Boost Payment Solutions Privacy Policy

Information Collected and Consent 

You do not have to provide any Personally Identifiable Information to browse the publicly available pages of the Site; however, in order to obtain or use products or services that are or may be provided through the Site or that we may otherwise offer online or offline (collectively, the “Service(s)”) you may be required to register and/or provide Personally Identifiable Information.

We may collect Personal Information from you in a variety of ways, including, but not limited to, when you (i) register on the Site; (ii) fill out forms or fields on the Site or offline; (iii) complete an application for a Service available through the Site; (iv) communicate with us through the Site or by email, mail, text, telephone, facsimile or other electronic means; (v) use the Site or authorize us to access any financial information stored or processed by a third party; (vi) provide us with Personal Information or other information; (v) participate in activities or utilize resources provided by or through Boost. The amount and type of information that Boost gathers depends on the nature of the interaction. Generating Card Processing Agreements and other related documentation that may be required for your company to accept payments through Boost. 

Business information collected during the online application process will be used solely for evaluating a supplier or merchant’s suitability for enrollment and to facilitate the boarding process. This information may be shared securely with third parties only as necessary to accomplish these tasks, and the privacy policies of these third-parties may be different from ours. Contact information will not be shared with third parties for marketing purposes but may be used by Boost to periodically share information with you about changes in regulatory compliance, new products, and services.

The personal information we may collect about you may include, depending on the nature of the transaction, the following:

• First and last name, and middle initial

• Postal/mailing address

• Email address

• Telephone number

• Geographic area

• Title

• Internet protocol address

• ID verification/Social Security Number

• Passport information

• Age/Date of Birth

• Documents to verify your identity

• Your occupation

• Payment information

• Preferred language

• Details included in any application

• Transaction and financial information related to the transaction

• Services purchased, obtained, or considered

• Information about your business, if applicable

• Geolocation data

When submitting information through Boost’s payment portals, you agree to submit only complete and accurate information and attest that the submission of this information does not violate any applicable federal, state, or local laws. You also agree that any personal information shared is provided with the explicit consent of that person. 

We will treat as personal information any item that, either alone or together with other information, we could use to identify an individual. Except as described below, we will not share with third parties any personal information without your permission.

By providing your Personal Information to us, you explicitly agree to our collection and use of such information as described in this Privacy Policy. By providing Personal Information belonging to another person, you expressly represent and warrant that you have the authority and right to do so, and that you obtained all appropriate and required consents.

We may also collect your Personal Information from sources that you have authorized to share with us or that you have authorized us to obtain information from.

We collect information about you from third parties related to transactions you are contemplating entering into with us or that you have entered into with us.

If you believe we received our personal information from a source without authority to share your personal information with us, please contact us so that we can resolve your complaint.

Information We Automatically Collect

Boost may collect information about you automatically when you visit the Site, communicate through the Site, or use any of our online Services. 

System Information: We may automatically receive certain information from your browser or mobile device, such as your browser type, the operating system of your device, the equipment you use to access the Site, and the unique identifier of your mobile device.

IP Address: We may also receive your IP address and the name of the internet service provider (“ISP”) or your mobile carrier.

Browsing Information: We may collect the URL of the site from which you came and the URL of the site you visit when leaving the Site or any of our online Services. We may also collect information related to your activities on the Site, such as webpages you view and how you interact with those webpages. 

Location: We may collect, depending on your device’s settings, location data and other types of information sent from third party services or GPS-enabled devices.

Site Usage: As you use the Site or any of our online Services, we may also collect information about such usage and your actions on the Site, such as pages you viewed, access times, and how long you spend on a page. We may use cookies to collect such information, as described in more detail below. This information is considered Non-Personal Information, which we can use for any purpose, including, without limitation, to help us improve the Site or the Services and to enhance your, and other users’, experience. 

Aggregated Anonymized Data: We may also convert personal information into Non-Personal Information by excluding information that is personally identifiable. You acknowledge that Non-Personal Information and Personal Information that is converted into Non-Personal Information belongs to Boost and that Boost has the right to use such general information as it determines in its sole discretion, including, without limitation, publishing reports on trends in the usage of the Site.

Cookies and Similar Technologies Used on the Site

Retention and Storage of Personal Information

We retain your Personal Information for as long as necessary to fulfill the purpose for which it was collected and to comply with applicable laws. We use reasonable security precautions to protect your information while in storage.

To determine the appropriate retention period for Personal Information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your Personal Information, the purposes for which we process your personal information, whether we can achieve those purposes through other means, and applicable legal requirements.

Security

We will use commercially reasonable methods to keep your Personal Information secure in our files and systems. All information provided to Boost is transmitted using SSL (Secure Socket Layer) encryption. SSL is a coding system that lets your browser automatically encrypt (or scramble) data before you send it to us. Unfortunately, no data transmission over the Internet is 100% secure. While we strive to protect your information, we cannot ensure or warrant the security of such information.

Do Not Track 

Your browser may provide you with the option to send a “Do Not Track” signal to websites you visit. This signal is used to request that websites not send the requesting device cookies, but websites have no obligation to respond to such signal or to modify their operation. Our online sites may not recognize all web browser based “Do Not Track” signals.  However, you may be able to modify your internet-enabled device’s web browser settings to block all cookies or third-party cookies.

Exemptions from the Privacy Policy

Our Privacy Policy does not apply to any information you may send to Boost by email or instant messaging programs (e.g., Instagram, Yahoo, etc.), or through social media networks, even if you open such programs or services by clicking a link displayed on the Site. Email, social media, and instant messages are not recognized as secure communication forms. Please do not send any information you consider private to us by email or instant message or through social media sites (e.g., Twitter, Facebook, etc.) due to the public nature of such postings. 

Links to Other Sites

The Site and the online Services may contain links to other websites. Boost is not responsible for the actions, practices, or content of websites linked to, or from, the Site or the online Services. You understand such websites may require you to agree to their terms of use and that we have no control over these terms. As always, you understand it is your responsibility to verify your legal use of a website, and use of information from the website and the corresponding website owner.

Age of Consent 

Boost takes special care to protect the privacy needs of children under the age of 13 and we encourage parents to be an active participant in their child’s online activities. Boost abides by the Children’s Online Privacy Policy Act (COPPA) and other relevant laws. The Site does not target and is not intended for children under the age of 13, and Boost will not knowingly collect Personal Information directly from them. If Boost discovers that a child has provided personal information directly through the Site, Boost will eliminate that data. The Site is only intended for persons 18 years of age or older. If you are under the age of 18, you may not use the Site.

If you have knowledge that a child 13 years of age or younger has submitted personal information to us, please contact us and we will delete the personal information collected belonging to that child. You may contact us by writing to us at the address below. Parents and guardians can also contact us by mail but before any information is disclosed, the parent will be required to provide verification of his/her identity and authority related to any request. We will only send the information to the parent email address in the registration file.

CAN-SPAM Compliance Notice

Boost fully complies with the federal CAN-SPAM Act. You can always opt-out of receipt of further email correspondence from us.

California Privacy Rights

Under Section 1798.83 of the California Civil Code, residents of California can obtain certain information with whom they have an established business relationship. That information is about the Personal Information those companies have shared with third parties for direct marketing purposes during the preceding calendar year. The law requires companies to inform consumers about the categories of Personal Information shared with third parties, the names and addresses of those third parties, and examples of the services or products marketed by those third parties. Boost does not engage in direct marketing of consumers and does not share Personal Information of consumers with third parties.

US State Law Privacy Rights

Some US states have adopted privacy laws that require specific disclosures. The following explains your rights pursuant to the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, the “Act”). Some or all of the rights provided for under the Act are also provided for under the Colorado Privacy Act, the Connecticut Data Privacy Act, the Utah Consumer Privacy Act and the Virginia Consumer Data Protection Act. Collectively, these privacy laws are referred to as “US State Privacy Laws.”

The US State Privacy Laws supplements the information contained above in our general Privacy Policy and applies solely to visitors, users and others who reside in those referenced states or who’s state has adopted some or all of the privacy rights set forth below. The following terms in this Section 13 supersede any inconsistent terms in any other sections of the Privacy Policy.

We do not sell your personal information

We do not sell your Personal Information. Under US State Privacy Laws, a business that sells personal information to others: 1) must give notice to that person before selling his/her personal information to others; and 2) must provide the right to opt-out of the sale of their personal information.

Your Rights Under US State Privacy Laws

1. Right to Access and Know. You may request that we disclose the following information:

a. The categories of Personal Information we collected about you and the categories of sources from which we collected such Personal Information;

b. The specific pieces of Personal Information we collected about you;

c. The business or commercial purpose of collecting or sharing Personal Information about you;

d. The categories of Personal Information about you that we shared (as defined under the applicable privacy law) and the categories of third parties with whom we shared such Personal Information; and

e. The categories of Personal Information about you that we otherwise disclosed, and the categories of third parties to whom we disclosed such Personal Information (if applicable).

Under US State Privacy Laws, the right to obtain “specific pieces” does not grant a right to the whole of any document that contains Personal Information, but only the right to obtain items of your Personal Information. Additionally, you have a right to know “categories” of sources of Personal Information and “categories” of third parties to which personal information is disclosed, but not the individual sources or third parties. Boost does not always track individualized sources or recipients.

2. Right to Request Correction of your Personal Information. You may request to correct inaccuracies in your Personal Information;

3. Right to Request Deletion of Your Personal Information. You may request to have your Personal Information deleted;

4. Right to Opt-out of Sharing for Cross-Context Behavioral Advertising. You may request to opt out of the “sharing” of your Personal Information for purposes of cross-context behavioral advertising.

5. Right to Data Portability. You have the right to request a copy of your data in a machine-readable format.

Verification of Requests to Exercise Rights. When receiving a request, we will verify that the individual making the request is the resident to whom the Personal Information subject to the request pertains. You may exercise your rights yourself or may use an authorized agent to make requests to disclose certain information about the processing of your Personal Information or to delete Personal Information on your behalf. If you use an authorized agent to submit a request, we may request that you provide us with additional information demonstrating that the agent is acting on your behalf.

Categories of Personal Information We Collect

We collect information that identified you, including information that may identify your household or your device or is reasonably capable of being connected with or linked to you, your household, or your device. “Personal Information” does not include public information available from government records, de-identified or Aggregated Anonymized Data, or information that is protected by certain laws such as HIPAA for health-related information and the Gramm-Leach Bliley Act for certain financial institutions.

How We Use Your Information

See above for how we use your information. We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

We are not required to (1) retain your Personal Information if collected for a single one-time service if, in the ordinary course of business, that information would not be retained and (2) re-identify or otherwise link any data that, in the ordinary course of business, is not maintained in a way that would be considered personal information.

Request to Delete

We are not required to grant your deletion request if retaining the Personal Information is necessary for us or our service providers to:

1. Complete the transaction for which the Personal Information was collected, fulfill the terms of a written warranty or product recall, or otherwise perform a contract between us and you.

2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity.

3. Debug to identify and repair errors that impact existing intended functionality.

4. Exercise free speech, ensure the right of another consumer to exercise that consumer’s right of free speech, or exercise another right provided for by law.

5. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest when the deletion of the public information is likely to render impossible or seriously impair the achievement of such research, if the consumer has provided informed consent.

6. For solely internal uses that are reasonably aligned with your expectations based on your relationship with us.

7. Comply with a legal obligation.

8. Internally make otherwise lawful uses of your Personal Information that are compatible with the context in which you provided your Personal Information.

Opt-Out Request

Once you make an opt-out request, we will wait at least twelve (12) months before asking you to reauthorize Personal Information sharing with third parties. However, you may change your mind and opt back into Personal Information sharing with third parties at any time by mailing us at the address below.

We will only use Personal Information provided in an opt-out request to review and comply with the request. We will act upon your opt-out request within 15 days of receipt. 

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you Services.

• Charge you different prices or rates for Services, including through granting discounts or other benefits, or imposing penalties.

• Provide you a different level or quality of Services.

• Suggest that you may receive a different price or rate for Services or a different level or quality of Services.

However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.

EU and UK Privacy Rights

This section is for users in the European Union and the United Kingdom (collectively, “EEA”) and supplements the information contained in other sections of this policy and applies solely to all visitors, users and others who are located in the EEA. Any inconsistent terms in any other sections of this policy will be superseded by this Section for EEA residents.

a. Personal Data.   References to Personal Information in this policy are equivalent to “personal data” governed by the General Data Protection Regulation (EU/UK) (collectively and generically, the “GDPR”).

b. Controller.  We are the controller of your Personal Information covered by this policy for purposes of the GDPR. Our contact information is provided below.

c. Legal Bases for Processing.  We use your Personal Information only as permitted by law. Our legal bases for processing Personal Information is described in this Section 14 is as follows:

• To provide services to you.

• To perform our contractual obligations.

• To perform pre-contractual measures.

• For research and development.

• To send you marketing communications.

• For compliance, fraud prevention and safety.

• To create anonymous data.

• To comply with applicable law.

• Processing of Personal Information with your consent.

• Protect your vital interests or those of another natural person.

• Processing operations that are pursued by Boost for our legitimate interests or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of Personal Information.

d. Your rights. The GDPR gives you certain rights regarding your personal information.  If you are located within the EEA, you may ask us to take the following actions in relation to your Personal Information that we hold:

• the purposes of the processing;

• the categories of Personal Information concerned;

• the recipients or categories of recipients to whom the Personal Information have been or will be disclosed, in particular recipients in third countries or international organizations;

• where possible, the envisaged period for which the Personal Information will be stored, or, if not possible, the criteria used to determine that period;

• the existence of the right to request from the data controller rectification or erasure of Personal Information, or restriction of processing of Personal Information concerning you, or to object to such processing;

• the existence of the right to lodge a complaint with the Information Commissioner’s Office which is the UK’s data protection regulator;

• where the Personal Information is not collected from you, any available information as to their source;

• the existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and envisaged consequences of such processing for you.

Right to Rectification.  You have the right to update or correct inaccuracies in your Personal Information. Taking into account the purposes of the processing, you shall have the right to have incomplete Personal Information completed, including by means of providing a supplementary statement.

Right to Erasure (“Right to be Forgotten”).  You have the right to request that Personal Information be deleted without undue delay where one of the following grounds applies, if the processing is not necessary:

• The Personal Information is no longer necessary in relation to the purposes for which they were collected or otherwise processed.

• You withdraw Consent to which the processing is based according to point (a) of Article 6(1) of the GDPR, or point (a) of Article 9(2) of the GDPR, and where there is no other legal ground for the processing.

• You object to the processing pursuant to Article 21(1) of the GDPR and there are no overriding legitimate grounds for the processing, or you object to the processing pursuant to Article 21(2) of the GDPR.

• The Personal Information has been unlawfully processed.

• The Personal Information must be erased for compliance with a legal obligation in UK law to which the data controller is subject.

• The Personal Information has been collected in relation to the offer of information society services directly to a child, referred to in Article 8(1) of the GDPR.

If one of the above reasons applies, and you wish to request the erasure of Personal Information stored by us, they may, at any time, contact us via email.

Where we have made Personal Information public and are obliged pursuant to Article 17(1) to erase the Personal Information, we shall, taking account of available technology and the cost of implementation, take reasonable steps, including technical measures, to inform other controllers processing the Personal Information that you have requested erasure by such controllers of any links to, or copy or replication of, those Personal Information, as far as processing is not required. We will arrange the necessary measures in individual cases.

• The accuracy of the Personal Information is contested by you, for a period enabling us to verify the accuracy of the Personal Information.

• The processing is unlawful, and you oppose the erasure of the Personal Information and request the restriction of their use instead.

• We no longer need the Personal Information for the purposes of the contemplated processing but is required by us to exercise or defend legal claims.

• You have objected to processing pursuant to Article 21(1) of the GDPR pending the verification whether our legitimate grounds of processing override those of yours.

Right to Data Portability. You have the right to receive your Personal Information, which was provided to us, in a structured, commonly used machine-readable format.

You shall have the right to transmit such Personal Information to another controller without hindrance from us, as long as the processing is based on consent pursuant to point (a) of Article 6(1) of the GDPR or point (a) of Article 9(2) of the GDPR, or on a contract pursuant to point (b) of Article 6(1) of the GDPR, and the processing is carried out by automated means, as long as the processing is not necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

In exercising your right to data portability pursuant to Article 20(1) of the GDPR, you shall have the right to have Personal Information transmitted directly from one controller to another, where technically feasible and when doing so does not adversely affect the rights and freedoms of others.

Right to Object/Withdraw Consent. You have the right to object to our reliance on our legitimate interests as the basis of our processing of your Personal Information that impacts your rights.  You also have the right to withdraw your consent to our processing of your Personal Information at anytime. 
Right Not to Be Subject to Automated decision making. You have the right to object to decisions based solely on automated processing, including profiling, which produces legal effects concerning you or affecting you.

Cross-Border Data Transfer. Personal Information voluntarily submitted to us online, via electronic communication, or otherwise, may be maintained or accessed in servers or files in the United States, which the European Union and UK have not deemed to provide “adequate” privacy protection.  If you do not consent to having your Personal Information processed and stored in the United States, please do not provide it to us on the Website or through any other means.

How to Submit A Request to Boost to Exercise Your Privacy Rights

In the US, EU and UK to exercise your Privacy Rights, you may submit your verifiable consumer requests to Boost at the address or email address set forth below:

Mailing a request to Boost at:

Boost Payment Solutions

767 Third Ave, 12^th Floor, New York, NY 1017

Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request to your Personal Information. Unless otherwise provided for in applicable privacy law, we are not required to provide you with Personal Information more than twice in a 12-month period.

We will not be able to respond to your request to provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you.

We will try to respond to your request within forty-five (45) days of receipt of your written request (thirty (30) days under the GDPR). If we require more time (up to 90 days) (up to sixty (60) additional days under the GDPR), we will inform you of the extension period in writing. We will deliver our written response by mail or electronically, at your option. For United States based requests, any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance, specifically by electronic mail communication.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

We may request specific information from you to help us confirm your identity and process your request.  Applicable law may require or permit us to decline your request.  If we decline your request, we will tell you why, subject to legal restrictions.  

Supervisory Authority. If you are a European Union or United Kingdom resident, you may make a complaint regarding the use of your personal information to your local data protection regulator.  You can find your data protection regulator here: 

• EU: https://edpb.europa.eu/about-edpb/about-edpb/members_en.  

• UK: https://ico.org.uk/global/contact-us/

Your Nevada Privacy Rights

Nevada law (SB 220) permits customers in Nevada to opt-out of the sale of certain kinds of Personal Information. A sale under Nevada law is the transfer of this Personal Information to third parties for monetary consideration so these third parties can then re-sell or license the sold information. We do not sell your Personal Information to third parties as defined in Nevada law. If you are a Nevada resident and wish to opt-out of the sale of your Personal Information, should we change our practices in the future, you must send a request by mail, or electronically.

Amendments

Boost reserves the right to change the Privacy Policy from time to time as its sole discretion with or without notice. Revisions to the Privacy Policy regarding the use of Personal Information are not retroactive.

European Union Disclosure

Personal Information voluntarily submitted to Boost online, via electronic communication, or otherwise, may be maintained or accessed in servers or files in the United States of America, which the European Union has not deemed to provide “adequate” privacy protection. If you do not consent to having your information processed and stored in the United States of America, please do not provide it to Boost. Boost contends that the General Data Protection Regulation (EU) 2016/679 does not apply to its processing of Personal Information and that it is not within the jurisdiction of the EU. All processing of PII is governed by the applicable laws of the United States of America.

Employees, Contractors and Job Applicants

To view or obtain a copy of our privacy policy related to employees, independent contractors, including individuals that perform work for Boost that are not employees, dependents, emergency contacts and beneficiaries of employees or independent contractors, please contact us. See Section 20 for contact information.

Contact

If you have any concerns/inquiries about the way Boost is handling your personal information, please let us know immediately via privacy@boostb2b.com.