This Privacy Notice describes how Tango Card, Inc., a subsidiary of Blackhawk Network
Holdings, Inc., and affiliates (collectively, “Tango,” “we,” “us,” or “our”) collect, use, disclose,
and safeguard personal information. This Privacy Notice applies to Tango and Tango’s online
properties (including our websites and websites or mobile applications that link to it “Sites”),
our social media pages or handles, our products and services, and our interactions with you
such as through customer service requests (the “Services”). This Privacy Notice also tells you
about your rights and choices with respect to your personal information, and how you can
reach us to get answers to your questions. Tango provides Services to support our enterprise
Clients’ (“Clients”) rewards and incentives programs. Please note that this Privacy Notice does
not apply to the personal information we collect from our Clients’ end users when we are
acting as a data processor – our collection and use of information in such purposes is governed
by the Tango Terms and Conditions and our data processing agreements with Clients. When we receive or process information on behalf of one of our Clients, the privacy practices that apply to the processing of that information are also governed by our Client’s privacy notice, and you
should direct any data processing questions to the Client.
When we receive information for our own purposes as a data controller, such as the contact or billing information of our Clients, the processing of that information is covered by this Privacy Notice.
You can jump to particular topics by going to the headings below:
Special Information for Job Applicants
Privacy Disclosures for Specific Jurisdictions
We provide Services and products to support enterprise Clients’ rewards, loyalty and incentive programs. In that capacity we receive personal information from our Clients or collect it directly from you, and we process that information on behalf of our Clients. In other situations, we receive personal information for our own use. The following provides examples of the type of information that we collect from you.
You may provide the following information to us directly:
We and partners working on our behalf may use log files, cookies, or other digital tracking technologies to collect the following information from the device you use to interact with our Services:
We may also create records using the above information when you interact with the Services.
The following is a list of our primary partners who collect information. Please follow the links to find out more information about the partner’s privacy practices.
To learn more about how we use cookies, including for our analytics and marketing purposes, and how to manage cookies, please see our “Cookies Policy” below.
In addition to the information that we collect from you or from our Clients, we may also receive information about you from other sources, including third parties, business partners, our affiliates, or publicly available sources.
We may collect the following information about you from third-party sources:
We may use the information we collect in the following ways:
Aggregate/De-Identified/Anonymized Information. We may aggregate, de-identify and/or anonymize any information collected through our Services so that such information can no longer be linked to you or your device. Subject to applicable law, we may use De-Identified/anonymized Information for any purpose, including without limitation for research and marketing purposes, and may also disclose such data to any third parties, including advertisers, partners, and sponsors.
Combined Information. We may combine the information that we collect through the Services with information that we receive from other sources, both online and offline, and use such combined information in accordance with this Privacy Notice.
Legal Bases for Processing. The laws in certain jurisdictions (such as those in the European Union and United Kingdom), require us to inform you of the "legal bases" on which we process your information. The legal bases for using your information as set out in this Privacy Notice are as follows:
To provide our products and Services
To respond to inquiries related to support, employment opportunities, or other requests.
To offer you recommendations and tailor the Services to your preferences.
To send marketing and promotional materials, including information relating to our products, Services, sales, or promotions, to personalize the advertisements you see on our Services and third-party online properties, and to measure the effectiveness of our advertising. We may disclose your information to business partners, online advertising partners, and social media platforms for this purpose.
To improve our Services and product offerings, including analytics.
To identify you when you visit our websites and prevent fraud.
To protect and secure our Services, assets, network, and business operations, and to detect, investigate, and prevent activities that may violate our policies or be fraudulent or illegal.
To comply, in good faith, with legal process, such as warrants, subpoenas, court orders, and lawful regulatory or law enforcement requests and to comply with applicable legal requirements, including “know-your-customer” due diligence and other anti-money laundering or OFAC compliance obligations.
To communicate with you, to protect your account or notify you of suspicious activity.
For internal administrative purposes, accounting, record keeping and legal functions, as well as to manage our relationships.
* For personal information from the EU and UK, the processing is in our legitimate interests to the extent they are not overridden by your interests and fundamental rights. Our legitimate interests include our interests in verifying identify, detecting and preventing fraud and crime, protecting and improving our products and services, in support of our general business operations including the growth of our business, and to comply with our legal obligations.
The personal information we collect from you may be transferred to, stored at, or processed in other countries, which may not provide equivalent levels of data protection to your home jurisdiction.
We will take steps to ensure that your personal information receives an adequate level of protection in the jurisdictions in which we process it, including through appropriate written data processing terms, data transfer agreements, and risk assessments where required. The steps we will follow may differ depending on jurisdictions specific requirements, and may include (but are not limited to) the following:
To the extent that we are a data processor that is processing your information on behalf of one of our Clients, we encourage you to reach out to that Client to make your request, as we are required to await instructions from the Client as the data controller. If you submit your request directly to us, we may explain how to forward your request to the applicable Client for handling as the data controller.
To exercise your rights as described in this Notice, you may contact us via the following methods:
We will respond to your request in accordance with applicable law, and if we are unable to comply with your request, we will provide information regarding why. We will not discriminate against you for exercising these rights.
Note that we may require you to prove your identity, including by phone call or email. Depending on your request, we will ask for information such as your name, the last item you received or ordered from us, or the date of your last redemption or order from us. We may also ask you to provide a signed declaration confirming your identity.
In some circumstances, you may designate an authorized agent to submit requests to exercise certain privacy rights on your behalf. We will require verification that you provided the authorized agent permission to make a request on your behalf. You must provide us with a copy of the signed permission you have given to the authorized agent to submit the request on your behalf and verify your own identity directly with us. If you are an authorized agent submitting a request on behalf of an individual you must attach a copy of the following information to the request:
If we do not receive both pieces of information, the request will be denied.
If your request is denied in part or in full, depending on your jurisdiction of residence, you may have the ability to appeal our decision. If an appeal right applies to you, we will let you know in our response to your request.
Depending on your jurisdiction, you may also have the right to opt out of “sales” of your information and “sharing/processing of your information for targeted advertising.”
As explained in the “Disclosure of Information” section above and as further detailed in our
Cookie Policy, we may allow third-party advertising providers to collect information about your activities on the Services for targeted advertising purposes or use advertising analytics partners to assist us in analyzing use of our Services and our user/customer base. Under applicable law, the disclosure of your personal information to these third parties to assist us in providing these services may be considered a “sale” of personal information or the processing/sharing of personal information for targeted advertising purposes.
If you would like to opt out of the disclosure of your personal information through cookies and similar tools for purposes that could be considered “sales” for those third parties’ own commercial purposes, or “sharing” or processing for purposes of targeted advertising, please visit the following link, which is also available in the footer of our Services: “Do Not Sell or Share My Personal Information.” Note that you will need to opt out on each device you use to access the services. We will honor legally-required browser-based opt out signals in compliance with applicable law.
If you believe that our processing of your personal information infringes your rights or violates applicable data protection laws, you have a right to lodge a complaint with the relevant supervisory authority. If you are located in the European Union, a list of supervisory authorities is available here. If you are in the United Kingdom, you may contact the Information Commissioner’s Office. If you are in the United States, you may contact the US Federal Trade Commission (residents of California may contact the California Department of Justice). Residents of Canada may contact the Privacy Commissioner of Canada or their provincial data protection commissioner. If you are located in another jurisdiction, you will need to research or contact your local government for further guidance.
No method of transmission or electronic storage is fully secure. While we use a variety of efforts to protect your personal information from unauthorized access, use, or disclosure, we cannot guarantee the security of your personal information. In the event that we are required by law to inform you of any unauthorized access to your personal information, we may notify you electronically, in writing via email, if permitted to do so by law.
Our Services may permit you to create an account and prompt you to create a password. You are responsible for maintaining the confidentiality of your password, and you are responsible for any access to or use of your account by someone else that has obtained your password, whether or not such access or use has been authorized by you. You should notify us of any unauthorized use of your password or account.
When you apply for a job with us, we may collect information from you, including:
In certain circumstances, you may submit your application for employment through a third-party service that displays our job posting. We do not control the privacy practices of these third-party services. Please review their privacy policies carefully prior to submitting your application materials.
The following additional information relates to our privacy practices:
Your California Privacy Rights; “Shine the Light” Law
California residents are entitled once a year, free of charge, to request and obtain certain information regarding our disclosure, if any, of certain categories of personal information to third parties for their own direct marketing purposes in the preceding calendar year. We do not disclose your personal information to third parties for third parties’ own direct marketing
purposes.
California Consumer Privacy Act (CCPA)
The California Consumer Privacy Act (“CCPA”) gives California residents the rights to receive certain information regarding the collection, use, and disclosure of information about them, as well as rights to know/access, correct, delete, and limit the use and disclosure of sensitive personal information and opt out of the “sale” or “sharing” of “personal information” (as all terms in quotes are defined under the CCPA).
Under the CCPA, you have the right to receive notice of certain information about our data collection, use, and disclosure. The following table summarizes the categories of personal information we collect; the categories of sources of that information; whether we disclose, sell, or share that information to service providers or third parties, respectively; and the criteria we use to determine the retention period for such information. The categories we use to describe personal information are those enumerated in the CCPA. We collect this personal information for the purposes described above in “Use and Processing of Information.”
Please note that because this list is comprehensive, it may refer to types of information that we collect and share about people other than yourself. For example, while we transfer credit card or debit card numbers for our business purpose in order to process payments for orders placed with us, we do not collect or transfer credit card or debit card numbers of individuals that submit questions through our website’s “contact us” page.
We determine the retention period for each of the categories of personal information listed above based on (1) the length of time we need to retain the information to achieve the business or commercial purpose for which it was obtained, (2) any legal or regulatory requirements applicable to such information, (3) internal operational needs, and (4) any need for the information based on any actual or anticipated investigation or litigation.
Entities to whom we disclose information for business purposes are Service Providers, which are companies that we engage to conduct activities on our behalf. We prohibit Service Providers from using personal information for any purpose that is not related to our engagement.
Entities to whom we “sell” or with whom we “share” information are third parties. Under the CCPA, a business “sells” personal information when it discloses personal information to a company for monetary or other benefit. A company may be considered a third party either because we disclose personal information to the company for something other than an enumerated business purpose under California law, or because its contract does not prohibit it from using personal information for purposes unrelated to the service it provides to us. A business “shares” personal information when it discloses personal information to a company for purposes of cross-context behavioral advertising. Mobile Information received for multi-factor authentication purposes will not be shared with third parties for marketing or promotional purposes.
Your rights under the CCPA