This Consumer Data Privacy Policy applies to VGM Group, Inc. consumers whose data is subject to Data Privacy Laws as defined below. It applies whenever you visit our websites, including www.vgm.com, www.vgmgroup.com, www.vgmhomelink.com, www.vgminsurance.com, www.tworiversmarketing.com, or any other website of one of VGM’s divisions or subsidiaries (“Sites”), or use any of our products or services that link to or otherwise reference this policy. The following policy describes what information VGM Group, Inc. (“VGM” or “We” or “Us”) collects that is subject to Data Privacy Laws, your rights under Data Privacy Laws, and how you can enforce your rights under Data Privacy Laws.
Consumer: A consumer is a natural person who is a resident of a state with a Data Privacy Law, living in a state with a Data Privacy Law for other than a temporary or transitory purpose, or an individual domiciled in a state with a Data Privacy Law.
Data Privacy Laws: All applicable federal, state, and foreign laws, rules, regulations, and guidance (and any implementing legislation or regulations thereunder as amended) pertaining to consumer data privacy.
Personal Information (“PI”): Information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal Information does not include:
Note: If certain types of information are excluded from Data Privacy Laws this policy will not apply to such excluded data.
Sensitive Personal Information (“SPI”): is a subset of PI which includes, but may not be limited to:
VGM has collected the following categories of PI, including Sensitive PI, from its consumers within the last twelve (12) months:
Category | Examples | Collected? |
---|---|---|
| A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, account name, social security number, driver's license number, passport number, mobile device information (e.g., device model, operating system version, device date and time, unique device identifiers, mobile network information, etc.), or other similar identifiers. | YES |
B. Personal Information categories listed in Data Privacy Laws. | Information that is protected against security breaches such as: name, signature, social security number, physical characteristics or description, address, telephone or mobile device number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some PI included in this category may overlap with other categories and may not be subject to all the rights under Data Privacy Laws | YES |
C. Protected classification characteristics under state or federal law. | Age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, and genetic information (including familial genetic information). | YES |
D. Commercial information. | Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. Media information (e.g., advertising engagement in social, digital, and broadcast media, etc.). | YES |
Category | Examples | Collected? |
---|---|---|
E. Biometric information. | Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data. | NO |
F. Internet or other similar network activity. | Use of a Site, including browsing history, search terms and history, and information on a consumer's interaction with a Site (i.e., pages visited), application, or advertisement. | YES |
G. Geolocation data. | Physical location or movements. | YES |
H. Sensory data. | Audio, electronic, visual, thermal, olfactory, or similar information. | NO |
I. Professional or employment-related information. | Current or past job history or performance evaluations. | YES |
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)). | Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records. | NO |
K. Inferences drawn from other PI. | Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. | NO |
L. Sensitive PI | As defined above. | YES |
We generally do not collect additional categories of PI or use the PI we collected for significantly different or meaningfully unrelated purposes without providing you notice.
We obtain the categories of PI listed above from the following categories of sources:
We may use or disclose the PI we collect for one or more of the following business purposes:
As to job applicants, employees, owners, directors, officers, or contractors of VGM who reside in states with Data Privacy Laws and from whom we collect PI as a business under applicable law, we collect, use and disclose your PI in accordance with the specific business purposes below:
If you have any questions, comments, or concerns about our processing activities, please contact Human Capital.
VGM may disclose your PI to a third party for a business purpose. When we disclose PI for a business purpose, we enter into a contract that describes the purpose and requires the recipient to both keep that PI confidential and not use it for any purpose except performing the contract.
In the preceding twelve (12) months, VGM has disclosed the following categories of PI for a business purpose:
Category A: Identifiers
Category B: Customer records
Category C: Protected classification characteristics under state or federal law.
Category D. Commercial information
Category F: Internet history
Category G Geolocation data
Category I: Professional or employment-related information
Category L: Sensitive personal information
In the preceding twelve (12) months, VGM has not disclosed PI for a commercial purpose that constitutes “selling” or “sharing” under the applicable Data Privacy Laws.
Pursuant to VGM’s Consumer Privacy Policy, we share your information with the following categories of third parties for a business purpose:
Data Privacy Laws provide Consumers with specific rights regarding their PI. This section describes your rights and explains how to exercise those rights.
Right | To Exercise This Right | Time Frame and Response From VGM | If We Cannot Complete Your Request |
---|---|---|---|
Access to specific information and the categories of sources and purposes for collection, use, disclosure, and sale in the last 12 months, after verification of your identity. | Submit your request and confirm your "verifiable consumer request" via the contact information below. | We will evaluate and respond to your request by a toll-free telephone number, webform, email, or by mail within 45 days. If we require more time, we will inform you of the reason and extension period in writing. Once we confirm your verifiable consumer request, we will provide you access to your specific information and the categories of sources and purposes for collection, use, disclosure, and sales (and direct VGM’s service providers to do the same) of your personal information. | We will explain the reasons we cannot comply with a request in our response. |
Deletion of information. You have the right to request that VGM delete your PI, subject to certain exceptions and after verification of your identity. | Submit your request and confirm your "verifiable consumer request" via the contact information below. | We will evaluate and respond to your request by a toll-free telephone number, webform, email, or by mail within 45 days. If we require more time, we will inform you of the reason and extension period in writing. Once we confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your PI from our records, unless an exception applies. | We will explain the reasons we cannot comply with a request in our response. The law does not require us to honor requests to delete where it is necessary in certain circumstances for us or a service provider to maintain Personal Information. These include:
impair existing intended functionality.
-Comply with a legal obligation or make other lawful use compatible with the context in which information was provided. |
Opt-out of the "sale" or “sharing” of PI in some circumstances. | Submit your request and confirm your "verifiable consumer request" via the contact information below. | We will evaluate and respond to your request by a toll-free telephone number, webform, email, or by mail within 45 days. If we require more time, we will inform you of the reason and extension period in writing. | We will explain the reasons we cannot comply with a request in our response. |
Correction of PI You have the right to have VGM correct errors in the PI it maintains about you. | Submit your request and confirm your "verifiable consumer request" via the contact information below. | We will evaluate and respond to your request by a toll-free telephone number, webform, email, or by mail within 45 days. If we require more time, we will inform you of the reason and extension period in writing. Once we confirm your verifiable consumer request, we will correct (and direct our service providers to correct) your PI in our records, unless an exception applies. | We will explain the reasons we cannot comply with a request in our response. |
Limit use and disclosure of SPI in some circumstances | Submit your request and confirm your "verifiable consumer request" via the contact information below. | We will evaluate and respond to your request a toll-free telephone number, webform, email, or by mail within 45 days. If we require more time, we will inform you of the reason and extension period in writing. Once we confirm your verifiable consumer request, we will limit use and disclosure of your sensitive information (and direct our service providers to do the same) | We will explain the reasons we cannot comply with a request in our response. |
To exercise your rights to access or delete your PI under applicable Data Privacy Laws, you must submit a “verifiable consumer request.” Only you, or a person authorized by you to act on your behalf, may make a verifiable consumer request related to your PI. You may also make a verifiable consumer request on behalf of your minor child.
A verifiable consumer request must:
If we cannot verify your identity or authority to make the request, we will not be able to fulfill your request. The information provided for verification will only be used for that purpose.
To authorize an agent to make a request to know or delete on your behalf, please write to the contact address below. To authorize an agent to make an opt-out request on your behalf, please send a written authorization signed by you and the authorized agent to us via the Contact Information section below.
We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
In some circumstances, you may opt out of the sale of your PI.
Your PI may be retained for a minimum of ten (10) years in accordance with applicable federal law.
We will not discriminate against you for exercising any of your Data Privacy Law rights. Unless permitted by applicable Data Privacy Laws, we will not:
You also have the right not to receive discriminatory treatment by VGM for the exercise of privacy rights conferred by any applicable Data Privacy Laws, including an employee’s, applicant’s, or independent contractor’s right not to be retaliated against for the exercise of applicable Data Privacy Laws.
We may offer you certain financial incentives such as discounted prices, rates, or quality levels. Any permitted financial incentive we offer will reasonably relate to your PI’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.
We reserve the right to amend this privacy policy at our discretion and at any time. When we make changes to this privacy policy, we will post the updated policy on the Sites and update the policy’s effective date. Your continued use of our Sites and/or services following the posting of changes constitutes your acceptance of such changes.
You may request a paper copy of this Consumer Data Privacy Policy, free of charge, via the Contact Information section below. Upon request you may also receive a paper or electronic copy of this Consumer Data Privacy in alternative formats or in languages in the ordinary course of business in the states with applicable Data Privacy Laws.
You have the right to receive a copy of this Consumer Data Privacy Policy, free of charge, and to discuss its contents with the VGM Privacy Officer by making a request via the Contact Information below.
You can contact VGM with your questions, comments, consumer rights requests, and other applicable Data Privacy Law inquiries by:
Mail: Attn: VGM Privacy Officer
1111 Van Miller Way
Waterloo, IA 50701
Phone: 1-877-474-3227
Email: [email protected]
If you believe your PI was accessed without permission, please contact VGM by any means listed above.
March 21, 2025