Introduction and Scope of Practices.

Blackhawk Network Holdings, Inc. and its affiliates (“Blackhawk,” “we,” “us,” or “our”) care about your personal information. This Privacy Policy (“Policy”) describes how we, use this data, disclose the personal information (which includes “personal data” as defined under applicable EU and other data protection laws) we collect about you, and the rights you have regarding such data. This Policy applies to the personal information Blackhawk collects about users of our websites (including www.blackhawknetwork.com), mobile applications, and the services and features therein (together the “Sites”), as well as the data we collect in providing our services (the “Services”) and when individuals communicate with us about our Sites and Services, whether in person, by telephone, by mail, or other means. When we act as a data processor on behalf of another controller, we collect, use, and disclose certain personal information only under the controller’s instruction, and our processing of your personal information is subject to their instructions and privacy policies.

Please note that links to third-party websites are subject to the third-parties’ privacy policies and terms of use, not ours, unless you are told otherwise. Also, some of Blackhawk’s Services are offered through third-parties, such as banks or other financial institutions. In those cases, the third-parties’ policies will govern their use of the personal information they process about their customers.

Personal Information We Collect

We collect personal information directly from you, through third parties, or automatically through our Sites and related to our Services, subject to applicable laws as set out below. Where the personal information we collect is needed to comply with law, or to enter into or perform an agreement with you, we will inform you at the time of such data collection. If we cannot collect this data, we may be unable to on-board you as a client or provide products or services to you.

Certain websites also may offer a referral service where users may refer other people they know to our Services, subject to restrictions under applicable local laws. If you choose to use our referral service to tell your friends about our Services, we will provide you with a referral code and signup instructions that you can share with your friends. Where permitted by local law, we conduct such referrals on an opt-out basis. If personal information about you has been provided to us and you want us to delete it, you may email us at privacy@bhnetwork.com.

Personal Information We Collect Automatically.

We and our service providers automatically gather information about your use of the Sites and Services through cookies, web beacons, java script, log files, pixels, and other technologies, which include: your domain name, browser type, browser language preference, device type and operating system, page views and links you click within the Sites, IP address, device ID or other identifier, location information, date and time stamp, and time spent using the Services, referring URL, your activity within the Sites, and device geolocation information (where permitted by your device settings).

We also collect information from analytic services, including Google Analytics, to compile and analyze information derived from the use of our Services, such as aggregate usage patterns, user preferences, peak demand times, preferred content and other information.

See the “Cookies and Online Tracking” section below for details.

Use of Your Personal Information and Legal Bases

We may use the personal information we collect for the following purposes:

• Provide Our Services: To provide our Services, operate our Sites, respond to your enquiries and fulfill your requests and orders, process your payments, for bug and error reporting and resolution, to perform upgrades and maintenance;
• Customer Service and Support: To send you important information, such as changes to terms, conditions, and policies and/or other administrative information;
• Personalization: To personalize your experience on a Site or using the Services, such as by tailoring the content we send or display to you in order to personalize help and instructions, and to otherwise personalize your experience using the Services;
• Marketing and Promotions: To send you marketing communications you have signed up for;
• Advertising and Referrals: To assist in advertising the Services on third-party websites and to track referrals from partner websites;
• Analytics and Improvement: To better understand how users access and use the Services, and for other research and analytical purposes, such as to evaluate and improve the Services;
• Verify Identity and Detect Fraud: To verify your identity and/or location in order to allow access to your accounts, conduct online transactions, and secure your personal information, and for risk control, fraud detection and prevention, and compliance with laws and regulations;
• Protect Our Legal Rights and Prevent Misuse: To protect the Services, prevent unauthorized access and other misuse, and where we believe necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, or violations of our Terms of Use or this Policy.
• Comply with Legal Obligations: To comply with the law or legal proceedings such as when required to disclose information in response to lawful requests by public authorities, including responding to national security or law enforcement disclosure requirements; and
• General Business Operations: Where necessary to the administration of our general business, accounting, recordkeeping and legal functions.

How We Disclose Personal Information We Collect

We do not sell your personal information to third-parties.

Cookies and Online Tracking

We and our third-party service providers collect information automatically through cookies, beacons, pixels, tags, scripts, and HTML5, as well as log files. We, or our service providers, may combine this information with other information, including personal information we collect about you, to record your preferences, gather information about the use of our Services, identify when our emails are viewed, personalize content and ads and track information about the performance of our advertisements.

Cookies. These are small files with a unique identifier that are transferred to your browser through our websites. These technologies allow us to collect information such as browser type, time spent on our Sites, pages visited, language preferences, and your relationship with us. We can use this information to analyze trends, administer the website, track users’ movements around the website, measure the effectiveness of our communications, tailor our advertising to you, and gather demographic information about our user base as a whole. These technologies may provide us with information about devices and networks you utilize to access our Services, and other information regarding your interactions with our Services. For detailed information about the cookies used in the Services and how you can manage your cookie preferences or reject cookies altogether, please read and review our Cookie Policy.

Pixels, Web Beacons, Clear GIFs. These are tiny graphics with a unique identifier, similar in function to cookies that we use to track the online movements of users of our web pages and our Ad Services, and to personalize content, and to identify when our emails are viewed or forwarded.

Our third-party partners use Local Shared Objects, such as Flash cookies, to embed features on our sites. To manage Flash cookies, please click here.

Marketing and Targeted Advertising

We partner with third-party ad networks and third-party ad companies to manage our advertising on other sites. Our third-party partner use technologies such as cookies to gather information about your activities on this website and other sites in order to provide you personalized advertising based upon your browsing activities and interests. Please see the “Cookies and Online Tracking” section above or our Cookie Policy for more information.

Social Media Widgets

Our Sites include social media features, such as the Facebook "Like" button, either hosted by a third-party or hosted directly on our website (“Widgets”). Please refer to the privacy policies of the relevant third-party websites or services to find out more about the collection, use, and disclosure of your information through such features. We will comply with any legal obligations placed on the use of these technologies by certain jurisdictions, which may affect how these Widgets function.

Security

The security of your personal information is important to us. We have implemented safeguards designed to protect the personal information submitted to us. Please note that no data transmission over the Internet cannot be guaranteed to be 100% secure. As a result, we cannot guarantee or warrant the security of any personal information that we process.

Retention

We will retain your information for as long as your account is active or as needed to provide you services and up to a period of no longer than seven (7) years, unless the period is required to be different under applicable law. To the extent permitted by applicable law, we may also further retain and use your personal information only as necessary to comply with our legal obligations, resolve disputes, maintain appropriate business records, and enforce our agreements.

Image Submissions and Public Directories

Some of our websites offer you the ability to upload your own image to be used to create a personalized product. You may have the option to make these images available in publicly-accessible directories. You should be aware that any information you provide in these areas may be read, collected and used by others who access them. You may request removal of your personal information at any time.

Your Rights

Certain countries and regions, including the European Union, have enacted laws that provide for privacy rights for individuals located in the EU. Regardless of your location and jurisdiction, Blackhawk may at its sole discretion choose to extend these rights to all individuals, and to comply with requests as detailed below. We do not charge for these services but in certain cases we may require further proof of your identity or ask you to clarify the scope and nature of your request if it is unclear. Where you are entitled to a right, we will respond to your request within the timeframe set out by law, or where we provide answers on a voluntary basis within a reasonable timeframe.

Please note that we only respond directly to you in cases where we are the controller of your personal information. Where we are acting as a data processor on behalf of a client or partner, we will forward your request to the client or partner who is the data controller of your personal information.

Protecting Children’s Privacy Online

Our Sites are not directed to children and we do not knowingly collect personal information from children under the age of sixteen (16), and we request that such individuals do not provide personal information through our Sites.

International Transfer

The personal information we collect from you may be transferred to, stored at or processed in other countries, including the United States or outside the European Economic Area, which may not provide equivalent levels of data protection to your home jurisdiction.

We will take steps to ensure that your personal information receives an adequate level of protection in the jurisdictions in which we process it, including through appropriate written data processing terms and/or data transfer agreements. For transfers from the EU, United Kingdom (“UK”) or Switzerland to the U.S., Blackhawk Network relies on its Privacy Shield certification (see below). Safeguards may also include adequacy decisions by the EU Commission or putting in place standard contractual clauses as approved by the European Commission (the form for the standard contractual clauses can be found here: EU Commission Standard Contractual Clauses) or another applicable supervisory body.

Privacy Shield Certification

Blackhawk Network, Inc. (and its subsidiary companies listed on its certification page here: Blackhawk Network Privacy Shield Certification) complies with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework (“Privacy Shield”) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European Union, the United Kingdom (“UK”) and/or Switzerland to the United States in reliance on Privacy Shield. Blackhawk Network has certified to the Department of Commerce that it adheres to the Privacy Shield Principles with respect to such information. If there is any conflict between the terms in this Policy and the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification, please visit https://www.privacyshield.gov/.

Blackhawk is responsible for the processing of personal information it receives, under the Privacy Shield Framework, and subsequently transfers to a third party acting as an agent on its behalf. Blackhawk complies with the Privacy Shield Principles for all onward transfers of personal information from the EU, Switzerland and/or the UK, including the onward transfer liability provisions.

With respect to personal information received or transferred pursuant to the Privacy Shield Framework, Blackhawk is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission. In certain situations, Blackhawk may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third-party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request. We are committed to cooperating in the resolution of disputes with individuals through this process.

Under certain conditions, more fully described on the Privacy Shield website https://www.privacyshield.gov/article?id=How-to-Submit-a-Complaint, you may invoke binding arbitration when other dispute resolution procedures have been exhausted.

Updates to This Policy

This Policy may be subject to change. Please review it from time to time. If we make material changes to this Policy about how we process your personal information, we will post those changes on this page and revise the "Last Updated" date at the top and we will notify you by email or prominent notice on this Site prior to the change becoming effective. Where required by law, we will obtain your consent or give you the opportunity to opt out of such changes. Any changes will become effective when we post the revised Policy.

Contact Information

If you have any questions or concerns regarding the way in which your personal information is being processed, please reach out to us using the contact information below: