oldhamite.com

CCPA Compliance

Last Updated: September 2026

This CCPA Compliance Policy (this “Policy”) describes how oldhamite (“Company,” “we,” “us,” or “our”) collects, uses, discloses, sells, shares, retains, and otherwise processes Personal Information relating to California residents, and explains the rights available to California residents under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (together, the “CCPA”), and the regulations promulgated thereunder by the California Privacy Protection Agency (the “CPPA”) and the California Attorney General (collectively, the “CCPA Regulations”).

This Policy applies to the website, applications, software-as-a-service platforms, and related services and features operated, made available, or provided by oldhamite under the name oldhamite.com (collectively, the “Services”). This Policy supplements and forms an integral part of our general Privacy Policy and our Terms of Service. In the event of a direct conflict between this Policy and our general Privacy Policy solely with respect to California residents and the rights described herein, this Policy controls with respect to those matters.

PLEASE READ THIS POLICY CAREFULLY. By accessing or using the Services, or by otherwise providing Personal Information to us, you acknowledge that you have read and understood this Policy. If you do not agree with this Policy, you must discontinue use of the Services.

1. Scope, Applicability, and Important Exemptions

1.1 Who This Policy Applies To

This Policy applies to “Consumers” as that term is defined under the CCPA, meaning a natural person who is a California resident, as identified by the CCPA and the CCPA Regulations. This includes California residents acting in an employment or independent-contractor capacity with us, and California residents acting in a commercial or business-to-business context, to the extent such information is not otherwise exempt. This Policy does not apply to:

Individuals who are not California residents (though they may have rights under other laws, including other U.S. state privacy statutes and, where applicable, the GDPR);
Information that is deidentified or aggregated such that it cannot reasonably be linked to a particular Consumer or household, or that we maintain in deidentified form in accordance with the CCPA;
Information lawfully made available from federal, state, or local government records;
Information collected, processed, or disclosed pursuant to an exemption described in Section 1.3 below.

1.2 Two Capacities: Controller and Service Provider

oldhamite operates a software-as-a-service business. As a result, we process Personal Information in two distinct capacities, and the rights available to you may differ depending on that capacity:

(a) As a “Business” (controller). We act as a Business with respect to Personal Information we collect directly from visitors to oldhamite.com and from our prospective customers, account holders, and other individuals with whom we interact directly (for example, account registration information, billing information, marketing preferences, and website analytics data).
(b) As a “Service Provider” or “Contractor.” Where our business customers upload, submit, or otherwise make available Personal Information about their own end users, employees, clients, or other individuals into the Services (for example, data stored within a customer’s account configuration, records, or database environment), we process that Personal Information solely on behalf of and at the direction of that business customer. In that context, the business customer is the Business and is responsible for responding to your CCPA requests. If you are an end user of one of our business customers and wish to exercise your CCPA rights, please direct your request to that business customer. We will assist that business customer as required by the CCPA and our contractual obligations. We do not “sell” or “share” Personal Information processed by us in this Service Provider capacity.

1.3 Statutory Exemptions

Certain Personal Information is exempt from the CCPA, in whole or in part. Where an exemption applies, we will handle that information in accordance with the applicable law and our separate notices. Exemptions include, without limitation:

Protected Health Information (PHI) governed by the Health Insurance Portability and Accountability Act (HIPAA) and the California Confidentiality of Medical Information Act (CMIA);
Information governed by the Gramm-Leach-Bliley Act (GLBA) and the California Financial Information Privacy Act;
Information governed by the Fair Credit Reporting Act (FCRA);
Information governed by the Driver’s Privacy Protection Act or the Vehicle Information and Collision Repair Act;
Information collected as part of a clinical trial or other research subject to the Federal Policy for the Protection of Human Subjects (the Common Rule);
Information governed by the Family Educational Rights and Privacy Act (FERPA) and the California Student Records statutes;
Personal Information collected from employees and job applicants, to the extent the CCPA’s exemptions apply, and limited to the purposes specified in those exemptions.

1.4 Business-to-Business and Employment Information

Personal Information we collect from an individual acting in a commercial or employment context on behalf of a company (such as a business contact name, title, business email address, business telephone number, or employer name) is processed for the purposes described in this Policy. Unless an exemption applies, we treat such information as Personal Information subject to the rights described in Section 6.

2. Definitions

For purposes of this Policy, the following terms have the meanings set forth below. Terms that are capitalized but not defined in this Policy have the meanings given to them in the CCPA and the CCPA Regulations.

“Business” means the legal entity that determines the purposes and means of the processing of Personal Information.
“Consumer” means a natural person who is a California resident, however identified, including by any unique identifier, but does not include a person acting in a commercial or employment capacity where an exemption applies.
“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular Consumer or household. Personal Information includes “Sensitive Personal Information” unless otherwise stated.
“Sensitive Personal Information” has the meaning given in Civil Code § 1798.140(ae), which includes, among other categories, government identifiers, account log-in credentials, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, contents of mail, email, and text messages (unless we are the intended recipient), genetic data, biometric information used for identification, health information, information concerning sex life or sexual orientation, and immigration status.
“Sale” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a Consumer’s Personal Information to a third party for monetary or other valuable consideration.
“Sharing” means disclosing Personal Information to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration.
“Service Provider” means an entity that processes Personal Information on behalf of a Business pursuant to a written contract that restricts the entity’s use of the Personal Information to the purposes specified in the CCPA.
“Third Party” means a person or entity that is not the Business, a Service Provider, a Contractor, or a Consumer.
“Verified Request” means a request to exercise a CCPA right that we have reasonably verified as having been made by the Consumer who is the subject of the Personal Information, or by an authorized agent acting on that Consumer’s behalf.

3. Categories of Personal Information We Collect

The table below identifies the categories of Personal Information we have collected about Consumers in the preceding twelve (12) months, the categories of sources from which the information is collected, the business or commercial purposes for collection, and the categories of third parties to whom we disclose the information. The examples provided are illustrative and not exhaustive.

Category	Examples	Collected	Purposes and Disclosure
A. Identifiers	Name, alias, postal address, email address, account name, online identifier, IP address, device identifier, unique personal identifier	Yes	Account creation and administration; authentication; billing; support; security; analytics; service providers (hosting, payment, communications)
B. Personal Information described in Cal. Civ. Code § 1798.80(e)	Name, signature, telephone number, credit or debit card number, financial account information	Yes	Payment processing; fraud prevention; billing and collections; service providers (payment processors)
C. Characteristics of protected classifications	Age or date of birth (where provided); gender (where voluntarily provided)	Limited / Voluntarily provided	Account eligibility; personalization; support
D. Commercial information	Products or services purchased or considered; subscription tier; purchase and usage history	Yes	Provision of Services; billing; renewals; customer support; analytics
E. Biometric information	Not collected	No	Not applicable
F. Internet or other electronic network activity	Browsing history on the Services, interaction with pages and features, log data, session information, crash reports	Yes	Service functionality; security; debugging; analytics; service providers
G. Geolocation data	Approximate location inferred from IP address. We do not collect precise geolocation.	Limited (approximate only)	Security; fraud prevention; analytics; compliance with regional requirements
H. Sensory data	Audio recordings of customer support calls, where permitted by law and with notice	Limited	Quality assurance; training; dispute resolution
I. Professional or employment-related information	Employer name, job title, business contact details, role	Yes	Account administration; business relationship management; marketing (with consent or as permitted)
J. Non-public education information	Not collected	No	Not applicable
K. Inferences	Preferences, characteristics, and behavioral tendencies derived from the information above	Yes	Personalization; product improvement; analytics; recommendations
L. Sensitive Personal Information	Account log-in credentials; payment card information with security code	Yes (limited)	Authentication; security; payment processing. Used only for the purposes permitted by Civil Code § 1798.121(a). We do not use or disclose Sensitive Personal Information for inferring characteristics about you.

3.1 Sources of Personal Information

Directly from you: when you create an account, complete forms, subscribe to a plan, contact support, or otherwise communicate with us.
Automatically from your device: through cookies, pixels, SDKs, server logs, and similar technologies when you interact with the Services.
From our business customers: where you are an end user of a customer’s account and the customer submits your information to the Services.
From service providers and vendors: including payment processors, analytics providers, fraud-prevention providers, and marketing partners.
From publicly available sources and third-party data providers: for business contact enrichment and fraud prevention, to the extent permitted by law.

3.2 Business and Commercial Purposes for Collection

We use Personal Information for the following business and commercial purposes:

Providing, maintaining, and improving the Services, including account creation, authentication, and feature delivery;
Processing payments, managing subscriptions, and performing billing and collections;
Communicating with you about your account, service updates, security alerts, and support inquiries;
Personalizing your experience and delivering relevant content and recommendations;
Marketing and advertising our products and services, subject to your choices and applicable law;
Performing analytics, research, and product development;
Detecting, preventing, and responding to security incidents, fraud, abuse, and other illegal activity;
Debugging and repairing errors and defects in the Services;
Complying with legal obligations, responding to lawful requests, and enforcing our agreements;
Establishing, exercising, or defending legal claims;
Short-term, transient use, including contextual customization of advertising, provided the Personal Information is not disclosed to a third party or used to build a profile (except as permitted by the CCPA Regulations);
Verifying and maintaining the quality and safety of the Services, including audits and internal research for technological development.

4. Sale and Sharing of Personal Information

4.1 Our Practices

oldhamite does not sell Personal Information for monetary consideration. We do not rent, trade, or otherwise exchange Personal Information for money. We do not knowingly sell or share the Personal Information of Consumers under sixteen (16) years of age.

To the extent we engage in activities that constitute “sharing” under the CCPA (for example, the use of third-party advertising or analytics cookies that permit the recipient to use the information for cross-context behavioral advertising), we will disclose that practice in our Notice at Collection, honor opt-out preference signals as described in Section 7.3, and provide a “Do Not Sell or Share My Personal Information” mechanism as described in Section 7.2. Where such practices are not active, the opt-out mechanism will remain available to you and will be honored with respect to any future activity of that nature.

4.2 Disclosure for a Business Purpose

We disclose Personal Information to Service Providers, Contractors, and other recipients for the business purposes described in Section 3.2, pursuant to written contracts that prohibit the recipient from retaining, using, or disclosing the Personal Information for any purpose other than the business purposes specified in the contract, and that require compliance with the CCPA. Categories of recipients include:

Cloud hosting, infrastructure, and data storage providers;
Payment processors and fraud-prevention providers;
Email, SMS, and customer-support platform providers;
Analytics and product-performance providers;
Marketing and advertising providers (subject to your choices);
Professional advisors, auditors, and insurers;
Affiliates and subsidiaries that operate under common control and comply with this Policy.

4.3 Disclosures Required by Law

We may disclose Personal Information to government authorities, law enforcement, courts, and other parties where we believe in good faith that disclosure is necessary to (a) comply with a law, regulation, subpoena, court order, or other legal process; (b) protect the rights, property, or safety of oldhamite, our users, or the public; (c) enforce our Terms of Service or other agreements; (d) detect, prevent, or address fraud, security, or technical issues; or (e) respond to an emergency. We will disclose only the minimum information reasonably necessary to achieve the applicable purpose.

4.4 Corporate Transactions

If oldhamite is involved in a merger, acquisition, financing, reorganization, bankruptcy, receivership, sale of assets, or transition of service to another provider, Personal Information may be transferred as part of that transaction. In such circumstances, we will require the recipient to honor this Policy or provide you with advance notice of any material change to the treatment of your Personal Information.

4.5 Deidentified and Aggregated Information

We may create and use deidentified or aggregated information that cannot reasonably be linked to a particular Consumer or household. We maintain such information in deidentified form, do not attempt to reidentify it, and require our contractual counterparties to comply with the same restrictions. To the extent required by the CCPA, such information is not treated as Personal Information.

5. Notice at Collection

This Policy and our general Privacy Policy together constitute our Notice at Collection. At or before the point of collection, we inform you of:

The categories of Personal Information we collect;
The purposes for which the Personal Information is collected;
Whether the Personal Information is sold or shared, and if so, the categories of third parties to whom it is sold or shared;
The length of time we intend to retain each category of Personal Information, or if that is not possible, the criteria used to determine the retention period;
A link to this Policy and instructions for submitting a request to exercise your CCPA rights.

Where we collect Sensitive Personal Information, we provide a separate notice and limit our use and disclosure of that information to the purposes enumerated in Civil Code § 1798.121(a), unless you are provided a right to limit its use and disclosure and you have not exercised that right.

6. Your California Privacy Rights

Subject to verification of your identity and applicable exemptions, California residents have the following rights:

6.1 Right to Know and Right to Access

You have the right to request that we disclose, for the twelve (12) month period preceding your request (and, upon request, beyond twelve months, provided the burden on us is proportionate to the value of the data):

The categories of Personal Information we have collected about you;
The categories of sources from which the Personal Information was collected;
The business or commercial purpose for collecting, selling, or sharing Personal Information;
The categories of third parties to whom we disclose Personal Information;
The specific pieces of Personal Information we have collected about you (in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the information to another entity without hindrance); and
The categories of Personal Information we have sold or shared, and the categories of third parties to whom each category was sold or shared.

6.2 Right to Delete

You have the right to request that we delete Personal Information we have collected from you, subject to certain exceptions. We may deny a deletion request where the information is necessary for us or our Service Providers or Contractors to:

Complete the transaction for which the Personal Information was collected, provide a good or service you requested, or perform a contract between you and us;
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible;
Debug to identify and repair errors that impair existing intended functionality;
Exercise or defend legal claims, or comply with a legal obligation;
Engage in public-interest scientific, historical, or statistical research in accordance with applicable law;
Enable solely internal uses reasonably aligned with your expectations based on your relationship with us;
Comply with the California Electronic Communications Privacy Act or other applicable law.

6.3 Right to Correct

You have the right to request that we correct inaccurate Personal Information we maintain about you, taking into account the nature of the Personal Information and the purposes of processing. We will use commercially reasonable efforts to correct the information as requested, and may require documentation to substantiate the accuracy of the correction requested.

6.4 Right to Opt Out of Sale or Sharing

You have the right to direct a Business that sells or shares your Personal Information to third parties to stop doing so. Because we do not sell Personal Information for monetary consideration, and only engage in “sharing” (if at all) through certain advertising or analytics technologies, you may exercise this right by following the instructions in Section 7.2 and Section 7.3.

6.5 Right to Limit Use and Disclosure of Sensitive Personal Information

Where we collect Sensitive Personal Information, and where we use or disclose it for purposes beyond those enumerated in Civil Code § 1798.121(a), you have the right to limit our use and disclosure of that information to those enumerated purposes. Where our use is limited to the enumerated purposes, this right does not apply, because our use is already restricted. You may submit a request to limit by contacting us using the details in Section 14.

6.6 Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

Deny you goods or services;
Charge you different prices or rates for goods or services, including through the use of discounts, other benefits, or the imposition of penalties;
Provide you a different level or quality of goods or services;
Suggest that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

We may, however, charge a different price or rate, or provide a different level or quality of goods or services, if that difference is reasonably related to the value provided to us by your Personal Information, and we comply with the notice and opt-in requirements of the CCPA Regulations.

6.7 Right to Data Portability

Where you exercise your right to know, you may request that we provide your Personal Information in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the information to another business without hindrance.