Boomerang Information Services, Inc. (“we” or “us”) wants to inform you about the ways we process your personal information. In this Data & Privacy Policy we explain what personal information we collect, use and disclose.

Personal information means any data relating to an individual who can be identified, directly or indirectly, based on that information. This may include information such as names, contact details, (online) identification data, online identifiers, or other characteristics specific to that individual.

This Data & Privacy Policy applies when you visit our websites and other services, including events, that refer or display a link to this notice (“Services”). This Data & Privacy Policy may be supplemented by additional privacy statements or terms provided to you.

Who we are

Boomerang Information Services, Inc. is a Chicago-based due diligence and corporate services company providing services to clients nationwide. Any personal information provided to or collected by us is controlled by us at 53 W Jackson Blvd., Ste. 1420, Chicago, IL 60604.

We are committed to safeguarding the personal information of our customers, employees and other stakeholders, while helping our customers, employees, investors, and society create a deeper impact and make the right decisions.

If you wish to contact us in relation to questions to your personal information we refer you to the ‘How you can contact us’ section below.

What personal information do we collect?

The type of personal information we collect depends on your relationship with us and the Services we deliver to you. To that end, we may collect the following personal information about you:

  • Name and contact details, such as, first and last name, email address, postal address, telephone number
  • Work-related information, such as, job title and other employment or education information
  • Financial Information, such as, bank account, credit and debit card numbers for processing of payments

If you are under 13 years of age, please do not use or access the Services. Boomerang does not knowingly collect or maintain personal information (as defined by the United States Children’s Online Privacy Protection Act) from persons under 13 years of age. If Boomerang learns that personal information of persons under 13 has been collected on or through the Services, we will take appropriate steps to delete this information.

How we collect personal information

We and our third-party service providers may collect personal information from the following sources:

  • Direct Interactions, such as, when you register for our Services, place an order or make a purchase.

How we use your personal information

Personal information collected is used for the purposes for which you have provided it and might be further used for statutory or other legitimate purposes only. As an example, if you make use of our service contact form on our website, we will use the information you provided in the first place to respond to your service request. We might further use that information to improve the quality of our customer service process.

Lawfulness of the processing is one of the main principles relating to processing of your personal information – we apply the following legal processing grounds:

  • processing is necessary for the performance of a contract or in order to take steps prior to entering into a contract;
  • processing is necessary for the purposes of our legitimate interests – for example, to improve the quality of our products and services;
  • processing is necessary for compliance with a legal obligation to which we are subject or that is otherwise lawful under applicable data protection laws;
  • with your given consent.

Depending on how you interact with us and the Service, we may use your personal information for the following purposes:

  • Administering our relationship with you and our business, such as providing and managing your access to and use of our Services. This processing is necessary for the performance of a contract;
  • Improving our Services, such as inviting you to participate in surveys or to personalize your experience with our Services. This processing is necessary for the purposes of our legitimate interests;
  • Marketing, such as registering your opt-in to receive marketing communications when applicable. This processing is with your given consent or for our legitimate interests;
  • Recruiting, such as assessing job applicants. This processing is in order to take steps prior to entering into a contract or with your given consent;
  • Other general business support purposes, including but not limited to, procurement, financial and fiscal management, risk and compliance management, and external reporting. This processing is necessary for compliance with a legal obligation to which we are subject or that is otherwise lawful under applicable data protection laws or for our legitimate interests.

Sharing your personal information

To be able to provide you the best possible Services and further our business operations, we may share certain information internally or with selected third parties. There might also be a certain statutory or legal obligation that we believe in good faith requires us to disclose your personal information externally. Parties we might share data with include:

  • our service providers, e.g. for managing or hosting services and/or underpinning technology for the Services we are providing;
  • organizations involved in business transfers, e.g. to a purchaser or successor entity in the event of a sale or any other corporate transaction involving some or all of our business;
  • other parties, e.g. as needed for external audit, compliance, risk management, corporate development and/or corporate governance related matters; or
  • governmental authorities and regulators, as required under applicable law.

Whenever we share personal information internally or with third parties in other countries, we have appropriate safeguards in place in accordance with applicable data protection laws. As required under applicable law, third parties are required to use appropriate safeguards to protect personal information and they can only access personal information that is necessary for performing their specific tasks.

For how long we keep your personal information

Your personal information will be processed to the extent necessary for the performance of our obligations, and for the time necessary to achieve the purposes for which the information is collected, in accordance with applicable data protection laws. When we no longer need your personal information, we will take all reasonable steps to remove it from our systems and records or take steps to properly anonymize it so that you can no longer be identified from it.

How we protect your personal information

We have put in place an internal framework of policies and minimum standards across all our businesses to keep your data safe. In addition, we limit access to personal information by our employees, business partners, service providers and third-party service providers to a ‘need-to-know’ basis.

What are your rights

  • Right of access (‘an overview of your personal information’): the right to get an overview of your personal information that we process.
  • Right to rectification (‘correct your personal information’): if your personal information is inaccurate or incomplete, the right to ask us to rectify or complete your personal information.
  • Right to erasure (‘right to be forgotten’): the right to request that we delete your personal information to the extent permitted by applicable law. In certain circumstances, it may not be possible for us to accept your request, for example, when the processing is necessary to comply with a legal obligation, or if processing is necessary for the performance of a contract.
  • Right to data portability (‘transfer your personal information’): the right to ask us to transfer your personal information directly to you. This applies to certain personal information if processed by automated means and with your consent or based on a contract you have with us. On your request, and where technically feasible, we will transfer your personal information to another party of your choice.
  • Right to restrict processing: the right to request that we restrict or stop the processing of your personal information held by us for a certain period of time, or for an indefinite period. In certain circumstances, it may not be possible for us to accept your request, for example, when the processing is necessary to comply with a legal obligation, or if we can demonstrate compelling legitimate grounds otherwise.
  • Right to object: the right to object to the processing of your personal information. The reasons for objection should relate to your particular situation, and be related to a processing based on the legitimate interest condition. We will then no longer process the personal information, unless we can demonstrate compelling reasons otherwise. In certain circumstances you have the unconditional right to object; for instance, in the context of direct marketing activities.
  • Withdrawal of Consent: the right to withdraw your consent to the processing of your personal information at any time; for instance, after you consented to keeping you informed about our Services, you have the right to withdraw this consent at any time.

To exercise your rights and/or for any other questions about the handling of your personal information, we refer you to the ‘How you can contact us’ section below.

How you can contact us

If you have any questions about how we process your personal information or if you want to exercise one of your rights, you can contact us by emailing [email protected] or calling (312) 662-1206.

If you feel we are unresponsive or disagree with our data privacy practices, you can also file a complaint with your national Data Protection Authority.

In response to a request, we might ask you to verify your identity if needed, and to provide information that helps us to understand your request better. If we do not grant your request, whether in whole or in part, we will explain why.

Updates to this notice

From time to time we may update this Data & Privacy Policy or any other specific privacy statement. When making changes to this Data & Privacy Policy, we will add a new date to this Privacy Statement. This version is effective March 5, 2020.