Privacy Policy

1. Introduction

Malama Family Counseling, Corp., a California professional corporation (“Malama”, “we” or “us”), provides this privacy policy (this “Privacy Policy”) to inform users about our policies and procedures regarding the collection, use, processing, deletion, security, and disclosure of personal data and information that is subject to protection under applicable data protection, data privacy and data security laws, including the California Consumer Privacy Act (as amended, the “CCPA”) and the General Data Protection Regulation (EU) 2016/679 (the “GDPR”) (such data and information collectively, “Personal Data”) received from users of the websites owned and operated by Malama, namely www.malamafamily.com (the “Website”) and received from other persons or entities that have entered into written agreements with us that expressly reference this Privacy Policy (as applicable). We are committed to ensuring that we process your Personal Data in accordance with applicable data protection legislation and privacy and data security laws. Your use of the Website means that you accept and understand this Privacy Policy. Please do not use the Website or provide us with any Personal Data if you do not accept this Privacy Policy.

Malama may from time to time update this Privacy Policy by posting an updated version of the Privacy Policy to the Website. The date on which this Privacy Policy was last updated is set forth below. Your use of the Website after any updated version is posted means that you accept and understand such updated Privacy Policy. In addition, the Website makes use of cookies as described in further detail below.

We may also process additional categories of Personal Data which we receive from our clients during our work with such clients. However, such processing is on a case-by-case basis at the direction of our clients (subject to, among other forms, our informed consent, practice policies, and payment authorization) and is not covered by this Privacy Policy.

2. Information Collected

We may collect the following Personal Data when you visit the Website or otherwise provide us with Personal Data in connection with the Website:

Personal Data you provide when you complete forms available on the Website;
Personal Data you provide when you contact us;
Details of visits to the Website, including the volume of traffic received, logs and the resources that you have accessed and the devices you have used to access such information;
Personal Data you provide in connection with your application for employment with Malama; and
Personal Data relating to you that you provide to us to enable us to provide services to you and to comply with our legal obligations.

The categories of Personal Data we have collected from individuals pursuant to this Privacy Policy over the last twelve (12) months include the following:

Identifiers, such as name, contact details and address (including physical address, telephone number, email address and Internet Protocol address, which we may use to identify your geographic location); and
Internet or other electronic network activity information, such as information regarding your use of the Website (e.g., cookies, browsing history and/or search history), as well as information you provide to us when you correspond with us in relation to your inquiries.

3. How We Obtain Your Personal Data

In connection with operating the Website, we obtain your Personal Data from the following sources:

Information from your communications with us in connection with the Website or other services, events, publications or programs that we are offering, including any updates to such information provided by you;
Information captured on the Website, including information provided by you through online forms and any information captured via cookies;
Information that you provide us at the start of our engagement with you, or during the course of us providing services to you;
Information that you provide us in conjunction with your application for employment; and
Information that we collect from publicly available sources. This will generally include information collected in an online or offline context.

4. How We Use Your Personal Data

We use your Personal Data for one or more of the following business purposes and pursuant to the corresponding legal bases:

- Purpose: To understand your needs and provide you with better service
  - Legal Bases:
    - Performance of a contract with you
    - Necessary for our legitimate interests in providing a service to you
- Purpose: To improve the Website and to notify you about changes to the Website
  - Legal Bases: Necessary for our legitimate interests in providing a service to you and other clients
- Purpose: To communicate with you, including responding to requests for information submitted by you through the Website or to notify you of services we provide, events that we are hosting, employment opportunities, or publications that may be of interest to you
  - Legal Bases:
    - Consent provided by you in opting into such communications (where relevant)
    - Performance of a contract with you
    - Necessary for our legitimate interests in providing a service to you
- Purpose: To keep a record of your relationship with us
  - Legal Bases:
    - Performance of a contract with you
    - Necessary to comply with a legal obligation
- Purpose: To evaluate and respond to your application for employment with Malama
  - Legal Bases:
    - Steps taken prior to entering into a contract with you
    - Necessary for our legitimate interests in providing employment opportunities
- Purpose: To research and analyze users’ demographic characteristics, interests and behavior in an aggregated form in order to better understand and serve our users and improve the Website and its offerings
  - Legal Bases: Necessary for our legitimate interests in supporting and improving services to you
- Purpose: For ongoing operations, administrative, accounting, reporting, account maintenance and other processes
  - Legal Bases:
    - Necessary for our legitimate interests in providing a service to you
    - Necessary to comply with a legal obligation
- Purpose: To audit and verify the quality and effectiveness of the Website, services and compliance
  - Legal Bases:
    - Necessary for our legitimate interests in providing a service to you and other clients
    - Necessary to comply with a legal obligation
- Purpose: To detect security incidents and to protect against malicious, deceptive, fraudulent, or illegal activity
  - Legal Bases: Necessary to comply with a legal obligation
- Purpose: To generally comply with U.S., state, and local laws, rules and regulations
  - Legal Bases: Necessary to comply with a legal obligation

Please note that we may process your Personal Data for more than one legal basis depending on the specific purpose for which we are using your Personal Data.

You may opt-in to certain kinds of marketing communications by contacting us and you may unsubscribe to receiving further communications by clicking on the “opt-out” or “unsubscribe” link provided in all our marketing emails or by using the contact details in Section 14 (“Contact”) of this Privacy Policy.

5. With Whom We Share Your Personal Data

We do not sell or rent any of the Personal Data we collect about you to third-parties.

We do not disclose any Personal Data about you to third-parties, except: (i) as permitted or required by law or regulation or pursuant to any legal process; (ii) in response to governmental, regulatory, law enforcement or judicial inquiries; (iii) to affiliates; (iv) to third-party suppliers and service providers (including vendors providing hosting, database management and development services related to the operation of the Website, outsourcing providers of our back-office and internal functions, technology service providers, and/or email marketing services related to events we are hosting, our publications or other communications we may send to you); (v) our lawyers, auditors and other professional advisors; and (vi) entities to whom we may transfer, or merge parts of our business or our assets in a restructuring or in connection with a corporate transaction. If a change happens to our business, then the successor entity may use your Personal Data in the same way as set out in this Privacy Policy.

Within the last twelve (12) months, we have shared with affiliates and service providers each of the categories of Personal Data collected in connection with the Website with affiliates and service providers that are set forth above in Section 2 (“Information collected”). Please contact us using the details in Section 14 (“Contact”) of this Privacy Policy for more details on the third-parties with whom we share your Personal Data.

6. Transfer of Personal Data Under the GDPR

The Personal Data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”) where a third-party identified in Section 5 (“With whom we share your Personal Data”) is located outside of the EEA. Where such transfers take place, they are made in accordance with this Privacy Policy and in accordance with applicable data protection legislation. Usually, any such transfer will be made on the basis of the model clauses approved by the European Commission for transfers from EU controllers to non-EU controllers, which may be found at the European Commission’s website at https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32004D0915. For more information about the safeguards we rely on to make such transfers, please use the contact details in Section 14 (“Contact”) of this Privacy Policy.

7. Links to Third-Party Websites

We may provide links to third-party websites for your information or convenience. Such websites are independently operated and are not under our control, and the privacy practices of such third-party websites are not governed by this Privacy Policy. We are not responsible for the content or privacy practices of such third-party websites or any products or services offered through them or the confidentiality, use, processing and security of any Personal Data that you provide to such websites.

8. Data Subject Rights Under European Data Protection Legislation

This Section 8 is relevant to you to the extent that your Personal Data is protected by the GDPR or equivalent European data protection legislation. For the purposes of applicable data protection laws in the European Economic Area, including the GDPR, we will be a data controller of any Personal Data collected by us. In simple terms, this means that we: (i) “control” your personal data, including making sure that it is kept secure; and (ii) make certain decisions on how to use and protect your Personal Data, but only to the extent that we have informed you about the use or such use is otherwise permitted by law. If this paragraph applies to you and you have any questions regarding our use of your Personal Data, or this Privacy Policy, please contact us using the contact details in Section 14 (“Contact”) of this Privacy Policy.

Data Retention: We will retain your Personal Data only for so long as we need the Personal Data for the purposes it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements, unless a longer retention period is required under applicable law or requested by you. To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, and the applicable legal requirements.

Your Personal Data Rights: To the extent that your Personal Data is protected by the GDPR or equivalent European data protection legislation, you have the right to access the Personal Data we hold about you, and there are a number of ways you can control the way in which we store such Personal Data. We have explained these individual rights below. To exercise these rights, please contact us using the contact details in Section 14 (“Contact”) of this Privacy Policy.

- Access: You have the right to ask for a copy of the Personal Data that we hold about you free of charge, however we may charge a “reasonable fee” if we think that your request is excessive, to help us cover the costs of locating the Personal Data you have requested. We will respond to your request as soon as possible and (save for in certain circumstances) within one month.
- Correction: If there are any inaccuracies in the Personal Data we hold about you, please contact us and we will correct them.
- Deletion: If you think that we should not be processing your Personal Data any more, you may request that we delete it. Please note that this may not always be possible due to legal obligations.
- Restrictions on use: You may request that we restrict our processing of your Personal Data (other than storing it), if: (i) you contest the accuracy of it (unless the accuracy is verified); (ii) you believe the processing is against applicable law; (iii) you believe that we no longer need your Personal Data for the purposes for which it was collected (and so may otherwise amend or delete your Personal Data), but you still need your data to establish, exercise or defend a legal claim; or (iv) you have objected to the processing (as set forth in the bullet immediately below) and we are verifying whether our legitimate grounds to process your Personal Data override your own rights. In such circumstances, we will only process such Personal Data based on your consent (including not deleting it). However, in certain situations, we may override this right to restriction, either with your consent, to establish, exercise or defend legal claims, to protect the rights of others, or for public interests purposes. We will inform you where such exemption applies or where the restriction is no longer available.
- Object: You have the right to object to the processing of your Personal Data where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your Personal Data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your Personal Data which override your rights and freedoms.
- Request the transfer: If you wish to transfer your Personal Data to another organization (and certain conditions are satisfied), you may ask us to do so, and we will send it directly if we have the technical means. Please note that this right only applies to automated Personal Data which you initially provided consent for us to use or where we used the Personal Data to perform a contract with you.
- Withdrawal of consent: If you previously gave us your consent to allow us to process your Personal Data for a particular purpose, but you no longer wish to consent to us doing so, you can contact us to let us know that you withdraw that consent. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

Complaints to Supervisory Authorities: You also have the right to make a complaint at any time to the competent data protection supervisory authority in your jurisdiction if you do not agree with the manner in which we have processed your Personal Data or responded to your requests in relation to your Personal Data. If you are based in: (i) the United Kingdom, this authority if the UK Information Commissioner’s Office (https://ico.org.uk/); (ii) Germany, this authority is Der Bundesbeauftragte für den Datenschutz und die Informationsfreiheit (http://www.bfdi.bund.de/); and (iii) France, this authority is Commission Nationale de l’Informatique et des Libertés (http://www.cnil.fr/). We always appreciate the chance to deal with your concerns before you approach any such authority so please contact us in the first instance using the contacts in Section 14 (“Contact”).

9. Cookies

We use cookies and certain other technologies and tools on the Website to track user preferences. A cookie is a small text file that certain websites save on your device when you visit those websites. Cookies automatically collect information regarding how you access the Website (e.g., browser type, access times, Internet Protocol (“IP”) address) and information regarding the hardware and software that you use to access the Website.

We use cookies to improve your Website experience, provide additional security, and remember you when you return to the Website. A cookie cannot give us access to your computer or to information beyond what you provide us and we do not store Personal Data in cookies we create, but we do use encrypted information gathered from them to help improve your experience of the Website.

You can confirm your Website cookie preferences through the interface in the cookies banner provided on the homepage of the Website. You can set your browser to warn you before accepting cookies and refuse the cookie when your browser alerts you to its presence, or refuse all cookies by turning them off in your browser. Cookies are required to select text size preferences within the Website. If you refuse certain cookies, you may not be able to access certain parts of the Website or use the full functionality of the Website. You may wish to visit www.aboutcookies.org, which contains comprehensive information about types of cookies, how they are used, and how you manage your cookie preferences.

Further, the Website uses Google Analytics, a web analytics service provided by Google, Inc. (“Google”). Google Analytics uses cookies to help us analyze how users use the websites and to improve the website services, communications and user experience. The information generated by the cookies about your use of the websites (including your IP address) will be transmitted to and stored by Google on servers controlled by Google in the United States or other jurisdictions selected by Google. Google will use this information for the purpose of evaluating your use of the websites, compiling reports on website activity and providing other services relating to website activity and internet usage. Google may also transfer this information to third-parties where it is required to do so by law, or where such third-parties process the information on Google’s behalf or where Google is permitted to do so under its privacy policy. Please visit the Google Analytics privacy policy available at https://policies.google.com/privacy for additional information regarding how Google processes and protects your data collected through Google Analytics. By using the Website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.

10. Choice

We will not use or share the Personal Data you provide to us on or through the Website in ways that are unrelated to the uses described in this Privacy Policy without first obtaining your consent.

As previously stated, we will also provide you the opportunity to let us know if you do not wish to receive unsolicited direct marketing materials from us.

11. Our Commitment To Data Security

We consider the protection of Personal Data to be a sound business practice, and to that end we employ commercially appropriate organizational, physical, technical and procedural safeguards and measures to protect your Personal Data in our possession or under our control, to the extent possible, from unauthorized or accidental access and improper use.

Unfortunately, the transmission of information via the Internet is not completely secure, and we cannot guarantee the security of your Personal Data transmitted to or through the Website; any such transmission is at your own risk. Once we have received your Personal Data, we will use the procedures and security features described above to try to prevent unauthorized access of your Personal Data.

12. Notice to California Residents of Certain Rights Under the CCPA

This section outlines specific rights granted under the CCPA to individual California residents and provides information regarding how such California residents can exercise their rights under the CCPA. This section is only relevant to you if you are a resident of California as determined in accordance with the CCPA. Information required to be disclosed to California residents under the CCPA regarding the collection of their Personal Data that is not set forth in this section is otherwise set forth in this Privacy Policy. For the avoidance of doubt, for purposes of this Privacy Policy, references to Personal Data in Section 8 (“Data subject rights under European data protection legislation”) of this Privacy Policy and in sections that are specific to rights under the GDPR are deemed to include references to “personal information” as defined under the CCPA.

Deletion Rights: You have the right to request that we delete any of your Personal Data that we retain, subject to certain statutory exceptions, including, but not limited to, our compliance with U.S., state, and local laws, rules and regulations. We will notify you in writing and provide an explanation if we cannot comply with a specific request.

Disclosure and Access Rights: You have the right to request that we disclose to you certain information regarding our collection and use of Personal Data specific to you over the last twelve (12) months. Such information includes:

the categories of Personal Data we collected about you;
the categories of sources from which the Personal Data was collected;
our business or commercial purpose for collecting such Personal Data;
the categories of third-parties with whom we share the Personal Data;
the specific pieces of Personal Data we collected about you; and
whether we disclosed your Personal Data to a third-party, and, if yes, the categories of Personal Data that each recipient obtained.

No Discrimination: We will not discriminate against you for exercising your rights under the CCPA, including by denying service, suggesting that you will receive, or charging, different rates for services or suggesting that you will receive, or providing, a different level or quality of service to you.

How to Exercise Your Rights: To exercise any of your rights under the CCPA or to access this notice in an alternative format, please submit a request on your behalf using any of the methods set forth in Section 14 (“Contact”) of this Privacy Policy below.

13. Our Commitment to Children's Privacy

We do not seek to collect or maintain information (including Personal Data) on the Website from those we know are under the age of 18, and no part of the Website is structured to attract anyone under the age of 13. If we learn we have collected or received Personal Data from an individual under the age of 13, we will delete that Personal Data.

14. Contact

For any questions regarding our processing of your Personal Data, or requests relating to the exercise of your rights under the GDPR, CCPA or other applicable data protection laws, please submit (or have your authorized representative submit) a request using any of the methods set forth below.

Call us using the following toll-free number: (818) 275-1742

Email us at the following email address: info@malamafamily.com

If you are submitting a request pursuant to the GDPR, CCPA or other data protection laws, we will contact you to confirm receipt of your request and request any additional information necessary to verify your request (which may include verification of the requestor’s identity ourselves or using a third-party service). We verify requests by matching information provided in connection with your request to information contained in our records. Depending on the sensitivity of the request and the varying levels of risk in responding to such request (for example, the risk of responding to a fraudulent or malicious request), we may request further information in order to verify your request. We also reserve the right to verify your request through a third-party verification service. You may designate an authorized agent to make a request under the CCPA on your behalf, provided that you satisfy certain requirements set forth in the CCPA for such authorized agent to make a request on your behalf. We may verify such authorized person’s identity using the procedures above.

Our goal is to respond to any verifiable consumer request promptly and in any event within the time frame required under applicable law (if any). Please contact us at the phone number or email address above with any questions about this Privacy Policy.

Updated May 21, 2023