Privacy Policy

Effective Date: April 21, 2026

Please click here for a printable PDF version of this policy.

This Privacy Policy describes how Acosta Inc. and our affiliates (“we” or “Acosta Group”) collects, uses, shares and protects personal data when you interact with our websites where this Privacy Policy is posted, the emails we send, our social media accounts, our online services, and through our interactions with individuals by telephone or other means (collectively, our “Services”).

Acosta Group is the data controller of the personal data collected under this Privacy Policy.

This Privacy Policy explains the following:

Please note that this Privacy Policy does not apply to non-Acosta Group websites or services that state that they are offered under a different privacy policy. Please review the privacy policies on those websites and applications directly to understand their privacy practices.

1. How We Collect Information

We may collect information about you by the following means:

Directly from you, when you provide information to us or interact with us, our clients, or our affiliates’ Services;
Automatically from you, when you utilize or interact with our Services;
From service providers who collect information on our behalf in order to provide services to us;
From online advertising companies who may share information about the marketing and advertisements you have seen or clicked on, and from social networks and other sources of publicly available data;
From job applicants who may share information in relation to applying for a position with Acosta Group; and
From other third-party sources that provide consumer data, such as information about your interests, demographic information, consumer behaviors, and marketing inferences.

2. Information We Collect

In order to better provide you with our Services, we may collect the following categories of information:

Contact information and any other information you choose to include when you communicate with us via e-mail, mail, phone or other channels;
Transactional information including payment information and payment history if you engage in transactions through the Services;
Demographic information including postal code or ZIP, preferences, gender, interests and favorites;
Inferences including information about your preferences, interests and purchasing tendencies;
Device information when you utilize our technology platforms, including as model, serial number, device location, usage data, and operating information, including as described below in the “Online User Activity, Cookies and Information Collected by Other Automated Means” section;
Survey information in response to questions we may send you through the Services, including for feedback and research purposes;
User content you may provide to publicly post via the Services (e.g., comments);
Online user activity described in the next section; and
Biographical information when you inquire about or apply for a position with us.

If you provide us with information regarding another individual, you represent that you have that person’s consent to give us their information and to permit us to use the information in accordance with this Privacy Policy.

Job Applicant Information

Job applicant information may be collected by us directly through the Services, or by email, or may be collected on our behalf by our contracted third-party administrator(s) for applicant tracking purposes. In certain jurisdictions, we may also use chat-based assessment tool provider(s). These third-party administrators and assessment tool providers are permitted to process the information you provide only for purposes of providing services to us. We collect the information you provide to us, such as your name, email address, phone number, address, the content of any comments, your job application (including your work history, reasonable adjustments for interviews, right to work status, type of right to work documentation, any criminal convictions, and Acosta Group employee referral information), your CV (including your employment history and other information provided on the CV), information provided during your chat-based interview, scores and profile results generated from the chat-based interview, and any cover letter you provide. For successful job applicants, we will also collect bank account details and other personal and family details. We also collect your personal data when you sign up to receive job alerts, including your email address.

For job applicants that are California residents, please see the “California Job Applicants” section below for additional information. For job applicants that are UK residents, please see the “Use of Automated Decision-Making in Recruitment” subsection in the “EEA, Switzerland, or UK Residents” section below for more information about our use of chat-based assessment tools.

Online User Activity, Cookies and Information Collected by Other Automated Means

When you interact with the Services, such as when you visit one of our websites or open one of our emails, certain information about your use of our Services is automatically collected. This may include the following types of information: your location, computer or device configuration, IP address and URL of referring website, if any, pages viewed, number of visitors, and length of visits.

Like many websites, we collect information when you use our Services through cookies, web beacons, and other similar technologies, which may be operated by our partners who assist us in serving ads or providing other services to you. Please see our Cookie Policy for more information.

With respect to any social media pages that we may use, please see the privacy policies and any cookie policies of the applicable social media providers as to their automated data collection practices.

Also, your browser or device may include “Do Not Track” functionality or send opt-out preference signals. Where required by applicable law, we will recognize and honor opt-out preference signals (or global privacy controls).

3. How We Use Your Information

We use the information we collect from you to:

Provide our Services to you and to send you related important notices;
Respond to your requests, questions and comments and provide customer support;
Evaluate, recruit, and hire personnel;
Provide job applicants in certain jurisdictions with insights and coaching tips based on their chat-based interviews; and
Comply with legal requirements and industry standards, detect, investigate, and prevent activities that may violate our policies or be fraudulent or illegal, and protect the rights of Acosta Group, you, or others.

We may use and share information in an aggregated or de-identified manner at our discretion, including for research, analysis, modeling, marketing, and improvement of our Services. Where we maintain de-identified information, we commit to maintaining and using such information in de-identified form and will not attempt to reidentify such information.

4. How We Disclose Your Information

Service Providers. We may share your information with service providers that we believe need the information to perform a technology, business, or other professional function for us such as billing and collection, IT services, maintenance and hosting of our Services, payment processors, marketing partners, accounting, auditing, and tax services, and other professional services.
Analytics Partners. We partner with analytics providers, who collect information via tracking technologies on our websites to assist us with measuring visits and traffic on our websites so we can measure and improve the performance of the websites.
Social Media. If you interact with us on social media platforms, the platform may be able to collect information about you and your interaction with us. If you interact with social media objects on our Services (for example, by clicking on a Facebook “like” button), both the platform and your connections on the platform may be able to view that activity.
Affiliates. We share information with other entities in our corporate family, for purposes consistent with this Privacy Policy.
Corporate Event. We reserve the right to transfer to another entity or its affiliates or service providers some or all information about you in connection with, or during negotiations of, any merger, acquisition, sale of assets or any line of business, change in ownership control, or financing transaction. We cannot promise that an acquiring party or the merged entity will have the same privacy practices or treat your information the same as described in this Privacy Policy.
Legal. We share information where necessary to comply with applicable law, to respond to requests from law enforcement agencies or other government authorities or third-parties, as permitted by law and without your consent when it is necessary to protect our customers, employees, or property; in emergency situations; or to enforce our rights under our terms of service and policies.

5. How We Protect and Store Your Information

We use a combination of physical, technical, and administrative safeguards in an effort to protect the information we collect through the Services. While we use these precautions to safeguard your information, we cannot guarantee the security of the Internet, networks, systems, servers, devices, and databases we operate or that are operated on our behalf.

6. Your Email Marketing Options

You may have certain choices when it comes to how we collect and use your information in relation to email marketing: If at any time you no longer wish to receive marketing communications from us, you can click the unsubscribe link at the bottom of any email.

7. Children’s Information

We do not knowingly or intentionally gather personal data about children who are under the age of 18. If a child has provided us with personal data, a parent or guardian of that child may contact us at privacy@acosta.com to have the information deleted from our records. If we learn that we have inadvertently collected the personal data of a child under the minimum age depending on jurisdiction, we will take steps to delete the information as soon as possible and cease the use of that information in accordance with applicable law.

8. Privacy Rights

Certain jurisdictions have specific legal requirements and grant privacy rights with respect to personal data, and we will comply with restrictions and any requests you submit as required by applicable law. If you are a California resident, see the “California Privacy Rights” section below for additional information as to your rights and to how to exercise those rights. If you are a resident of the EEA, Switzerland, or the UK, see the “EEA, Switzerland, and UK Residents” section below for additional information as to your rights and to how to exercise those rights.

Nevada residents have the right to opt out of the sale of certain pieces of their information to third parties who will license or sell their information to others. However, Acosta Group does not sell personal data as contemplated by Nevada law.

If you are a resident of one of the U.S. states listed below, you have one or more of the following rights: (1) to request additional information about our data collection, use, disclosure, and sales practices in connection with your personal data; (2) to request the specific personal data collected about you; (3) to request the deletion of the personal data we have about you, with exceptions; (4) to request a restriction on certain processing of personal data; (5) to request correction of inaccurate information; (6) to opt-out of the processing of personal data for the purpose of “profiling” in furtherance of decisions that produce legal or similarly significant effects; and (7) to opt-out of the “selling” and “sharing”/“targeted advertising” of personal data as such terms are defined under U.S. state privacy laws. Please note, Acosta Group sells personal data and shares personal data/engages in “targeted advertising”. For a description of the categories of personal data that are sold or shared/used for targeted advertising and for a description of the categories of third parties that such personal data is disclosed to, see the chart in the “California Privacy Rights” section below. Acosta Group may engage in profiling in furtherance of decisions that produce legal or similarly significant effects in certain circumstances. You may also have the right to not be discriminated against for exercising your privacy rights. If you are a resident of one of the following U.S. states, you have one or more of these rights:

Alabama (effective May 1, 2027)	Colorado	Connecticut	Delaware
Indiana	Iowa	Kentucky	Maryland
Minnesota	Montana	Nebraska	New Hampshire
New Jersey	Oklahoma (effective Jan. 1, 2027)	Oregon	Rhode Island
Tennessee	Texas	Utah	Virginia

If you are located outside these jurisdictions and seek to exercise your rights under the law of another If you are located outside these jurisdictions and seek to exercise your rights under the law of another jurisdiction, please contact us by emailing privacy@acosta.com.

You or, depending on your state of residence, your authorized agent may submit a request regarding your personal data by:

Email: privacy@acosta.com
Completing this form online

To exercise a right to opt out of “sharing” (for targeted advertising) or the “sale” of personal information, please use our cookie preference management tool, which may be accessed via a “Cookie Settings” or “Cookie Preferences” link in the footer of the website homepage.

To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to the information. We may need to request specific information from you to help us confirm your identity. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. When you make a request, we may also contact you to ask you for further information in relation to your request to speed up our response and require you to follow procedures so that we can verify your identity (and the applicable jurisdiction). The verification steps we take may differ depending on your jurisdiction and the request. Where possible, we will attempt to match the information that you provide in your request to information we already have on file to verify your identity. If we are able to verify your request, we will process it. If we cannot verify your request, we may ask you for additional information to help us do so.

We will respond to your request within the time period required by applicable law. However, we may not always be able or required to comply with your request, in whole or in part, and we will notify you in that event.

9. Our Retention of Your Information

We retain your personal data for as long as necessary for the purpose for which it was initially collected, to carry out legitimate business interests, as well as on the basis of applicable legal requirements (such as applicable statutes of limitation). After expiry of the applicable retention periods, your personal data will be deleted. If there is any data that we are unable, for technical reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent any further use of such data.

The criteria we use to determine the retention period is as follows:

whether there are contractual or legal obligations that exist that require us to retain the data for a period of time;
whether there is an ongoing legal claim that relates to any business (or otherwise) relationship you have with us, or that is otherwise related to your relationship with us;
whether any applicable law, statute, or regulation allows for a specific retention period; and
whether the personal data is considered to be sensitive personal data, in which case a shorter retention period generally would be applied.

These criteria may also mean we adjust the period of time we retain the categories of personal data detailed above.mean we adjust the period of time we retain the categories of personal data detailed above.

10. International Transfers

If you use our Services outside of the United States, you understand that we may collect, process, and store your personal data in the United States and other countries. The laws in the United States regarding personal data may be different from the laws of your state or country. Any such transfers will comply with safeguards as required by applicable law. By using the Services, you consent to the collection, international transfer, storage, and processing of your data.

Your personal data will be transferred to the United States or other jurisdiction outside the EEA, EU, or UK if there is a safeguard in place to ensure an appropriate level of data protection for your data.

11. Jurisdiction-Specific Notices

California Residents

California Consumer Privacy Act

The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA”), provides California residents with certain rights related to our collection, use, sharing or disclosure of their personal data. If you are a resident of California, you have the right: (1) to know what personal data has been collected about you, and to access that information, (2) to request deletion of your personal data, though exceptions under the CCPA may apply, (3) to request correction of inaccurate personal data, (4) to request to limit the disclosure and use of any of your sensitive personal data, (5) to opt-out of the processing of personal data for the purpose of “profiling” in furtherance of decisions that produce legal or similarly significant effects, and (6) to opt-out of the selling or sharing of personal data, as defined by the CCPA. You have the right to be free from discrimination based on your exercise of your CCPA rights.

We have collected the following categories of personal data from consumers. Please see our Cookie Policy for information about the collection and use of personal data by third-parties who process information collected by cookies and related technologies that we permit them to use on the Services. Except as indicated in the “California Job Applicants” section below, we do not seek to collect any other “sensitive personal information” (as defined in the CCPA). The sources of this personal data are described in the “Information We Collect” section above. We collect this personal data for the purposes described in the “How We Use Your Information” section above.

Category	Examples	Sold or shared	Disclosed to
Personal Identifiers	name, email address, phone number, and contact address, username, social media handle and basic account information, unique identifiers (such as those assigned in cookies)	Certain information may be sold or shared, including to advertising and marketing partners and analytics providers	Service providers, affiliates, advertising and marketing partners, analytics providers
Personal data categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))	name, signature, address, telephone number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information	Not sold or shared	Service providers and affiliates
Commercial information	transaction information, billing records, payment records, order history	Not sold or shared	Service providers and affiliates
Internet or other similar network activity	unique numerical identifier, cookie or tracking pixel information, device ID, browsing history, search history, IP address, interaction with a website, interaction with an application, or interaction with advertisement	Sold and shared	Service providers, affiliates, advertising and marketing partners, and analytics providers
Geolocation information	Location information (e.g., ZIP code, city, region, IP address), device location	Certain information may be sold or shared, including to advertising and marketing partners and analytics providers	Service providers, affiliates, advertising and marketing partners, and analytics providers
Audio, electronic, visual, thermal, olfactory, or similar information	call recording (e.g., customer service calls)	Not sold or shared	Service providers and affiliates
Inferences drawn from other personal data	Interests, preferences	Not sold or shared	Service providers and affiliates

California Job Applicants

When you apply for a job with Acosta Group, information may be collected about you in multiple ways: you may provide it to us in connection with your application; we may make observations in the application process or collect information from public information sources; or you may authorize us to collect information from other sources, such as a former employer or reference.

The following table describes our practices with regard to information submitted in the job application process. If you use our website in the job application process, additional information may be automatically collected, as described above.

Category (may constitute “sensitive information” under the ccpa)	Examples	Sold or shared	Disclosed to
Personal Identifiers*	name, email address, phone number, and contact address, username, social media handle, Social Security number	Not sold or shared	Service providers
Personal Classifications*	gender, race and ethnicity, date of birth	Not sold or shared	Service providers
Geolocation Information	Location information (e.g., ZIP code, IP address)	Not sold or shared	Service providers
Professional or employment-related information	employer’s name, employer’s address	Not sold or shared	Service providers
Education Information	institutions attended, degrees and certifications attained	Not sold and shared	Service providers

In certain circumstances, you may submit your application for employment through a third-party service that displays our job posting. We do not control the privacy practices of these third-party services. Please review their privacy policies carefully prior to submitting your application materials.

Exercising Your Rights as a California Resident

You may submit a request to exercise your rights under CCPA through one of two means:

By completing this form online
By calling us at 1-800-377-2754

To opt-out of selling and sharing, please use our cookie preference management tool, which may be accessed via a “Cookie Settings” or “Cookie Preferences” link in the footer of the website homepage.

You may also designate an agent to exercise your privacy rights on your behalf. In order to designate an authorized agent to make a request on your behalf, you must provide a valid power of attorney, the requester’s valid government-issued identification, and the authorized agent’s valid government issued identification.

Upon submission of your request, we will contact you (via the email address provided in your request) with instructions on how to verify the request and your identity, after which we will check our records for matching information, and aim to complete requests as soon as reasonably practicable and consistent with any applicable laws. You may authorize another individual or a business, called an authorized agent, to make requests on your behalf through these means. We may have a reason under the law why we do not have to comply with your request, or why we may comply with it in a more limited way than you anticipated. If we do, we will explain that to you in our response.

California Shine the Light Law

California’s “Shine the Light” law permits customers in California to request certain details about how certain types of their information are shared with third parties for those third parties’ own direct marketing purposes. Acosta Group does not disclose personal data to third parties for such third parties’ own direct marketing purposes.

EEA, Switzerland, or UK Residents

If you are located in the EEA, Switzerland, or the UK, you are entitled to certain rights, subject to applicable exceptions, under the GDPR, Swiss, and UK data protection laws. Please note that, in order to verify your identity, we may require you to provide us with information prior to accessing any records containing information about you.

We typically will process your information pursuant to the following legal bases: (1) with your consent; (2) as necessary to perform our agreement to provide Services to you; or (3) as necessary for our legitimate interests in providing the Services where those interests do not override your fundamental rights and freedoms related to data privacy. We also may process your information where it is necessary to comply with a legal obligation to which we are subject. For UK residents that are job applicants, please see the “Use of Automated Decision-Making in Recruitment” section below for more information that may apply to you..

Use of Automated Decision-Making in Recruitment

We will use the contact details you provide to us as a job applicant to contact you to process your application. We will also use the contact details and other information you provide to assess your suitability for the role you have applied for. We do not collect more information than we need to fulfil our stated purposes and will not retain it for longer than is necessary. The information we ask for is used to assess your suitability for employment. You do not have to provide what we ask for, but it may affect our ability to fully assess your suitability for employment.

Transparency and Use of Automated Decision Making

Within our recruitment process, we use automated decision-making (ADM) in the form of an automated digital chat-based assessment tool to automate the initial filtering of applications based on specific criteria to assist in our hiring process. We will provide you with further information about the system(s) used and the logic involved upon request; for example, after you use the chat-based assessment tool, you will have the opportunity to request your personality profile. The final recruitment decisions are not made by the ADM but by a member of our recruitment team who considers the tool’s output alongside the applicant’s application.

Lawful Bases and Special Categories of Personal Data

We process personal data when using ADM during recruitment in accordance with Article 6(1)(b) (the processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract) or Article 6(1)(f) (the processing is necessary for Dee Set’s legitimate interests) of the UK GDPR, as amended by the Data (Use and Access) Act 2025.

We ask that you not provide sensitive data, or special category data (such as information regarding ethnicity, health, political opinions, or trade union membership), in your responses through the chat-based interview.

Safeguards and Rights

Following a hiring decision, job applicants: (1) have the right to obtain human intervention regarding the decision by contacting us with questions or concerns; (2) may express their point of view and contest the decision; and (3) may request a human review. Job applicants can contact us using the information in the “Contact Information” section below.

We strive to maintain transparency about our use of ADM and job applicants’ rights to request a human intervention.

Rights

Right to be Informed: You are entitled to be informed of the use of your personal data. This Privacy Policy provides such information to you.
Right of Access: You have the right to access your personal data (commonly known as a “subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
Right to Correction: You have the right to request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
Right to Erasure: You have the right to request erasure of your personal data in certain circumstances. This enables you to ask us to delete or remove personal data where there is not a good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
Right to Restriction of Processing: You have the right to restrict the processing of your personal data. This enables you to ask us to suspend the processing of your personal data in one of the following scenarios:
- If you want us to establish the data’s accuracy;
- Where our use of the data is unlawful but you do not want us to erase it;
- Where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or
- You have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
Right to Data Portability: You have the right to request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you. We do not use personal data to make automated decisions about you in any situations where you may have a legal right to opt out.
Right to Object: You have the right to object to the processing of your personal data where we are relying on a legitimate interest (or those of a third party) as the legal basis for that particular use of your data (including carrying out profiling based on our legitimate interests). In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your right to object. You also have the absolute right to object any time to the processing of your personal data for direct marketing purposes.
Right to Withdraw Consent: If we are processing your personal data based on your consent, you have the right to withdraw your consent at any time.

To submit a request to exercise your rights, please contact us using the information in the “Contact Information” section below. We may have a reason under the law why we do not have to comply with your request, or may comply with it in a more limited way than you anticipated. If we do, we will explain that to you in our response.

Lodging a Complaint

Users that reside in the EEA, Switzerland, or the UK have the right to lodge a complaint about our data collection and processing actions with the supervisory authority concerned. Contact details for EU data protection authorities are available https://ec.europa.eu/newsroom/article29/items/612080. If you are based in the UK, you can make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues (www.ico.org.uk).

12. Updates To This Privacy Policy

We may make changes to this Privacy Policy from time to time. The “Effective Date” at the top of this page indicates when this Privacy Policy was last revised. If we make any material changes, we will provide notice of such changes on the pertinent website for a reasonable period of time. We may also notify you in other ways from time to time about the collection, use, and disclosure of your personal data described in this Privacy Policy. We encourage you to review this Privacy Policy periodically, especially if you don’t use the Services regularly.

13. Contact Information

For questions about our privacy practices, you may contact us via email at privacy@acosta.com or write to us at the following address:

Acosta Inc.
Attn: Data Privacy Officer
6651 Gate Parkway
Jacksonville, Florida 32256