Ashford.com Privacy Policy for California Consumers

Last updated: January 17, 2024

Our commitment to privacy

United Time Group LLC, a Delaware corporation d/b/a Ashford.com ("Ashford") has created this privacy policy (this “Policy”) to demonstrate our firm commitment to the privacy and to apply solely to individuals who are residents of the State of California (“consumers” or “you”) as required under the California Consumer Privacy Act, as amended (CCPA).

This Policy describes our policies and practices regarding the collection, use, and disclosure of personal information we collect about you, including personal information we obtain when you access or use the Site, or through other channels including but not limited to visiting one of our locations, phone and email conversations, attending our events, in-person interactions, interactions on our websites and other third party websites such as social media sites, viewing our emails, or through our authorized services providers. In addition, as we may offer you the ability to use our applications, services, and tools using a mobile device, either through a mobile application or via a mobile optimized website, the provisions of this Policy apply to all such mobile access and use of mobile devices. This Policy will be referenced by all such mobile applications or mobile optimized websites.

This Policy also describes the choices you can make about how we collect, use and disclose your information. Ashford will not collect, use, or disclose your personal information other than in compliance with this Policy.

Any terms defined within the CCPA have the same meaning when utilized within this Policy. All other terms shall have the meaning set forth in the Privacy Policy or Terms of Service, as applicable. The other provisions of the Privacy Policy continue to apply except as modified in this CCPA Section.

If our Policy changes substantively in the future, we will notify our customers and website users of any such changes by posting an updated Policy on our website. Following the posting of such changes, your continued use of the Ashford website will constitute your acceptance of these changes and you will be bound by such changes. If you do not continue to use the www.ashford.com website following a change to our Policy but take no other action with respect to your personal information, our use of that information will remain subject to our Policy as it was in effect prior to the change. You are responsible for regularly reviewing this Policy and any changes thereto.

Your Rights as a California Resident

The CCPA provides consumers (California residents) with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.

• The categories of personal information we collected about you
• The categories of sources for the personal information we collected about you
• Our business or commercial purpose for collecting that personal information
• The categories of third parties with whom we disclose that personal information
• The categories of personal information we sold or disclosed for a business purpose
• The specific pieces of personal information we collected about you (also called a data portability request).

Upon receipt of a verifiable consumer request (see below), and as required by the CCPA, we will provide a response to such requests. Any disclosures we provide will only cover the 12-month period preceding the receipt of your verifiable consumer request. With respect to personal information collected on and after January 1, 2022, and to the extent expressly required by applicable regulation, you may request that such disclosures cover a period beyond the 12 months referenced above, provided doing so would not require a disproportionate effort by us.

Right to delete:You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers and contractors, as applicable, to delete) your personal information from our records, unless an exception applies.

We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

• Complete the transaction for which the personal information was collected, provide a good or service requested by you, or reasonably anticipated by you within the context of our ongoing business relationship with you, or otherwise perform a contract between BCI and you.
• Help to ensure security and integrity to the extent the use of the consumer's personal information is reasonably necessary and proportionate for those purposes.
• Debug to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.
• Engage in public or peer-reviewed scientific, historical, or statistical research that confirms or adheres to all other applicable ethics and privacy laws, when BCI's deletion of the information is likely to render impossible or seriously impair the ability to complete such research, if you have provided informed consent.
• To enable solely internal uses that are reasonably aligned with your expectations based on your relationship with BCI and compatible with the context in which the consumer provided the information.
• Comply with a legal obligation.
• Otherwise use your personal information, internally, in a lawful manner that is compatible with the context in which you provided the information.

Right to Correct. You have the right to request that BCI correct any inaccurate personal information we maintain about you, taking into account the nature of that information and purpose for processing it. Upon receipt of a verifiable consumer request (see below), and as required by the CCPA, we will provide a response to such requests.

[Rights regarding sale, sharing, and limiting use of sensitive personal information]

Exercising the Rights to Know, Delete, and Correct. To exercise the know, correction, and deletion rights described above, please submit a verifiable consumer request to us by either:

• Toll-free number: (888) 771-1164
• Emailing us at Email: customerservice@ashford.com

Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period. We will verify your identity before responding to your request.

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collect personal information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. We will take steps to verify that you are the parent. Note that while we will not discriminate against you for exercising your rights, if you decline to provide parental authorization in circumstances where it is required, we cannot make those services available to your child except as permitted by law.

Making a verifiable consumer request does not require you to create an account with us. However, we do consider requests made through your password-protected account sufficiently verified when the request relates to the personal information associated with that specific account.

We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

Response Time and Format We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt, except as provided above or as required under the CCPA. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit the information from one entity to another entity without hindrance. Data portability request format will be determined upon request.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded.

Authorized Agent. You may authorize a natural person or a business (the Agent) to act on your behalf with respect to the rights under this Policy. When you submit a Request to Know, Correct, or Delete, the Agent must provide proof that you gave the Agent signed permission to submit the request, and you either must (i) verify you own identity with the business or (ii) directly confirm with us that you provide permission to the Agent. However, these steps are not required when you have provided the authorized agent with power of attorney pursuant to Probate Code sections 4000 to 4465. We reserve the right to deny requests from persons or businesses claiming to be authorized agents that do not submit sufficient proof of their authorization.

Nondiscrimination We will not discriminate against you for exercising any of your CCPA rights. The right to nondiscrimination also includes an employee’s, applicant’s, or independent contractor’s right not to be retaliated against for the exercise of their CCPA rights.