("Website") and/or through documents provided during your initial account setup and at any point thereafter, we may transfer your Personal Information within Epoch (its parent company and/or any subsidiaries) or to third parties, across borders, and from your country or jurisdiction to other countries or jurisdictions around the world as set forth in this Privacy Policy.
Epoch strives to comply with all applicable laws around the globe that are designed to protect your privacy. Although legal requirements may vary from country to country, Epoch intends to adhere to the principles set forth in this Privacy Policy even if, in connection with the above, we transfer your Personal Information from your country to other countries. In other words, our goal is to provide protection for your Personal Information no matter where that Personal Information is collected, transferred, or retained.
To protect your privacy, we have adopted and comply with the following principles:
Notice
Choice
Accountability for Onward Transfer
Security
Data Integrity & Purpose Limitation
Access
Recourse, Enforcement & Liability
PRIVACY SHIELD*
Epoch complies with the EU-US Privacy Shield Framework and Swiss-US Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use and retention of personal information transferred from European Union, United Kingdom and Switzerland to the United States in reliance on Privacy Shield. Epoch has certified that it adheres to the Privacy Shield Principles with the respect to such information. If there is any conflict between the terms in this privacy policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program and to view our certification, please visit U.S. Department of Commerce's Privacy Shield website.
*Not applicable to Epoch's European subsidiary
NOTICE
Information Collection and Use
You may access and browse our Website without disclosing any Personal Information. However, if you attempt to retain Epoch's Services for your websites and/or to purchase a product or service online, Epoch may request that you voluntarily supply it with Personal Information. Personal Information we collect and how we use it is as follows:
Registration information - When you sign up or use our Services, we ask for your personal information so that we can provide you with our Services. If you are a customer purchasing a product or service online using our Services, you may be required to provide your name, credit or debit card number, card expiration date, card verification code (CVV), bank account number, address, username/password and/or email address. If you are a merchant or an affiliate of an Epoch merchant attempting to retain our Services for your websites, you may also be required to provide your personal address, your business details, and a government-issued identification number (for example, social security number or taxpayer identification number for U.S. residents). We may also ask you to send us additional documentation or to answer additional questions to help verify your information.
Information obtained from third parties - In order to protect you from fraud or other misconduct, we may obtain information about you from third parties to verify the information you provide. For example, we may use card authorization and fraud screening services to verify that your credit or debit card information and address match the information that you provided to us. Also, for merchants, we may obtain information about you and your business from a credit bureau or other sources such as public records or private business information services.
Transaction information - When you use our Services to purchase a product or service online, we collect information about each transaction, including the transaction amount, a description of the goods or services being purchased, your name, username/password and the payment information.
Log information - When you use our Services, our servers automatically record information that your browser sends whenever you visit a website. These server logs may include information such as your web request, Internet Protocol address, the date and time of your request and one or more cookies that may uniquely identify your browser.
User communications - When you send e-mail or other communication to us, we may retain those communications in order to process your inquiries, respond to your requests and improve our Services.
Epoch is the sole owner of the information collected. We will not sell, share, or rent this information to third parties, except as set forth in this Privacy Policy. We will not use any of your Personal Information to send you any promotional materials or advertisements. If you are a merchant or an affiliate of an Epoch merchant, you may from time to time receive from us important updates about our Services. If you are an affiliate of an Epoch merchant, you may also receive from us important updates about services of the Epoch merchant(s) for which you are an affiliate. If you are a customer, you may receive from us order/cancellation e-mail confirmations that are automatically generated whenever an order/cancellation is placed through us and that confirm your purchase or cancellation with important details about your purchase or cancellation, including but not limited to, product purchased/cancelled, order/cancellation date, username/password and our customer service toll free telephone number that may be used for any inquiries about the purchase/cancellation.
INFORMATION SHARING
We ensure that your Personal Information will not be disclosed to anyone other than:
Epoch's affiliated merchant banks and credit card associations in order to process a payment and provide our Services to you;
Epoch's merchant(s) from which you have purchased a product or service online using our Services;
Companies that we may merge with or be acquired by. (Should such a combination occur, we will require that the new entity follow this Privacy Policy with respect to your Personal Information. If your Personal Information could be used contrary to this Privacy Policy, you will receive prior notice.);
Law enforcement, government officials, or other third parties when (a) we are compelled to do so by a subpoena, court order or similar legal procedure; (b) we need to do so to comply with law; or (c) we believe in good faith that the disclosure of Personal Information is necessary to prevent physical harm or financial loss, to report suspected illegal activity, or to investigate violations of our agreement(s);
Other third parties with your consent or direction to do so.
LEGAL BASIS FOR PROCESSING YOUR PERSONAL INFORMATION
Our legal basis for collecting and using the Personal Information described above will depend on the personal information concerned and the specific context in which we collect it. However, we will normally collect Personal Information from you only where:
We have your consent to do so
We need the personal information to perform a contract with you
The processing is in our legitimate interests and not overridden by your rights or
We have a legal obligation to collect Personal Information from you
"Legitimate interests" means the interests of our company in conducting and managing our business to enable us to give you the best service/products and the best and most secure experience. For example: we have an interest in keeping our network secure. It can also apply to processing that is in your interests as well. For example: we may process your Personal Information to protect you against fraud when transacting on our website. We process Personal Information for certain legitimate business purposes, which include some or all of the following:
To enhance, modify, personalize or otherwise improve our services/communications for the benefit of our customers
To identify and prevent fraud
To enhance the security of our network and information systems
When processing your Personal Information for our legitimate interests, we make sure to consider and balance any potential impact on you (both positive and negative) and your rights under the data protection laws. Our legitimate business interests do not automatically override your interests – we will not use your Personal Information for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted by law). If you have any concerns about the processing, you have the right to object to processing that is based on our legitimate interests. For more information on your rights, please see “Your Rights” section below.
CHOICE
You may choose whether or not to provide Personal Information to us. If you choose not to provide the Personal Information we request, you can still visit most of Epoch's Website, but you will be unable to purchase a product or service online, setup an account with us and/or use our Services for your websites. If you choose to have a relationship with us, such as a contractual or other business relationship, you will be required to provide Personal Information in connection with such relationship.
ACCOUNTABILITY FOR ONWARD TRANSFER
When we transfer Personal Information to a third party we will ensure that our agreement with the third party provides that such Personal Information may only be processed for limited and specified purposes consistent with the consent you provided and that the third party will provide the same level of protection as the Privacy Shield Principles and will notify us if it determines that it can no longer meet this obligation. In cases of onward transfer to third parties of data of EU, UK or Swiss individuals received pursuant to the EU-US Privacy Shield or Swiss-US Privacy Shield respectively, we are potentially liable.
SECURITY
We have implemented security policies, rules and technical measures to protect the Personal Information that we have under our control from unauthorized access, improper use or disclosure, unauthorized modification, unlawful destruction or accidental loss. Epoch utilizes HTTP Secure (HTTPS) and/or Transport Layer Security (TLS) when receiving and transmitting information electronically.
We protect Personal Information by maintaining physical, electronic and procedural safeguards in compliance with applicable US federal and state regulations. We use computer safeguards such as firewalls and data encryption, we enforce physical access controls to our buildings and files, and we authorize access to personal information only for those employees who require it to fulfill their job responsibilities.
Finally, your Personal Information is disposed by shredding paper records and by the use of the shred tool that ensures that any and all electronically stored files are permanently removed from hard disks and any other electronic media which are then also physically destroyed before being disposed.
DATA INTEGRITY & PURPOSE LIMITATION
We will take reasonable steps to ensure that all Personal Information that we collect is accurate, complete, current and reliable for its intended use and purpose which may include those that reasonably serve payment processing, customer relations, compliance and legal considerations, auditing, security and fraud prevention, preserving or defending our legal rights or other reasonable uses in this context. You may send updates and corrections about your Personal Information to legal@epoch.com and we will make reasonable efforts to incorporate the changes in your Personal Information that we hold as soon as practicable. We will retain your Personal Information only for as long as it is necessary for purposes as identified above.
ACCESS
You may inquire about your Personal Information being held by Epoch by sending an email to legal@epoch.com. Upon meeting certain security measures, Epoch shall provide you with a copy of the Personal Information that it keeps about you. Prior to completing your request, Epoch may require that you provide us with certain items as a proof of your identity. Epoch reserves the right to refuse a request where the burden or expense of providing access would be disproportionate to the risks to your privacy or where the rights of persons other than You would be violated.
RECOURSE, ENFORCEMENT & LIABILITY
In compliance with the EU-US Privacy Shield Principles and Swiss-US Privacy Shield Principles, we are committed to investigate and expeditiously resolve complaints about your privacy and our collection or use of your Personal Information. Epoch uses the self-assessment method of verification of compliance and is subject to the enforcement authority of the US Federal Trade Commission.
European Union, UK and Swiss individuals with inquiries or complaints regarding this Privacy Policy should first contact us at legal@epoch.com or via post at Epoch, Attn: Chief Privacy Officer, 3110 Main Street, Suite 220, Santa Monica, California 90405, USA.
We have further committed to refer unresolved privacy complaints under the EU-US Privacy Shield Principles and Swiss-US Privacy Shield Principles to JAMS, an independent dispute resolution provider located in the United States. If you do not receive timely acknowledgment of your complaint regarding our compliance with the EU-US Privacy Shield Principles or Swiss-US Privacy Shield Principles or if your complaint is not satisfactorily addressed, please visit https://www.jamsadr.com/eu-us-privacy-shield to file a complaint.
If you do not receive a timely acknowledgment of your complaint regarding our compliance with the EU-US Privacy Shield Principles or Swiss-US Privacy Shield from JAMS or if your complaint is not satisfactorily addressed through JAMS, EU and UK individuals may complain to the US Department of Commerce through the EU Data Protection Authority in the country in which you reside while Swiss individuals may complain to the US Department of Commerce through the Swiss Federal Data Protection and Information Commissioner in Switzerland.
If you do not receive a timely acknowledgment of your complaint regarding our compliance with the EU-US Privacy Shield Principles or Swiss-US Privacy Shield Principles from the US Department of Commerce or if your complaint is not satisfactorily addressed through the US Department of Commerce, EU and UK individuals may invoke arbitration with the Privacy Shield Panel to determine whether we have violated our obligations under the EU-US Privacy Shield Principles. For more information about the arbitral model, please review Annex 1 available at http://ec.europa.eu/justice/data-protection/files/annexes_eu-us_privacy_shield_en.pdf. Swiss individuals may be able to invoke arbitration in the future with the Swiss Federal Data Protection and Information Commissioner in Switzerland.
YOUR RIGHTS
You have the following data protection rights:
You may email us at legal@epoch.com in order to access, correct, delete or update your Personal Information in our records. We will answer every email as promptly as possible.
In addition, you can object to processing of your Personal Information, ask us to restrict processing of your Personal Information or request portability of your Personal Information. Again, you can exercise these rights by contacting us at legal@epoch.com.
Similarly, if we have collected and processed your Personal Information on the basis of your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your Personal Information conducted in reliance on lawful processing grounds other than consent.
We may use automated decision making in processing your Personal Information for some services and products. You can request a manual review of the accuracy of an automated decision if you are unhappy with it.
You have a right to lodge a complaint with a supervisory authority if you believe that processing of your Personal Information relates to the infringement of any laws and regulations. For more information, please review Recourse, Enforcement & Liability section above.
If you have any privacy-related questions or unresolved problems, you may contact us at legal@epoch.com.
COOKIES
Epoch uses 'cookie' technologies on some portions of Epoch's Website. You are always free to decline our cookies if your browser permits, although in that case you may not be able to use certain features on our Website. Epoch does not collect any personally identifiable information about your online activities over time and across third-party websites or online services.
Some of our third party service providers may use cookies to collect personally identifiable information about your online activities over time and across third-party websites. Please visit webcookies.info and each third party service providers' privacy policy for more information.
We have no access to information collected by third parties' cookies and third parties have no access to information collected by ours.
THIRD PARTIES
Any websites displayed to you by our Website as Internet search results or linked to Internet search results pages provided to you by our Website have been developed by third parties over which Epoch exercises no control. Such websites may send their own cookies to end users, collect data, or solicit personal information from you. Epoch is not responsible for the privacy practices or the content of such websites, including such websites' use of any information collected when you are directed to or click through to such websites. Even though such information might not identify you personally, we strongly encourage you to become familiar with the privacy practices of those websites.
DATA RETENTION
We retain Personal Information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements). When we have no ongoing legitimate business need to process your Personal Information, we will either delete or anonymize it or, if this is not possible (for example, because your Personal Information has been stored in backup archives), then we will securely store your Personal Information and isolate it from any further processing until deletion is possible.
CHILDREN
Epoch does not request, or knowingly collect Personal Information from children under the age of 13. Epoch does not give children the ability to post messages or otherwise distribute information about themselves through our Website or through any other means.
POLICY CHANGES
We may update or amend this Privacy Policy from time to time, to comply with law or to meet our changing business or legal requirements. When we update our Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make. Any updates or amendments will be posted on our Website. By continuing to access our Website, your access and use will be subject to these updates and amendments.
EFFECTIVE DATE
This page was last updated on 2019-02-19. We may change this statement from time to time, so please check periodically.