This US Data Privacy Policy explains your privacy rights if you are located in the United States, under the growing set of comprehensive state privacy laws (including California, Texas, Virginia, Colorado, and other states with similar frameworks). It should be read alongside our Privacy Policy, which explains what data we collect and why in full. This is version 1 of this policy - see the version history link above for every previous version.
If you are located in the European Economic Area, the United Kingdom, or Switzerland, see our GDPR Policy instead.
Cerenos (Cerenos Limited, a private company limited by shares registered in Ireland under company number 824270, with its registered office at Venture Hub, 136 Capel Street, Dublin, Dublin, D01 T2C9, Ireland) operates AvalonEleven, Helios, and myHR. We are based in Ireland and our servers are hosted in Ireland - we do not have a US office, but we still make the commitments in this policy to any US visitor or customer of our services.
The categories of personal information we collect from US users, using the categories comprehensive state privacy laws typically ask us to disclose:
See our Privacy Policy's "What data we collect" section for the full detail behind each of these categories.
We do not sell your personal information for monetary payment. However, our use of third-party analytics cookies (Google Analytics) may be classified as a "sale" or "share" of personal information for the purposes of targeted analytics or cross-context behavioural advertising under California and Texas law, even though no money changes hands. Where this applies, you have the right to opt out - see "Your rights" and "Global Privacy Control" below.
If you are a US consumer, you have the right to:
We will not deny you goods or services, charge you a different price, or provide you a different level or quality of service because you exercised any of the rights above.
If we deny a request you have made under this policy, you may appeal our decision by contacting [email protected] and referencing your original request. This address does not send automated replies, but a member of our team will personally review your appeal and follow up with you, generally within 45 days.
Some browsers and browser extensions broadcast a Global Privacy Control signal to tell websites you want to opt out of the sale/sharing of your data and of targeted advertising. We automatically detect and honour this signal: if your browser sends it, we will not load Google Analytics for you, without you needing to click anything on our cookie banner. This is checked every time you visit, regardless of any earlier cookie choice you made on that device.
We do not collect "Sensitive Personal Information" (as defined by the CCPA/CPRA) for the purpose of inferring characteristics about you. Because of this, a separate "Limit the Use of My Sensitive Personal Information" link is not needed on our website.
Texas's data privacy law applies regardless of revenue size and does not use the higher processing-volume thresholds some other states rely on. Because we serve both business (B2B) and individual consumer (B2C) customers, note that under Texas law, personal data we process about you purely in a business-to-business or employment context (for example, a work contact at a company that uses AvalonEleven) is exempt from individual consumer deletion requests.
Virginia's Consumer Data Protection Act, the Colorado Privacy Act, and the other comprehensive US state privacy laws not named above use materially similar frameworks to California's and Texas's. The core rights set out in Part 1 above (access, deletion, correction, opt-out of sale/sharing and targeted advertising, non-discrimination, and the right to appeal) apply consistently across all of these states; we have not identified a need for a further state-specific clause beyond California and Texas at this time.
Under GDPR, data about a business contact (for example, a client's work email address) is treated exactly like consumer data. In the United States, several states - Texas in particular - exempt data processed purely in a business-to-business or employment context from individual consumer rights requests. Where you contact us as a business representative rather than as a consumer, we will let you know if a specific request of yours falls under this exemption.
Questions about this policy, or to exercise your rights, contact [email protected]. This address does not send automated replies - a member of our team will personally follow up with you once your message is received.