Privacy Program Dispute Resolution Procedure

1. Introduction

1.1. This VeraSafe Dispute Resolution Procedure (the “Procedure”) is provided and administered by Advanced Partnerships LLC (“VeraSafe”) for the resolution of complaints alleging that a Participant in the VeraSafe Website Trust Seal Program, Website Security Program or Website Privacy Program (“Applicable VeraSafe Program”) has failed to comply with the Applicable VeraSafe Program Certification Criteria. The Procedure combines facilitation, mediation and arbitration.

1.2. By participating in the Procedure, the Parties agree as follows:

2. Definitions

2.1. The following definitions apply to the Procedure:

1. “Applicable VeraSafe Program Certification Criteria” The certification criteria for the Applicable VeraSafe program, such as the VeraSafe Website Security Program Certification Criteria, the VeraSafe Website Privacy Program Certification Criteria or the VeraSafe Website Trust Seal Program Certification Criteria.
2. “Complainant” A person who has filed a Complaint with VeraSafe under the terms of the Procedure.
3. “Complaint” An allegation of non-compliance with Applicable VeraSafe Program Certification Criteria registered with VeraSafe under the terms of the procedure.
4. “Credible Evidence” Facts that, when viewed in light of surrounding circumstances, are highly and substantially likely to be true.
5. “Participant” A licensee of the VeraSafe Website Trust Seal Program, Website Security Program or Website Privacy Program who is in good standing in the Program.
6. “Party/Parties” The Complainant and the Participant.
7. “PII” Any information or combination of information that can be used to identify or locate a specific individual person. This includes name(s), contact information, Social Security Number(s), email address(es) and other individually identifiable information.
8. “Procedure Submissions” All documents, writings, briefs, evidence and other material, submitted to the Procedure by the Parties in accordance with Section 5.2, or by VeraSafe.
9. “Settlement Agreement” An agreement reached by the Parties as resolution of a Complaint. The terms of the Settlement Agreement must be recorded in writing to be effective.
10. “The Procedure” The terms of this VeraSafe Dispute Resolution Procedure.

2.2. Capitalized terms not defined herein, have a definition ascribed to them in the Applicable VeraSafe Program Certification Criteria.

3. No Guarantee

3.1. VeraSafe can offer no guarantee that the outcome of the Procedure will be an outcome with which either Party, or the Parties, is satisfied. By utilizing the Procedure, the Parties agree that VeraSafe shall have no liability for the outcome of the Procedure.

4. Permitted Outcomes

4.1. The Parties agree that the possible outcomes that a Complainant may seek via the Procedure, and the maximum relief that VeraSafe shall assign in a Procedure Hearing during the Procedure are limited to the Permitted Outcomes. Permitted Outcomes are only those that may require:

1. the effects of noncompliance with the Applicable VeraSafe Program Certification Criteria to be reversed or corrected by the Participant;
2. that future data processing by the Participant be in conformity with the Applicable VeraSafe Program Certification Criteria;
3. that the Participant cease processing PII of the Complainant;
4. the Participant to delete Complainant’s PII that was processed contrary to the Applicable VeraSafe Program Certification Criteria;
5. the temporary suspension and/or removal of Participant’s license to display VeraSafe Seal(s); and/or
6. the Participant to comply with other injunctive orders.

5. Complaint Filing Procedure

5.1. Information Required. Complainant is required to provide certain information to VeraSafe in order to successfully file a Complaint with the Procedure. Therefore the Complaint must:

1. allege Participant’s failure to comply with the Applicable VeraSafe Program Certification Criteria of a VeraSafe Program in which Participant is in good standing;
2. include the desired outcome that are being sought;
3. include the fullest possible account of facts and events giving rise to the Complaint;
4. if any damages and/or harm is alleged, include specific details of the harm and/or damages;
5. include valid contact information for the Complainant;
6. include authorization to share Complaint with Participant;
7. include all available documentation to support Complaint; and
8. include a declaration, under penalty of perjury under the laws of the United States of America, that all information submitted to VeraSafe in the Procedure is true and correct.

5.2. Medium for all Procedure Submissions

1. Complaints must be initiated by submitting VeraSafe’s online complaint form located at: https://www.verasafe.com/public-resources/dispute-resolution/submit-dispute/ or by submitting the required information to VeraSafe via email or fax.
2. VeraSafe will provide correspondence to the Parties electronically, either by email or fax.
3. The Parties shall submit all Procedure Submissions to VeraSafe electronically.
4. Correspondence and Procedure Submissions shall be considered delivered to the recipient immediately upon their electronic transmission by the sender.

6. Eligibility

6.1. Eligible Complainant. For a Complainant to be eligible to file a Complaint with the Procedure, the Complainant must be above 12 years of age at the moment the Complaint is filed with the Procedure.

6.2. For a Complaint to be eligible, the Complaint must:

1. name a Participant that is in good standing in an Applicable VeraSafe Program as a defendant in the Complaint;
2. not seek relief or other outcomes beyond the Procedure’s Permitted Outcomes;
3. be filed with the Procedure for the first time, except for Complaints alleging a Participant’s failure to comply with a previous Settlement Agreement; and
4. must not have been previously resolved or settled by court action, arbitration or other form of dispute resolution.

6.3. Prior Good Faith Attempt to Resolve Complaint. Complainant must make a good faith effort to resolve the dispute directly with the Participant before filing the Complaint with VeraSafe. Complainants are further encouraged to read the Participant’s privacy policy entirely before filing a Complaint with VeraSafe. If VeraSafe determines, in its sole capacity, no good faith effort attempt to resolve the dispute has been made, VeraSafe will ask the Complainant to try to resolve the Complaint and will advise the Complainant that he or she can re-file the Complaint as outlined herein if the attempt to resolve the Complaint with the Participant does not yield satisfactory results.

6.4. Eligibility Determination. If VeraSafe, in its sole determination, concludes that additional information is needed to sustain the Complaint it shall promptly contact the Complainant and advise him or her of the need for further information. If VeraSafe does not receive the requested information within 15 business days of its request, it shall advise the Complainant that it cannot proceed. If then, the Complaint or Complainant is found to be ineligible, VeraSafe will close the Complaint and notify the Complainant of the outcome.

1. Complainant’s Right to Appeal the Eligibility Determination. Complainant has the right to appeal VeraSafe’s Eligibility Determination within ten business days of receiving the Eligibility Determination. If the Complainant can furnish Credible Evidence to VeraSafe that a material error was made in the Eligibility Determination, VeraSafe will duly re-examine the Complaint and make a final Eligibility Determination.

7. Consultative Mediation

7.1. Participant’s Response to Complaint. Complaints that are found to be eligible will be forwarded to the Participant. Participant must file its response to the Complaint (“Response to Complaint”) within 20 business days. The Participant’s Response to Complaint shall either:

1. defend Participant’s actions as permissible under the Applicable VeraSafe Program Certification Criteria;
2. dispute the validity of information presented in the Complaint and contain all available documentation to support the dispute; or
3. admit fault and agree to remedy the alleged breach of the Applicable VeraSafe Program Certification Criteria.

7.2. Upon receipt, the Participant’s Response to Complaint will be forwarded to the Complainant.

7.3. Participant’s Failure to Respond. If the Participant fails to file a timely Response to Complaint, the failure to comply with the Procedure will be duly noted in the next Procedure Report and VeraSafe shall refer the matter to the appropriate government agency pursuant to Section 11.

7.4. Mediation Teleconference. If Complainant is not satisfied with the Participant’s Response to Complaint, the Complainant may file with VeraSafe, a request for Mediation Teleconference within ten business days of receiving the Participant’s Response to Complaint.

1. Mediation Teleconference Procedure. VeraSafe will provide and appoint a mediator to lead the Mediation Teleconference. VeraSafe will schedule the teleconference with due regard for the schedules of the Parties and will notify the Parties of the scheduled time and date no less than 15 days prior to the scheduled Mediation Teleconference. The Mediation Teleconference is an informal process to re-examine the Complaint and guide the Parties towards a mutually agreeable solution or settlement.

7.5. Possible Outcomes of Mediation Teleconference.

1. Complainant Failure to Comply: Closed by Default. If the Complainant fails to appear at the scheduled time of the Mediation Teleconference or comply with the Mediation Teleconference Procedure (as described in Section 7.4.(a)), it will be assumed that the Participant’s Response to Complaint has satisfied the Complainant and the Complaint will be Closed by Default and the Parties duly notified.
2. Participant’s Failure to Comply: Referral to FTC and Closed by Referral. If Participant fails to appear at the scheduled time of the Mediation Teleconference or comply with the Mediation Teleconference Procedure, the failure to comply with the Procedure will be duly noted in the next Procedure Report and VeraSafe shall refer the matter to the appropriate government agency pursuant to Section 11.
3. Mutual Settlement Agreement: Closed by Settlement. If the Parties reach an agreement during the Mediation Teleconference, VeraSafe will record the Settlement Agreement parameters and notify both parties in writing of the terms of the Settlement Agreement as decided by the Parties, within five business days of the Mediation Teleconference or as soon as practicable thereafter. The Complaint will then be Closed By Settlement.
4. No Settlement Reached. Complainant may file with VeraSafe, a request for a Procedure Hearing within ten business days of the Mediation Teleconference.I. If no Settlement Agreement is reached during the Mediation Teleconference, and Complainant does not request a Procedure Hearing within ten business days of the Mediation Teleconference, it will be assumed that the Participant’s Response to Complaint has satisfied the Complainant and the Complaint will be Closed by Default.

8. Procedure Hearing

8.1. Overview. In a Procedure Hearing an officer of the VeraSafe Procedure Hearing Panel will review the Complaint and all Procedure Submissions in a fair and impartial way and determine if clear, convincing, and satisfactory evidence is present to support the Section 5.1allegation made in the Complaint.

8.2. Exchange of Brief and Rebuttal. The Complainant’s request for a Procedure Hearing should include its detailed brief of the Complaint. Upon receipt, VeraSafe will forward the brief to the Participant. The Participant shall provide a rebuttal to VeraSafe within ten business days of receiving the Complainant’s brief.

8.3. Late Filings and Extensions. If a Party submits required information after the specified time limits, the untimely information shall not be submitted to the Panelist unless VeraSafe grants an extension for good cause. In lieu of such untimely Procedure Submissions, the Hearing Officer will proceed to use all other available Procedure Submissions in making its Hearing Decision.

8.4. Procedure Hearing Officer.

1. The Hearing Officer shall hold a current CIPP/US or CIPM credential from the International Association of Privacy Professionals (IAPP) or hold a Juris Doctor from an American Bar Association accredited law school. For more information on the IAPP credentialing programs, see http://www.privacyassociation.org.
2. The Hearing Officer shall be impartial and neutral in the application of the Procedure.

8.5. Procedure Hearing Administration and Procedure.

1. Hearing Officer’s Request for Information.
   1. The Hearing Officer may request additional information or seek clarification from either Party regarding the Procedure Submissions.
   2. VeraSafe Investigative Analysis. The VeraSafe Program Administrator will independently and impartially investigate the Procedure Submissions and furnish to the Hearing Officer its analysis of the validity of each essential fact presented in the Procedure Submissions. The VeraSafe Investigative Analysis shall then be included in the Data Privacy Hearing as a Procedure Submission.
2. Hearing Decision and Burden of Proof.
   1. Substantiated Complaints. If in due examination of the Procedure Submissions, and in due consideration of the totality of the circumstances, the Hearing Officer determines that the available evidence does clearly, convincingly and satisfactorily substantiate the Section 5.1allegation made in the Complaint, the Hearing Officer will issue a Reparation Order requiring the Participant to comply with one or more Permitted Outcomes, as appropriate to the circumstances. The Parties will be notified of the Reparation Order.
   2. No Action Taken. If in due examination of the Procedure Submissions, and in due consideration of the totality of the circumstances, the Hearing Officer determines that the available evidence does not clearly, convincingly and satisfactorily substantiate the Section 5.1allegation made in the Complaint, the Complaint will be closed as “Closed – No Action Taken” and the Parties duly notified.

9. Participant’s Performance of Reparation Order or Settlement

9.1. Notice of Reparation Orders and Settlement Agreements will be forwarded to the VeraSafe Program Administrator who will monitor the Participant’s compliance there with

9.2. Participant’s Non Compliance. If Participant fails to comply with a Settlement Agreement or Reparation Order issued under the Procedure, the failure to comply with the Procedure will be duly noted in the next Procedure Report and VeraSafe shall refer the matter to the appropriate government agency pursuant to Section 11.

10. Complaint Closure

10.1. When a Complaint is closed, the Parties will be notified electronically.

10.2. VeraSafe will close the Complaint when:

1. VeraSafe determines that the Complaint or Complainant is not eligible pursuant to Section 6;
2. VeraSafe determines additional information is needed to substantiate the Complaint and that information is not timely received by VeraSafe pursuant to Section 2.4(b);
3. the Complainant withdraws the Complaint;
4. the Parties have reached a Settlement Agreement and VeraSafe has Credible Evidence that Participant has complied with the Settlement Agreement within a reasonable time;
5. the Hearing Officer or Panelist of the Procedure has issued a Hearing Decision and if a Reparation Order has been issued, VeraSafe has Credible Evidence that the Participant has complied with the Reparation Order within a reasonable time;
6. VeraSafe has referred the matter to a government agency pursuant to Section 11; or
7. the Complainant breaches any term(s) of the Procedure in a material way.

11. Referral to Government Agencies

11.1. VeraSafe, in its discretion, may refer matters to appropriate government agencies if:

1. the Participant refuses to comply with the Procedure in regards to a Complaint that has been filed with VeraSafe; or
2. VeraSafe determines that the Participant has failed to comply with a Settlement Agreement or Reparation Order issued under the Procedure within a reasonable time.

11.2. Before referring any matter to the appropriate government agency, VeraSafe must first notify Participant of the intended referral and give Participant a reasonable opportunity of at least ten business days to cure any breach of the Participant’s Master Service Agreement or failure to perform under the Procedure.

11.3. Reports of referrals to government agencies shall be included in VeraSafe’s Annual Procedure Report.

12. Public Reporting

12.1. VeraSafe shall publish Annual Procedure Reports annually when there is relevant data to report. Annual Procedure Reports will not be published when no Complaints have been filed with the Procedure. These Annual Procedure Reports shall:

1. provide a statistical summary of the number and nature of Complaints filed with the Procedure;
2. provide a statistical summary of the number and nature of Settlement Agreements and Reparation Orders issued under the Procedure;
3. provide a statistical summary of the number and nature of Complaints deemed ineligible during the period pursuant to Section 6, including the specific reason(s) for determinations of ineligibility;
4. for each Complaint which VeraSafe refers to a government agency pursuant to Section 11, provide a summary (including the Participant’s name) of the nature and outcome of the Complaint; and
5. be published online at www.verasafe.com.

12.2. The statistical summaries shall be comprised solely of aggregated anonymous data.

13. Confidential Information

13.1. Other than the Hearing Decisions and except as noted in Sections 11 and 12, all Procedure Submissions, deliberations, meetings, proceedings and writings of the Procedure shall be treated as confidential by VeraSafe.

13.2. The Parties agree that during the Procedure they will treat any information provided to them by VeraSafe as confidential, and that they will not share such information with anyone other than those persons directly involved in the handling of the Complaint.

14. Complainant’s Right To Withdraw

14.1. Complainant has the right to withdraw its complaint at any time during the Procedure by submitting to VeraSafe a request to withdraw the Complaint.

1. The complaint will then be closed as “Closed – Withdrawn” and the Parties will be notified electronically.

15. Limitation of VeraSafe’s Liability

15.1. Except in the case of deliberate wrongdoing, and except to the extent that such a limitation of liability is prohibited by applicable law, and with the knowledge that VeraSafe is providing any Procedure access for the benefit of the other Parties involved and not for the benefit of VeraSafe, the Parties acknowledge and agree that the following are not liable for any act or omission in connection with the Procedure: Advanced Partnerships LLC; VeraSafe or VeraSafe staff; Board members; committee members; independent contractors utilized by VeraSafe; or Officers.

16. Interpretation

16.1. VeraSafe and any Mediator or Hearing Officer appointed under the Procedure, shall interpret and apply the Procedure insofar as they relate to their powers and duties.

17. Waiver of Subpoena

17.1. By participating in the Procedure, the Parties agree that they will not subpoena any of the following in any legal proceeding arising out of the matters at issue in the Procedure or Complaint: Advanced Partnerships LLC; VeraSafe or VeraSafe staff; Board members; committee members; independent contractors; Officers; or any records of the Procedure.

18. Language

18.1. VeraSafe conducts the Procedure in English but will provide translation services as necessary during the Procedure.

19. Hold Harmless

19.1. The Participant agrees to hold Advanced Partnerships LLC, VeraSafe, its officers, agents and employees harmless from any liability, loss or damage the Participant may suffer as a result of Complaints, claims, demands, costs, Reparation Orders or judgments against them arising out of the Procedure.

19.2. The Complainant agrees to hold Advanced Partnerships LLC, VeraSafe, its officers, agents and employees harmless from any liability, loss or damage the Complainant may suffer arising out of the Procedure or the acts or omissions of the Participant that gave rise to the Complaint.

20. Relationship of the Parties, No Commercial Relationship Between VeraSafe and Complainant

20.1. Nothing contained in the Procedure shall be construed to create the relationship of principal and agent, partnership or joint venture, or any other commercial relationship between VeraSafe and either Party.

20.2. No Authority. The Parties have no authority to act as agent for, or on behalf of, VeraSafe, or to represent VeraSafe, or bind VeraSafe in any manner.

21. Contact VeraSafe

21.1. VeraSafe may be contacted using the contact information found at https://www.verasafe.com/about-us/contact-us