Privacy Policy

Onyx — Privacy Policy

Last Updated: 11/15/2023

Pegasus Business Intelligence, LP d/b/a Onyx CenterSource, and its affiliates including without limitation Onyx CenterSource Spain, S.A. and Onyx CenterSource AS (together, “Onyx,”) respects the privacy of individuals who visit Onyx’s websites and platforms (“Sites”) or use Onyx’s services (“Services”). This Privacy Policy (“Privacy Policy” or “Policy”) discloses the privacy practices of Onyx including what information Onyx may collect in connection with the Sites and Services, how Onyx may use that information, and with whom Onyx may share it.

By using the Site or Services, you are expressly consenting to the Terms and Conditions and this Privacy Policy. Your continued use of the Site or Services constitutes your acceptance of the then-posted version of the Privacy Policy. However, it does not equate to consent for the processing of your personal information for purposes of EEA and UK data protection laws.

This Policy does not cover the personal information we collect about employees and independent contractors, or job applicants, which we cover in separate notices.

Notice at Collection: Personal Information We Collect

We collect the following categories of personal information:

Personal identifiers: name, email address, IATA number, your home or billing address, telephone numbers, IP address.
Commercial and financial information: records of products or Services ordered or considered; other purchasing or consuming histories; bank account or financial account number; and payment information.
Internet or other electronic activity information: your device and browser type, your browsing and search history on our Sites, and information regarding your interaction with our Sites and our advertisements.

We have collected the same categories of personal information in the 12 months prior to the date of this Privacy Policy.

Notice at Collection: Purposes for Collection of Personal Information

We have set out below, a description of the ways we use your personal information (referred to as “processing purposes” below), and, for individuals located in the EEA or the UK, we explain which of the legal bases we rely on to do so. If you choose not to provide us with your personal information, we may not be able to fulfil these processing purposes.

Categories of Personal Information	Processing Purposes	Legal Basis (where you are located in the EEA or the UK)
Personal identifiers; Commercial and financial information; Internet or other electronic activity information	To provide our Services to you: to provide access, functionalities, and features of our Services and Sites; carry out our obligations arising from any contracts entered into between you and us; and verify your identity.	To manage and perform our contract with you.
Personal identifiers; Commercial and financial information; Audio information; Internet or other electronic activity information	Information and monitoring purposes: to contact you from time to time; to provide you with information about our business; for customer support; to deliver advertisements and marketing promotions and offers about products or Services we think may be of interest to you; to respond to your inquiries; to customize your experience; to audit and analyze the placement and effectiveness of our advertisements and other marketing efforts; and to monitor or improve our Sites; for internal business analysis.	To pursue our legitimate interests to operate and improve our business, and to properly manage and administer our relationship with you. With your consent where required for marketing.
Personal identifiers; Commercial and financial information; Audio information; Internet or other electronic activity information	Security: To ensure network and information security, including monitoring authorized access to our Sites for the purpose of preventing cyber-attacks, unauthorized use of our Sites, prevention or detection of crime, fraud, or other activities that violate our Terms and Conditions or that are illegal, and protection of your personal information.	To pursue our legitimate interests to ensure our Sites are safe and secure.
Personal identifiers; Commercial and financial information; Audio information; Internet or other electronic activity information	Transactions: To enable any due diligence and other appraisals or evaluations for any actual or proposed merger, acquisition, financing transaction or joint venture contemplated by Onyx.	To pursue our legitimate interests to administer the management of our business.
Personal identifiers; Commercial and financial information; Audio information; Internet or other electronic activity information	Legal Claims: To defend and enforce our rights including, against legal claims that involve us, and to manage regulatory matters, investigations, data breaches, and/or data subject requests. To protect our rights and the rights and safety of our customers or others.	To comply with our legal obligations. To pursue our legitimate interests to enforce or defend our rights and interests.

Notice at Collection: Categories of Personal Information We Sell or Share and Related Information

We may share your personal information with service providers that help us operate our business, including through payment processing, managing customer information and providing customer service, facilitating services, facilitating email communications, providing security services and cloud-based data storage, hosting our Sites and assistance with other IT-related functions, advertising and marketing, providing analytics information, legal and accounting services, among other business functions.

When we engage in digital advertising, we may sell the following categories of personal information (as “sell” is defined under California law) or we may share them for purposes of cross-context behavioral advertising: personal identifiers (IP address); and internet or other electronic activity information.

These categories of personal information are sold to or shared for cross-context behavioral advertising to advertising networks and other companies that facilitate digital advertising. We engage in such sales and sharing to facilitate digital advertising that is able to reach people that are most likely to be interested in the Services we provide. We do so by allowing third parties to place cookies or other tracking technologies on our Sites that may collect information about your online activities over time and across different websites or applications. For more information about the use of cookies and other tracking technologies, see the section “Our Use of Cookies and Analytics” below and to see our cookie policy or to tailor your cookie preferences, click here: https://www.onyxcentersource.com/cookie-policy/.

To opt out of such sales and sharing of personal information, click here: https://trust.onyxcentersource.com/OP-Data-Subject-Rights_LP.html.

We do not sell or share for cross-context behavioral advertising any of the other categories of personal information we collect.

Notice at Collection: Retention Periods

We retain the categories of personal information we collect for the length of time necessary to provide our Service (including any warranty services) and to comply with legal obligations or to protect our legal rights. To determine the appropriate retention period, the amount, nature and sensitivity of the personal information are considered, together with the necessity and purposes for the processing (including, whether such purposes can be achieved through other means) and the potential risk of harm from unauthorized use or disclosure of the personal information. In exceptional cases (e.g., in pending litigation matters or where the law requires us to), your personal information may need to be kept for longer periods of time.

Sources From Which We Collect Personal Information

We collect personal information directly from our customers, website users, and representatives of entities with which we do business.

We also collect personal information from third parties from which we purchase personal information to advertise our Services.

Use or Disclosure of Sensitive Personal Information

We do not use or disclose sensitive personal information to create profiles about individuals or for any purposes other than providing our Services.

Disclosure of Personal Information For Business Purposes in the Past 12 Months

The following chart describes the categories of personal information we disclosed to third parties for a business purpose in the 12 months prior to the date of this Policy:

Categories of Consumers’ Personal Information	Categories of Third Parties to Which We Disclosed Personal Information for Business Purposes
Personal identifiers: name, email address, IATA number, your home or billing address, telephone numbers, IP address.	Service providers that process payments, verify customer information, manage customer information and provide customer service (including through our call center), facilitate email communications, provide security services and cloud-based data storage, host our Sites and assist with other IT-related functions, advertise and market our products and Services and those of our affiliates, provide analytics information, and provide legal and accounting services.
Commercial and financial information: records of products or Services ordered or considered; other purchasing or consuming histories; bank account or financial account number; and payment information.	Service providers that process payments, verify customer information, manage customer information and provide customer service (including through our call center), facilitate email communications, provide security services and cloud-based data storage, host our Sites and assist with other IT-related functions, advertise and market our products and Services and those of our affiliates, provide analytics information, and provide legal and accounting services.
Internet or other electronic activity information: your device and browser type, your browsing and search history on our Sites, and information regarding your interaction with our Sites and our advertisements.	Service providers that provide security services and cloud-based data storage, host our Sites and assist with other IT-related functions, advertise and market our products and Services and those of our affiliates, and provide analytics information.

Business Purposes for Such Disclosures

We disclosed the aforementioned categories of personal information to the categories of third parties identified above for the following purposes: to manage customer, supplier and vendor accounts and relationships; process payments; verify customers’ identities; fulfill orders and transactions; engage in advertising and marketing; operate our IT systems and secure our systems; prevent fraud and other illegal activities; and to obtain professional advice about legal and accounting matters.

Additional Information About How We May Disclose Personal Information and Purposes for Disclosures

We may also disclose your personal information as required or permitted by law to comply with a subpoena or similar legal process or government request, or when we believe in good faith that disclosure is legally required or otherwise necessary to protect our rights and property or the rights, property or safety of others, including to law enforcement agencies, and judicial and regulatory authorities. We may also disclose your personal information to third parties to help detect and protect against fraud or data security vulnerabilities. And we may disclose or transfer your personal information to a third party in the event of an actual or potential sale, merger, reorganization of our entity or other restructuring.

Our Use of Cookies and Analytics

We and our service providers may use cookies, pixel tags, web beacons and other similar tracking technologies (“tracking technologies”) to automatically collect information through the Services. Tracking technologies are essentially small data files placed on your computer, tablet, mobile phone, or other devices that allow us to record certain pieces of information whenever you visit or interact with our Site and Services. We may use these tracking technologies to help identify irregular behavior, prevent fraudulent activity and improve security, as well as making it possible for you to save your preferences and help us understand how you interact with our Site.

We also allow third parties to use tracking technologies on our Site for analytics and advertising. They assist in helping display advertisements, tailor advertisements to your interests and to assist in determining if you require assistance or are having problems navigating on our Site. Some of these third parties use the tracking technologies to collect information about how you interact with other websites and advertisements across the Internet in order to provide advertising that is tailored to your interests and which may appear on our Site or on other websites or platforms.

You may set your browser to notify you when you receive a cookie. Many web browsers also allow you to block cookies. You can disable cookies from your computer system by following the instructions on your browser or at www.youradchoices.com.

For further information on how we use cookies or to tailor your cookie preferences, please see our cookie policy: https://www.onyxcentersource.com/cookie-policy/.

Other Websites and Social Media Buttons

Our Sites may contain links to other websites or social media buttons. We are not responsible for the privacy practices or the content of those websites or social media platforms. This Privacy Policy applies only to our business and the personal information we collect.

Onyx CenterSource uses Google Analytics to collect and process data. Please refer to www.google.com/policies/privacy/partners/ to learn more about how Google uses information from sites or apps that use its services.

Information Regarding Children

Our products and Services are not directed to minors under the age of 18 and we do not knowingly sell or share for purposes of behavioral advertising the personal information of minors, including minors under 16 years of age.

Do Not Track Signals

Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. Please note that we do not respond to or honor DNT signals. We observe the Global Privacy Control signal with respect to California IP addresses.

How We Keep Your Personal Information Secure

We implement and maintain reasonable security appropriate to the nature of the personal information that we collect, use, retain, transfer or otherwise process. However, there is no perfect security, and reasonable security is a process that involves risk management rather than risk elimination. While we are committed to maintaining a reasonable information security program, no such program can be perfect; in other words, all risk cannot reasonably be eliminated. Data security incidents and breaches can occur due to factors that cannot reasonably be prevented. Accordingly, it cannot be assumed that the occurrence of any given incident or breach results from our failure to implement and maintain reasonable security.

US State Data Privacy Rights

Laws in certain US states give residents of those states specific rights with respect to the personal information collected about them. See below for more information.

CALIFORNIA PRIVACY RIGHTS

If you are a California resident, the California Consumer Privacy Act (“CCPA”) and other laws provide you with the following rights with respect to your personal information:

Your Right To Know About Personal Information We Collect

You can ask us for the following information from us with respect to the personal information we have collected about you in the 12 months prior to our receipt of your request:

Specific pieces of personal information we have collected about you;

Categories of personal information we have collected about you;

Categories of sources from which such personal information was collected;

Categories of personal information that the business sold or disclosed for a business purpose about the consumer;

Categories of third parties to whom the personal information was sold or disclosed for a business purpose; and

The business or commercial purpose for collecting or selling your personal information.

Your Right To Request Deletion of Personal Information We Have Collected From You

Upon your request, we will delete the personal information we have collected from you, except for situations where the CCPA authorizes us to retain specific information, including when itis necessary for us to provide you with a good or service that you requested; perform a contract we entered into with you; maintain the functionality or security of our systems; or comply with or exercise rights provided by the law. The law also permits us to retain specific information for our exclusively internal use, but only in ways that are compatible with the context in which you provided the information to us or that are reasonably aligned with your expectations based on your relationship with us.

Your Right to Request to Correct Personal Information We Hold About You

You have the right to request that we correct personal information we hold that you believe is not accurate. We will take steps to determine the accuracy of the personal information that is the subject of your request to correct, and in doing so will consider the totality of the circumstances relating to the personal information you have identified as being incorrect. We may ask that you provide documentation regarding your request to correct in order to assist us in evaluating the request.

Your Right to Ask Us Not to Sell or Share Personal Information We Have Collected About You

With respect to those categories of personal information that we sell to third parties or share with third parties for the purpose of cross-context behavioral advertising, you have the right to opt out of such sales and sharing.

California Shine the Light

California Civil Code Section 1798.83, also known as the “Shine the Light” law, permits California residents to annually request, free of charge, information about the personal information (if any) disclosed to third parties for direct marketing purposes in the preceding calendar year. To make a request, please contact us at privacy@corp2023.onyxcentersource.com.

Our Commitment to Honoring Your Rights

If you exercise any of the rights explained in this Privacy Policy, we will continue to treat you fairly. If you exercise your rights under this Privacy Policy, you will not be denied or charged different prices or rates for goods or services, or provided a different level or quality of goods or services than others.

Exercising Your Rights and How We Will Respond

To exercise your rights to know, delete or correct your personal information, or to ask a question, contact us using the form found here. For such requests, we will first acknowledge receipt of your request within 10 business days of receipt of your request. We will then provide a substantive response to your request as soon as we can, generally within 45 days from when we receive your request, although we may be allowed to take longer to process your request in certain jurisdictions or under certain circumstances. If we expect your request is going to take us longer than normal to fulfill, we will let you know.

You can direct us not to sell your personal information or share it for purposes of cross-context behavioral advertising here. For such requests, we will comply no later than 15 business days after receipt of your request.

We usually act on requests and provide information free of charge, but we may charge a reasonable fee to cover our administrative costs of providing the information in certain situations. In some cases, the law may allow us to refuse to act on certain requests. When this is the case, we will endeavor to provide you with an explanation as to why.

Verification of Identity – Requests to Know, Delete or Correct

We will ask you for two pieces of personal information and attempt to match those to information that we maintain about you.

If we are unable to verify your identity with the degree of certainty required, we will not be able to respond to the request. We will notify you to explain the basis of the denial.

Authorized Agents

You may designate an agent to submit requests on your behalf. The agent can be a natural person or a business entity.

If you would like to designate an agent to act on your behalf, you and the agent will need to comply with our verification process:

Requests to Know, Delete or Correct Personal Information: If the agent submits a request, the agent will need to provide us with your signed permission indicating the agent has been authorized to submit the request on your behalf. We will also require that you verify your identity directly with us or confirm with us that you provided the agent with permission to submit the request.
Requests to Opt Out of Sale or Sharing: If the agent submits a request to opt out of the sale of your personal information or the sharing of your personal information for purposes of cross-context behavioral marketing, the agent will need to provide us with your signed permission indicating the agent has been authorized to submit the opt-out request on your behalf.

Please note that this subsection does not apply when an agent is authorized to act on your behalf pursuant to a valid power of attorney. Any such requests will be processed in accordance with California law pertaining to powers of attorney.

EEA/UK Privacy Rights

If you are located in the EEA or the UK you have the following data privacy rights which may be subject to limitations / restrictions:

The right to request access to your personal information;
The right to request that your personal information be corrected or deleted;
The right to request that we restrict our processing of your personal information;
The right to object to the processing of your personal information where it is carried out (i) for our legitimate interests unless we can demonstrate compelling legitimate grounds for the processing, and/or (ii) for direct marketing purposes;
The right to object to the processing of your personal information where that processing is carried out by legitimate interest (including, for direct marketing purposes) or withdraw consent to the processing of your personal information; and
The right to request that personal information be provided to you or a third party in a machine-readable format.

Please contact us at privacy@onyxcentersource.com in case you wish to exercise any of these above rights.

Finally, you also have the right to file a complaint with the competent data protection authority if you believe we did not properly handle your personal information or did not respect your rights.

International Data Transfers

Your personal information can be transferred to countries outside the EEA or the UK, including in countries that may not offer the same level of protection as in the EEA or the UK. We have put in place appropriate safeguards so that your personal information are and remain protected. These may include implementing the Standard Contractual Clauses which may require the recipient to put in place supplementary measures to ensure an essentially equivalent level of protection is provided, as in the EEA or the UK. We will ensure that your rights and an adequate level of protection essentially equivalent to that ensured within the EEA or the UK are guaranteed. You may obtain further information and a copy of the relevant data transfer mechanisms that we have in place by contacting us at privacy@onyxcentersource.com.

Changes to This Policy

We will review and update this Policy from time to time. If changes are made, we will update the Privacy Policy and reflect the date of such modification in the date above. If the changes are material, you will be notified via email or a notice on our website.

Accessibility

We are committed to ensuring that our communications are accessible to people with disabilities. To make accessibility-related requests or report barriers, please contact us at privacy@onyxcentersource.com.

Contact Onyx

If you have any questions or issues regarding this Privacy Policy, please contact privacy@onyxcentersource.com.