If you reside in the European Economic Area, United Kingdom, or Switzerland (collectively, “EEA Residents”), you have additional rights with respect to your personal data, which include rights under the EU’s General Data Protection Regulation (“GDPR”).
If you reside in California, USA, you have additional rights with respect to your personal information as granted by the California Consumer Privacy Act (“CCPA”).
- through our social media pages that we control, if any (collectively, our “Social Media Pages”), and
- through our email messages and through your direct communications with us.
Collectively, we refer to the Website and our Social Media Pages, together with our email and direct communications with you as the “Services”. GSM Acquisition Corp. and our related entities (together, "GSM", "we", “us”, or “our”) strive to make our website and online resources useful tools and rewarding experiences for our customers by tailoring the content to your personal needs and interests. This way, the content of our online interactions will be as relevant as possible for you.
We may provide additional “just-in-time” disclosures or additional information about the data collection, use and sharing practices of specific Services. These notices may supplement or clarify our privacy practices or may provide you with additional choices about how we process your personal information.
What Personal Data Is Collected by GSM?
Personal information is data that identifies an individual or relates to an identifiable individual. This includes information you provide to us, information which is collected about you automatically, and information we obtain from third parties.
When you interact with us, at various points we may collect your personal information in accordance with the law. You may choose not to provide certain personal information; however, your interactions with us may be limited, or you may be unable to access certain functionalities of our Services. Below we have listed the categories of personal information that we may collect from you.
- Contact Information. Your first and last name, email address, postal address, phone number, user name, password, social media handle or other similar contact information. We may also collect your signature and employer information.
- Survey Information. The information you provide in response to a survey that you choose to respond to.
- Demographic Information. Demographic information, such as your geographic location, date of birth, anniversary date, or any other significant date.
- Online Interactions. We collect aggregated analytics data about website visitors, such as your internet protocol (IP) address, location information, when you use our Website or interact with us through social media.
- Personal Information Received From Third Parties. We may receive some of the above sated personal information about you from third parties such as social media sites, through technology such as cookies, and when you use third party agents or third party services to make requests for information.
How We Collect Personal Data
We collect personal information in the following manner:
Personal information that you provide:
-Online Interactions. We may collect personal information from you when you visit our website, interact with us on Social Media, or send us requests over emails.
-Direct Interactions. We may collect personal information from you when you visit our locations, tell us your preferences, or schedule an appointment.
-Other Sources. We collect personal information from other sources, such as public databases, joint marketing partners and other third parties.
Personal Information that we collect from you automatically
We use certain tracking technologies to improve the functionality of the website and your experience when you access it. We also keep a record of third party websites accessed when you are on our website and click on a hyperlink. However, we do not track users to subsequent sites and do not serve targeted advertising to them. We do not, therefore, respond to Do Not Track (DNT) signals. If you connect to our site using a mobile device, we may collect device information, including the device ID, model and manufacturer; the operating system; the location (to the city level), and the IP address. We also use Google Analytics to track how often people gain access to or read our content. We use this information in the aggregate to understand what content our site visitors find useful or interesting, so we can produce the most valuable content to meet their needs.
Anonymized and Aggregated Data
We may use anonymized or aggregate customer data for any business purpose, such as to better understand customer needs and behaviors, improve our Services, conduct business intelligence and marketing, and detect security threats. We may perform our own analytics on anonymized data or enable analytics provided by third parties. Types of data we may anonymize include contact information, survey information, and demographic information.
How Does GSM Process or Use Personal Data?
We use the personal information we collect to communicate with you, provide the products or services you have requested, understand your needs, provide you with a better service, and in particular, for the following purposes:
- To conduct transactions you request.
- To respond to your questions and to contact you, and to provide notice about the status of our website or the specific services you have requested.
- To assist us in providing better information, and to help us improve our website and services.
- To learn more about our website traffic patterns and other use in order to improve the functionality and features of our website.
- To help us operate, maintain and improve our systems, our website, and your user experience.
- To facilitate corporate acquisitions, mergers or transactions.
- To send you information about GSM and its related companies, which may or may not relate to the reason for which you interacted with GSM. You may unsubscribe or opt out of marketing-related communications or emails from us by clicking the unsubscribe link on any email marketing communication you receive; however, you may not be able to opt-out of receiving critical Service-related communications.
GSM does not collect any categories of personal information beyond the categories of personal information outlined above, and not for the purposes other than outlined above. If GSM plans to collect and use personal information for any purposes beyond the ones outlined in this notice, additional consent needs to be obtained prior to use.
How and Why Does GSM Share Personal Data with Third Parties?
GSM does not sell, rent, or share personal information to or with any third party not affiliated with, related to or owned by GSM, except service providers who may assist us in such areas as our promotions, credit checks, data storage and order processing, as further detailed below. GSM will never give or sell your personal information to unaffiliated third parties to be used for the purposes of sending you unsolicited commercial offers, such as spam. We do not share personal data about you with third parties except as follows:
- With service providers under contract who help with parts of our business operations. Our contracts require these service providers to only use your information in connection with the services they perform for us, and prohibit them from selling your information to anyone else. Examples of the types of service providers we may share personal information with include: (a) Network infrastructure; (b) Cloud storage; (c) Payment processing; (d) Document repository services; (e) Sales; (f) Website Management; (g) Accounting; (h) Customer Support; (i) Internet (e.g. ISPs); (j) Data analytics; (k) Information Technology.
- With our professional advisors who provide banking, legal, compliance, insurance, accounting, or other consulting services in order to complete third party financial, technical, compliance and legal audits of our operations or otherwise comply with our legal obligations.
-When required by law, or if we have a good faith belief that such action is necessary to: (a) to identify, contact or bring legal action against someone who may be causing injury to or interference with (either intentionally or unintentionally) our rights or property, customers or other users of our website, or anyone else who could be harmed by such activities; (b) to respond to judicial process and provide information to law enforcement agencies or in connection with an investigation on matters related to public safety, as permitted by law, or otherwise as required by law, or (c) to transfer your information as a business asset in the event we or our related entities sell or buy other businesses or entities, or we or substantially all of our assets are acquired.
- Administrative, technical or marketing purposes: We will share information with third parties, business partners or related entities, subject to confidentiality agreements as appropriate, for research and analytical purposes; for administrative or technical support or other business purposes, or to analyze our data or to maintain and improve our services or your user experience. We may also share aggregated information about our customers with our advertisers and our marketing partners. We may share website usage information about visitors to our website with third party advertising companies.
- Consent: We also share personal data with third parties, other than those described above, when we have your consent to do so.
What Personal Data Rights Do You Have?
Depending on applicable law where you reside, you may be able to assert certain rights related to your personal information identified below. If any of the rights listed below are not provided under law for your jurisdiction, we have absolute discretion in providing you with those rights.
Your rights to personal information are not absolute. Depending upon the applicable law, access may be denied: (a) when denial of access is required or authorized by law; (b) when granting access would have a negative impact on another's privacy; (c) to protect our rights and properties; (d) where the request is frivolous or vexatious, or for other reasons.
Access and portability. You may request that we provide you a copy of your personal information held by us. This information will be provided without undue delay. In certain circumstances, you may request to receive your personal information in a structured, commonly used and machine-readable format, and to have us transfer your personal information directly to another data controller. To request access, see HOW CAN YOU EXERCISE THESE RIGHTS below.
Rectification of incomplete or inaccurate personal information. You may request us to rectify or update any of your personal information that we have. You may do this at any time by contacting us at email@example.com.
Erasure or deletion. You may request to erase or delete your personal information, subject to applicable law. To request erasure or deletion, see HOW CAN YOU EXERCISE THESE RIGHTS below.
Withdraw consent. To the extent the processing of your personal information is based on your consent, you may withdraw your consent at any time. Your withdrawal will not affect the lawfulness of your processing based on consent before your withdrawal. You may withdraw your consent by contacting us at firstname.lastname@example.org.
Restriction of processing. In some jurisdictions, applicable law may give you the right to restrict or object to us processing your personal information under certain circumstances. We may continue to process your personal information if it is necessary for the defense of legal claims, or for any other exceptions permitted by applicable law.
Automated individual decision-making, including profiling. We do not rely on automated individual decision-making or profiling tools.
How to make a privacy request
To make a privacy request, you can contact us at email@example.com or see the “HOW YOU CAN EXERCISE THESE RIGHTS” section below.
How to lodge a complaint
If you believe that we have infringed your rights, we encourage you to first submit a request by sending us an email at firstname.lastname@example.org, so that we can try to resolve the issue or dispute informally.
If you reside in the EU, you can file a complaint with your relevant data protection authority.
California Privacy Rights
In addition to the rights provided for above, if you are a California resident, the California Consumer Privacy Act provides some California residents with the additional rights listed below. To exercise these rights see the “HOW YOU CAN EXERCISE THESE RIGHTS” section below.
Right to Know. You have the right to know and see what data we have collected about you over the 12-month period, including:
- The categories of personal information we have collected about you;
- The categories of sources from which the personal information is collected;
- The business or commercial purpose for collecting your personal information;
-The categories of third parties with whom we have shared your personal information; and
-The specific pieces of personal information we have collected about you.
Right to Delete. You have the right to request that we delete the personal information we have collected from you (and direct our service providers to do the same). There are a number of exceptions, however, that include, but are not limited to, when the information is necessary for us or a third party to do any of the following:
-Complete your transaction;
-Provide you a good or service;
-Perform a contract between us and you;
-Protect your security and prosecute those responsible for breaching it;
-Fix our system in the case of a bug;
-Protect the free speech rights of you or other users;
-Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et seq.);
-Engage in public or peer-reviewed scientific, historical, or statistical research in the public interests that adheres to all other applicable ethics and privacy laws;
-Comply with a legal obligation; or
-Make other internal and lawful uses of the information that are compatible with the context in which you provided it.
Other Rights. To the extent we sell your personal information to third parties, you also have the right to request that we disclose to you: (i) the categories of your personal information that we sold, and (ii) the categories of third parties to whom your personal information was sold. You have the right to direct us not to sell your personal information. We do not sell your personal information in the ordinary course of business and will never sell your personal information to third parties without your explicit consent.
You will not receive discriminatory treatment by GSM for exercising the above individual rights. Prohibited discriminatory treatment includes denying goods or services, charging different prices or rates for goods or services (including discounts or other benefits or imposing penalties), providing a different level or quality of goods or services to you, or even suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.
How Can You Exercise These Rights?
To exercise access and deletion rights, call us at (713) 580-3900 or email us at email@example.com to submit a request.
- If you are a consumer who has or may receive marketing materials from GSM, email firstname.lastname@example.org to submit a request.
- If you are a job applicant or a current or former GSM employee, email email@example.com to submit a request.
- If you are an automotive dealership, a dealer group, or an automotive manufacturer submitting a request on behalf of a consumer, please contact us at firstname.lastname@example.org.
You will be asked for personal information such as name, phone number and/or email address to verify your identity, as well as the type of right you want to exercise, such as access or deletion.
For access requests we must first verify your identity by using identifiers. Verification identifier may include but are not limited to: Name, Address, Email, and Phone Number. Once we verify your identity, we will search for personal data collected and provide you a report with:
-list of categories of personal data we collected
-sources we collected from
-purposes of collecting
-categories of third parties with whom we share data
For deletion requests, once we verify your identity, we will confirm receipt of the deletion requests and provide an estimated timeline for deletion completion unless the processing of your personal information falls under a regulatory exception to deletion in which case we will notify you of such exception. For deletion requests initiated through our web-based form, an additional confirmation question will be asked to confirm that you want to delete your data.
California Authorized Agent: If you are a California resident, you may designate an authorized agent to make a request to access or a request to delete on your behalf. We will respond to your authorized agent's request if they submit proof that they are registered with the California Secretary of State to be able to act on your behalf, or submit evidence you have provided them with power of attorney pursuant to California Probate Code section 4000 to 4465. We may deny requests from authorized agents who do not submit proof that they have been authorized by you to act on their behalf, or are unable to verify their identity.
How Your Information Is Kept Secure
GSM takes commercially reasonable precautions, including physical, administrative and electronic safeguards, to protect and secure the confidentiality and integrity of your personal information. For example, we encrypt communications through our website with commercial strength encryption generally used by our industry. However, given the nature of the Internet and the fact that network security measures are not perfect, we cannot guarantee the absolute security of your information. If we are required to provide notice to you of a data security breach, the notice will be provided in electronic form.
For EEA Data Subjects
Transferring personal data from the EU to the US
Legal Basis for Processing your Information
For individuals who are EEA Residents at the time their personal data is collected, we rely on legal basis for processing your information under Article 6 of the EU General Data Protection Regulation (“GDPR”). We generally only process your data where we are legally required to, where processing is necessary to perform any contracts we entered with you (or to take steps at your request prior to entering into a contract with you), for our legitimate interests to operate our business or to protect us, or you, property, rights, or safety, or where we have obtained your consent to do so. Below is a list of the purposes described in our policy with the corresponding legal basis for processing.
Based on our contract with you or to take steps at your request prior to entering into a contract with us so that we can provide you with our Services:
-To provide you Services
-To provide you with personalized Services
-To communicate with you
-To ensure quality
-To ensure security
Based on our legitimate interests, balancing any potential impact on you and your rights:
-To enhance your experience
-To facilitate corporate acquisitions, mergers, or transactions
Based on our legal obligations, the public interest, or in your best interest:
-To ensure security
Based on your consent:
-To enhance your experience
-To engage in marketing activities
-For any purpose
Right to Withdraw Consent
If you have given us consent in relation to particular processing or activities, you can withdraw your consent at any time by contacting us as indicated in the “HOW YOU CAN EXERCISE THESE RIGHTS” section.
Children's Online Privacy
Our website is a general audience site and is not intended for use by children under 18. If you become aware that a child under 18 years of age has provided personal data through the site, notify us by email at the email address listed herein. If we become aware that a child under age 18 years of age has provided personal information through this website, we will take steps to immediately delete it.
Questions or Concerns
GSM Acquisition Corp.
Attention: Privacy Officer
1345 Enclave Parkway
Houston, Texas 77077
Update 3/18/2021, 3:00:00 PM CT