OBRC Customer
Data Privacy Policy

Your Rights and Choices
The Oregon Consumer Privacy Act (“OCPA”) provides consumers residing in Oregon (“Oregon Consumers” or “you”) with specific rights regarding their personal data. This Customer Data Privacy Notice (“Notice”) applies solely to Oregon Consumers residing in Oregon who wish to enter into agreements concerning products and services provided by Oregon Beverage Recycling Cooperative (operator of the BottleDrop Network).  In addition, all Oregon Beverage Recycling Cooperative (OBRC) websites are not generally intended for children under the age of 13. Verifiable parental consent may be required if OBRC has notice that a user may under the age of 13. If you have reason to believe that we have collected Personal Data directly from someone under 13 years of age, please contact OBRC at the contact information listed below.

This Notice describes the practices of the Oregon Beverage Recycling Cooperative (“OBRC”) regarding the collection, use, disclosure, and retention of personal data we will collect from you and other Oregon Consumers. This Notice also explains your rights regarding your personal data and how you can exercise those rights.

Scope of This Notice
In order to provide you with the services you requested (for example opening a BottleDrop account), we collect personal data that is necessary to verify your identity so we can set up your BottleDrop account and so we can communicate with you about your account on an ongoing basis. We do not sell the personal data of any covered Oregon Consumers. In this Notice, personal data has the meaning described below and excludes certain information subject to other laws.

Under the OCPA, and for the unique consumer rights described below, Personal Data does not include:

• Publicly available data, such as data from government records, widely-distributed media, or data we reasonably believe you made available to the general public or have not restricted to a specific audience;
• Deidentified personal data we maintain in deidentified form and do not attempt to reidentify except as required or permitted by law;
• Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”); and
• Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (“FCRA”), the Gramm- Leach-Bliley Act (“GLBA”), and the Driver’s Privacy Protection Act of 1994.

Personal data is defined for purposes of this Notice and the OCPA as data, derived data or any unique identifier that is linked to or is reasonably linkable to you or your device that identifies, is linked to or is reasonably linkable to you or other Oregon Consumers in your household. Personal data includes, for example, personal information that you voluntarily provide, such as information you provide in response to questions on a BottleDrop account application form or information you provide when you reach out to our customer service team.

Personal Data We Process
We process limited categories of personal data concerning Oregon Consumers. These categories may include:

Identifiers. This may include a real name, alias, postal address, Internet Protocol (IP) address, email address, account name, telephone numbers, or other similar identifiers of Oregon consumers who open and maintain a BottleDrop account.

Audio, electronic, visual, or similar information. This may include audio, electronic, visual, or similar information.

Account Activity. This may include records of account card scans, login activity, account balance, redemption activity, kiosk activity, account withdrawal activity.

Business Purposes for Processing Personal Data

Provision and Improvement Of Products And Services. We use personal data to verify identity, to fulfill or meet the reason you provided the information (to purchase a product (such as BottleDrop bags) or service (such as opening and maintaining a BottleDrop Account). For example, if you share your name and contact information to ask a question about our products or services, we will use that Personal Data to respond to your inquiry.

Security And Fraud Detection. We use personal data for our security and fraud detection services including: detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity both online and at all facilities affiliated with the BottleDrop program (including, but not limited to protecting any person’s health and safety); and prosecuting those responsible for that activity.

Debugging. We may use personal data to engage in debugging to identify and repair errors that impair existing intended functionality with our customer-facing webpages and mobile application.

Internal Research. We use personal data for our internal research related to technological development and demonstration.

Advertising And Marketing Services. Generally speaking, we collect, use, and/or disclose personal data only for the following business purpose:

• Marketing To You.  For example, this may include determining what products and services you opted in for at the time of creating your BottleDrop account, such as marketing emails about the BottleDrop Plus program (See discussion below.)

Legal Obligations. We use personal data to comply with applicable laws, rules, or regulations in operating our business and to respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.

Audits. We use personal data to audit our staff interactions with you and related transactions (e.g., verifying transaction history and internal auditing).

Third Parties to Whom We May Disclose Your Personal Data For a Business or Commercial Purpose

We may disclose your personal data to the following categories of third parties:

Identity Verification Providers. As part of  setting up a BottleDrop account, we share the name, email address, postal address, and phone number you entered on the BottleDrop account application form with Lexis Nexis for the purpose of verifying your identity and creating the BottleDrop account. If the individual completes the BottleDrop account application on a personal device (not at a BottleDrop kiosk), we also collect the IP address and device information for the purpose of verifying your identity and creating the BottleDrop account.

Digital Marketing Providers. This category applies only for BottleDrop account holders who “opted in” to receive marketing emails from BottleDrop and its affiliates and is limited to the Northwest Grocery Retailers Association (“NWGRA”) that facilitates the delivery of online advertisements, promotions and offers related to the BottleDrop Plus program. OBRC shares consumer data with NWGRA as part of the BottleDrop Plus program (participants with accounts can receive store credit at 120% of the redemption at participating grocery stores).  If a consumer or authorized agent opts out of OBRC’s processing of the consumer’s personal data and the decision conflicts with a consumer’s voluntary participation a bona fide reward, club card or loyalty program or a program that provides premium features or discounts in return for the consumer’s consent to OBRC’s processing of the consumer’s personal data, OBRC may either comply with the request to opt out or notify the consumer of the conflict and ask the consumer to affirm that the consumer intends to withdraw from the bona fide reward, club card or loyalty program or the program that provides premium features or discounts. If the consumer affirms that the consumer intends to withdraw, OBRC shall comply with the request to opt out.

Your Rights under the OCPA

If you are an Oregon resident, you may exercise certain privacy rights related to the Personal Data we collect about you. You may exercise these rights free of charge, except as otherwise permitted under applicable law.

1. Right to Confirm Processing of Personal DataYou have the right to request that: (1) we confirm whether we are actually processing your Personal Data; (2) we inform you of the categories of Personal Data we are processing or have processed; and (3) we provide the list of specific third parties to which we have disclosed your Personal Data. You have the right to submit such a request, free of charge, up to once annually, except as otherwise permitted under applicable law.

2. Right to Obtain Copy of Personal DataYou have the right to obtain a copy of your Personal Data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the Personal Data to another business without hindrance. You have the right to submit such a request, free of charge, once annually, except as otherwise permitted under applicable law.

3. Right to Deletion of Personal DataYou have the right to request that we delete your Personal Data, subject to certain limited exceptions. For example, we may deny your request to delete Personal Data that we are required to maintain to fulfill a legal obligation.

4. Right to Correct Inaccurate Personal DataYou have the right to request that we correct inaccurate Personal Data that we maintain about you.

5. Right to Non-DiscriminationWe will not discriminate or retaliate against you for exercising your consumer rights under the OCPA, including by (a) denying you goods or services; (b) charging (or suggesting that we will charge) different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; or (c) providing you a different level or quality of goods or services (or suggesting that we will do so). We may, however, offer a different price, rate, level, or quality of goods or services if the offering is in connection with your voluntary participation in a loyalty, rewards, premium features, discounts or club card program. We do not currently provide financial incentives.

6. Right to AppealIf we deny your request to access, delete, or correct, you have the right to appeal such decision by submitting your request to appeal by contacting us as set forth below. Within forty-five (45) days of our receipt of your appeal request, we will inform you of any action taken or not taken in response to the appeal, including an explanation of the reasons for the decisions.If your appeal is denied, you have the right to submit a complaint to the Oregon Attorney General. To file a complaint with the Oregon Attorney General, please visit: https://www.doj.state.or.us/consumer-protection/id-theft-data-breaches/privacy/.

Exceptions
We may deny your request if retaining the personal data is reasonably necessary for us (or our processors) to:

• Complete the transaction for which we collected the personal data, provide a good or service that you requested, take actions reasonably anticipated by you within the context of our ongoing business relationship with you, or otherwise perform our contract with you;
• Help ensure security and integrity of our systems;
• Preventing, detecting, protecting against, or responding to, and investigating, reporting or prosecuting persons responsible for, security incidents, malicious, deceptive, fraudulent, or illegal activity;
• Debug systems to identify and repair errors that impair existing or intended functionality;
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when deleting the personal data may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent;
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;
• Comply with a legal obligation; and
• Make other internal and lawful uses of the personal data that are compatible with the purposes for which we collected and processed it and are and disclosed in this Notice.

Other legal limitations and exceptions may also apply.

Exercising Your Rights

How to Submit a Request to Exercise Your Rights
To exercise any of the rights described above, you may submit a request either by clicking HERE or mailing the request to:

Oregon Beverage Recycling Cooperative
ATTN: Oregon Consumer Protection Act Inquiry
17300 SE 120th Ave.
Clackamas, OR 97015

Exercising Your Rights to Confirm and Access, Delete, Correct, and Opt-Out
Only you or your authorized agent may make an authenticated consumer request to confirm and access, delete, correct, or opt-out your personal data. If you use an authorized agent to submit an authenticated consumer request on your behalf, you will be required to provide additional information as described below.

In order to authenticate your identity to process your request, we will request your full name, street address, city, zip code, phone number, and email address. For us to treat your request as an authenticated consumer request, you must:

• Provide sufficient information, commensurate to the type or sensitivity of the information you are requesting, that allows us to reasonably authenticate that you are the person about whom we collected personal data or an authorized representative; and
• Describe your request in sufficient detail that allows us to properly understand, evaluate, and respond to your request.

We cannot respond to your request or provide you with personal data if we are unable to: (a) authenticate your identity or authority to make the request, (b) confirm the personal data we have in our systems relates to you, or (c) locate your data in our systems. If the information you provided us does not match our records, in certain circumstances we may request additional information from you. If the information you provided us does match our records, your request is authenticated (an “authenticated consumer request”).

In certain circumstances, an authorized agent may submit a rights request for you. An authorized agent is a natural person or business entity you have given permission to submit a request on your behalf. An authorized agent must submit a request using the form link provided above. We must be able to authenticate whether the authorized agent has the authority to act on your behalf. In order to authenticate the authorized agent’s authority, we generally require evidence of either (i) a valid power of attorney; or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a statement by you authorizing the authorized agent to submit an authenticated consumer request on your behalf.   Depending on the evidence provided, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to authenticate your identity in connection with the request.

Response Timing and Format
We endeavor to respond to an authenticated consumer request to confirm and access, to delete, correct, or opt-out within forty-five (45) days of its receipt. If we require more time (up to 45 additional days), we will inform you of the reason and extension period in writing. We will deliver our written response by mail or electronically, at your option. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

We do not charge a fee to process or respond to your authenticated consumer request unless you have already made a request within the preceding twelve (12) months. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Changes to Our Privacy Notice
We reserve the right to amend this Notice at our discretion and at any time. When we make changes to this Notice, we will post the updated Notice on the website and update the Notice’s effective date. Your continued use of our services following the posting of changes constitutes your acceptance of such changes.

The effective date of the rights for Oregon residents described in this Notice is listed at the top of this Notice. Changes to the Notice will not affect our use of previously provided personal data.

Contact Information
If you have any questions about this Notice, the ways in which we may collect and use your personal information described in this Notice, and your choices and rights regarding such use, you may contact us at the contact information listed below.

Data Request Form: https://bottledrop.com/datarequest

Email: datarequest@obrc.com

Postal Address:
Oregon Beverage Recycling Cooperative
ATTN: Oregon Consumer Protection Act Inquiry
17300 SE 120th Ave.
Clackamas, OR 97015