Montana Consumer Data Privacy Act (MCDPA) Compliance

Overview

The Montana Consumer Data Privacy Act (MCDPA), effective October 1, 2024, provides Montana residents with comprehensive privacy rights regarding their personal data. Kids on the Yard is committed to protecting the privacy of Montana residents and complying with all MCDPA requirements.

What is the MCDPA?

The Montana Consumer Data Privacy Act is a comprehensive privacy law that grants Montana consumers fundamental rights regarding their personal data and requires businesses to implement responsible data protection practices. The law applies to businesses that conduct business in Montana or produce products or services targeted to Montana residents and meet specific data processing thresholds.

Your Rights Under the MCDPA

As a Montana resident, you have the following rights under the MCDPA:

Right to Confirm and Access

You have the right to confirm whether we are processing your personal data and to access such personal data. This includes the right to obtain:

• Categories of personal data we collect about you
• Purposes for processing your personal data
• Categories of sources from which personal data is collected
• Categories of third parties with whom we share personal data
• Specific pieces of personal data we have collected about you

Right to Correct

You have the right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes for processing such data.

Right to Delete

You have the right to delete personal data concerning you, subject to certain exceptions including:

• Completing the transaction for which personal data was collected
• Detecting security incidents and protecting against fraudulent or illegal activity
• Complying with legal obligations
• Exercising free speech rights or ensuring others can exercise free speech rights
• Engaging in public or peer-reviewed scientific research in the public interest

Right to Data Portability

You have the right to obtain your personal data in a portable and readily usable format that allows you to transmit the data to another business without hindrance from us.

Right to Opt-Out

You have the right to opt out of:

• Processing of personal data for purposes of targeted advertising
• Sale of personal data to third parties
• Profiling in furtherance of decisions that produce legal or similarly significant effects

How We Comply with MCDPA

Responsible Data Management

Kids on the Yard complies with MCDPA through:

Data Minimization and Purpose Limitation

• Limited Collection: We collect only personal data that is adequate, relevant, and reasonably necessary for disclosed purposes
• Purpose Specification: We process personal data only for disclosed, specific, and legitimate purposes
• Retention Limits: We retain personal data no longer than reasonably necessary for stated purposes
• Regular Assessment: We periodically review and update our data collection and retention practices

Transparency and User Control

• Clear Privacy Notices: We provide accessible, comprehensive information about our data practices
• Processing Records: We maintain detailed records of processing activities and legal bases
• User Controls: We provide easy-to-use tools for Montana residents to manage their privacy preferences
• Regular Updates: We keep our privacy practices and notices current with evolving legal requirements

Consumer Rights Implementation

We have established comprehensive processes to:

• Identity Verification: Authenticate requests using secure, reliable methods to prevent unauthorized access
• Timely Response: Process verified consumer requests within 45 days of receipt
• Clear Communication: Provide requested information in accessible, understandable formats
• Non-Retaliation: Ensure no adverse treatment for exercising privacy rights
• Quality Assurance: Maintain high standards for response accuracy and completeness

Categories of Personal Data We Process

Under the MCDPA, we collect and process the following categories of personal data from Montana residents:

Personal Identifiers and Contact Information

• Full name, email addresses, phone numbers, mailing addresses
• Account usernames, encrypted passwords, and authentication credentials
• Government-issued identification numbers (when legally required)
• Emergency contact information and authorized user designations

Educational and Academic Information

• Student academic records, performance data, and progress tracking
• Learning assessments, skill evaluations, test scores, and educational goals
• Tutoring session recordings, notes, recommendations, and curriculum progress
• Parent/guardian communications regarding educational services and student needs

Financial and Transaction Information

• Payment card information, billing addresses, and payment method preferences
• Transaction histories, subscription details, payment records, and billing cycles
• Refund and dispute information, payment failure logs, and account adjustments
• Financial assistance information, scholarship data, and promotional discount records

Technical and Usage Information

• Device information, IP addresses, browser types, and operating system details
• Website navigation patterns, service usage data, session duration, and interaction logs
• Customer support communications, help desk interactions, and feedback submissions
• Platform preferences, account settings, feature usage, and customization choices

Communication and Engagement Data

• Email correspondence, live chat conversations, and messaging histories
• Phone call records, voicemail messages, and communication preferences
• Survey responses, feedback forms, testimonials, and product reviews
• Marketing communication consent records, preferences, and opt-out status

Sensitive Personal Data Handling

When we process sensitive personal data as defined by MCDPA (including precise geolocation, biometric identifiers for identification, health information, or data concerning children under 13), we implement enhanced protections:

Additional Safeguards

• Explicit Consent: We obtain clear, informed opt-in consent for sensitive data processing
• Enhanced Security: We implement additional technical and organizational security measures
• Limited Processing: We restrict processing to strictly necessary purposes with clear legal justification
• Access Controls: We implement role-based access controls and detailed audit trails
• Special Procedures: We follow enhanced protocols for sensitive data storage, transmission, and deletion

Consent Management

For sensitive personal data processing, we:

• Clearly explain the specific purposes and categories of sensitive data involved
• Provide easy-to-understand information about the risks and benefits
• Offer simple mechanisms to withdraw consent at any time
• Regularly review and reconfirm consent as appropriate
• Maintain comprehensive records of consent and withdrawal requests

Third-Party Data Sharing and Processing

We may share personal data with carefully selected third parties for legitimate business purposes:

Service Providers and Data Processors

• Cloud hosting and data storage providers with appropriate security certifications
• Payment processing companies and financial institutions with regulatory compliance
• Customer support platforms and communication service providers
• Educational content providers, curriculum developers, and assessment platforms

Business Partners and Collaborators

• Technology integration partners and software platform providers
• Analytics and performance monitoring services with privacy-focused practices
• Educational research organizations and academic institutions (with appropriate approvals)
• Marketing partners and advertising platforms (only with explicit user consent)

Legal and Regulatory Compliance

• Law enforcement agencies (when required by valid legal process or court orders)
• Regulatory authorities and government agencies (as mandated by applicable laws)
• Legal counsel, professional advisors, and external audit firms
• Court-ordered disclosures and litigation support services

We do not sell personal data to third parties for monetary consideration.

Data Security and Protection Framework

We implement comprehensive security measures to protect Montana residents' personal data:

Technical Security Controls

• Encryption Standards: Industry-leading encryption for data at rest and in transit
• Access Control Systems: Multi-factor authentication and role-based access controls
• Network Security: Advanced firewalls, intrusion detection, and threat monitoring systems
• Secure Development: Privacy and security by design principles in all system development

Administrative and Organizational Controls

• Privacy Training: Regular, comprehensive training for all personnel handling personal data
• Policy Framework: Detailed data handling, retention, deletion, and incident response policies
• Vendor Management: Rigorous security assessments and ongoing monitoring of third-party processors
• Regular Audits: Periodic internal and external audits of privacy and security practices

Physical Security Measures

• Facility Security: Controlled physical access to data centers and processing facilities
• Media Protection: Secure storage, handling, and disposal procedures for physical storage media
• Environmental Controls: Climate monitoring, fire suppression, and backup power systems
• Access Monitoring: Comprehensive logging and surveillance of physical access to sensitive areas

How to Exercise Your MCDPA Rights

Montana residents may exercise their privacy rights through multiple convenient channels:

Submit a Privacy Request

• Online Privacy Portal: Visit our secure Privacy Request Center
• Email: Send detailed requests to [email protected] with "MCDPA Request" in the subject line
• Phone: Call our dedicated privacy hotline at International: +1 786-382-2000
• Mail: Send written requests to our business address listed in the contact information section

Information Required for Request Processing

To verify your identity and process your request efficiently, please provide:

• Your full legal name and current contact information
• Email address associated with your Kids on the Yard account (if applicable)
• Proof of Montana residency (utility bill, driver's license, voter registration, etc.)
• Specific and detailed description of your privacy request and desired outcome
• Any additional information that may help us locate and verify your personal data

Response Timeline and Procedures

• Initial Acknowledgment: We confirm receipt of all requests within 10 business days
• Identity Verification: Verification process typically completed within 5-15 business days
• Response Period: We respond to verified requests within 45 days of receipt
• Complex Requests: May require up to 90 days with advance written notification and detailed explanation
• No Charge Policy: We provide up to two comprehensive responses per calendar year at no cost
• Excessive Requests: May incur reasonable administrative fees for repetitive or manifestly unfounded requests

Appeals Process and External Review

If you are not satisfied with our response to your privacy request under MCDPA:

Internal Appeal Process

1. Submit Appeal: Email [email protected] with "MCDPA Appeal" in the subject line
2. Include Documentation: Provide your original request reference number and detailed explanation of concerns
3. Review Period: We will thoroughly review appeals and respond within 60 calendar days
4. Appeal Response: We will provide a detailed written explanation of our decision and any corrective actions

External Review Options

If you remain unsatisfied with our internal appeal response, you may:

• Contact the Montana Attorney General's Office Consumer Protection Bureau
• File a complaint with relevant state consumer protection agencies
• Consult with qualified legal counsel regarding your privacy rights under Montana law
• Explore other legal remedies and enforcement mechanisms available under applicable law

Contact Information

For questions about our MCDPA compliance or to exercise your privacy rights:

Privacy Team Kids on the Yard Limitless Virtue LLC 9701 NE 2nd Ave, Suite #1069 Miami Shores, Florida 33138 U.S.A Email: [email protected] Phone: International: +1 786-382-2000

Montana Residents Privacy Hotline: Available Monday-Friday, 9 AM - 5 PM MST

Last Updated: January 1, 2025

For more information about the Montana Consumer Data Privacy Act, visit: https://leg.mt.gov/bills/2023/billpdf/SB0384.pdf