Third Iron Website Privacy Policy

Last Revised: January 13, 2025 

Please read this Website Privacy Policy (“Policy”) carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, your choice is not to use our Website. By accessing or using our Website, you agree to this Policy.

This Policy may change from time to time (see the “Changes to Our Policy” section). Your continued use of our Website after we make changes is deemed to be acceptance of those changes, so please check the Policy periodically for updates.

Overview

We know that your privacy is important to you, and we work hard to earn and keep your trust. This Policy governs the manner in which Third Iron, LLC and its affiliates, including BZ DISC, Inc. (“Third Iron”,  “we”, “us,” and “our”) collects, uses, maintains and discloses Personally Identifiable Information (“PII”) collected from users (each, a “User”) and visitors of Third Iron’s website available at: https://thirdiron.com/ (“Website”). The words “you” and “your” refer to you as a User or visitor of the Website. 

This Policy describes:

• The types of PII Third Iron collects on our Website and any other interactions we may have with you through our Website; and  
• Our practices for collecting, using, maintaining, protecting, and disclosing your PII.

This Policy does not apply to information collected by us offline or through any other means, including on any other website or application operated by Third Iron or any third party, or information collected by any third party through any application or content (including advertising) that may link to or be accessible from the Website (for further information, see below, “Links to Other Services and Websites”).

Application Privacy Policy

Third Iron offers BrowZine and LibKey web browser and mobile applications and services (collectively “Applications”) to licensed organizations such as universities, schools, hospitals, corporations and government research labs (“Licensed Entities”). Individuals affiliated with these Licensed Entities may access and use our Applications on the web, network and devices of these Licensed Entities. This Policy is incorporated by reference and should be read in conjunction with Third Iron’s Application Privacy Policy, available at https://support.thirdiron.com/support/solutions/articles/72000639010-third-iron-application-privacy-policy.

Information We Collect

We collect information from you in two ways. First, you provide us with certain information when you access and otherwise use our Website. Second, we collect certain information automatically as you interact with our Website.  If you do not want us to collect this information, please do not provide it.  The information we may receive and collect includes:

• Personal Information.  To ensure that we provide you with the best possible experience, we will store, use, and disclose personal information about you in accordance with this Policy.  Personal information is information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular user, household or device (“Personal Information”). The Personal Information that we may receive and collect depends on what you do when you visit our Website. For example, when you contact us to request more information about one of our products, services or Applications, we may collect your Personal Information such as your name, e-mail address, school or employer, and any other information you may provide us when you contact us. 

• Information of Other Individuals. You may have the opportunity to provide information of other individuals. When providing such information, you are solely responsible for obtaining the necessary consents and authorizations from any individuals in accordance with applicable data security laws and regulations, and Third Iron shall not be responsible or held liable for your failure to obtain the necessary consents.

• Aggregated and De-Identified Data. We may also collect, use and disclose aggregated and de-identified data such as statistical or demographic data for any purpose. Aggregated and de-Identified data could be derived from your Personal Information but is not considered Personal Information under applicable law as this data will not directly or indirectly reveal your identity. However, if we combine or connect aggregated or de-identified data with your Personal Information so that it can directly or indirectly identify you, we treat the combined data as Personal Information which will be used in accordance with this Policy.

• Free-Text Boxes. The information that you provide in each case will vary. In some cases, you may be able to provide Personal Information via email or free text boxes, such as contacting Third Iron to request further information. When providing your Personal Information, please provide only relevant information and do not provide unnecessary sensitive information, such as Social Security numbers, credit card information or other sensitive personal data, unless required for our services.   

(a) Information We May Collect on the Website

You may have the opportunity to provide Personal Information on our Website, including but not limited to:

We may obtain the Personal Information listed above from the following categories of sources:

• Directly from you. For example, when you: 
  • interact with the Website;
  • submit a ticket requesting assistance; 
  • subscribe to one of our e-newsletters; or
  • otherwise communicate with us, such as contacting us for more information. 
• Indirectly from you. For example, through information we collect from you or receive from our Licensed Entities in the course of providing our products and services to you and other Licensed Entities.
• Directly and indirectly from activity on our Website. For example, from Website usage details that are collected automatically. For more information on automatic information collection, please review the “Automated Information Collection” section below.

Automated Information Collection

In addition to the information that you provide to us, we may also collect information about you during your visit to our Website. We collect this information using automated tools that are detailed below.  These tools may collect information about your behavior and your computer system, such as your internet address (IP Address), the pages you have viewed, and the actions you have taken while using the Website. Some of the tools we use to automatically collect information about you may include:

Embedded Web Links. Links provided in our emails and, in some cases, on third-party websites may include tracking technology embedded in the link. The tracking is accomplished through a redirection system. The redirection system allows us to understand how the link is being used by email recipients. Some of these links will enable us to identify that you have personally clicked on the link and this may be attached to the Personal Information that we hold about you. This data is used to improve our service to you and to help us understand the performance of our marketing campaigns.

• Web Beacons:  A Web Beacon is an electronic image (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us to understand User behavior, for example, to count users who have opened an email. If you choose to receive emails from us, we may use Web Beacons to track your reaction to our emails. We may also use them to track if you click on the links and at what time and date you do so. 

Using Your Personal Information

We may use information collected from or about you for any of the following purposes:

• To deliver our Services. We use information you provide us when you register for our products, Applications or services to deliver them to you.
• To meet legal requirements. We may be required to provide Personal Information to comply with legally mandated reporting, subpoenas, court orders, or other requirements.
• To market our products and services. We may inform you about our products, services or events and otherwise perform marketing activities. Further, we may use information for analytics purposes.
• Verify Users. We may use Personal Information to manage and verify your account and the identity of users of the services.
• Other purposes. We may use Personal Information for any other legal, business or marketing purposes that are not inconsistent with the terms of this Policy.

The length of time Third Iron intends to retain Personal Information is for as long as reasonably necessary to carry out Third Iron’s intended business purpose for such information.  

Disclosing Your Personal Information

We do not sell or lease your Personal Information to any third party. However, we may disclose Personal Information to a third party for a business purpose, including in the following circumstance:

• Internally. In order to provide services through our Website that require the input of information, we may need to share your information within Third Iron.
• Business Partners, Distributors and Contractors. We may provide Personal Information to business partners, distributors, and contractors (including third-party distributors and resellers, vendors, suppliers and other service providers), who may use the information to fulfill product orders, develop and improve products, contact you about product orders or in connection with the performance, operation, and support of the services or solutions, performing marketing or consulting services, or as otherwise appropriate in connection with a legitimate business need.  Further, we may disclose Personal Information to service providers who host or facilitate the delivery of online training, seminars and webinars; email-delivery services and other technology providers; and third parties that may assist in the delivery of marketing materials, technical support services, or other products, services or other information. These companies are authorized to use your Personal Information only as necessary to provide these services.
• Third Party Analytics Providers. We may disclose Personal Information with third parties who conduct marketing studies and data analytics, including those that provide tools or code which facilitates our review and management of our cloud-based software. 
• In Aggregate or De-Identified Form. We may aggregate or otherwise anonymize the data we collect for purposes of analytics, research, marketing and other legitimate business interests of Third Iron. Such use shall not include Personal Information or information that can identify you as an individual or reasonably be used to identify you.
• Transfer or Assignment in Connection with Business Transfers or Bankruptcy.  In the event of a merger, acquisition, reorganization, bankruptcy or sale of all or a portion of our assets, any Personal Information owned or controlled by us may be one of the assets transferred to third parties. We reserve the right, as part of this type of transaction, to transfer or assign your Personal Information and other information we have collected from users of the services to third parties. Other than to the extent ordered by a bankruptcy or other court, or as otherwise agreed to by you, the use and disclosure of all transferred user information will be subject to this Policy. However, any information you submit or that is collected after this type of transfer may be subject to a new privacy policy adopted by the successor entity.
• Response to Legal Requirements, Subpoenas, or Protection of Our Rights.  We may disclose Personal Information as and when we believe, in our sole discretion, that disclosure is necessary or appropriate to meet legal requirements, to comply with a subpoena, law-enforcement or government request, to investigate fraud, or to protect our rights.
• To Our Affiliates. We may disclose some or all of your information with our subsidiaries and corporate affiliates, joint venture partners, or other companies that are or may become under common control with us. We will require these entities to comply with the terms of this Policy with regard to their use of your information.

How We Protect Your Information

Third Iron takes commercially reasonable security measures to protect against unauthorized access, alteration disclosure or destruction of your Personal Information.  However, like other companies, Third Iron cannot guarantee 100% the security or confidentiality of the information you provide to us.  If you have reason to believe that your interaction with us is no longer secure please notify us by sending an email with the subject line “Security Concern” and a description of the concern to [email protected] or by calling us at 855-649-7607.

We use a select number of trusted external service providers for certain technical data analysis, processing and/or storage offerings.  We only disclose information with them that is required for the services offered and we contractually bind them to keep Personal Information we disclose to them confidential and to process Personal Information according to our instructions.

Rights and Choices

• Opt-Out.  If you have established a User account or registered for our email newsletter and do not wish to receive communications from us, you may unsubscribe at any time. 
• Correction.  You have the right to access your Personal Information and to correct, amend, or delete such Personal Information if it is inaccurate. Requests for access, correction, amendment, or deletion should be sent to [email protected].  If you delete any account information, we may retain certain information as required by law or for legitimate business purposes.
• “Do Not Track Requests.”  Your Internet browser and mobile device may allow you to adjust your browser settings so that “do not track” requests are sent to the websites you visit. Third Iron respects your wishes and will not track user activity once “do not track” signals have been activated.
• Your Consumer Rights. Some state laws in the United States provide individuals with additional rights with respect to their Personal Information (also known as “personal data”), as those terms are defined under those applicable state laws. Such state laws may include, but are not limited to, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 and its implementing regulations (“CCPA”),  Colorado Privacy Act and its implementing regulations (“CPA”), Connecticut Data Privacy Act (“CTDPA”),  Montana Consumer Data Privacy Act (“MTCDPA”), Oregon Consumer Data Protection Act (“OCPA”), Utah Consumer Privacy Act (“UCPA”), and Virginia Consumer Data Protection Act (“VCDPA”) (collectively “U.S. Privacy Laws”). Any Personal Information we collect is for the commercial purpose of effectively providing our Website to you, as well as enabling you to learn more about and benefit from our Website and services. If you are a consumer in a state that provides consumer rights, please be advised that Third Iron is NOT a “business” or “controller” as that term is defined under U.S. Privacy Laws and therefore does not afford consumers these rights with respect to their Personal Information. Regardless, all Personal Information will be processed in accordance with this Policy.

California Privacy.  

• Shine the Light law. If you are a California resident, California Civil Code Section 1798.83 permits you to request information regarding the disclosure of your Personal Information by Third Iron to a third party for the third party’s direct marketing purposes. To make such a request, please send an email to [email protected] or write us at:  Third Iron, LLC., Attn: Privacy, PO Box 270400, St Paul, MN 55127 USA
• WE DO NOT SELL OR SHARE YOUR PERSONAL INFORMATION. If we ever decide to “sell” or “share” Personal Information, as those terms are defined under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, we will update you via this Policy and include a link entitled “Do Not Sell or Share My Personal Information,” to provide you with an opportunity to opt out of the selling or sharing of your Personal Information.

Nevada Privacy 

Nevada law permits customers in Nevada to opt-out of the sale of certain kinds of Personal Information. We do not sell your Personal Information to third parties as defined in Nevada law. If you are a Nevada resident and wish to opt-out of the sale of your Personal Information, should we change our practices in the future, you can contact us at [email protected].

Texas Privacy 

The Texas Data Privacy and Security Act applies to Texas consumers. As a Texas resident, you have the right to:

• Right to know whether we process your Personal Information and to obtain the Personal Information in a readable format;
• Right to correct inaccuracies in your Personal Information, taking into account the nature of the data and the purposes for processing the data;
• Right to delete Personal Information provided by or obtained about you;
• Right to opt out of the processing of Personal Information for purposes of targeted advertising, the sale of Personal Information, or profiling; and 
• Right to not face retaliation or discrimination for exercising these rights. 

If you are a Texas resident who chooses to exercise the rights listed above, you can submit a request via email at [email protected].

For Users Outside the United States. Under the (i) General Data Protection Regulation (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, or “GDPR”), (ii) Data Protection Act 2018, (iii) GDPR as it forms part of the law of England and Wales, Scotland and Northern Ireland (i.e., “UK GDPR”) as provided in the Data Protection Act 2018, (iv) Switzerland Federal Act of Data Protection as amended (“FADP”), (v) General Law for the Personal Data Protection (Law No. 13.709/2018; “LGPD”) and (vi) any other applicable data protection legislation of any country or other jurisdiction (collectively “International Data Protection Laws”) individuals have specific rights with respect to their Personal Information, or “personal data” as defined under the International Data Protection Laws. For the purposes of this Policy, the Company operates as a data controller, but may also act as a data processor on behalf of our Licensed Entity-customers (as further described in our Application Privacy Policy). Any Personal Information we collect from you is processed in the United States and under the terms of this Policy. Any Personal Information we collect from you is processed in the legitimate interest of our business and providing our products, Applications and services to you as the lawful means of such processing. You may always withdraw your consent to our use of your Personal Information as described below. We will only retain your Personal Information for the time necessary to provide you the information and services to which you have consented, to comply with the law and in accordance with your rights below. 

Third Iron maintains a lawful basis to process your Personal Information, including but not limited to such bases listed below:

• You have given consent.
• Processing is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract.
• Processing is necessary to protect our legitimate interests or that of a third party, except where such interests are overridden by your interests or fundamental rights.

The Data Controller is:

• Name: Third Iron, LLC (including all affiliates)
• Address: PO Box 270400, St Paul, MN 55127
• Email Address: [email protected]

You can exercise any of the following rights, subject to verification of your identity, by notifying us as described below:

• Access. You may request a copy of the Personal Information our Website databases currently contain. 
• Automated Processing and Decision-Making. You may request that we stop using your Personal Information for automated processing, such as profiling.   When contacting Third Iron, please explain how you wish us to restrict automated processing of your Personal Information. When such restrictions are not possible, we will advise you accordingly. You can then choose to exercise any other rights under this Policy, to include withdrawing your consent to the processing of your Personal Information. 
• Correction or Rectification. You can correct what Personal Information our Website database currently contains by accessing your account directly, or by emailing us (as provided below) to request that we correct or rectify any Personal Information that you have provided to us.  We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause information to be incorrect. Where applicable, we will ensure such changes are shared with trusted third parties. 
• Restrict Processing. When applicable, you may restrict the processing of your Personal Information by submitting a request via email (to the email provided below). In your email, please explain how you wish us to restrict processing of your Personal Information. When such restrictions are not possible, we will advise you accordingly. You can then choose to exercise any other rights under this Policy, to include withdrawing your consent to the processing of your Personal Information. Where applicable, we will ensure such changes are shared with trusted third parties. 
• Object to Processing. When applicable, you have the right to object to the processing of your Personal Information by submitting a request via email to (to the email provided below). When such objections are not possible, we will advise you accordingly. You can then choose to exercise any other rights under this Policy, to include withdrawing your consent to the processing of your Personal Information. Where applicable, we will ensure such changes are shared with trusted third parties.
• Portability. Upon request and when possible, we can provide you with copies of your Personal Information. When such a request cannot be honored, we will advise you accordingly. You can then choose to exercise any other rights under this Policy, to include withdrawing your consent.  Where applicable, we will ensure such changes are shared with any trusted third parties. 
• Withdraw Consent. At any time, you may withdraw your consent to our processing of your Personal Information through this Website by notifying us via email (to the email provided below) and typing the words “WITHDRAW CONSENT” in the subject line of your email. Upon receipt of such a withdrawal of consent, we will confirm receipt and proceed to stop processing your Personal Information. Where applicable, we will ensure such changes are shared with trusted third parties. 
• Erasure. If you should wish to cease use of our Website and have your Personal Information deleted from our Website, then you may submit a request by emailing us at the email provided below. Upon receipt of such a request for erasure, we will confirm receipt and will confirm once your Personal Information has been deleted. Where applicable, we will ensure such changes are shared with trusted third parties. 

Exercising your rights. If you are a data subject that has rights under International Data Protection Laws, who chooses to exercise the rights listed above, you can submit a request via email at [email protected]. 

Submit Complaints or Questions. If you wish to raise a complaint on how we have handled your Personal Information, you can contact us as described below. If you reside in a European Union member state, the United Kingdom, Switzerland or any other applicable international jurisdiction granting you rights to your Personal Information under International Data Protection Laws, you may also lodge a complaint with the supervisory authority in your country.

Data Transfers. If we transfer your Personal Information to a recipient in a country outside the European Economic Area (“EEA”), United Kingdom, or any other applicable international jurisdiction granting you rights to your Personal Information under International Data Protection Laws, we will ensure that at least one of the following shall apply:  (i) the transfers will be to countries that have been deemed to provide an adequate level of protection for Personal Information by supervisory authorities; (ii) we have used specific model contracts approved by supervisory authorities, such as the European Commission, which are intended to give Personal Information the same protection it has in the country where you reside; or (iii) any alternative transfer mechanism that can lawfully support the transfer under International Data Protection Laws.  Please contact us if you want further information on the specific mechanism used by us when transferring your Personal Information outside your country of origin. For more information about data transfers, please also see the “Data Privacy Framework” section below.

Data Privacy Framework: EU-U.S. Data Privacy Framework with UK Extension, and Swiss-U.S. Data Privacy Framework 

Third Iron participates in and has certified its compliance with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. Data Privacy Framework, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce. Third Iron, LLC and its affiliate BZ DISC Inc has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. DPF Principles with regard to the processing of Personal Information received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) under the UK Extension to the EU-U.S. DPF. Third Iron, LLC and its affiliate BZ DISC Inc has also certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. DPF Principles with regard to the processing of Personal Information received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Frameworks, and to view our certification, visit the U.S. Department of Commerce’s Data Privacy Framework website at https://www.dataprivacyframework.gov.

We are committed to upholding the DPF Principles to all Personal Information received from the European Union, United Kingdom (and Gibraltar) and Switzerland in reliance on the relevant parts of the DPF program. 

Third Iron, LLC and its affiliate BZ DISC, Inc is responsible for the processing of Personal Information it receives, under each Data Privacy Framework, and subsequently transfers to a third party acting as an agent on its behalf.  Third Iron, LLC and its affiliate BZ DISC, Inc complies with the Data Privacy Framework Principles for all onward transfers of Personal Information from the EU, the UK and Switzerland, including the onward transfer liability provisions.

The Federal Trade Commission has jurisdiction over Third Iron’s and its affiliate BZ DISC Inc’s compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. In certain situations, Third Iron, LLC and its affiliate BZ DISC Inc may be required to disclose Personal Information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Third Iron, LLC and its affiliate BZ DISC, Inc commits to refer unresolved complaints concerning our handling of Personal Information received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF to VeraSafe, an alternative dispute resolution provider based in the United States.  If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://verasafe.com/public-resources/dispute-resolution/dispute-resolution-procedure more information or to file a complaint.  These dispute resolution services are provided at no cost to you..

Under certain conditions, more fully described on the Data Privacy Framework website at https://www.dataprivacyframework.gov/s/article/How-to-Submit-a-Complaint-Relating-to-a-Participating-Organization-s-Compliance-with-the-DPF-Principles-dpf, you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted.  

Children’s Privacy

Our Website is intended for use by users aged 16 and older. In all cases, we do not market to or intentionally collect any personally identifiable information from children under 16 years of age.  If you are under 16, please do not provide us with any personally identifying information. If we become aware that a visitor under the age of 16 has submitted Personal Information without verifiable parental consent, we will remove their information from our files. Please contact [email protected] if you become aware that a child for which you are the parent or guardian has provided us with Personal Information without your consent.

Links to Other Services and Websites

Our Website may link to full text articles hosted by other websites. When you select a link to an outside website you are leaving the Third Iron Website and are subject to the privacy and security policies of the owners of the third-party website. We encourage our users to be aware when they leave our Website and to read the privacy policies of each website that collects PII.

Changes To Our Policy

This Policy describes our current policies and practices with regard to the information we collect through the Website. From time to time we may change this Privacy Policy. It is our policy to post any changes we make to our Policy on this page. If we make material changes to how we treat your Personal Information, a revised Policy will be posted on this webpage and the date of the change will be reported in the “Last Revised” block above. You can get to this page from any of our webpages by clicking on the “Privacy Policy” link (usually at the bottom of the screen).

Questions

If you have questions, comments, or concerns regarding this Privacy Policy, please send us an email at [email protected].