CCPA data subject rights requests

What are CCPA Data Subject Rights Requests?

The California Consumer Privacy Act (CCPA) passed in June 2018 expands on an individual's right to access and delete their personal information. As a merchant, if your DTC site is available to California residents or you're involved in the sale of California residents' personal information, then this law may apply to you. Businesses subject to the CCPA must provide certain data subject rights, including access and deletion, to California residents.

Note: Various state laws are coming into effect that give these same rights.

What businesses does the CCPA apply to?

Not all Buy with Prime merchants are subject to the CCPA. The CCPA applies to for-profit businesses that do business in California and meet any of the following:

• Have a gross annual revenue of over $25 million;
• Buy, receive, or sell the personal information of 50,000 or more California residents, households, or devices; or
• Derive 50% or more of their annual revenue from selling California residents’ personal information.
   

Data Subject Access Requests (DSAR)

The CCPA gives California residents the right to request a copy of their personal information. If a California resident requests a copy of their personal information, you should respond to them within 45 days of their request. If that isn't possible due to the complexity or number of requests, then inform the requester that another 45 days are necessary. If you decide not to fulfill the request, then you should inform the requester of your reasons for not completing the request within 45 days.

Data Deletion Requests

Under the CCPA, California residents can request deletion of their personal information. If you receive a deletion request, you must complete it or inform the requester of your reasons for not completing the request within 45 days.

How you can use Buy with Prime to address data subject rights requests from your customers

When you receive a data subject access or deletion request from a customer, use the following steps and submit a support ticket to Buy with Prime to process the request. Only the Owner can submit a support ticket to Buy with Prime to process a data subject access or deletion request on behalf of a customer.

Submit a data subject rights request support ticket on behalf of a customer

Only the Owner can submit a support ticket to Buy with Prime to process a data subject access or deletion request for a customer. If a Staff or Admin submits the ticket, merchant support will follow up to have the Owner file a ticket.

To process a data subject access request:

Step 1Acknowledge the receipt of the request and verify that the identity of the requester matches the customer whose data is being requested. For example, you can ask the requester to share their recent order transaction details.

Step 2In the Buy with Prime merchant console, choose the Get support tab, then choose Contact us.

Step 3Select Security and Privacy as the issue category.

Step 4Choose how you'd prefer to be contacted.

Step 5Enter following details into the support ticket:

1. Type of Request: Customer DSAR
2. Merchant email
3. Requester email
4. Requester DSAR submission date

Note: File the support ticket as soon as possible upon receiving the request to allow enough time to process the request and respond to the requester within the required timeframe.

Step 6Select Submit case to file the ticket.

Step 7Merchant support will update the support case correspondence with the personal information we store about the requester through a URL link. Important: Download the results from the URL link to share with the requester directly. If the URL link expires before you are able to download the results, please reply in the support case correspondence to request a new URL link.

Step 8You can combine the results with any other information you store about the requester, and then provide it to the requester.

To process a data deletion request:

Step 1Acknowledge the receipt of the request and verify that the identity of the requester matches the customer whose data is being deleted. For example, you can ask the requester to share their recent order transaction details.

Step 2Inform the requester that once their data deletion request is processed, they will no longer be able to access their Buy with Prime orders associated with your DTC site, or request returns or refunds for these orders.

Step 3In the Buy with Prime merchant console, choose the Get support tab, then Contact us.

Step 4Select Security and Privacy as the issue category.

Step 5Choose how you'd prefer to be contacted.

Step 6Enter following details into the support ticket:

1. Type of Request: Customer Data Deletion
2. Merchant email
3. Requester email
4. Requester data deletion request submission date

Note: File the support ticket as soon as you receive the request to allow enough time to process the request and respond to the requester within the required timeframe.

Step 7Select Submit case to file the ticket.

Step 8Buy with Prime will process the data deletion request after a 7-day buffer period from the original requester data deletion request submission date, during which time you can cancel the request. Note: Customer requests should be submitted as soon as possible. To cancel a pending deletion request, please reply in the support case correspondence to request a cancellation. Important: If the requester who submitted a data deletion request has any open orders at the time they made their request, Buy with Prime won't be able to process the data deletion request. The requester will need to resubmit their request once all open orders have been completed. 

Step 9Once the data deletion request has been processed, merchant support will update the support case correspondence confirming that the customer’s personal information has been deleted.  

Submit a data subject rights request support ticket for yourself

You can submit a data subject access request in addition to accessing a lot of your personal information in your account.

To submit a data subject access request:  

Step 1In the Buy with Prime merchant console, choose the Get support tab, then choose Contact us.

Step 2Select Security and Privacy as the issue category.

Step 3Choose how you'd prefer to be contacted.

Step 4Enter following details into the support ticket:

                a. Type of Request: Merchant DSAR.

                b. Merchant email              

Step 5Select Submit case to file the ticket.

Step 6Merchant support will update the support case correspondence with the personal information we store about you through a URL link. Important: Download the results from the URL link. If the URL link expires before you are able to download the results, please reply in the support case correspondence to request a new URL link.

You can submit a request to permanently delete your personal information and close your Buy with Prime user account.

To submit a data deletion request:   

Step 1In the Buy with Prime merchant console, choose the Get support tab, then Contact us.

Step 2Select Security and Privacy as the issue category.

Step 3Choose how you'd prefer to be contacted.

Step 4Enter following details into the support ticket:

                a. Type of Request: Merchant Data Deletion

                b. Merchant email        

Step 5Select Submit case to file the ticket.

Step 6Buy with Prime will process your data deletion request after a 7-day buffer period from the date of  submission, during which time you can cancel the request. Note: To cancel a pending deletion request, please reply in the support case correspondence to request a cancellation. Important: Once your data deletion request has been processed, your Buy with Prime user account will be closed and no longer accessible by you or anyone else.

Important: If you are the Owner of a business account, deletion of your personal information requires the closure of your business account. Please contact merchant support to close your business account before you submit your data deletion request. You can also use the address listed in our Privacy Notice to submit your data deletion request.