Last modified 19 January 2021
We at Cartus (collectively, “Cartus”, “we”, “us”, or “our”) recognize the importance of protecting the privacy of personal information (as defined below in Section 1) collected by us. This Privacy Notice describes how Cartus collects, uses, discloses, retains, and transfers Personal Information in performing relocation and other services (the "Services"). It also describes your choices regarding use, access and correction of your Personal Information. Personal Information may be requested/collected to enable the delivery of our services, to operate our business and to make the experience of using our websites faster and more effective.
OVERVIEW OF OUR COLLECTION AND USE OF PERSONAL INFORMATION
We think transparency is important. In this overview, we summarize the Personal Information we collect and how we use it, which is further explained in our Privacy Notice below. Keep in mind that the actual Personal Information we collect and how we use it varies depending upon the nature of our relationship and interactions with you. Also, in some cases (such as where required by law), we ask for your consent or give you certain choices prior to collecting or using certain Personal Information.
Categories of Personal Information Collected. Generally, we collect the following types of Personal Information:
- Identifiers: includes direct identifiers such as a real name, alias, address, user ID, username, account number; phone number, unique personal identifier, online identifier, IP address, app ID, email address, account name, social security number, social insurance number, driver's license number, passport number, or other similar identifiers.
- Customer records: includes Personal Information that individuals provide us in order to obtain our products and services, such as name, account name and number, signature, contact information, employment information, social security number, social insurance number, passport number, driver's license and other government identifiers and financial information. For example, this may include information collected when an individual registers for our services.
- Commercial information: includes records of personal property, products or services purchased, obtained, or considered, or other purchasing or use histories or tendencies.
- Usage Data: includes browsing history, clickstream data, search history, and information regarding an individual's interaction with an internet website, application, or advertisement.
- Geolocation data: includes precise location information about a particular individual or device.
- Audio, video and other electronic data: includes audio, electronic, visual or similar information such as thermal screenings and CCTV footage (e.g., collected from visitors to our offices), photographs, and call recordings (e.g., of customer support calls).
- Professional Information: includes professional or employment-related information.
- Education information: educational history and records.
- Inferences: inferences drawn from and of the above. Personal Information used to create a profile reflecting an individual's preferences, behavior, or other characteristics.
1. SCOPE OF OUR PRIVACY NOTICE
This Notice applies to our collection, use, disclosure, and other processing of Personal Information related to:
- the use of our Services that display or link to this Notice;
- former, current, and prospective clients and customers; and
- other individuals who use our Services, whose Personal Information we receive related to the Services, or who otherwise interact or communicate with us related to our Services
Our collection, use, disclosure, and processing of Personal Information about individuals will vary depending upon the circumstances. This Privacy Notice is intended to describe our overall privacy and data protection practices. In some cases, different or additional notices about our data collection and processing practices may be provided and apply to our processing of certain Personal Information.
Personal Information. In this Privacy Notice, our use of the term "Personal Information" includes other similar terms under applicable privacy laws—such as "personal data" and "personally identifiable information." In general, Personal Information includes any information that identifies, relates to, describes, or is reasonably capable of being associated, linked, or linkable with a particular individual.
Not covered by this Notice. This Privacy Notice does not apply to job applicants and candidates who apply for employment with us, or to our employees and non-employee workers.
2. OUR COLLECTION OF PERSONAL INFORMATION
Generally, we collect your Personal Information on a voluntary basis. However, if you decline to provide certain Personal Information that is marked mandatory, you may not be able to access certain Services or we may be unable to fully respond to your inquiry.
We may collect Personal Information directly from individuals, automatically related to the use of the Services, and in some cases, from third parties (such as a relocating employee’s employer and operators of certain third party services that we use).
Information we collect directly. We collect information that you provide to us, such as
- when you create an account, provide contact information, and send other Personal Information to us;
- when you complete or submit a form through our Services, for example, in CartusOnline or via "Contact Us" or "More Information" forms;
- when you participate in surveys, submit orders or requests, or register for or use our Services, or otherwise contact us;
- information you submit or provide such as information related to the purchase or sale of real estate.
Information we collect from third parties. We may collect Personal Information about you from third party sources, such as a relocating employee’s employer and from other third parties. For example, without limitation, if you choose to link, create, or log in to your Services account with a social media service (e.g., Twitter, Facebook, Instagram, etc.), or if you engage with a separate app or website that communicates with the Services, we may receive Personal Information about you or your connections from that service. In many cases you can control what Personal Information you share with us through privacy settings available on those third-party social media services.
3. LEGAL BASES FOR OUR PROCESSING OF PERSONAL INFORMATION
Certain laws, including the EU General Data Protection Regulation ("GDPR"), require that we inform applicable individuals of the legal bases for our use and other processing of Personal Information.
Pursuant to the GDPR (and other relevant laws), we process Personal Information for the following legal bases:
- Performance of contract: as necessary to enter into or carry out the performance of a contract with you.
- Compliance with laws: for compliance with legal obligations and/or defense against legal claims, including those in the area of labor and employment law, social security, and data protection, tax, and corporate compliance laws.
- Our or our clients’ legitimate interests: in furtherance of our or our clients’ legitimate business interests including:
- Performance of contracts, including for relocation services
- Implementation and operation of global support (e.g., IT) services for our business operations
- Customer relationship management and improving our Services, including marketing and analytics
- Fraud prevention, including misuse of company IT systems or money laundering
- Physical, IT, and network perimeter security
- Internal investigations
- Mergers, acquisitions, and reorganization, and other business transactions
- With your consent: where we need and obtain your consent (the GDPR (where it applies)) and other applicable laws give you the right to withdraw your consent, which you can do at any time by contacting us using the details at the end of this Privacy Notice. In some jurisdictions, your use of the Services may be taken as implied consent to the collection and processing of Personal Information as outlined in this Privacy Notice.
In addition, we may process your Personal Information where necessary to protect the vital interests of any individual.
4. USE OF PERSONAL INFORMATION
We process your Personal Information described above as necessary for Cartus to provide relocation services under the terms of its contract with your employer or membership group consistent with the legitimate interests of your employer or membership group (i.e., our corporate or government entity client). If you provide us with sensitive Personal Information, we will process it based on your consent. In general, we collect, use, disclose, retain and transfer Personal Information for the purposes of managing and facilitating your move from one location to a new location (the "Relocation Purpose"), including the following to the extent authorized by your employer or membership group: (a) arranging for your physical move and the storage of your property; (b) tracking and processing expense reimbursements and other benefits, such as lump sum payments; (c) home sales, purchases, and rentals, including financing arrangements; (d) explaining various employer-sponsored benefits; (e) immigration and other customs related purposes; (f) referring you to third parties who provide cultural assistance and/or language training; and (g) other activities relating to the delivery and improvement of relocation services. Any access to your Personal Information is restricted to those individuals that have a need to know to fulfill their job responsibilities. We will not use Personal Information for any other purpose incompatible with the Relocation Purpose outlined in this Privacy Notice, unless it is required or authorized by laws that apply to Cartus or otherwise authorized by you.
In addition to the Relocation Purpose we also use Personal Information for the purposes set forth below. Where GDPR or other relevant laws apply, we have set forth the legal bases for such processing.
- Providing support and services: including, for example, to send or facilitate communications with you, your employer or membership group, to provide the Services, provide products and services you or your employer request (and send related information), operate our Services; to communicate with you about your access to and use of our Services; to respond to your inquiries; to provide troubleshooting, fulfill your requests and provide technical support; and for other customer service and support purposes. (Legal basis: performance of our contract with you or your employer or membership group; and our and our clients’ legitimate interests)
- Analyzing and improving our business: including to better understand how users access and use our Services, to evaluate and improve our Services and business operations, and to develop new features, offerings, and services; to conduct surveys, and other evaluations, such as customer satisfaction surveys; and for other research and analytical purposes. (Legal basis: our legitimate interests)
- Personalizing content and experiences: including to provide or recommend features, content, social connections, and referrals; tailor content we send or display on our Services; to offer location customization and personalized help and instructions; and to otherwise personalize your experiences. (Legal basis: our legitimate interests and/or with your consent)
- Advertising, marketing and promotional purposes: including to evaluate, measure, and improve the effectiveness of our ad campaigns; to send you newsletters, offers, or other information we think may interest you; and to contact you about our Services or information we think may interest you. (Legal basis: our legitimate interests and/or with your consent)
- Securing and protecting our business: including to protect and secure our business operations, assets, Services, network and information and technology resources; to investigate, prevent, detect and take action regarding fraud, unauthorized access, situations involving potential threats to the rights or safety of any person or third party, or other unauthorized activities or misconduct. (Legal basis: our legitimate interests and/or compliance with laws)
- Defending our legal rights: including to manage and respond to actual and potential legal disputes and claims, and to otherwise establish, defend or protect our rights or interests, including in the context of anticipated or actual litigation with third parties. (Legal basis: our legitimate interests and/or compliance with laws)
- Auditing, reporting, corporate governance, and internal operations: including relating to financial, tax and accounting audits; audits and assessments of our operations, privacy, security and financial controls, risk, and compliance with legal obligations; our general business, accounting, record keeping and legal functions; and related to any actual or contemplated merger, acquisition, asset sale or transfer, financing, bankruptcy or restructuring of all or part of our business. (Legal basis: our legitimate interests and/or compliance with laws)
- Complying with legal obligations: including to comply with the law, our legal obligations and legal process, such warrants, subpoenas, court orders, and regulatory or law enforcement requests. (Legal basis: our legitimate interests and/or compliance with laws)
Aggregate and de-identified information. We may de-identify Personal Information and create anonymous and aggregated data sets and reports in order to assess, improve and develop our business, products and services, prepare benchmarking reports on our industry and for other research, marketing and analytics purposes.
5. DISCLOSURE OF PERSONAL INFORMATION
We may disclose the Personal Information that we collect about you as set forth below or as otherwise described at the time of collection or sharing.
- Service providers: We may disclose Personal Information with third-party service providers who use this information to perform services for us, such as hosting providers, auditors, advisors, consultants, and customer service and support providers.
- Subsidiaries and affiliates: We may share your Personal Information with our affiliated companies (i.e., companies under common ownership, control or management with us) - use will be subject to this Privacy Notice.
- Third parties: We may disclose Personal Information to third parties in order to provide our Services, facilitate your requests, or with your acknowledgement and consent, including with:
- independent real estate professionals, moving services providers, immigration and visa service providers to enable them to provide services you request through the Services.
- other third parties to provide you a service you or your employer requested.
- the public if you submit information, such as comments, social media posts, or other features viewable by the public.
- third parties with whom you choose to let us share information, for example other apps or websites that integrate with the Services, or those with Services with which we integrate.
- third parties we work with to provide you with more personalized content, and to track the effectiveness of campaigns and our Services.
- Business transfers: We may disclose or transfer Personal Information as part of any actual or contemplated merger, sale, and transfer of our assets, acquisition, financing or restructuring of all or part of our business, bankruptcy or similar event, including related to due diligence conducted prior to such event where permitted by law.
- Legally required: We may disclose Personal Information if we are required to do so by law (e.g., to law enforcement, courts or others, e.g., in response to a subpoena or court order).
- Protect our rights: We may disclose Personal Information where we believe it necessary to respond to claims asserted against us or, comply with legal process (e.g., subpoenas or warrants), enforce or administer our agreements and terms, for fraud prevention, risk assessment, investigation, and to protect the rights, property, or safety of us, our clients and customers or others.
Anonymized and Aggregated Data. We may share aggregate or de-identified information with third parties for research, marketing, advertising, analytics, and other
6. COOKIES, TRACKING AND ANALYTICS
Our Services may use first party and third-party cookies, pixel tags, plugins, and other tools to gather device, usage and browsing information when users visit our websites. For instance, when you visit our websites, our server may record your IP address (and associated location information) and other information such as the type of your internet browser, your Media Access Control (MAC) address, computer type (Windows or Macintosh), screen resolution, operating system name and version, device manufacturer and model, language, and the pages you view and links you select on the Services, as well as date and time stamps associates with your activities on our Services.
We use the information for security purposes, to facilitate navigation, to personalize and improve your experience while using the Services, to improve and measure our advertising campaigns and to better reach users. We also gather statistical information about use of the Services in order to continually improve their design and functionality, understand how they are used and assist us with resolving questions regarding them.
- Essential cookies are essential, as they enable you to move around the Service and use its features. Without these cookies we could not, for example, authenticate your login or remember that you are logged-in as you move through the Service.
- Functionality cookies allow us to remember choices you make (such as the region you're in) and tailor the Service to provide enhanced features and content for you. For instance, they can be used to remember your login details or remember your nickname when you next login. They may also be used to provide services you've requested, for example leaving a comment on the Service.
- Analytics & performances cookies collect information about how the Service is used, for example which pages users visit most often and if any error messages are displayed on certain pages. Information collected using these cookies is used to monitor activity on the Service and understand how it is being used.
If you have disabled one or more cookies, we may still use information collected from cookies before your disabled preference was set. However, we will stop using the disabled cookie to collect any further information.
To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.aboutcookies.org.
Pixel tags and other similar technologies. Pixel tags (also known as web beacons and clear GIFs) may be used in connection with some Websites to, among other things, track the actions of users of the Websites (including email recipients), measure the success of our marketing campaigns and compile statistics about usage of the Websites and response rates. We and our service providers may also use pixel tags in HTML emails to our customers, to help us track email response rates, identify when our emails are viewed, track whether our emails are forwarded, and conduct analytics.
Log files. Most browsers collect certain information, such as your IP address, device type, screen resolution, operating system version and internet browser type and version. This information is gathered automatically and stored in log files.
Do-Not-Track signals. Please note that our Websites do not recognize or respond to any signal which your browser might transmit through the so-called 'Do Not Track' feature your browser might have. If you wish to disable cookies on our Websites, you should not rely on any 'Do Not Track' feature your browser might have. For more information about do-not-track signals, please review https://allaboutdnt.com/
7. INTEREST BASED ADVERTISING
You can manage how your preferences regarding third party ad company cookies set by reading the cookie discussion above.
Please also see the cookie discussion above for information about the third parties we may work with to display targeted ads on third-party sites and to measure the success of our marketing and campaigns. You may also obtain more information about targeted or "interest-based advertising" and opt-out of many ad networks at the industry websites below:
8. SOCIAL FEATURES AND THIRD PARTY PLUG INS
Some of our Services may integrate with social sharing features and other related tools which let you log in to the Services or share actions you take on the Services. Your use of such features enables the sharing of information with your friends or the public, depending on the settings you establish with the social sharing service. Please refer to the privacy policies of those social sharing services for more information about how they handle the data you provide to or share through them. We do not receive or store passwords to your third-party social media accounts in this context.
9. PRIVACY SHIELD WITHDRAWAL AND INTERNATIONAL TRANSFERS OF PERSONAL INFORMATION
Cartus has withdrawn our certifications under the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework (collectively, “Privacy Shield”), meaning that we no longer participate in Privacy Shield or comply with the Privacy Shield. In accordance with Privacy Shield requirements, with respect to personal data that we previously collected pursuant to Privacy Shield and are retaining, we will continue to apply the Privacy Shield Principles, and annually confirm to the U.S. Department of Commerce our commitment to apply those principles to such data. For more information about Privacy Shield, please visit https://www.privacyshield.gov/.
Our Websites are hosted on servers located in the United States or European Union. Note that some countries may not provide the same level of data protection as your home country. If you are located, for example, in European Economic Area or Switzerland (collectively, "EEA"), your Personal Information will be transferred to the United States and possibly to other jurisdictions (e.g., to your relocation departure and destination location), which may not provide the same level of protection under your local data protection laws. In such cases, we rely on suitable Personal Information transfer safeguards, such as the European Union standard contractual clauses. You may have the right to request a copy or information about those safeguards by contacting us as detailed below.
We use technical, administrative, and physical controls in place to help protect Personal Information from unauthorized access, use, and disclosure. Even so, despite our reasonable efforts, no security measure is ever perfect or impenetrable. In the event that the security of your account has been compromised, please immediately notify us in accordance with Section 15 below.
11. DATA RETENTION
We will retain your Personal Information for the period necessary to fulfill the purposes outlined in this Privacy Notice unless a longer retention period is required or permitted by law. We may retain Personal Information for longer where required by our legal and regulatory obligations, professional indemnity obligations, or where we believe it is necessary to establish, defend or protect our legal rights and interests or those of others. With respect to the data and files we handle as a processor, we retain this information in accordance with applicable law and our clients’ instructions.
Our Websites are not directed to children under the age of 16 (“Children”), and we do not knowingly collect any information, including Personal Information, from Children.
13. THIRD-PARTY WEBSITES
14. CHANGES TO THIS NOTICE
We may amend this Notice at any time. If we make any material change in how we collect, use, disclose, or otherwise process Personal Information, we will prominently post a notice regarding such change on our Websites or by other means we deem appropriate. Any material changes to this Notice will be effective 10 days after our posting of the updated Notice or as otherwise required by applicable law. Where required to do so by law, we may seek your prior consent to any material changes we make to this Notice.
15. CONTACTING US/CORRECTION/UPDATING PERSONAL INFORMATION/EXERCISING YOUR RIGHTS
You may contact us through the methods stated below for a number of purposes, including: (1) if you no longer wish to use the site; (2) to opt-out of communications or unsubscribe from any industry updates; (3) to receive information or special offers; (4) to provide feedback and comments on this Privacy Notice; (5) to request access to your Personal Information, deletion of your incorrect Personal Information or correction of your Personal Information; and (6) to make inquiries whether we hold or process on behalf of a third party, any of your Personal Information or complaints/objections regarding our Privacy Notice and/or privacy practices.
|By e-mail to:||InformationProtection@cartus.com|
Privacy Officer, Cartus, 40 Apple Ridge Road, Danbury, CT 06810
Or if your relocation is being handled by our UK affiliate:
Director of Legal Services, Cartus Limited, Frankland Road, Blagrove, Swindon, Wiltshire SN5 8RS
|Toll free U.S. phone:||(877) 651-7356|
|By phone (Singapore):||+65 6880 5804|
We will respond to your request within a reasonable timeframe, but in no event later than 45 days, or such lesser period prescribed by applicable law.
ADDITIONAL INFORMATION FOR RESIDENTS OF CERTAIN JURISDICTIONS
15 (a). European Union/European Economic Area/United Kingdom:
If you are a resident of the EU, European Union or United Kingdom you may have the following rights that you should exercise through the contacts listed above or directly through your employer or membership group. Cartus will respond to you or aid your employer when you exercise the following rights:
- The right to require a copy of your personal data;
- The right to require that inaccurate or out of date personal data be corrected;
- The right to request that personal data is erased when it is no longer necessary to be retained;
- If consent it the basis for processing, the right to withdraw your consent;
- The right to data portability, if applicable;
- The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction be placed on further processing;
- The right to object to processing, if applicable; and
- You also have the right to lodge a complaint with your applicable data protection authority.
15 (b). California Residents (Last Updated: 19 January 2021)
In this section we provide information for California residents, as required under California privacy laws, including the California Consumer Privacy Act ("CCPA"), which requires that we provide California residents certain specific information about how we handle their Personal Information, whether collected online or offline. This section does not address or apply to our handling of publicly available information made lawfully available by state or federal governments or other Personal Information that is subject to an exemption under CCPA.
Categories of Personal Information that we collect and disclose. Our collection, use and disclosure of Personal Information about a California resident will vary depending upon the circumstances and nature of our interactions or relationship with such resident. The table below sets out generally the categories of Personal Information (as defined by the CCPA) about California residents that we collect and disclose to others for a business purpose.
|Categories of personal information||May We Disclose this Information?||Categories of Third Parties to Whom We May Disclose this Information|
|Identifiers: includes direct identifiers such as a real name, alias, address, user ID, username, account number; phone number, unique personal identifier, online identifier, IP address, app ID, email address, account name, social security number, social insurance number, driver's license number, passport number, or other similar identifiers.||Yes||
Usage Data: includes browsing history, clickstream data, search history, and information regarding a resident's interaction with an internet website, application, or advertisement, including access logs and other usage data related to your use of any company websites, applications or other online services.
Geolocation data: includes precise location information about a particular individual or device.
|Professional Information: includes professional or employment-related information.||Yes||
|Education information: includes information about an individual’s educational history (such as the schools attended, degrees you were awarded, and associated dates).||Yes||
In addition, we may disclose any of the categories of Personal Information we collect about you to other third parties as directed by or consented to by you, or where necessary to fulfil your or your employer’s or membership group’s specific requests.
Do We “Sell” Personal Information? The CCPA defines a "sale" as disclosing or making available to a third-party Personal Information in exchange for monetary or other valuable consideration. While we do not disclose Personal Information to third parties in exchange for monetary compensation, as defined by the CCPA, we may “sell” Identifiers, Usage Data and Inferences to ad networks and data analytics providers, via cookies and tags on certain of our websites (e.g., in order to improve and measure our advertising and marketing campaigns).
Sources of Personal Information. As further described above, we may collect Personal Information from the following sources:
- directly from the individual
- advertising networks
- social networks
- government entities
- public records
- data analytics providers
- internet service providers
- operating systems and platforms
- our business clients
Rights of California Residents. California residents have the following rights under CCPA:
- Do-not-sell (opt-out): to opt-out of our sale of their Personal Information. The link to opt out can be found in the footer of this website.
- Deletion: to request deletion of their personal information that we have collected about them and to have such Personal Information deleted, subject to certain exemptions.
- Request to Know: with respect to Personal Information that we have collected about them in the prior 12 months, to require that we disclose the following to them (up to twice per year and subject to certain exceptions):
- categories of personal information collected;
- categories of sources of personal information;
- categories of Personal Information that we have disclosed or shared with a third party for a business purpose or sold;
- categories of third parties to whom we have disclosed for a business purpose or sold their Personal Information;
- the business or commercial purposes for collecting or selling their Personal Information; and
- a copy of the specific pieces of Personal Information we have collected about them.
- Right to non-discrimination: the right not to be subject to discriminatory treatment for exercising their rights under the CCPA.
We will respond to verifiable requests received from California residents as required by law.
Financial Incentives. We may make available certain programs or offerings that are considered “financial incentives” under the CCPA as described below. We will provide you with notice and obtain your consent prior to your participation in any such program.
Submitting Requests. Requests to opt-out of sales, requests to know, and requests to delete may be submitted:
- By email to InformationProtection@cartus.com
- All requests: By contacting us at (877) 651-7356 (toll free)
When you submit a request to know or a request to delete, we will take steps to verify your request by matching the information provided by you with the information we have in our records. You must provide us with any requested information or otherwise provide us with this information via the above toll-free number to verify your request. In some cases, we may request additional information in order to verify your request or where necessary to process your request. If we are unable to adequately verify a request, we will notify the requestor. Authorized agents may initiate a request on behalf of another individual by contacting us at InformationProtection@cartus.com; authorized agents will be required to provide proof of their authorization and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent.
Rights Under California Shine the Light Law. California residents may request from businesses with whom they have an established business relationship (1) a list of categories of personal information, such as name, address, e-mail address, and the type of services provided to the customer, that a business has disclosed to third parties during the immediately preceding calendar year for the third parties' direct marketing purposes and (2) the names and addresses of all such third parties. Cartus does not provide Personal Data to third parties for direct marketing purposes.