Destruction Policy

Blacksmith Biometric Information Retention and Destruction Policy(the “Policy”)

Date of Last Revision: 10/3/2023

Purpose:  Blacksmith Agency, LLC (the “Company”) has adopted this Policy for collection, use, safeguarding, storage, retention, and destruction of Biometric Information collected by the Company.  The purpose of the Policy is to define Biometric Information and establish a retention schedule and disposal schedule for Biometric Information. This Policy only applies to Company’s own internal systems and does not apply to third parties who handle, process, or have access to personal data and other sensitive information.

“Biometric Information” means personal information stored by the Company about an individual’s physical characteristics that can be used to identify that person. Biometric Information can include, but is not limited to: fingerprints; voice patterns; face, hand, retina or ear features; and other biological traits that can be used to identify an individual.

The Company shall protect and store Biometric Information in accordance with applicable standards and laws including, but not limited to, the Illinois Biometric Information Privacy Act, the Texas Capture or Biometric Identifier Act (CUPI), and Washington’s Biometric Privacy Law.

The Company will not sell, lease, trade, or otherwise profit from an individual’s Biometric Information. The foregoing does not exclude Company from using intellectual property that may embody Biometric Information to fulfil its obligations to an individual whom Company has collected Biometric Information or an entity on whose behalf such individual interacts with Company.

Biometric Information will not be disclosed by the Company unless (a) consent is obtained, or (b) disclosure is required by law, including required disclosure to law enforcement authorities.  This Policy is not intended to restrict communications or actions protected or required by state or federal law.

Biometric Information will be stored using a reasonable standard of care to guard against unauthorized access to and acquisition of the Biometric Information, which will be reasonable for the Company’s industry, in a manner that is the same or exceeds the standards used to protect other confidential information held by the Company.

The Company will destroy biometric data when the initial purpose for obtaining or collecting such data has been fulfilled or within three (3) years of the individual’s last interaction with the Company, whichever occurs first.

Any individual may at any time request the Company to destroy, correct, or provide a copy any Biometric Information concerning that individual in the possession of the Company and Company will honor that request so long as to do so in not a violation of applicable law. An individual can make a request to destroy, correct or provide a copy of Biometric Info by contacting Legal@Blacksmith.Agency.

This Policy may be revised from time to time by the Company.