Privacy Policy

Protecting your privacy is fundamental to the way Control Source, Inc. and its subsidiaries and affiliates (collectively, “we,” “us,” or “our”) conduct business. Although privacy regulations require companies to inform you of their practices regarding the collection and use of your personal information, keeping client information confidential has always been our policy. We have always known that privacy is important to you, and we are committed to safeguarding your personal information. This Privacy Statement explains how we may collect, use, and disclose your personal information.

I. How We Use Your Personal Information

Personal Information

In the course of offering and providing our products and services, it is common for us to receive sensitive information from and about our clients, including financial and business information, some of which constitutes personal information. Generally speaking, personal information is any information that can be used, directly or indirectly, to identify, locate, or contact someone. Types of personal information that may be collected include names, physical addresses, mailing addresses, social security numbers, email addresses, phone numbers, bank account numbers, and driver’s license numbers. Under certain circumstances, personal information may also include other information that can reasonably link to a particular person, such as internet protocol (IP) addresses, unique device identification numbers, employment information, medical information, and internet activity. However, Control Source, Inc. does not track individuals by IP address or geolocation information directly, and therefore any such IP address or geolocation information is anonymized and used only for aggregated site metrics purposes.

Email Opt-In

We may use the email address you provide to respond to your inquiries, questions, and/or other requests, and to send you Service-related emails (e.g., account verification, changes or updates to features of the Service, technical and security notices). You may receive emails that include company news, updates, and related product or service information. If you do not wish to receive promotional emails, you can click the “unsubscribe” link on promotional email communications. Note that you are not permitted to unsubscribe or opt out of non-promotional messages regarding your account, such as account verification, enrollment updates, changes or updates to features of the Service, or technical and security notices. By providing a telephone number, you are consenting to be contacted by SMS text message; message and data rates may apply, message frequency may vary, and you can reply STOP at any time to opt out or HELP for more information.

How We Collect Personal Information

Typically, we receive personal information directly from our clients or their agents in the course of performing our services. For example, clients may provide their personal information to us in order for us to quote or enroll in a qualified benefits plan. We may also collect personal information through services authorized by our clients — for example, many group clients provide employee information as employees become eligible to participate in group-sponsored benefits programs.

We also collect personal information through our website (controlsourceinc.com) and secure client portal. For example, if you set up an account for portal access on our website (to review benefits, enroll in benefit plans, or make changes to current enrollments) we will collect information such as your name, email address, username, and password, and we will receive any documents you submit through the client portal or benefit center. Our web servers may also collect information from visitors such as IP address, browser type and version, time zone setting, operating system, and platform. Some web browsers allow you to send “do-not-track” signals to websites, but our website does not respond to those signals.

How We Use Personal Information

We use the personal information we collect from you to fulfill the purpose for which you provided it. For example, you may provide us with personal information in order for us to prepare a benefits quote, modify a policy, or complete other service-related activities on your account. We may also use your personal information to: (1) provide you with information, products, or services that you request from us; (2) provide you with text or email alerts, event registrations, and other notices concerning our products or services, or events or news that may be of interest to you or as directed by your employer; (3) carry out our obligations and enforce our rights arising from any contracts entered into between you or your employer and us, including for billing and collections; (4) improve our website and present its contents to you; (5) conduct testing, research, analysis, and product development; and (6) any other purpose with your consent.

Disclosure of Personal Information

We may disclose personal information we collect from you: (1) to our subsidiaries and affiliates; (2) to contractors, service providers, and other third parties we use to support our business; (3) to fulfill the purpose for which you provided it; (4) to a buyer or other successor in the event of a sale or transfer of some or all of our business or assets; (5) for any other purpose disclosed by us when you provide the information; (6) to comply with any court order, law, or legal process, including responding to any government or regulatory request; (7) to carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collections; (8) if we believe disclosure is necessary or appropriate to protect the rights, property, or safety of us, our clients, or others; or (9) with your consent.

Data Security

We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access and disclosure. Access to your personal information is restricted to employees and contractors who need to know that information to provide services to you. We maintain physical, electronic, and procedural safeguards to limit access to your nonpublic personal information.

Unfortunately, transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of personal information transmitted to us through our website or other electronic means. Any electronic transmission of personal information is at your own risk.

Information We Collect Through Cookies and Other Technology

We automatically collect certain types of usage information when you visit our website or use our Service. When you visit the Service, we may send one or more cookies — a small text file containing a string of alphanumeric characters — to your computer that uniquely identifies your browser and lets us help you log in faster and enhance your navigation through the site. A cookie may also convey information to us about how you use the Service (e.g., the pages you view, the links you click, how frequently you access the Service, and other actions you take), and allow us to track your usage of the Service over time. We may collect log file information from your browser or mobile device each time you access the Service, including anonymous information such as your IP address, browser type, information about your mobile device, referring/exit pages and URLs, number of clicks and how you interact with links, domain names, landing pages, pages viewed, and similar information. We may employ clear gifs (web beacons), including in HTML-based emails, to anonymously track usage patterns and to see which emails are opened and which links are clicked. We may also use analytics data and third-party analytics tools to help us measure traffic and usage trends and to better understand our users. We may work with third parties that apply statistical modeling tools which attempt to recognize you across multiple devices. Although we do our best to honor the privacy preferences of our visitors, we are not currently able to respond to Do Not Track signals from your browser.

When you access our Service by or through a mobile device, we may receive or collect a unique identification number associated with your device or our mobile application (such as a UDID, IDFA, Google Ad ID, or Windows Advertising ID), mobile carrier, device type, model and manufacturer, operating system, phone number, and, depending on your device settings, geographical location data.

We use the data collected through cookies, log files, device identifiers, location data, and clear gifs to: remember information so you do not have to re-enter it on your next visit; provide custom, personalized content and information; provide and monitor the effectiveness of our Service; monitor aggregate metrics such as total visitors, traffic, usage, and demographic patterns; diagnose or fix technology problems; and otherwise plan for and enhance our Service.

Third Party Tracking and Online Advertising

We may share with, or permit, third-party online advertising networks, social media companies, and other third-party services to collect information about your use of our website over time so that they may display ads that may be relevant to your interests on our site as well as on other websites, apps, or devices you may use. Typically, this information is shared through cookies or similar tracking technologies that recognize the device you are using and collect information including hashed data, click-stream information, browser type, and time and date of your visit. This information is used to display targeted ads on or through our site or on other websites or apps, including on Facebook. You may be able to “opt out” of the collection of information through cookies or other tracking technology by managing the settings on your browser or mobile device; refer to your browser’s or device’s technical information for instructions on how to delete or disable cookies and other tracking tools. You may also be able to limit interest-based advertising through your mobile device settings by selecting “limit ad tracking” (iOS) or “opt-out of interest-based ads” (Android). To learn more about interest-based advertising and how to opt out of some of this advertising, you may visit the Network Advertising Initiative’s online resources at networkadvertising.org/choices, and/or the DAA’s resources at aboutads.info/choices; you may also adjust your ad preferences through your Facebook settings, or opt out of some — but not all — interest-based ads served by mobile ad networks by visiting youradchoices.com/appchoices and downloading the mobile AppChoices app. If you have any questions about opting out of the collection of cookies and other tracking/recording tools, contact us at service@controlsourceinc.com.

II. Third Party Websites

You may find advertising or other content on our site that links to the sites and services of our partners, suppliers, advertisers, sponsors, licensors, and other third parties. We do not control the content or links that appear on these sites and are not responsible for the practices employed by websites linked to or from our site. These sites or services, including their content and links, may change at any time and may have their own privacy policies and customer service policies. Browsing and interaction on any other website, including one that links to our site, is subject to that website’s own terms and policies. Control Source, Inc. does not sell or share your personal information, including phone numbers, with third parties or affiliates for marketing or lead-generation purposes.

Third-Party Providers

In the course of using any Control Source, Inc. electronic system, you may be directed to an external resource not managed by us, in order to fulfill services not directly managed by or provided by us. In these cases, information you provide through those external resources is not housed or managed by Control Source, Inc., and we will not be liable for any data entered into or stored in systems not directly controlled or managed by us.

Non-Personal Information

This Privacy Statement does not restrict our collection, use, or disclosure of any aggregated information or information that does not identify, or cannot be reasonably linked to, any individual. However, any such non-personal information will not be sold for direct marketing purposes.

III. Your Rights and Choices

Certain state legislation gives consumers who reside in those states specific rights regarding their personal information. This section describes those rights and explains how to exercise them, where applicable.

Information We Collect

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (“personal information”). In particular, we have collected the following categories of personal information from consumers within the last twelve (12) months:

Categories of personal information collected

Category	Examples	Collected
A. Identifiers	A real name, alias, postal address, unique personal identifier, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.	Yes
B. Personal information categories referenced in state legislation	A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state ID number, insurance policy number, employment history, bank account number, credit or debit card number, or other financial, medical, or health insurance information. Some information here may overlap with other categories.	Yes
C. Protected classification characteristics	Age (40 or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy, or childbirth and related medical conditions), sexual orientation, veteran or military status, and genetic information (including familial genetic information).	Yes
D. Commercial information	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	Yes
E. Biometric information	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifying information, such as fingerprints, faceprints, voiceprints, iris or retina scans, keystroke or gait patterns, and sleep, health, or exercise data.	No
F. Internet or other similar network activity	Browsing history, IP address, geolocation data, search history, and information on your interaction with a website, application, or advertisement.	Yes
G. Geolocation data	Physical location or movements.	Yes
H. Sensory data	Audio, electronic, visual, thermal, olfactory, or similar information.	No
I. Professional or employment-related information	Current or past job history.	Yes
J. Non-public education information (per FERPA, 20 U.S.C. § 1232g, 34 C.F.R. Part 99)	Education records directly related to a student, such as grades, transcripts, class lists, schedules, student ID codes, financial information, or disciplinary records.	No
K. Inferences drawn from other personal information	A profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	Yes

Personal information does not include: publicly available information from government records; de-identified or aggregated consumer information; or information excluded from the scope of applicable state or federal legislation, such as health or medical information covered by HIPAA or the California Confidentiality of Medical Information Act (or similar state-specific legislation), or information covered by sector-specific privacy laws such as the Fair Credit Reporting Act, the Gramm-Leach-Bliley Act (or the California Financial Information Privacy Act), and the Driver’s Privacy Protection Act of 1994.

We obtain the categories of personal information listed above from the following sources: directly from our clients or their agents (for example, documents our clients provide related to the services for which they engage us); indirectly from our clients or their agents (for example, information we collect while providing services to them); directly and indirectly from activity on our website (controlsourceinc.com), such as submissions through our website portal or usage details collected automatically; and from third parties that interact with us in connection with the services we perform, such as a third-party administrator regarding premium or payroll deductions for programs in which you participate.

Use of Personal Information

We may use or disclose the personal information we collect for one or more of the following business purposes: to fulfill or meet the reason for which the information was provided; to provide you with information, products, or services you request; to provide you with email alerts, event registrations, and other notices concerning our products, services, events, or news that may interest you; to carry out our obligations and enforce our rights under any contract between you and us, including for billing and collections; to improve our website and present its contents to you; for testing, research, analysis, and product development; as necessary to protect the rights, property, or safety of us, our clients, or others; to respond to law enforcement requests and as required by applicable law; as described to you when your information was collected or as otherwise set forth in applicable state legislation; and to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets. We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

Sharing Personal Information

We may disclose your personal information to a third party for a business purpose. When we do, we enter into a contract that describes the purpose and requires the recipient to keep that information confidential and use it only to perform the contract. In the preceding twelve (12) months, we have disclosed Category A (identifiers), Category B (customer records), Category C (protected classification characteristics), and Category I (professional or employment-related information) for a business purpose to our affiliates, our service providers, and third parties you or your agents authorize us to disclose information to in connection with the products or services we provide. In the preceding twelve (12) months, we have not sold any personal information.

Access to Specific Information and Data Portability Rights

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you: the categories of personal information we collected about you; the categories of sources for that information; our business or commercial purpose for collecting it; the categories of third parties with whom we share it; the specific pieces of personal information we collected about you (also called a data portability request); and, if we disclosed your personal information for a business purpose, the categories of personal information each category of recipient obtained.

Deletion Request Rights

You have the right to request that we delete personal information we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies — for example, where retaining the information is necessary to complete a transaction you requested, detect security incidents or fraud, debug the Service, exercise free speech or another legal right, comply with a legal obligation, or complete other purposes compatible with the context in which you provided the information.

Exercising Access, Data Portability, and Deletion Rights

To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request by calling us at (877) 652-7872 or visiting our Data Requests page. Only you, or a person authorized to act on your behalf and registered with the Secretary of State of your primary state of residence, may make a verifiable consumer request related to your personal information; you may also make such a request on behalf of your minor child. You may only make a verifiable consumer request for access or data portability twice within a 12-month period, and the request must provide enough information for us to reasonably verify your identity and describe your request with sufficient detail for us to understand, evaluate, and respond to it. We cannot respond to your request or provide personal information if we cannot verify your identity or authority. Making a verifiable consumer request does not require you to create an account with us, and information provided in the request will only be used to verify your identity or authority.

Response Timing and Format

We endeavor to respond to a verifiable consumer request within 45 days of receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response there; otherwise, we will deliver it by mail or electronically, at your option. Disclosures will only cover the 12-month period preceding the request. For data portability requests, we will provide your personal information in a format that is readily usable and allows you to transmit it to another entity without hindrance. We do not charge a fee to process or respond to a verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded, in which case we will explain why and provide a cost estimate before completing the request.

Non-Discrimination

We will not discriminate against you for exercising any of your state-legislated privacy rights. Unless permitted by state or federal law, we will not deny you goods or services; charge you different prices or rates, including through discounts or penalties; provide you a different level or quality of goods or services; or suggest that you may receive a different price, rate, level, or quality of goods or services.

IV. Changes to This Privacy Policy

We will post any changes we make to this Privacy Statement on our website. If we make material changes to how we treat personal information we collect from you, those updates will be reflected in the updated Privacy Statement available on our public website. The date this Privacy Statement was last revised is identified above. To stay aware of the most current privacy notices and any updates, we recommend periodically visiting this page to check for changes.

V. Contact Information

If you have any questions or comments about this notice, our Privacy Statement, the ways in which we collect and use your personal information, your choices and rights regarding such use, or wish to exercise your rights under applicable state law, please contact us at: