Privacy Notice for Residents of California

How to Contact Us About Your Privacy

1. Fill out form
2. Call us: 1-800-635-4772(MELISSA) ext. 4

Updated January 2026

1. CCPA Notice – Personal Information of California Residents

The California Consumer Protection Act of 2018 (“CCPA”) was enacted to enhance privacy rights for residents of the state of California. In November 2020, California voters passed Proposition 24, also known as the California Privacy Rights Act (“CPRA”), which amends and expands the CCPA. The new CCPA provisions, with the CPRA amendments, became effective on January 1, 2023. For ease of reference, these California consumer privacy laws collectively will be referred to herein as “CCPA.”

Under CCPA, a resident of California (“Consumer”) has certain rights related to their personal information. “Personal information” means information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information does not include publicly available information or lawfully obtained, truthful information that is a matter of public concern. (Cal. Civ. Code § 1798.140(v)(2).)

This Privacy Notice for California residents supplements the information in Melissa’s Privacy Policy and describes how Melissa processes personal data we collect about individuals who reside in the state of California.

2. Your Consumer Rights Under CCPA

As a California resident, you may exercise the following rights in relation to the personal information about you that we have collected, subject to certain limitations and exceptions:

1. The right to know what personal information has been collected, disclosed, shared, or sold. (Cal. Civ. Code § 1798.110, 1798.115.)

- You have the right to request the following information from the past twelve (12) months, upon verification of your identity:

- The categories of personal information we have collected about you;
- The sources of that personal information, identified by category;
- Our business or commercial purposes for collecting or, if applicable, sharing or selling your personal information;
- The categories of third parties to whom the personal information was disclosed; and
- The specific pieces of personal information we have collected about you.

2. The right to request deletion of personal information. (Cal. Civ. Code § 1798.105.)

- You have the right to request the deletion of personal information we have collected from you, subject to certain exceptions.

3. The right to opt out of the sale or sharing of personal information. (Cal. Civ. Code § 1798.120.)

- You have the right to direct us not to sell or share the personal information we have collected about you to third parties. 

4. The right to correct inaccurate personal information. (Cal. Civ. Code § 1798.106.)

- If we maintain inaccurate personal information about you, you have the right to request that we correct that inaccurate personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information.

5. The right to limit use and disclosure of sensitive personal information. (Cal. Civ. Code § 1798.121.)

- You have the right to request that we limit our use of your sensitive personal information to the use which is necessary to provide the services, and for certain business purposes.

6. The right to non-discrimination and non-retaliation for exercising rights conferred by CCPA. (Cal. Civ. Code § 1798.125.)

- By exercising your rights under CCPA, you have the right to not receive discriminatory treatment – for example, we cannot deny goods or services to you, nor can we charge you different prices for goods or services.

3. Personal Information We Collect

The table below summarizes:

- Categories of Personal Information as defined per Ca. Civ. Code § 1798.140 (v)(1) & § 1798.80(e); 

- The kinds of Personal Information that we have collected within the last twelve (12) months from or about consumers within each category;

- The sources of that Personal Information (organized by category); and 

- The business or commercial purposes for which we collect the Personal Information. 

Please note that “Personal Information,” as defined by CCPA, does not include publicly available information that is available from federal, state, or local government records, or information that a business has a reasonable basis to believe is lawfully made available to the general public by the consumer or from widely distributed media, or information made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience. (Cal. Civ. Code § 1798.140(v)(2).) We are including “publicly available information” in the chart below where it is a source of personal information just for clarity.

The data we collect directly from you as a website user, application user, or business customer is used specifically for business-related purposes and is never integrated into or used for unrelated purposes such as our products or services.  The data we collect directly from you as a website user, application user, or business customer is used specifically for business-related purposes and is never integrated into or used for unrelated purposes such as our products or services.  

4. Personal Information We Sell, Share, or Disclose to Third Parties

The CCPA distinguishes between personal information that is disclosed for a business purpose (i.e., for our internal operating purposes: maintaining or servicing accounts, verifying customer information, processing payments) and personal information that is sold or shared for a commercial purpose (i.e., inducing a business or individual to buy or subscribe to our products and services). Melissa’s practices relating to the sale, sharing, or disclosure of personal information, for both business and commercial purposes, are described below.

Note: Our website and all products and services are intended for use by individuals over 18 years of age. We do not collect, sell, share, or disclose any information about anyone under 18 years of age.

Selling or Sharing to Third Parties

Melissa does not sell or share personal information to third parties that you provide to us when using this website or in relation to your use of the Services. 

Separate from your use of our website and Services, we do share and sell personal information that we have collected through third-party licenses, data brokers, government entities, or publicly available sources. We do this to provide useful products to our customers that are typically used for address validation, identity verification, or for marketing and CRM (customer relationship management) purposes. Within the past twelve (12) months, we have sold or shared the following categories of information:

Disclosing to Third Parties

Within the past twelve (12) months, the only circumstances under which we have disclosed your personal information for business purposes are for the following reasons:

• For payment processing;
• For data analytics purposes; or
• If required by applicable law, regulation or legal process, including in connection with lawful requests by law enforcement, national security, or other public authorities.

5. Data Retention Criteria
How Long We Keep Your Personal Information

We retain the personal information we collect only for as long as is reasonably necessary to fulfill the purposes for which it was collected, or to comply with our legal, regulatory, and contractual obligations.

Because Melissa provides data quality, identity verification, and address management services using data aggregated from various third-party sources (including public records, data licensors, and other data brokers), we do not maintain a single fixed retention period for all data. Instead, the retention period for any specific piece of personal information is determined by the following retention criteria:

Data Accuracy and Validity (The "Supersession" Standard)

- Reference Data: Information used for identity verification and address standardization (such as names and addresses) is retained for as long as we have reasonable grounds to believe the information is current, accurate, and valid for its intended commercial use.

- Updates and Supersession: When we receive updated information from our third-party data sources that supersedes older data, the outdated information is deleted or archived solely for historical fraud prevention or lineage purposes. Data determined to be invalid or unverifiable is purged in accordance with our data quality protocols.

Contractual Licensing Obligations
A significant portion of our database is licensed from third-party data providers. We retain this data in strict accordance with the terms of our license agreements. If a data provider requires us to delete or purge data after a specific timeframe or upon the termination of a contract, we comply with those mandates.

Business Purpose and Service Operations
We retain data necessary to provide our services to our clients (e.g., preventing duplicate records, verifying ongoing identity). Once the data is no longer necessary for these commercial purposes, it is securely removed from our active production systems.

Legal and Regulatory Compliance
We retain records of consumer rights requests (such as Opt-Out or Deletion requests) permanently or for the duration required by law to ensure we continue to honor those requests and to comply with California Delete Act audit requirements.

Backup and Archives
When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it. If immediate deletion is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

6. Consumer Requests Under CCPA

A resident of California may submit a verifiable consumer request to exercise their consumer rights. If you are a resident of California and would like to submit a CCPA verifiable consumer request to Melissa, go to our Consumer Privacy webform and select the Consumer Request option(s) you would like to exercise. You can also email us at ConsumerRequest@melissa.com, or call us at 1-800-800-6245 ext. 4.

In order to prevent improper or potentially fraudulent requests under CCPA, consumers are required to submit “verifiable consumer requests.” A “verifiable consumer request” means a request that is made by:

- a consumer,

- by a consumer on behalf of the consumer’s minor child,

- by a natural person or a person registered with the Secretary of State, authorized by the consumer to act on the consumer’s behalf, or

- by a person who has power of attorney or is acting as a conservator for the consumer, and 

- that the business can verify, using commercially reasonable methods.

Accordingly, in order to respond to your CCPA consumer request, we must verify your identity. This will require that you provide certain personal information for validation, such as an image of your driver’s license. If we are unable to satisfactorily verify your identity, we will be unable to fulfill your consumer request in accordance with the provisions of CCPA. However, any individual, regardless of state of residence, may request to have their personal information deleted from our Melissa Lookups and other database products. If you would simply like to request deletion of your information, select “Right to Delete” on our Consumer Privacy webform.

7. CCPA Data Processing Metrics Reporting

The following metrics for the 2024 calendar year are presented in compliance with Section 999.317 of the California Consumer Privacy Act Regulations (Cal. Code Regs. Tit. 11, § 7102). 

8. The "Delete Act" & DROP Notice

Effective January 1, 2026, the California Privacy Protection Agency (CPPA) has launched the Delete Request and Opt-Out Platform (DROP). This platform will allow California residents to submit a single, verifiable request to delete their personal information held by all registered data brokers in the state. 

As a registered data broker, Melissa is committed to full participation in the DROP system. Once the platform is operational:

- We will access the DROP system at least once every 45 days to retrieve deletion requests. 

- We will process these requests by deleting the relevant personal information from our databases and directing our service providers to do the same.

- We will maintain a record of your request to ensure your information is not re-collected or re-sold.

Data brokers will be permitted to access the system to begin this processing on August 1, 2026. Until such time, please continue to use the Consumer Privacy Webform to exercise your rights directly with us.