providers
Inferences drawn from any of these personal information categories	Preferences Characteristics Predispositions Behavior Attitudes	Websites, Mobile Applications, Member Registration, On-line Forms, Transactions, or Services (information collected directly from user) Other Sources (Healthcare Providers, Social Media, Public Databases, or Other Third Parties)	Advertising networks Data analytics providers Social networks Service providers
Financial Information (information described in CA Code §1798.80)	Bank account number Credit card number Debit card number Other financial information Credit Score	Websites, Mobile Applications, Member Registration, On-line Forms, Transactions, or Services (information collected directly from user) Other Sources (Healthcare Providers, Social Media, Public Databases, or Other Third Parties)	Loan Servicing Agencies, with your permission

“Sales” of Personal Information under the CCPA

California residents have the right to opt out of the “sale” of their personal information. Under the CCPA, “sale” is defined broadly and includes the transfer of personal information by a business to a third party for valuable consideration (even if there is no exchange of money).

We may “sell” personal information. The categories of personal information we have “sold” and the categories of third parties we have “sold” personal information to in the preceding twelve months are listed below:

Category of Personal Information Sold by Align	Category of Third Parties Personal Information is Sold
Identifiers A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number or other similar identifiers.	Advertising networks Internet service providers Data analytics providers Government entities Operating systems and platforms Social networks Consumer data resellers Service providers
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Personal Information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records. Note: Some personal information included in this category may overlap with other categories.	Advertising networks Data analytics providers Social networks Service providers
Protected classification characteristics under California or federal law Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition,	Advertising networks Data analytics providers Social networks Service providers
physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).
Commercial information Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	Advertising networks Data analytics providers Social networks Service providers
Biometric information Physiological, biological, or behavioral, characteristics (including DNA) that can be used to establish individual identity, or imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template such as a faceprint, a minutiae template, or a voiceprint, can be extracted and keystroke patterns or rhythms, gait patterns, or rhythms, and sleep, health or exercise data that contain identifying information.	X (we capture in the smile view – but do NOT advertise based on this information)
Internet or other electronic network activity Browsing history, search history, information on a consumer's interaction with an internet website, application, or advertisement.	Advertising networks Data analytics providers Social networks Service providers
Geolocation data Physical location or movements.	Advertising networks Data analytics providers Social networks Service providers
Sensory data Audio, electronic, visual, thermal, olfactory, or similar information.	X
Professional or employment-related information Current or past job history or performance evaluations.	Advertising networks Data analytics providers Social networks Service providers
Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g, 34 C.F.R. Part 99)) Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	X
Inferences drawn from other personal information to create a profile about a consumer Profile reflecting a consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	Advertising networks Data analytics providers Social networks Service providers

Align’s business and commercial purposes for “selling” personal information can be found in the Section “Personal Information We May Collect, Use and Share” above. Align does not have actual knowledge of any “sale” of personal information of minors under 16 years of age.

Opt-out of “Sales.” California residents may opt-out of the “sale” of their personal information by [here] or emailing privacy@aligntech.com.

Additional Privacy Rights for California Residents

Non-Discrimination. California residents have the right not to receive discriminatory treatment by us for the exercise of their rights conferred by the CCPA.

Accessibility. This Privacy Policy uses industry-standard technologies and was developed in line with the World Wide Web Consortium’s Web Content Accessibility Guidelines, version 2.1. If you wish to print this policy, please do so from your web browser or by saving the page as a PDF.

Your CCPA Rights

Access

You may request that Align disclose certain information regarding our use of your personal information over the past twelve (12) months. You may only make such requests twice per twelve (12) months.

Upon verifying your request (see below), we will disclose to you:

The categories of personal information we collected about you.
The categories of sources for the personal information we collected about you.
The specific pieces of personal information we collected about you.
Our business purpose for collecting that personal information.
The categories of third parties with whom we share personal information.

Deletion

You have the right to request that Align delete any of the personal information collected from you and retained by us, subject to certain exceptions. Once your request is verified (see below) and we have determined that we are required to delete that information in accordance with applicable law, we will delete and direct our service providers to delete your personal information from our records. Your request to delete your personal information may be denied if it is necessary for us to retain your information under one or more of the exceptions listed in the CCPA. Please note that a record of your deletion request may be kept pursuant to our legal obligations.

California Shine the Light

The California “Shine the Light” law permits users who are California residents to request and obtain from us once a year, free of charge, a list of the third parties to whom we have disclosed their personal information (if any) for their direct marketing purposes in the prior calendar year, as well as the type of personal information disclosed to those parties.

Exercising Your Rights

To exercise any of the rights described above, please submit a request to us by: Emailing us at Privacy@aligntech.com

Please note that Consumers have a right to not receive discriminatory treatment for the exercise of their rights under the CCPA.

Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. You may only make a verifiable consumer request for access twice within a 12-month period. Your verifiable consumer request must:

Provide sufficient information to allow us to reasonably verify that you are the person about whom we collected personal information, or a person authorized to act on your behalf; and
Describe your request with sufficient detail to properly understand and respond to it.

We will only use the personal information that you have provided in a verifiable consumer request in order to verify your request. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority.

Making a verifiable consumer request does not require you to create an account with us. We consider a request made through your password-protected account sufficiently verified when the request relates to personal information associated with that specific account.

Verifying Your Request

Only you, or a person that you authorize to act on your behalf, may make a request related to your personal information. You may also make a request on behalf of your minor child. In all cases, your request must be verified before we take action (and shall take such action pursuant to the timing permitted under the CCPA). Verifying your request may require you to:

Provide sufficient information to allow us to reasonably verify that you are the person about whom we collected personal information, or a person authorized to act on your behalf; and
Describe your request with sufficient detail to properly understand and respond to it.

We will only use the personal information that you have provided in a verifiable request in order to verify your request. As stated above, we cannot respond to your request or provide you with personal information if we cannot verify your identity or authority.

Making a verifiable request does not require you to create an account with us. We consider a request made through your password-protected account sufficiently “verified” when the request relates to personal information associated with that specific account and you have complied with any of our existing authentication practices.

Response Timing and Format

We aim to respond to customer requests within forty-five (45) days of receipt. If we are unable to deliver a response to verifiable consumer requests within this timeframe, we will inform you of the reason and estimated extension period in writing. We will deliver a response to your existing account with us, if applicable, or a written response by mail or electronically, at your option.

Any disclosures will cover only the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. Data portability requests will be issued in a format that is readily useable, we do not charge a fee unless your request is excessive, repetitive, or manifestly unfounded. If the request warrants a reasonable fee, we will tell you why and provide you with a cost estimate before completing your request.

Fees

Please note that we may charge a reasonable fee or refuse to act on a request if such request is excessive, repetitive, or manifestly unfounded.

Changes to this Privacy Statement

If, in the future, we intend to process your personal information for a purpose other than that which it was collected, we will provide you with information on that purpose and any other relevant information at a reasonable time prior to such processing. After such time, the relevant information relating to such processing activity will be revised or added appropriately (either within this Privacy Policy or elsewhere), and the “Effective Date” at the top of this page will be updated accordingly.

Further information

If you have any queries, questions, concerns or require any further information in relation to the Privacy Statement or you wish to exercise any of your rights, please do not hesitate to contact Align at

Privacy@aligntech.com

Align Technology, Inc.

Attn: Privacy Office

2820 Orchard Parkway

San Jose, CA 95134

1-888-822-5446