This is an addendum to Guava's privacy policy and only applies to residents
of the European Economic Area, United Kingdom, and Switzerland. Some requirements of this framework
are covered by the main privacy policy.
Statement of Compliance
Guava complies with the Data Privacy Framework (DPF) Principles as defined by
dataprivacyframework.gov,
a program of the U.S. government. Guava agrees to make all personal data received from the EEA, UK, or Switzerland
subject to the DPF Principles. Whenever we mention this framework or these principles in this document, we mean
the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.
Contact
For all inquiries or complaints, Guava's DPF compliance officer can be contacted by email at
[email protected].
Your Rights
Regarding your personal data stored by Guava, you have the right to access it, correct inaccuracies (or annotate
medical records), or delete it.
Choice
Guava will not use your personal data for a materially different purpose than originally disclosed without first
offering you choice (opt-out, or opt-in for sensitive data).
Independent Recourse Mechanism
For inquiries or complaints regarding Guava's privacy compliance, you should first contact
[email protected]
so we can try to resolve the issue quickly and directly. If you are not satisfied with Guava's resolution
of your complaint, you can learn more or file a free complaint with our independent dispute resolution provider,
JAMS.
Enforcement
Guava is subject to the investigatory and enforcement powers of the Federal Trade Commission regarding the DPF.
Binding Arbitration
Under certain conditions described on the DPF website, you may invoke binding arbitration
when other dispute resolution procedures have been exhausted.
Lawful Requests
Guava may be required to disclose personal information in response to lawful requests by public authorities,
including to meet national security or law enforcement requirements.
Onward Transfer
When we transfer personal data to a third party acting as our agent, we remain responsible under the DPF Principles
if that agent processes the data in a manner inconsistent with the Principles, unless we prove we are not
responsible for the event giving rise to the damage.
We require all such third parties to provide at least the same level of protection required by the DPF.