Last modified IN April 2023
Aspen HR PEO, LLC and its affiliates (the “Company”, “we”, “our”, or “us”) respects your privacy and are committed to protecting it through this Privacy Notice (“Privacy Notice”). This Privacy Notice describes the type of information we may collect from you or that you may provide to us when you visit www.aspenhr.com and the affiliated subdomains (the “Site”), use our Solutions (listed on the Site under the “Solutions” tab) that we provide to you or which are available through our Solutions and our policies and practices regarding how we collect, use, and disclose that information. If you engage in Solutions offered by us, then you may be subject to other terms and conditions and disclosures relevant to the Solutions that are not included in this Privacy Notice.
BY ACCESSING OR BROWSING THE SITE OR USING THE SOLUTIONS, YOU CONSENT TO THE COLLECTION AND USE OF YOUR INFORMATION AS DESCRIBED IN THIS PRIVACY NOTICE, AS MODIFIED FROM TIME TO TIME BY US.
This Privacy Notice applies to information we collect:
We reserve the right, at any time and without notice to you, to add to, change, update, or modify this Privacy Notice. If we decide to change our Privacy Notice, we will post a new notice on our Site and change the date at the top of the Privacy Notice. Any change, update or modification will be effective immediately upon posting on our Site and will apply to any Personal Information (as defined below) provided to us on and after that date. Your continued use of the Site or Solutions after we make changes is deemed to be acceptance of those changes, so please check the Privacy Notice periodically for updates.
If we make a material change to our Privacy Notice that affects how we collect or use your Personal Information, we will notify you via email, SMS text message, or other notification. If you have any questions about this Privacy Notice or our use of your information, you can email us at [email protected].
We use Personal Information to provide you with the features available through the Site and Solutions, to respond to requests that you initiate through the Site or Solutions, to process requests and required actions pursuant to our Solutions that you may initiate through the Site or Solutions, and to communicate with you. When we have location information, we may use it to tailor our services for you.
Additionally, we share Personal Information with health insurance and workers compensation providers, brokers, underwriters, taxation agencies, and state-level regulatory agencies, as needed to conduct business. Personal Information is shared pursuant to your electronic consent when enrolling in specific Solutions.
By providing us with your mobile phone number, you hereby expressly consent to receive automated text messages (including SMS and MMS) from us at the mobile phone number you provided. You represent that you are 18 years of age or older and you have the consent of the wireless account holder associated with the mobile phone number you provided.
You are responsible for all charges and fees associated with text messaging imposed by your wireless provider. Message and data rates may apply.
Text messages may be sent using an automatic telephone dialing system or other technology. Your consent to receive automated text messages is not required as a condition of purchasing, or utilizing, any of our Solution services. If you have opted in (this decision and others detailed further below), we may provide updates via text messages through your wireless provider to the mobile number you provided. Message frequency varies.
When you opt in to receive SMS communications from us:
We may use Personal Information, non-personal, and aggregate information to evaluate and improve our services, and for our own internal statistical, design, or operational purposes, or, for example, to estimate our audience size, measure aggregate traffic patterns, and understand demographic and other trends among our Client Users and Worksite Employees. We transfer information to certain vendors and service providers who provide technical infrastructure services and other content, analyze our services, and measure the effectiveness of our services.
We may outsource all (or some) of the tasks described in this Privacy Notice to third parties on a confidential basis, and would only share your Personal Information as needed for performance of those tasks, and only pursuant to appropriate confidentiality agreements. You agree that we may use your Personal Information, including your email address, to improve our Site and Solutions, and to customize the Solutions content and layout. These uses improve our Site and Solutions and better tailor it to meet your needs, so as to provide you with a smooth, efficient, and safe experience while using the Solutions.
If you provide us with feedback, we will collect that information and we may use it in our marketing materials, use it on our Site or to improve or enhance our Solutions, or disclose it for any purpose we choose. Your Personal Information will not be disclosed or associated with any feedback that we use or disclose unless you have given us permission to use your Personal Information for this purpose. We may use computer and device information for marketing purposes, to examine traffic to the Site and Solutions and improve the Site and Solutions to provide you a better experience.
We may disclose Personal Information, non-personal information, and aggregate information:
Information collected through our Site or Solutions is considered our trade secret or proprietary information. As the owner of such information, we may disclose or sell such information as an asset of the company in conjunction with the sale to a third-party of our company or a portion of our assets.
2.1) General Compliance Each Party shall comply with all Data Protection Laws applicable to its Processing of Personal Data hereunder. Where both parties are Controllers with respect to Processing undertaken under the Agreement, the Parties shall collaborate as necessary to ensure compliance with Data Protection Laws and the Parties’ obligations in connection with any Data Subject’s exercise of rights under Data Protection Law. Notwithstanding the foregoing: (a) to the extent Client provides Aspen with any Personal Data, Client shall be solely liable for the accuracy of such Personal Data and comply with all Data Protection Laws relating to the collection and transfer of Personal Data to Aspen, including without limitation obtaining any consents which may be required for Aspen to Process Personal Data for the purposes set forth in the Agreement or agreed between the Parties; (b) Client shall be solely responsible (subject to Aspen’s compliance with Sections 2.5 and 5 of this Exhibit B) for establishing the legal basis for, and the scope, limitations, extent, purpose, and means of conducting any criminal, credit, or other personal background check, credit report, consumer credit report, or similar reports requested by Client; and (c) the Parties agree that the Client shall be a Controller to the extent Client’s performance of its obligations under the Agreement (e.g. under Sections 5-9) involves the Processing of Personal Data. Each Party shall promptly notify the other if it becomes aware of any change or circumstance which will, may, or is alleged to impact the lawfulness of any Processing of Personal Data hereunder, together with all known details of the circumstances, and (immediately once available) revised and corrected data, if appropriate.
2.2) Privacy Notices. To the extent required by applicable Data Protection Laws, each Party will publish and maintain a Privacy Notice describing the Personal Data collected by the Party and the Processing to be undertaken by or on behalf of that Party under this Agreement with respect to such Personal For the avoidance of doubt, unless otherwise agreed in writing, Aspen shall have no obligation to provide notice with regard to Client’s Processing of Personal Data for its own purposes and shall not be liable to any Data Subject for any claim, harm, or damages arising from or relating to such Processing.
2.3) Security Procedures. Each Party will maintain reasonable and appropriate administrative, physical, and technical safeguards for protection of the security, confidentiality, and integrity of Personal Data. In particular, each party will implement reasonable and appropriate technical and organizational measures to ensure that only Authorized Persons Process Personal Data, and that Worksite Employee Personal Data is transferred to the other Party in a secure and encrypted manner and otherwise in compliance with Data Protection Laws.
2.4) Security Breach. In the event of any Security Incident affecting any Personal Data Processed by a Party in connection with the performance of its obligations under the Agreement, such Party shall promptly give notice to the other, together with all available material information relating to such Security Incident, and shall immediately commence a thorough investigation of any such Security Incident. Client specifically agrees to report any Security Incident to Aspen within twenty (20) days of Client’s knowledge of such Security Incident. Notifications to Aspen should be sent to [email protected]. If, as a result of such Security Incident, applicable Data Protection Laws require notice to authorities or individuals, or other remedial action, then such Party shall also undertake all such remedial actions (e.g. notice to individuals, credit reporting agencies, public authorities and other entities and credit monitoring) at such Party’s sole cost and expense. Each Party agrees to provide full cooperation to the other to the extent reasonably necessary in connection with any governmental or regulatory authority or agency involved in investigating or remediating any such Security Incident.
2.5) Processor Obligations. Notwithstanding any provision of this Agreement to the contrary, solely to the extent Aspen is acting as a Processor in the performance of its obligations under the Agreement (including, without limitation, in connection with the performance of its obligations under Section 7 of the Agreement, or as an operator of a Licensed Property under Section 5.5 of the Agreement):
2.6) Sub-processors. Each Party will perform reasonable due diligence to ensure that any Processors that Process Personal Data on a Party’s behalf or perform the Party’s obligations under the Agreement (“Subprocessor“) are able to, and are obligated by written contract to protect Personal Data in a manner consistent with the Party’s obligations under this Exhibit B. Each Party shall be liable for the acts and omissions of its Subprocessors to the same extent the Party would be liable if performing the services of each Subprocessor directly under the terms of this Exhibit B.
We use Personal Information to provide you with the features available through the Site and Solutions, to respond to requests that you initiate through the Site or Solutions, to process requests and required actions pursuant to our Solutions that you may initiate through the Site or Solutions, and to communicate with you. When we have location information, we may use it to tailor our services for you.
Additionally, we share Personal Information with health insurance and workers compensation providers, brokers, underwriters, taxation agencies, and state-level regulatory agencies, as needed to conduct business. Personal Information is shared pursuant to your electronic consent when enrolling in specific Solutions.
By providing us with your mobile phone number, you hereby expressly consent to receive automated text messages (including SMS and MMS) from us at the mobile phone number you provided. You represent that you are 18 years of age or older and you have the consent of the wireless account holder associated with the mobile phone number you provided.
You are responsible for all charges and fees associated with text messaging imposed by your wireless provider. Message and data rates may apply.
Text messages may be sent using an automatic telephone dialing system or other technology. Your consent to receive automated text messages is not required as a condition of purchasing, or utilizing, any of our Solution services. If you have opted in (this decision and others detailed further below), we may provide updates via text messages through your wireless provider to the mobile number you provided. Message frequency varies.
When you opt in to receive SMS communications from us:
We may use Personal Information, non-personal, and aggregate information to evaluate and improve our services, and for our own internal statistical, design, or operational purposes, or, for example, to estimate our audience size, measure aggregate traffic patterns, and understand demographic and other trends among our Client Users and Worksite Employees. We transfer information to certain vendors and service providers who provide technical infrastructure services and other content, analyze our services, and measure the effectiveness of our services.
We may outsource all (or some) of the tasks described in this Privacy Notice to third parties on a confidential basis, and would only share your Personal Information as needed for performance of those tasks, and only pursuant to appropriate confidentiality agreements. You agree that we may use your Personal Information, including your email address, to improve our Site and Solutions, and to customize the Solutions content and layout. These uses improve our Site and Solutions and better tailor it to meet your needs, so as to provide you with a smooth, efficient, and safe experience while using the Solutions.
If you provide us with feedback, we will collect that information and we may use it in our marketing materials, use it on our Site or to improve or enhance our Solutions, or disclose it for any purpose we choose. Your Personal Information will not be disclosed or associated with any feedback that we use or disclose unless you have given us permission to use your Personal Information for this purpose. We may use computer and device information for marketing purposes, to examine traffic to the Site and Solutions and improve the Site and Solutions to provide you a better experience.
We may disclose Personal Information, non-personal information, and aggregate information:
Information collected through our Site or Solutions is considered our trade secret or proprietary information. As the owner of such information, we may disclose or sell such information as an asset of the company in conjunction with the sale to a third-party of our company or a portion of our assets.
“Controller” means a person that, either alone or with another person, determines the purposes and means of Processing Personal Data, and includes a “Business” as defined by the CCPA.
“Data Subject” means any natural person to whom, or household to which, Personal Data relates.
“Data Protection Laws” means all federal, state, local and foreign laws, statutes, executive orders, and final rules or regulations applicable to the Processing of Personal Data under this Agreement in the respective jurisdictions, including (to the extent applicable) Regulation 2016/679 (“GDPR”) and other laws, rules, directives, and regulations applicable to Personal Data in the European Economic Area, United Kingdom, or Switzerland (collectively, “EU Data Protection Laws”), and Cal. Civ. Code §§ 1798.80 et seq., 1798.100 et seq.) (“CCPA”).
“Personal Data” means any data that identifies, relates to, describes, is capable of being associated, or could reasonably be linked, directly or indirectly, with a particular individual or household, and includes without limitation, “nonpublic personal information” as defined under the Gramm-Leach-Bliley Act (15 U.S.C. § 6801 et seq.), “Personal Data” as defined in EU General Data Protection Regulation (Regulation 2016/679), and “personal information” as defined under the Massachusetts Standards for the Protection of Personal Data of Residents of the Commonwealth (201 CMR 17.01 et seq.); “medical information” (as defined under Cal Civ. Code § 56.20; and “personal information” as defined by CCPA.
“Processing” means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
“Processor” means a person, to the extent that person Processes Personal Data on behalf of a Controller, and includes for purposes of this Exhibit B any party that meets the definition of a Service Provider or Third Party under the CCPA.
“Security Incident” means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorized disclosure of, or access to, Personal Data, or any other event affecting Personal Data which may result in data breach or incident notification obligations to Data Subjects or regulatory authorities under applicable Data Protection Laws.
We use Personal Information to provide you with the features available through the Site and Solutions, to respond to requests that you initiate through the Site or Solutions, to process requests and required actions pursuant to our Solutions that you may initiate through the Site or Solutions, and to communicate with you. When we have location information, we may use it to tailor our services for you.
Additionally, we share Personal Information with health insurance and workers compensation providers, brokers, underwriters, taxation agencies, and state-level regulatory agencies, as needed to conduct business. Personal Information is shared pursuant to your electronic consent when enrolling in specific Solutions.
By providing us with your mobile phone number, you hereby expressly consent to receive automated text messages (including SMS and MMS) from us at the mobile phone number you provided. You represent that you are 18 years of age or older and you have the consent of the wireless account holder associated with the mobile phone number you provided.
You are responsible for all charges and fees associated with text messaging imposed by your wireless provider. Message and data rates may apply.
Text messages may be sent using an automatic telephone dialing system or other technology. Your consent to receive automated text messages is not required as a condition of purchasing, or utilizing, any of our Solution services. If you have opted in (this decision and others detailed further below), we may provide updates via text messages through your wireless provider to the mobile number you provided. Message frequency varies.
When you opt in to receive SMS communications from us:
We may use Personal Information, non-personal, and aggregate information to evaluate and improve our services, and for our own internal statistical, design, or operational purposes, or, for example, to estimate our audience size, measure aggregate traffic patterns, and understand demographic and other trends among our Client Users and Worksite Employees. We transfer information to certain vendors and service providers who provide technical infrastructure services and other content, analyze our services, and measure the effectiveness of our services.
We may outsource all (or some) of the tasks described in this Privacy Notice to third parties on a confidential basis, and would only share your Personal Information as needed for performance of those tasks, and only pursuant to appropriate confidentiality agreements. You agree that we may use your Personal Information, including your email address, to improve our Site and Solutions, and to customize the Solutions content and layout. These uses improve our Site and Solutions and better tailor it to meet your needs, so as to provide you with a smooth, efficient, and safe experience while using the Solutions.
If you provide us with feedback, we will collect that information and we may use it in our marketing materials, use it on our Site or to improve or enhance our Solutions, or disclose it for any purpose we choose. Your Personal Information will not be disclosed or associated with any feedback that we use or disclose unless you have given us permission to use your Personal Information for this purpose. We may use computer and device information for marketing purposes, to examine traffic to the Site and Solutions and improve the Site and Solutions to provide you a better experience.
We may disclose Personal Information, non-personal information, and aggregate information:
Information collected through our Site or Solutions is considered our trade secret or proprietary information. As the owner of such information, we may disclose or sell such information as an asset of the company in conjunction with the sale to a third-party of our company or a portion of our assets.
