State Data Privacy Notice

Last update/Last Review – April 2024

This State Data Privacy Notice (“Notice”) is provided on behalf of Insurance Services Office, Inc. (hereinafter “we” “our” or “us”) and applies to consumers (hereinafter, “you” or “your”) of California, Colorado, Connecticut, Utah, Virginia, and other states with comprehensive consumer data privacy laws. Colorado consumers are also entitled to the rights provided by C.R.S. § 6-1-1306. This notice applies to website visitors.

Personal information we collect

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a consumer. For purposes of this Notice, consumers include those who interact online or offline with us.

We have collected personal information in the following categories from consumers in the last 12 months:

Category	Examples	Collected
Identifiers	Real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, e-mail address, account name, or other similar identifiers	Yes
Personal information categories in California Civil Code §1798.80(e)	Name, address, telephone number, email address	Yes
Protected classification characteristics	Age (40 years of age or older), marital status, gender, veteran or military status	No
Commercial information	Records of products or services purchased, obtained, or considered (for customer support services)	Yes
Internet or other similar electronic network activity	Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement	Yes
Geolocation data	Physical location, geocode, longitude/latitude (via IP address)	Yes
Audio, electronic, visual, thermal, olfactory, or similar information		No
Professional or employment-related information	Current or past job history; performance evaluations	No
Education information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)	Records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records	No
Inferences drawn from any of the information identified above to create a consumer profile	Inference: A derivation of information, data, assumptions, or conclusions from facts, evidence Profile: information reflecting a consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes	No
Sensitive personal information	Social security number, driver’s license number, state identification card, passport number Account log-in, financial account, debit card, or credit card number in combination with any required access or security code, password, or similar credentials allowing access to an account Precise geolocation (data or information derived from a device or technology used or intended to be used to locate a consumer within a geographical radius of 1,750 feet) Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership Contents of a mail, email, and text messages where the business or controller is not the intended recipient of such communication Genetic data Biometric information (physiological, behavioral, and biological characteristics or activity patterns used to extract a template or other identifier or identifying information, such as fingerprints, faceprints and voiceprints, imagery of the iris or retina, keystroke, gait, or other physical patterns, and sleep, health, or exercise data) Personal information concerning medical history, mental or physical health condition, diagnosis, or treatment Personal information concerning sex life or sexual orientation	No

Sources from which we collect personal information

We may obtain personal information from the following sources:

Directly from you: for example, from forms you complete or products and services offered to you through us, as well as when you communicate with us, such as when you send an e-mail or communication through a social media platform
Indirectly from you: for example, from action you take when visiting our websites or that is collected automatically
From our affiliates and subsidiaries
Publicly available sources

Purposes for which personal information is collected

We may use personal information that we collect for one or more of the following purposes:

To fulfill the reason the information was provided: for example, to provide the product or service requested
To operate, evaluate, and improve our business
To develop, maintain the quality or safety of, improve, upgrade, or enhance our products and services
To perform market research
To advertise and market our products and services and to determine the effectiveness of such advertising and marketing
To administer our websites
As required or necessary in response to law enforcement requests or to comply with applicable law, court orders, or governmental regulations
To perform auditing related to a current interaction with you and concurrent transactions, including, but not limited to, counting ad impressions, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards
To detect security incidents
To resist and protect against malicious, deceptive, fraudulent, or illegal activity
To identify and repair errors that impair existing intended website functionality
To perform services on behalf of, or for, clients or service providers, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of clients or service providers
To undertake internal research for technological research, development, analysis, or demonstration

Categories of third-parties that we disclose personal information to

Affiliates and subsidiaries
service providers and sub-processors that perform services for us, our affiliates, and/or subsidiaries

Purposes for which we disclose personal information to third-parties

We disclose the following categories of personal information to third-parties for the following purposes:

Records of products or services purchased, obtained, or considered (for customer support services)

Selling or Sharing of personal information

“Selling” mean the selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information to a third party for monetary or other valuable consideration.

“Sharing” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information to a third party for cross-context behavioral advertising.

[We do not sell or share consumers’ personal information collected via Verisk.com]

Personal Information Retention

We will retain your Personal Information for the period necessary to meet the purposes for which it was collected as documented in our corporate retention schedule, unless a longer period is required or permitted by law or legal process, such as a pending claim, investigation or litigation requiring preservation of relevant records.

Your additional rights

You have the right to request the disclosure of:

The categories of personal information we collected about you
The categories of sources from which we collected personal information about you
The purposes for which your personal information was collected
The categories of third parties with whom we disclosed your personal information
The specific pieces of personal information we collected about you

You have the right to request the deletion of personal information that we have collected from or about you, subject to certain exceptions and limitations as provided in applicable law
You have the right to correct inaccurate personal information we maintain about you
You have the right to data portability

Exercising your rights

To exercise your rights under applicable consumer data privacy laws, or to appeal a refusal to take action on a previously submitted request to us, you or your authorized agent may contact us at:

https://secure.ethicspoint.com/domain/media/en/gui/69464/index.html
Email us at: privacy@verisk.com
1-844-845-6988

In order for us to process your request, we may ask that you provide information to verify or validate your identity and address in accordance with applicable law such as a billing statement or utility bill. Any information collected will only be used for verification purposes. Information such as account numbers, balances, etc. should be removed from any such documents prior to submitting to us.

In the event we decline to take action on a request to exercise one or more of your rights under applicable law, you have the right to appeal our determination as follows:

Colorado residents: If we deny your appeal, you may contact the Colorado Attorney General at:

https://complaints.coag.gov/s/?varCFT=2

Connecticut residents: If we deny your appeal, you may contact the Connecticut Attorney General at:

https://portal.ct.gov/AG/Common/Complaint-Form-Landing-page

Virginia residents: If we deny your appeal, you may contact the Virginia Attorney General at:

https://www.oag.state.va.us/consumercomplaintform/form/start?AspxAutoDetectCookieSupport=1

If you are a resident of any other state with a consumer data privacy law, you may also contact your state’s Attorney General’s Office or the applicable data privacy/protection agency.

Nondiscrimination

You will not receive discriminatory treatment or be retaliated against for exercising any of your rights as described above or in accordance with applicable law. We will not:

Deny you goods or services
Charge you a different price or rate for goods or services, including through granting discounts and other benefits or imposing penalties
Provide you a different level or quality of goods or services
Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services

Contact Us

If you have questions or concerns about this Notice, you may contact privacy@verisk.com.