Effective Date: January 1, 2023
Backblaze, Inc. (“we,” “our,” or Backblaze) respects your privacy and is committed to providing a transparent Privacy Notice. This Privacy Notice describes how we collect and use your personal information, what we do with the information collected, and how you can exercise your privacy rights as a resident of California or Virginia.
The purpose of this Privacy Notice is to provide you, at or before the time we collect your personal information, with a comprehensive description of our online and offline practices regarding the collection, use, disclosure, retention, sharing, and sale of personal information and of the rights of consumers regarding your personal information.
This Privacy Notice applies to California and Virginia residents who are consumers in relation to Backblaze. If you are, in relation to Backblaze, an employee, former employee, or candidate for employment who is a resident in California, please see the Backblaze Privacy Notice for California Employees, Former Employees, and Candidates for Employment.
The purpose of this Notice at Collection is to provide you with timely notice, at or before the point of collection, about the categories of personal information to be collected from you and the purposes for which the personal information will be used, including whether that information is sold or shared.
Characteristics of CA or federal protected classifications, commercial information, biometric information, sensory or surveillance data, professional or employment-related information, education information, or profile data.
Government identification, consumer finances, race, religion and union membership, communications, genetics, biometrics, health, or sexual orientation
We retain your general personal information and sensitive personal information as reasonably necessary and proportionate to the purpose for which the personal information in each category was collected and will be processed. We may also retain your information with your consent. We seek to minimize the personal information needed to achieve the purpose for which the information is retained. We further employ safeguards for the personal information to address any possible negative impacts to data that is retained.
We will not collect additional categories of personal information without providing you a new Notice at Collection disclosing those categories.
If you wish to opt out of the selling and sharing of your personal information, please click the link that follows to complete and submit the form: Do Not Sell or Share My Personal Information.
The purpose of this privacy notice is to provide you with a comprehensive description of our online and offline practices regarding the collection, use, disclosure, retention, sharing, and sale of personal information and of your rights regarding your personal information as a resident of California or Virginia.
You have the right to request that we disclose what personal information we collect, use, disclose, sell, or share with third parties for cross-context behavioral advertising (e.g. targeted advertising). You have the right to request any of the following:
You can do this through a verified consumer request. That process is described below in the section, “Submitting a Verified Consumer Request.” We collect personal information, which means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“personal information”). The following table includes disclosures for the preceding 12 months of: categories of personal information we have collected about consumers, the categories we have disclosed for a business purpose, and categories of third parties with whom we shared the personal information during that period.
In the preceding 12 months we have not collected general personal information from the following categories:
Characteristics of CA or federal protected classifications, commercial information, biometric information, sensory or surveillance data, professional or employment-related information, education information, or profile data.
We do not use or disclose the below sensitive personal information for purposes beyond the minimum purposes specified under CPRA.
In the preceding 12 months we have not collected sensitive personal information in the following categories: Government identification, consumer finances, race, religion and union membership, communications, genetics, biometrics, health, or sexual orientation. The categories identified as collected in the tables above were collected from the following categories of sources:
We have sold or shared with third parties for cross-context behavioral advertising personal information to third parties in the preceding 12 months as disclosed in the table below.
We have not sold or shared the following categories of general personal information to or with third parties for cross-context behavioral advertising in the preceding 12 months: personal information, categories from Cal. Civ. Code § 1798.80(e), characteristics of CA or federal protected classifications, commercial information, biometric information, sensory or surveillance data, professional or employment-related information, education information or profile data.
We have not sold or shared any sensitive personal information to or with third parties for cross-context behavioral advertising in the preceding 12 months.
You may exercise your right to opt-out by:
Authorized agent for opt-out:
If you use an authorized agent to exercise your right to opt-out of the sale or sharing of personal information, please note that Backblaze requires that the authorized agent submit documentation signed by you that verifies the authorized agent has been authorized to act on your behalf. Once you make an opt-out request, we will comply within 15 business days. We will wait at least 12 months before asking you to reauthorize personal information sales or sharing. However, you may change your mind and opt back into personal information sales or sharing at any time by emailing us at privacyrequest@backblaze.com. We do not have actual knowledge that we sell the personal information of minors under 16 years of age.
You have the right to request correction of inaccurate personal information maintained by us. We may request documentation from you to determine the accuracy of the information maintained by us. If you provide us documentation either upon our request or through your own initiative, that documentation will only be used or maintained by us for the purpose of correcting your personal information and complying with our record keeping requirements under CCPA/ CPRA and VCDPA. We may deny your request if we have previously denied your same request to correct an alleged inaccuracy in the past six months, unless you provide new or additional documentation that the information at issue is inaccurate.
As an alternative to correction, we may delete the inaccurate information if it does not negatively impact you or if you consent to this deletion. We reserve the right to deny this request if allowed under law, or if we determine that the contested information is more likely than not accurate, based on the totality of circumstances. You can submit a correction request through a verified consumer request. That process is described below in the section, “Submitting a Verified Consumer Request.”
You have the right to limit our use and disclosure of your sensitive personal information collected by us for the purposes of inferring characteristics about you, which is called the “Right to Limit.” However, you do not have the right to limit certain uses and disclosures of your sensitive personal information for the following purposes:
Because the only sensitive personal information we use is your precise geolocation ONLY when you have “Find My Computer” enabled in your Backblaze account, you may exercise your Right to Limit by:
Disabling the “Locate My Computer” feature by following the directions found here.
If you have any trouble following the instructions to disable the “Find my Computer” function for the purposes of exercising your Right to Limit, please email us at privacyrequest@backblaze.com.
Authorized agent for request to limit
If you use an authorized agent to exercise your right to limit the use or disclosure of your sensitive personal information, please note that Backblaze requires that the authorized agent submit proof in the form of an authorization signed by you that the authorized agent has been authorized to act on your behalf. Once you make a request to limit, we will comply within 15 business days. We will wait at least 12 months before asking you to reauthorize the use or disclosure of your sensitive personal information beyond the limited purposes specified above. However, you may change your mind and opt back into certain uses and disclosures of your sensitive personal information at any time by emailing us at privacyrequest@backblaze.com.
You have the right to request that we delete any of your personal information collected by us, subject to certain exceptions. You can do this through a verified consumer request. That process is described below in the section, “Submitting a Verified Consumer Request.” We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:
You have the right to submit verified consumer requests to know information, to correct information, or for deletion.
The response to a request to know will provide all personal information collected and maintained about you since January 1, 2022, unless doing so proves impossible or would involve disproportionate effort. Please note that we are not required to provide personal information to you more than twice in a 12-month period. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.
You may submit a data subject request here. Additionally, you can submit a data subject requests by emailing us at privacyrequest@backblaze.com.
If you submit a request that is not through one of these designated methods or is deficient in some manner unrelated to verification, we will either treat it as if it had been submitted in accordance with our designated methods or provide you with information on how to submit the request or remedy any deficiencies.
Your request will be verified by matching the information you provide to information that we have collected. To verify your identity for your consumer request Backblaze will require one of the following (depending upon your request type):
Once we receive your verifiable consumer request, we will confirm receipt of the request within 10 business days describing our verification process. We will respond to your request within 45 calendar days, if we are able to verify your identity. Requests for deletion will require a separate confirmation that you want your information deleted.
If requests from you are manifestly unfounded or excessive in particular because of their repetitive character, we may either charge a reasonable fee or refuse to act on the request, notifying you of our reason for refusing to act. If we determine that the request warrants a fee, we will notify you of the reason for that determination and provide you with a cost estimate before completing your request.
Please note that, in responding to your request, we are not permitted to disclose or provide you with your Social Security number, driver’s license number or other government-issued identification number, financial account number, any health insurance or medical identification number, an account password, security questions and answers, or unique biometric data generated from measurements or technical analysis of human characteristics. However, we will inform you with sufficient particularity that we have collected the type of information without disclosing the actual data.
Requests to Know or Delete for Child Under the Age of 13: We do not knowingly collect information of minors under the age of 13.
Only you, or a natural person or a business entity registered with the Secretary of State to conduct business in California that you have authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. If you use an authorized agent, you may provide a power of attorney executed pursuant to California Probate Code sections 4000 to 4465. If a power of attorney that meets those provisions is not submitted, you will be required to provide the authorized agent signed permission to submit a request, verify your identity directly with us, and directly confirm with us that you provided the authorized agent permission to submit the request.
If you’re an authorized agent making a request you need to do the following:
(a) e-mail a copy of a power of attorney provided to you by the consumer pursuant to Probate Code sections 4000 to 4465; or
(b) e-mail proof of signed permission along with a copy of your ID and have the consumer direct confirm with us that they provided you permission to submit the request by sending an e-mail.
You may use an Opt-Out Preference Signal, such as the Global Privacy Control (GPC), to opt-out of the sale/sharing of your personal information.
If you do not have a Backblaze account or if you are not logged into your Backblaze account, your request to opt-out of sale/sharing will be linked to your browser identifier only and not linked to any account information because the connection between your browser and the account is not known to us.
If you would like us to make the connection between your browser and your account, and you have not yet opted out of sale/sharing your personal information, please click here to submit the form.
We will not discriminate against you for exercising any of your CCPA/ CPRA or VCDPA rights. Unless permitted by the CCPA/ CPRA or VCDPA, we will not:
California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our website that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please send an email to privacyrequest@backblaze.com. Backblaze responds to Do Not Sell Opt-Out requests as disclosed in the section “What we Sell and Right to Opt-Out.” Otherwise, we do not respond to web browser “do not track” signals or other mechanisms. Other parties may collect personally identifiable information about your activities over time and across different websites when a consumer uses our website or service.
We reserve the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on our website and update the notice’s effective date. Your continued use of our website following the posting of changes constitutes your acceptance of such changes.
If you have any questions or comments about this notice, the ways in which we collect and use your information, your choices and rights regarding such use, or wish to exercise your rights under California or Virginia law, please do not hesitate to contact us at: Website: https://www.backblaze.com/ Email: privacyrequest@backblaze.com