Doubtless Privacy Policy

Doubtless respects your privacy and is committed to protecting your personal data also called personal information under applicable law. This privacy policy will inform you as to how we look after your personal data when you visit our website (regardless of where you visit it from) or apply for a job with us, and tell you about your privacy rights and how the law protects you. Throughout this policy, the terms ‘personal data’ and ‘personal information’ are used interchangeably and have the same meaning unless otherwise specified by applicable law.

Important information and who we are

Purpose of this privacy policy

This privacy policy aims to give you information on how Doubtless collects and processes your personal data through your use of this website, including when applying for a job via our website.

It is important that you read this privacy policy together with any other privacy policy or fair processing policy we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your data. This privacy policy supplements other notices and privacy policies and is not intended to override them.

Controller

This privacy policy is issued by JAB Pet Insurance L.P. (known as “Doubtless”) so when we mention “we”, “us”, “our” or “Doubtless” in this privacy policy, we are referring to this entity, which is the controller responsible for this website.

Should you interact with one of our subsidiary companies, that subsidiary company will be the controller for your data in relation to that visit and/or interaction and their privacy policy will apply.

Registered Address

200 W. Adams St, Suite 2000, Chicago, IL, 60606, USA

We have appointed a data protection officer (DPO), or privacy officer under applicable law who is responsible for overseeing questions in relation to this privacy policy. If you have any questions about this privacy policy, including any requests to exercise your legal rights or to make a complaint relating to our data protection practices, please contact the DPO using the details set out below.

Contact details

If you have any questions about this privacy policy or our privacy practices, or to make a complaint about our data protection practices, please contact us or our DPO (or Privacy Officer) in the following ways:

Full name of legal entity: JAB Pet Insurance L.P.

Address: 200 W. Adams St, Suite 2000, Chicago, IL, 60606, USA

Email: DPO/Privacy Officer: [email protected]

Changes to the privacy policy

We keep our privacy policy under regular review.

Links to other websites

This website includes links to websites of other companies within the Doubtless Group of companies. When you leave our website, we encourage you to read the privacy policy of every website you visit.

This website may also include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy policy of every website you visit.

The data we collect about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store, disclose and transfer different kinds of personal data about you which we have grouped together as follows:

Identity Data includes first name, last name, any previous names, username or similar identifier, marital status, title, date of birth and gender.

Contact Data includes billing address, delivery address, email address and telephone numbers.

Financial Data includes bank account and payment card details.

Transaction Data includes details about payments to and from you and other details of purchase you have made from us.

Technical Data includes internet protocol (IP) address, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access this website.

Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.

Usage Data includes information about how you use our website.

Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

Recruitment Data includes information you provide to us in your curriculum vitae, resumé, covering letter or application form, including your educational history, qualifications and employment history, and any other information you or others provide to us during the interview and recruitment process.

We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data could be derived from your personal data but is not considered personal data in law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy policy.

We do not collect any sensitive or special categories of personal data about website users (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences of website users. However, if you are applying for a job with us, we may collect the following types of more sensitive, special category personal data:

Information about your race or ethnicity, religious or philosophical beliefs, trade union membership, sexual orientation and political opinions.
Information about your health, including any medical condition, health and sickness records.
Information about criminal convictions and offences.

We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data.

How is your personal data collected?

We use different methods to collect data from and about you as a website user, including through:

Automated technologies or interactions. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies and other similar technologies.

We may also receive Technical Data about you if you visit other websites employing our cookies. Please see our cookie policy for further details.

Third parties or publicly available sources. We will receive personal data about you from various third parties as set out below:

Technical Data from analytics providers such as Google based outside the UK or EU

If you are applying for a job with us, we collect personal information about candidates from the following sources:

You, the candidate.
Recruitment agencies, if relevant.
Background check providers, if relevant.
Credit reference agencies, if relevant.
Criminal convictions checking services, such as the UK Disclosure and Barring Service, if relevant.
Your named referees.
Publicly accessible sources such as linkedin, to the extent permitted by applicable law.

How we use your personal data

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

To perform a contract with you

To comply with our legal and regulatory obligations

To fulfil our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.

Where you are applying for a job with us, we may also use your personal data to decide whether to enter into a contract of employment with you.

If you are applying for a job with us and you fail to provide information that is necessary for us to consider your application (such as evidence of qualifications or work history, or a credit check or references where the role requires them), we will not be able to process your application successfully.

Purposes for which we will use your personal data

We have set out below, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate. Please use the Glossary at the end of this policy to understand the meaning of some of the terms used in this section.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

Purpose/Activity

Type of data

Lawful basis for processing including basis of legitimate interest

To administer this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)

Identity
Contact
Technical

Necessary for our legitimate interests (for provision of administration and IT services, network security, to prevent fraud)
Necessary to comply with a legal obligation

To deliver relevant website content to you and measure or understand the effectiveness of the content we serve to you

Identity
Contact
Profile
Usage
Marketing and Communications
Technical

Your express consent
Necessary for our legitimate interests (to study how visitors use our website, to develop them, to grow our business and to inform our marketing strategy)

To use data analytics to improve our website, marketing, relationships and experiences

Technical
Usage

Your express consent
Necessary for our legitimate interests (to keep our website updated and relevant, to develop our business and to inform our marketing strategy.

To manage our relationship with you which will include:

· Notifying you about changes to our terms or privacy policy

· Dealing with your requests, complaints and queries

· Identity

· Contact

· Profile

· Marketing and Communications

· Performance of a contract with you

· Necessary to comply with a legal obligation

· Necessary for our legitimate interests (to keep our records updated and manage our relationship with you

To send you relevant marketing communications and make personalised suggestions and recommendations to you about goods or services that may be of interest to you based on your Profile Data

· Identity

· Contact

· Technical

· Usage

· Profile

· Marketing and Communications

· Necessary for our legitimate interests (to carry out direct marketing, develop our products/services and grow our business)

· Consent, having obtained your prior consent to receiving direct marketing communications

When you apply for a job with us, to assess your skills, qualifications and suitability for the role.

· Recruitment

· Necessary for our legitimate interests (because it would be beneficial to our business to appoint someone to the role).

· Necessary to take steps at your request prior to entering into a contract with you.

When you apply for a job with us, to carry out background and reference checks, including about criminal convictions, where applicable. Background checks will not be conducted in every jurisdiction, as this will depend on applicable law (e.g. not in Germany)

· Identity

· Contact

· Recruitment

· Necessary for our legitimate interests (because it would be beneficial to our business to appoint an appropriate person to the role).

· Necessary to comply with our legal or regulatory obligations.

· Necessary for our compliance with employment, social security or social protection laws.

When you apply for a job with us, to communicate with you about the recruitment process.

· Identity

· Contact

· Necessary for our legitimate interests (because it would be beneficial to our business to appoint someone to the role).

· Necessary to take steps at your request prior to entering into a contract with you.

When you apply for a job with us, to keep records relating to our hiring processes

· Identity

· Contact

· Recruitment

· Necessary for our legitimate interests (because it would be beneficial to our business to appoint someone to the role).

· Necessary for our legal and regulatory compliance.

When you apply for a job with us, to consider whether we need to make reasonable adjustments for your disability during the recruitment process.

· Identity

· Contact

· Recruitment

· Special category data about disability

· Necessary for our legitimate interests (because it would be beneficial to our business to appoint someone to the role).

· Necessary to take steps at your request prior to entering into a contract with you.

· Necessary to comply with our legal or regulatory obligations.

· Necessary for our compliance with employment, social security or social protection or human rights laws.

When you apply for a job with us, to carry out meaningful equal opportunity monitoring and reporting, where required under applicable law.

· Identity

· Contact

· Recruitment

· Special category data about racial or ethnic origin, religious or philosophical beliefs, disability or sexual orientation

· Necessary to comply with our legal or regulatory obligations.

· Necessary for our compliance with employment, social security or social protection or human rights laws.

Automated Decision-Making

Automated decision-making is the process of making decisions by automated means, with or without any human involvement.

We do not make decisions about you based solely on automated processing that would have legal, or similarly significant, effects for you. We will notify you if this position changes.

Direct marketing

You will receive marketing communications from us if you have requested or consented to information from us or purchased similar goods or services from us and you have not opted out of receiving marketing after having been notified accordingly by us.

We may also analyse your Identity, Contact, Technical, Usage and Profile Data to form a view which products, services and offers may be of interest to you so that we can then send you relevant marketing communications.

Third-party marketing

We will get your express consent before we share your personal data with any third party for their own direct marketing purposes.

Opting out of marketing

You can ask us to stop sending you marketing communications at any time by following the opt-out links within any marketing communication sent to you or by contacting us [email protected].

If you opt out of receiving marketing communications, you will still receive service-related communications that are essential for administrative or customer service purposes.

Social Media

As an extension of our internet presence, we have social media accounts on Facebook, Instagram, LinkedIn, and TikTok, or others. The social media accounts of businesses are public, and therefore we recommend anyone who chooses to interact via social media should first read the terms of use and confidentiality and privacy policies of those platforms to inform themselves of how personal information is used by those platforms. Since all content posted on our social media accounts can be viewed publicly, we recommend users exercise caution when providing or disclosing personal information or details about themselves.

We offer content or discussions on our social media accounts, which, depending on your account settings, may allow us to access certain personal information associated with your social media account(s). We do not receive direct access to users’ private social media account information. Any data shared with us is governed by the privacy settings and policies of the social media platform. We may also use the services provided by social media platforms to display targeted advertisements intended for the users of such platforms.

Email and Advertising Targeting

We strive to manage all email addresses responsibly and in compliance with applicable laws. Therefore, pursuant to express consent you have given us, or implied based on the circumstances, we may send you promotional messages by email, unless you unsubscribe from such emails.

To better understand and improve the effectiveness of our email marketing efforts, when we send you an email for marketing purposes, we collect information to assess the open rate and to know whether you clicked on the links in the email, and which of our websites you visited.

You may remove your name from our mailing list at any time by following the unsubscribe link displayed at the bottom of every advertising email from us. We will remove your name from our electronic mailing lists within 10 business days of your request.

Text/SMS Communications

We may utilize text messaging, or SMS, communications and we strive to ensure compliance with all applicable laws for responsible SMS communication. Therefore, to receive SMS updates and promotions, we will ask for your express written consent before communicating with you. Message and data rates imposed by your mobile provider may apply. Text message opt-in originator will not be shared with affiliates or third parties for marketing purposes without your consent.

If you choose to opt-out of receiving promotional SMS communications, you may do so at any time by simply responding ‘STOP’ to our messages or by clicking the unsubscribe link in the message. However, we may continue to periodically communicate with you via SMS for non-promotional matters.

Cookies

You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of this website may become inaccessible or not function properly. For more information about the cookies we use, please see our Cookie Policy.

Change of purpose

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Protecting Children

Our website and mobile application are not directed toward children under the age of 16. We do not knowingly collect or use personal information from children under 16. If you are a parent or legal guardian and have reason to believe that any of your children has provided us with personal information without your consent, please contact us and we will take steps to delete the information.

Disclosures of your personal data

We may share, or disclose your personal data with the parties set out below, if necessary for the purposes set out in the table “Purposes for which we will use your personal data” above.

Sharing of information within our Group: We share your personal data within our Group for commercial reasons to understand our visitor base to our website.
Sharing of information outside our Group: IT service providers that perform services on our behalf related to the website strictly where necessary, and recruitment agencies, background checks providers and credit checking agencies, where relevant when you are applying for a job with us.
Subject to applicable laws, third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy policy.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions. In addition, we may disclose your personal data if we are under a duty to disclose or share your personal data in order to comply with any legal obligation including a search warrant, subpoena or court order, or if we believe in good faith is reasonably necessary to comply with any law, regulation, rule, or other lawful requests from governmental, regulatory or administrative agencies or law enforcement authorities (including in response to law enforcement or national security requirements), or in order to enforce or apply our website’s Terms and Conditions of Use; or to protect the rights, property, or safety of us or others.

Data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

UK and EU Data Protection

International transfers

In cases of international data transfers originating from the UK or the European Economic Area (EEA) to jurisdictions outside the UK or to a non-EEA country, the transfer of your personal data may take place. Where the UK government or the European Commission has recognised the recipient country as providing an adequate level of data protection, your personal data may be transferred on this basis without specific authorisation.

In cases of international data transfers originating from the UK or EEA to countries where the level of protection has not been recognised as adequate by the UK government or the European Commission, we will either rely on an exemption from a rule or law that is applicable to the specific situation (e.g. if the transfer is necessary to perform our contract with you) or use one of the following safeguards to ensure the protection of your personal data:

Standard contractual clauses approved by the Information Commissioner’s Office or European Commission; or
Binding corporate rules (for inter-group transfers), where applicable.

To obtain a copy of these safeguards or details on where they are available, you can send us a written request as set out in Section 9.

Retention of your personal data

We retain your personal data for a minimum period from the date of the data collection or the date of our last contact with you so that we can comply with applicable laws and regulations and our operational requirements. Where you have applied for a job with us, we will retain your information for a period of 6 months, or where required by applicable law, 1 year, after we have communicated our decision about whether to appoint you to the role. We retain your personal information for that period so that we can show, in the event of a legal claim, that we have not discriminated against candidates on prohibited grounds and that we have conducted the recruitment process in a fair and transparent way. After this period, we will securely destroy your personal information in accordance with [our data retention policy]. If we would like to retain your personal information on file, on the basis that we might be able to consider you for an opportunity that may arise in future, we will write to you separately, seeking your explicit consent to retain your personal information for a fixed period for that purpose.

What are your rights and how can you exercise them?

In accordance with applicable regulations and where applicable, including based on your location and applicable law, you may you have the following rights:

to access: you can obtain information relating to the processing of your personal data and a copy of the personal data held.
to rectify: where you consider that your personal data are inaccurate or incomplete, you can request that such personal data is updated.
to erase: you can require the deletion of your personal data, to the extent permitted by law.
to restrict: you can request the restriction of the processing of your personal data.
to object: you can object to the processing of your personal data, on grounds relating to your particular situation. You have the absolute right to object to the processing of your personal data for direct marketing purposes, which includes profiling related to such direct marketing.
to withdraw your consent: where you have given your consent for the processing of your personal data, you have the right to withdraw your consent at any time, subject to any subject to legal or contractual restrictions and reasonable notice where permitted by applicable law.
to data portability: where legally applicable, you have the right to have the personal data you have provided to us be returned to you or, where technically possible, transferred to a third party.

If you wish to exercise the rights listed above, please contact us using the details listed above.

You may be required to verify your identity in certain cases when you exercise your rights.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We try to respond to all legitimate requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Complaints

If you believe that we do not process your personal data in accordance with applicable laws, you may lodge a complaint with a competent supervisory authority, e.g. in the country where we are established or where you have your habitual residence.

If you are in the UK, you have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). However, before doing so please make sure you have first made your complaint to us or asked us for clarification if there is something you do not understand. The ICO will expect you to have done this before reviewing your complaint. You can make a complaint to us using the contact details set out above.

If you are in France, you have the right to make a complaint at any time to the French data protection authority (CNIL):

Contact form : https://www.cnil.fr/fr/webform/nous-contacter

Online complaint service https ://www.cnil.fr/fr/plaintes

Mailing address:

Commission nationale de l’informatique et des libertés
3 Place de Fontenoy
TSA80715
75334 PARIS CEDEX 07
France

If you are in Canada, you have the right to make a complaint at any time to the appropriate federal or provincial privacy commissioner.

Glossary

Lawful basis means the justification that we have for processing your personal data in order for it to be considered lawful.

Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

Comply with a legal obligation means processing your personal data where it is necessary for compliance with a legal obligation that we are subject to.

US Disclosures

Notice To California Consumers

If you are a California resident, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”), provides you with certain rights regarding your Personal Information. This section describes your CCPA rights and explains how to exercise those rights. For purposes of this section, “Personal Information” has the meaning given in the CCPA and does not include information that is publicly available, deidentified, or aggregated.

Collection and Disclosure of Personal Information

In the preceding twelve (12) months, we have collected the following categories of Personal Information:

identifiers (e.g., name, email address, postal address, phone number, IP address, account name);
Personal Information categories listed in Cal. Civ. Code § 1798.80(e) (e.g., name, address, telephone number, credit card number);
commercial information (e.g., records of products or services purchased, purchasing histories or tendencies);
internet or other electronic network activity information (e.g., browsing history, search history, interaction with the website);
geolocation data;
professional or employment-related information (e.g., job application data); and
inferences drawn from the above categories to create a profile reflecting your preferences and characteristics.

The categories of third parties to whom we disclose Personal Information for a business purpose include: affiliates and subsidiaries, service providers, payment processors, hosting providers, analytics providers, marketing and advertising platforms, customer relationship management providers, professional advisors (such as lawyers, auditors, and insurers), business successors (in the event of a merger, acquisition, or similar transaction), and government authorities or law enforcement agencies (where required by applicable law or legal process).

Sources of Personal Information

We collect Personal Information from the following categories of sources: (a) directly from you (e.g., when you create an account, make a purchase, or contact us); (b) indirectly from you (e.g., through your use of the website); (c) from third parties (e.g., social media platforms, analytics providers, and advertising networks); and (d) from publicly available sources.

Business and Commercial Purposes for Collecting Personal Information

We collect and use Personal Information for the business and commercial purposes described in the “How We Use Your Personal Information” section of this Privacy Policy, including: (a) providing, maintaining, and improving the website and our services; (b) processing transactions and fulfilling orders; (c) communicating with you; (d) marketing and advertising; (e) detecting, preventing, and responding to security incidents and fraud; (f) debugging and repairing errors; (g) performing internal research and analytics; and (h) complying with legal obligations.

Sale and Sharing of Personal Information

We do not “sell” your Personal Information as that term is defined under the CCPA. We do not “share” your Personal Information for cross-context behavioral advertising purposes. We do not have actual knowledge that we sell or share the Personal Information of consumers under 16 years of age. Please note that you may use opt-out preference signals such as the Global Privacy Control (GPC) to automatically opt-out of the sale/sharing of your personal information when you visit our website.

Sensitive personal information is a subtype of personal information consisting of specific information categories. We may collect and use information that falls within the sensitive personal information categories below. For more information about the use of such information, please see the defined Business Purpose for every category.

Information Category	Retention Period	Business Purpose	Sold or Shared for Cross-Context Behavioral Advertising
Government identifiers, such as your Social Security number, driver’s license, state identification card, passport and visa information, or immigration status and documentation.	We retain personal information for a time reasonably necessary to achieve the purposes unless a longer retention period is required or permitted by applicable law.	· Provide products and services · Marketing and Advertising · Perform data analytics · Fraud Detection and Prevention	Not Sold or Shared
Complete account access credentials, such as usernames, account numbers, or card numbers combined with required access/security code or password.	Not Collected	Not Collected	Not Sold or Shared
Precise geolocation	We retain personal information for a time reasonably necessary to achieve the purposes unless a longer retention period is required or permitted by applicable law.	· Provide products and services based on your consent. · Compliance and legal obligations	Not Sold or Shared
Racial or ethnic origin.	Not collected	Not Collected	Not Sold or Shared
Citizenship or immigration information.	Not collected	Not Collected	Not Sold or Shared
Religious or philosophical beliefs.	Not Collected	Not Collected	Not Sold or Shared
Union membership.	Not Collected	Not Collected	Not Sold or Shared
Mail, email, or text messages contents not directed to the Company.	Not collected	Not Collected	Not Sold or Shared
Genetic data.	Not Collected	Not Collected	Not Sold or Shared
Neural data, which is information generated by measuring a consumer’s central or peripheral nervous system activity that is not inferred from nonneural information.	Not Collected	Not Collected	Not Sold or Shared
Unique identifying biometric information.	Not Collected	Not Collected	Not Sold or Shared
Health information, including job restrictions and workplace illness and injury information.	Not Collected	Not Collected	Not Sold or Shared
Sex life or sexual orientation information.	Not collected	Not Collected	Not Sold or Shared

Automated Decision Making Technologies

Automated decision-making technologies (ADMTs) are technologies that process Personal Information and use computation to execute a decision and either replace or substantially replace human decision-making, resulting in decisions made without human involvement. Decisions are significant when they result in the provision or denial of employment or independent contracting opportunities or compensation, education enrollment or opportunities, housing, healthcare services, or financial or lending services. Advertising is not a significant decision. We do not currently use ADMT to make significant decisions about applicants, so we do not provide ADMT access, opt-out, or appeal rights.

Notice of Financial Incentives

We may offer discounts, advertisements, marketing incentives, rewards and other offers and benefits to you if you sign up to email and SMS promotional campaigns or other programs. When you sign up for one of our email or SMS programs, we typically ask you to provide your name and contact information (such as email address and/or telephone number). Because our programs involve the collection of Personal Information as well as offering of various benefits, our programs may be interpreted as providing a “financial incentive” under California Law. To the extent we derive value from the collection of the Personal Information you provide to us, that value is directly related to the value to us of the opportunity to promote products to you as well as the value of the benefits that you obtain. You may withdraw from participating in our email or SMS programs at any time by contacting us using the designated method described in the terms and conditions that apply to the program, or by contacting us at the information below.

Your Privacy Rights

We make available our products & services to the general public and will respond to individual privacy rights requests submitted by our customers. In some cases, We also acts as a software or platform service provider to our Customers and the data in our systems is owned by those Customers, meaning, those Customers have jurisdiction over the data and any end-user data subject request should be submitted directly to that Customer.

Right to Know. You can request that we disclose to you: (i) the categories and/or specific pieces of Personal Information we have collected about you (see the “What Personal Information Do We Collect” section), (ii) the categories of sources for that Personal Information (see the “How We Collect Personal Information” section), (iii) the purposes for which we will use that information, (iv) the categories of any third parties with whom we may disclose that information, and (v) the categories of information that we may disclose to any third parties. We will provide you with this information for the 12-month period preceding your request. You can make a request to know twice a year.
Right to Deletion. You can request that we delete your Personal Information and ask our service providers to do the same. We will honor the request to delete unless one of the following exceptions applies:
- Transactional: information necessary to complete a transaction or contract for which it was collected.
- Security: to detect, prevent, or investigate security incidents.
- Error Correction: to identify and repair any errors or bugs.
  - Non-identifying information: To help diagnose problems and administer our Website, information such as your browser type, and operating system may be gathered, but do not identify any individual.
- Legal: to comply with applicable laws or legal obligations, to protect against fraud or illegal activity, or to ensure the right of a consumer to exercise rights, such as free speech rights.
- Internal Use: to use in a lawful manner that is aligned with the expectations of the consumer and the context in which the consumer provided the information (i.e., improve our services).
Right to Opt-Out of Sale or Sharing. You may opt out of us sharing your information by submitting a request.
- We process opt-out preference signals, such as the Global Privacy Control, as required by the CCPA. These signals set the opt-out of sale and sharing preferences for the particular browser or device you are using. For information about how to use Global Privacy Control, please visit https://globalprivacycontrol.org/.
- You can manage your preferences through the cookie widget or the “Do Not Sell or Share My Personal Information” link on our Website.
- Submit a request through the “How May I Make a Request” link below.
Right to Nondiscrimination. We will not discriminate against you, and we will not charge you a different price or provide a different level of service for exercising your CCPA rights. We will not discriminate against you for exercising any of your CCPA rights and we will not deny you goods or services, charge you a different price, or provide you with a lower quality of goods or services if you exercise any of your CCPA Rights.
Right to Correct Inaccurate Personal Information. You can request correction of any inaccurate Personal Information we have about you.
Right to Limit. Upon your direction, we will limit the use and disclosure of sensitive Personal Information collected about you, such as only using this information to provide you with the services you requested.

California Privacy Rights Act Non-Discrimination Disclosure

We will not discriminate against you, and we will not charge you a different price or provide a different level of service for exercising your rights. We will not discriminate against you for exercising any of your rights and we will not deny you goods or services, charge you a different price, or provide you with a lower quality of goods or services if you exercise any of your Rights.

California Privacy Rights Act Retention Disclosure

We keep your information for as long as it is required to fulfill the products or services relevant to the “Identified Purposes” as defined in this Privacy Policy, as permitted or as required by law, or otherwise communicated to you.

Your California Privacy Rights

California’s “Shine the Light” law permits customers in California to request certain details about how certain types of their information are shared with third parties for those third parties’ own direct marketing purposes. If you are a California resident, you may opt-out of such sharing by emailing us at [email protected] or mailing a written request to the address under the “How May I Make A Request” section below.

US Additional Privacy Disclosures

State consumer privacy laws may provide their residents with additional rights regarding our use of their Personal Information. The exact scope of these rights may vary by state. To exercise any of these rights, see the “How I May Make a Request” section below. We will utilize commercially reasonable security and confidentiality measures to secure and maintain Personal Information, including but not limited to compliance with applicable data privacy laws, rules, and regulations, which protect the privacy rights of individuals submitting information to Us, including without limitation state and federal laws in the United States, such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act, Colorado Privacy Act, Connecticut Act Concerning Personal Data, Delaware Personal Data Privacy Act, Iowa Consumer Data Privacy Act, Maryland Online Data Privacy Act, Minnesota Consumer Data Privacy Act, Montana Consumer Data Privacy Act, Nebraska Data Privacy Act, New Hampshire Privacy Act, New Jersey Data Privacy Act, Oregon Consumer Privacy Act, Texas Data Privacy and Security Act, Virginia Consumer Data Protection Act, and the Utah Consumer Privacy Act.

We will honor requests received to the extent required by applicable law and within the time provided by law. None of the rights are absolute and are subject to legal and regulatory exceptions and exemptions. We will not discriminate against any individual who submits a request through our Privacy Rights Request process defined below.

Montana Consumer Data Privacy Act Disclosure

We do not engage in profiling consumers in furtherance of automated decisions that produce significant legal consequences as those terms are defined under the Montana Consumer Data Privacy Act.

Minnesota Consumer Data Privacy Act Retention Disclosure

We keep your information for as long as it is required to fulfill the products or services relevant to the ‘Identified Purposes’ as defined in this Privacy Policy, as permitted or as required by law, or otherwise communicated to you.

Oregon Consumer Privacy Act Profiling Disclosure

We do not engage in profiling consumers in furtherance of automated decisions that produce legal or similarly significant effects, as those terms are defined under the Oregon Consumer Privacy Act.

Oregon Consumer Privacy Act Controller Entity Disclosure

The controller entities that are subject to this Privacy Policy and this disclosure include JAB Pet Insurance L.P. (known as “Doubtless”).

How May I Make a Request?

You may make a request using one of the methods below:

Submit a Privacy Rights Request
Sending us a request via mail to: Attn: Privacy Officer Doubtless Pet Insurance Group, 200 W. Adams Street, Chicago, IL.

What Do I Need to Provide When Making a Request?

To verify your identity when you are making a request, you may need to provide the following information if applicable:

Name
Telephone number
Mailing address
Email address

We will match this information to the information in our systems and under certain circumstances may request additional information via email or telephone to ensure we are interacting with the correct individual.

Please be aware that we do not accept or process requests through other means (e.g., via fax, chats, social media, etc.).

Privacy Request Verification Process

If you (or your authorized agent) make any request related to your personal information, we will ascertain your identity (and the identity of the authorized agent, to the extent applicable) to the degree of certainty required or permitted under the law before addressing your request. We will, to the extent required or permitted by law, require you (or your authorized agent) to verify your request via email or other means and match at least four pieces of personal information we have previously collected from you before granting you access to, or erasing, specific pieces or categories of personal information, or otherwise responding to your request.

May I Make Multiple Requests?

If you wish to make multiple requests under this section, we recommend sending the deletion request last, as we will not be able to fulfill your other requests once we have deleted your information.

How Long Will It Take to Process My Request?

For verifiable consumer requests related to opting out of the sharing of data, we will respond within 10 days of receiving the request.

For all other requests, we will respond to a verifiable consumer request within forty-five (45) calendar days of receipt. If necessary, we may require an additional forty-five (45) calendar days, at which point we will inform you of the reason and extension period in writing.

Canadian Users – Additional Terms

Consent

By visiting, browsing or using our website and/or providing personal information to us, you voluntarily consent to the collection, use, and disclosure of personal information and other information as specified in this privacy policy. Without limiting the foregoing, we may on occasion ask you to consent when we collect, use, or disclose your personal information in specific circumstances, in which case we may ask for your consent in writing (including by electronic means) although in some circumstances we may accept your oral consent. Your consent may be implied through your conduct with us if the purpose of the collection, use or disclosure is obvious and you voluntarily provide the information.

In addition, we may collect, use, and disclose personal information without your consent when we are required or permitted by applicable law to do so.

Marketing Messages

Sending of marketing messages as described in this privacy policy requires the existence of the necessary consent, or our eligibility to rely on one of the exceptions or exemptions available under CASL (Canada’s Anti-Spam Legislation) and its associated regulations, that enable us to send “commercial electronic messages”, within the meaning of CASL.

Where We Store Your Personal Information

The information (including any personal information) we collect is transferred, maintained, stored, and processed in Canada and other countries outside Canada or Quebec, if applicable, where our Doubtless Group of companies or our service providers’ facilities may be located, including the United Kingdom, Europe, United States of America. You understand and agree that we may store and process this information in Canada and other countries as described. The data protection and privacy laws in those countries may offer a lower level of protection than the data protection and privacy laws of Canada. Also, this information may be subject to access requests from governments, courts, or law enforcement in Canada and foreign countries according to their laws.

Requests for information about our use of affiliates or third party service providers outside Canada to process personal information, should be addressed to our DPO at the address provided above.

Last updated on 24^th June 2026