Turn Technologies, Inc. (“Turn,” “we,” “our” or “us”) is committed to protecting the privacy of Consumers, Partners, and all other Visitors to and users of our website at www.turn.ai and any successor or additional website Turn owns or operates (the “Sites”), our mobile applications (the “Apps”), and our products, application programming interfaces, consumer reporting, identity verification, and related services (the “Services”). We’re also committed to providing you a rich, intensive experience when you use our Services and are always working to make them better. One way we do this is by analyzing the information that we collect to learn, for instance, how to improve your experience, or what opportunities might interest you. This Privacy Policy (this “Policy”) explains what data we collect, how we use it, and under what limited circumstances we share it; all of which will depend on your use of Turn’s Services. Depending on how you use the Sites, Apps, or Services, you may be considered a:
Consumer: An individual who is the subject of a consumer report Turn prepares or furnishes, or who submits personal information to Turn in connection with one, and an individual who accesses a report or file disclosure about themselves. An individual acting on behalf of a business customer is a Partner contact and not a Consumer.
Partner: A business that procures or uses the Services, whether directly from Turn or through a platform that has a reseller or channel arrangement with Turn. A Partner is the end user of any consumer report it procures, for purposes of the FCRA. A vendor, supplier, or service provider to Turn is not a Partner.
Visitor: Individuals, businesses, groups, or anyone else that visits our Sites or Apps.
How this Policy relates to Turn’s other agreements. This Policy is a transparency notice describing Turn’s own privacy practices. It is not a contract and it is not the data protection agreement for a business that procures Services from Turn. Where Turn processes personal data on behalf of a Partner or other business customer, that processing is governed by the Data Processing Agreement at turn.ai/dpa, which is a binding contractual instrument and which controls over this Policy in the event of any conflict. A business customer’s commercial relationship with Turn is governed by its written agreement with Turn or with the platform through which it accesses the Services, by the Turn Business Customer Terms at turn.ai/business-customer-terms, and by any separately signed agreement with Turn. Where Turn and a business customer have executed a separate signed data processing agreement, that signed agreement governs.
1.1 Consumer Information. Turn may collect the following information from Consumers when they interact with or use the Services:
Identification information, including name, date of birth, and government-issued identification numbers such as Social Security or Individual Taxpayer Identification Number, and driver’s license or state identification.
Biometric information. Where a Partner engages Turn to verify a Consumer’s identity, the verification is performed by a third-party identity verification provider. Turn does not collect, capture, purchase, receive through trade, or otherwise obtain a biometric identifier or biometric information. The provider may generate a facial template from the image of the identification document and the self-taken photograph in order to compare them, and any such template is created, held, and destroyed by the provider under the provider’s own biometric notice. Turn receives from the provider the verification result, the image of the identification document, and the self-taken photograph. Turn does not receive the facial template, the provider’s matching output, or the logic by which the provider reaches its result. Under the Illinois Biometric Information Privacy Act, a photograph is not itself a biometric identifier. Turn does not sell, lease, trade, or otherwise profit from biometric identifiers or biometric information. If Turn comes into possession of a biometric identifier or biometric information, Turn destroys it when the initial purpose for collecting it has been satisfied or within three years of the individual’s last interaction with Turn, whichever occurs first, and protects it using the reasonable standard of care applicable to Turn’s industry and in a manner at least as protective as the manner in which Turn protects other confidential and sensitive information. Retention of the image of the identification document and of the self-taken photograph is governed by the Retention section of this Policy rather than by this paragraph.
Contact information, including phone number, email and home address.
Education information, such as degrees, certifications, academic records, and other qualifications.
Employment information, including previous employers, roles and employee record information.
Financial information, including income, salary, billing rate, payments, and benefits.
Device information, such as the unique device identifier, device model, operating system, and MAC address.
Geolocation information – if you turn these features on, when you use your mobile device, we will collect information about Wi-Fi access points as well as other location information about your longitude and latitude and may save your device’s coordinates to offer certain features to you. Where you enable location services, we may use approximate location information to help secure your account, to detect and prevent fraud, and to confirm the region in which you are using the Services. We do not display your location to other users and we do not share it with other users. If using our mobile application and you have enabled location services, but wish to turn them off, you can do so through your mobile’s settings.
Additional information or supporting documentation you provide in connection with our Services, including your communications with Turn and your digital signature.
Certain Services require the collection of information from third parties, including Partners. Third-party information may include both public and private records as described below.
Public Records: Turn may collect public records bearing on a Consumer where appropriately authorized, including civil, and criminal court records and documentation.
Private Records: Where appropriately authorized, Turn may obtain private records, including educational, employment, financial, and drug test records.
1.2 Partner Information. Certain information collected by Turn relates to Partners and their use of Turn’s Services. This includes account information necessary to provide requested Services and analytics from using the Sites, Apps or other Services, which may include:
Account and user credential information, including name, email, roles and associated permissions.
Status and instructions for requested Services, including deactivation of Consumer or user credentials.
Payment information, including credit card and/or bank account information and billing information. Please note we do not store the credit card or bank account numbers you may use to make payments for Services.
Device information, including unique device identifier, device model, operating system, and MAC address.
Geolocation information – if you turn these features on when you use your mobile, we will collect information about Wi-Fi access points as well as other location information about your longitude and latitude and may save your device’s coordinates to offer certain features to you. Where you enable location services, we may use approximate location information to help secure your account, to detect and prevent fraud, and to confirm the region in which you are using the Services. We do not display your location to other users and we do not share it with other users. If using our mobile application and you have enabled location services but wish to turn them off, you can do so through your mobile’s settings.
Certain Services require the collection of information from third parties. Third-party information may include both public and private records as described below.
Public Records: Turn may collect public records bearing on a Partner, where appropriately authorized, including civil and criminal court records and documentation, business filings, and public media articles.
Private Records: Where appropriately authorized, Turn may obtain private records, including EIN or Tax Information, major shareholder information with contact information, headquarter office location, historical revenues, projected revenues, billing information, key personnel data, and labor needs by geographic market or nationwide.
Partner-user credentials and information about any account you set up with Turn may also be collected by third parties or Turn affiliates. For example, a Partner may reach the Services through an integration built by a human resources or applicant tracking platform, in which case that platform transmits the Partner’s request to Turn.
1.3 Visitor Information. Certain information may be collected when individuals visit our Site or use our App. This includes both manually submitted and automatically collected information. Visitors may have opportunities to submit information directly to Turn, including through information requests and in-browser chats with Turn agents. Visitors may be asked to provide Turn with basic information including name, email address, and general business information. We may collect information about your device when you use the App, including the unique device identifier, device model, operating system, and MAC address. In addition, if you permit us to do so, the mobile application may access your device’s address book to add someone to your contacts.
1.4 Automatically Collected Information. When Consumers, Partners, or other Visitors use any of our Services, Turn automatically gathers certain technical and usage information. This technical and usage information (“Technical Information”) may include information on when, how often, and for how long you use our Services, and server log data such as:
IP address, browser type, device type, location information, local storage information on your device, operating system and version, or the webpage you were visiting before you came to the Services.
Cookies or similar technologies to identify your device or browser. Information we collect when you use our Services, in addition to information we obtain about you from our Partners or other third parties, may be associated with any account that you set up with Turn. We treat information associated with such Turn Account as personal information.
1.5 Retention. Turn retains personal information for as long as it is needed for the purposes described in this Policy. Because Turn is a consumer reporting agency, a consumer’s file includes information Turn has archived, and Turn must be able to disclose that file and reinvestigate disputed items on request, Turn generally retains consumer reports and the records supporting them, including disclosures and authorizations, for the life of the relationship and thereafter. Turn retains personal information where retention is required or permitted by applicable law or is reasonably necessary for Turn to: (a) meet its recordkeeping, file disclosure, reinvestigation, and dispute obligations as a consumer reporting agency under the FCRA and comparable laws; (b) establish, exercise, or defend legal claims, including throughout any applicable limitations period; (c) comply with a litigation hold, subpoena, court order, or request from a regulator or supervisory authority; (d) retain records of disclosures, authorizations, and consents; or (e) detect, prevent, and investigate fraud, misuse, and security incidents. Personal information retained on one of these grounds is not used for any purpose other than the purpose for which it is retained. Where Turn processes personal information on behalf of a Partner, retention is governed by the Data Processing Agreement at turn.ai/dpa. Turn responds to deletion requests as described in Section 6.4, and will delete personal information unless one of the grounds above applies. For personal information subject to European or United Kingdom data protection law, Turn applies the storage limitation requirements of that law.
2.1 Turn uses the collected information in the following ways:
To Provide Services to Consumers, Partners and all other Visitors.
To Communicate with You. Turn uses your information to communicate with you about our Services, and to offer you our Services and features. Where appropriate, Turn may send you product announcements and special promotions from Turn or our business partners.
To Administer Your Account. Turn uses your information to administer settings for any account you create, to process billing and payment information, manage preferences and troubleshoot problems, and personalize the content that Visitors see based on personal characteristics or preferences.
To Meet Legal and Compliance Requirements. Turn may use your information (a) to comply with any applicable procedures, laws and regulations, subpoenas, governmental requests or legal process; (b) in connection with a legal investigation, if in our good faith opinion such is required or permitted by law; (c) to protect the rights, property or safety of Turn; (d) to prevent fraud or abuse; or (e) to perform a task carried out in the public interest.
To Provide Security. Turn may use your information to create Consumer and Partner account credentials, to verify users’ identities before granting access to account information, to validate against existing information maintained by Turn, to protect against duplicate or unauthorized account creation, to secure the Sites, Apps and Services, and to address fraud, abuse or safety concerns. We also use your information to detect security incidents; protect against malicious, deceptive, or illegal activity; and prosecute those responsible for that activity.
2.2 Information that does not identify an individual or cannot otherwise be reasonably linked or connected with them is not considered personal information. Personal information may be aggregated or de-identified so that it can no longer reasonably be used to identify an individual. Turn maintains technical safeguards designed to prevent re-identification, does not attempt to re-identify de-identified information except to test the effectiveness of those safeguards, and contractually obligates any recipient of de-identified information not to attempt re-identification. Subject to those commitments, Turn may use and retain de-identified and aggregated information to operate, secure, develop, test, benchmark, and improve the Services and to produce aggregated statistical and industry analyses, and does not disclose it in a form that identifies any individual. Where Turn processes personal data on behalf of a Partner, the treatment of de-identified data is governed by Section 2.4 of the Data Processing Agreement at turn.ai/dpa, which does not extend to data subject to European data protection law.
2.3 In some instances, Turn applies software algorithms and machine-learning techniques to information collected from Consumers, Partners, and other Visitors. For example, we apply automated compliance filtering to data collected from third parties to ensure that we are complying with all applicable reporting laws and responsibilities.
3.1 As authorized. Turn may share certain collected information when authorized, either expressly or implicitly through the use of the Sites, Apps or other Services. Such authorization includes:
Consumer authorization to share their personal information, as well as public and private information, with Partners (e.g., background check information, supplemental information, etc.).
Partner authorization to share certain account information necessary to administer requested Services (e.g., company name and contact information provided to Consumers) or to integrate with third-party service providers (e.g., applicant tracking systems).
3.2 To Provide Services. We may share Consumer personal information, including Social Security or Individual Taxpayer Identification Numbers, and driver’s license or state identification numbers, with Partners that use Turn’s Services to facilitate the provision of services to Consumers.
3.3 To Perform Services. Certain Services necessitate sharing collected information (e.g., to perform a background check). Turn may share or transfer certain collected information to third parties, affiliates or external processors who perform services on behalf of Turn, including but not limited to data storage, analysis, and processing. For Partners and other business customers for whom Turn processes Personal Data on their behalf, additional data processing terms are set out in Turn’s Data Processing Agreement at turn.ai/dpa.
3.4 To Provide Security. Turn may share information between relevant Partners or third parties to verify account credentials and to address fraud or safety concerns.
3.5 To Analyze Usage of Services. We use analytics services for purposes of analyzing usage of the Services.
3.6 To Transfer Business. In the event of a merger, sale of capital stock or assets, corporate reorganization, consolidation or similar transaction involving Turn, the information we possess may be transferred as a corporate asset to the acquiring or successor entity.
3.7 To Conduct Research and Marketing. Turn does not disclose Consumer personal information, including any information collected or generated in connection with a consumer report, to affiliates, Partners, or non-affiliated third parties for those parties’ own research or marketing purposes. Turn may use de-identified and aggregated information, as described in Section 2.2, to operate, secure, develop, test, benchmark, and improve the Services, including improving the accuracy of Turn’s record-matching and automated compliance filtering, and to produce aggregated statistical and industry analyses. Information obtained through the short code program is not shared with any third party for marketing purposes.
3.8 To Meet Legal Requirements or for Compliance Reasons. Turn may disclose certain collected information where, in good faith, we believe that the law or legal process (such as a court order, search warrant or subpoena) requires us to do so or, in other circumstances, where we believe it is necessary to protect the rights or property of Turn. Additionally, we may share aggregated or de-identified information that does not identify any individual, and that is de-identified to the standard described in Section 2.2, with Partners, prospective partners, and investors. For example, we may publish aggregate statistics showing trends in the general use of our Services. Turn does not publish, and does not share for these purposes, information that identifies an individual, and Turn does not use consumer report information for these purposes.
Our Services may contain links to other websites. If you choose to click on a third-party link, you will be directed to that third party’s website. We don’t exercise control over third-party websites and are not responsible for how these websites collect, share, or use your information. Because Turn has no control over the privacy practices or content of these linked sites, we encourage you to read the privacy policies or statements of the other websites you visit, including any third parties you interact with on our website. Where a page on the Sites embeds or links to content hosted by a third party, that third party may receive information about your visit under its own privacy policy rather than this Policy.
We, our third-party service providers, advertisers or our Partners may also use “web beacons” or clear gifs, tags and scripts, or similar technologies, which are small pieces of code placed on a web page, to analyze, collect and aggregate data about your use of our Services. For example, web beacons may be used to count the users who visit a web page or to deliver a cookie to the browser of a visitor viewing that page. Turn uses various cookie-based analytics services. Editing your tracking and cookie preferences will limit analytic tracking. To prevent Google Analytics from using your information for analytics, as an example, you may install the Google Analytics Opt-out Browser Add-on, available at https://tools.google.com/dlpage/gaoptout. Do Not Track Policy. At this time, the Services do not currently respond to “do not track” browser headers. But you can take steps to limit tracking by erasing cookies from your computer’s hard drive and by setting your browser to block all cookies or warn you before a cookie is stored. If you disable cookies, you may be prevented from taking full advantage of the Services because they may not function properly without cookies.
6.1 General Privacy Rights. Depending on where you live, you may have certain rights in addition to the rights set out in the rest of this Policy, which may include the right to know what personal information Turn holds about you, to access or obtain a copy of it, to correct inaccurate personal information, to request deletion, to restrict or object to certain processing, and to opt out of targeted advertising, the sale or sharing of personal information, and certain profiling. Turn does not sell or share personal information for targeted advertising and does not use personal information for profiling that produces legal or similarly significant effects outside the consumer reporting activity described in this Policy. Most of the personal information Turn holds is collected, used, and disclosed as a consumer reporting agency and is regulated by the FCRA. State privacy statutes, including the California Consumer Privacy Act at Civil Code 1798.145(d), generally exempt that activity from these rights, and your rights with respect to consumer report information are the rights the FCRA provides, including the right to obtain your file, to dispute the accuracy of information in it, and to have a dispute reinvestigated. Where a state right does apply, Turn will honor it without discrimination and will not provide you a lesser degree of service for exercising it. If you choose to exercise these privacy rights, you may have the right not to be treated in a discriminatory way nor to receive a lesser degree of service from Turn. To the extent provided by the law of your jurisdiction, you may exercise your privacy rights and choices by sending your request by email to support@turn.ai or call +1 (888) 499-8876. We will verify your request and may request additional information to do so. You may designate an authorized agent to exercise these rights on your behalf. Turn does not sell your personal information to non-affiliated third parties (including for their own direct marketing purposes) without your consent. In addition, Turn has not sold your personal information to non-affiliated third parties in the last 12 months. If you are entitled to any disclosure rights in your jurisdiction regarding our sale of your personal information to non-affiliated third parties or our disclosure of your personal information to third parties for their own direct marketing purposes, this disclosure satisfies those requirements. If you still wish to learn more about our compliance with this requirement, please use the contact information identified in Section 12 below.
6.2 California Resident Additional Privacy Rights. Pursuant to California’s “Shine the Light” law, California residents may request, once per calendar year, certain information regarding our disclosure of your personal information to third parties for their own direct marketing purposes, including the names and addresses of those third parties, and examples of the types of services or products marketed by those third parties. To make such a request, please use the contact information listed below. In the last 12 months, we have not disclosed your personal information to any third parties for their own direct marketing purposes.
6.3 Opting Out. Subject to any restrictions under applicable laws, we may send periodic promotional or informational emails to you. You may opt out of such communications by clicking unsubscribe in the email. Please note that it may take up to ten business days for us to process opt-out requests. If you opt out of receiving emails about promotions or other opportunities we think may interest you, we may still send you emails about your account or any Services you have requested or received from us. If you want to opt-out of (a) Turn using information that it received about you from an affiliate for marketing purpose or (b) Turn providing information about you to affiliates, Partners or other non-affiliated third parties for marketing purposes, please send an email to support@turn.ai with the subject line “Marketing Opt-Out” that specifies how you want Turn to stop using your information. Turn will honor your request unless an exception under applicable law authorizes Turn to continue using or disclosing your information for marketing purposes. You may also withdraw your consent to receive communications in electronic form. To begin receiving communications in paper form, please contact us at support@turn.ai. Please specify the information you wish to receive in paper form. Be sure to state that you are requesting a copy of the disclosures, notices, or other documents, and include your name and mailing address. Your request will apply only to those specific items you designate. We will not impose any fee to process the withdrawal of your consent to receive electronic communications. Any withdrawal of your consent to receive electronic communications will be effective only after we have a reasonable period of time to process your withdrawal.
6.4 Consumers may access and control the contents and use of their information as described below:
To request deletion of your information, contact support@turn.ai. Turn will verify your identity before acting on a deletion request, and may ask you for additional information in order to do so. Turn will respond within the period required by applicable law or, where no period is specified, within 45 days of verifying your request. If you delete certain personal information from any account or profile you set up with Turn, the account may become deactivated, and if your account is deactivated or closed you will no longer be able to use our Services. Turn is not required to delete personal information where an exception applies under applicable law. Those exceptions include information regulated by the FCRA or a comparable consumer reporting law, information Turn retains on a ground described in Section 1.5, and information Turn needs in order to meet an obligation owed to you, to a Partner, or to a regulator. Information retained on one of those grounds remains subject to this Policy and to the security measures described in Section 7, and Turn does not use it for any purpose other than the purpose for which it is retained.
Disputing Incorrect Information. If at any time you believe Turn possesses or has communicated incorrect information about you to Partners or other third parties, please contact us at support@turn.ai.
Submitting Supplemental Information. In certain instances, Consumers may be requested or given the opportunity to share additional information or context to collected information. Turn may share this information with third parties (such as Partners) unless you direct Turn not to do so.
Partners may access and control the contents and use of their information as described below.
Account information. Some requests to update Partner account information can be done from the Turn Dashboard. Other requests should be directed to your account representative or emailed to support@turn.ai.
Turn maintains an information security program with administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, and destruction. Those safeguards include encryption of personal information in transit and at rest, role-based access controls applied on a least-privilege basis, logging and monitoring of access to personal information, independent security testing, and mandatory security and privacy training for personnel with access to personal information. Turn regularly tests and evaluates the effectiveness of these measures and updates them as appropriate, and may change the specific technologies or vendors it uses provided that no change materially reduces the overall level of security applied to personal information. The measures in effect from time to time are described in Annex 2 to the Data Processing Agreement at turn.ai/dpa, which is the authoritative description of Turn’s security program. No security measures are 100% effective and Turn cannot guarantee that your use of our Sites and Services will be completely safe. You should take steps to protect against unauthorized access to your information, passwords, accounts, phones, computers, and other devices, and should use secure methods when transmitting sensitive information to us.
The federal Fair Credit Reporting Act (the “FCRA”) is a federal law that regulates how consumer reporting agencies such as Turn collect, use, and furnish your information. Here are links to helpful information about your rights under the FCRA and how to remedy a possible identity theft:
You can view A Summary of Your Rights Under the Fair Credit Reporting Act, published by the Consumer Financial Protection Bureau, at https://files.consumerfinance.gov/f/documents/bcfp_consumer-rights-summary_2018-09.pdf.
A summary of the obligations of users of consumer reports under the FCRA, in the form prescribed by the Consumer Financial Protection Bureau at Appendix N to Regulation V, is available at consumerfinance.gov/rules-policy/regulations/1022/N.
If you believe your identity has been stolen, you can find information about how to respond, and file a report, at the Federal Trade Commission resource https://www.identitytheft.gov.
Turn is a United States company. If you are located outside the United States and choose to provide information to us, we may transfer personal information to the United States for processing. The United States may not have the same data protection laws as the country in which you initially provided the information. When we transfer your information to the United States, we will protect it as described in this Policy. Where Turn transfers personal data from the European Economic Area, the United Kingdom, or Switzerland, Turn relies on the standard contractual clauses adopted by the European Commission in Decision 2021/914, together with the UK International Data Transfer Addendum for transfers from the United Kingdom and the Swiss law modifications for transfers from Switzerland. Those clauses are incorporated into the Data Processing Agreement at turn.ai/dpa. Turn does not rely on your consent as the legal mechanism for these transfers. Additional Information for Canadian Users: This Policy applies to Consumers, Partners, and other Visitors in Canada. Turn handles personal information about individuals in Canada in accordance with the Personal Information Protection and Electronic Documents Act and applicable provincial privacy legislation. Where this Policy is inconsistent with a requirement of that legislation, the requirement of that legislation governs and Turn will comply with it. Personal information about individuals in Canada may be processed and stored in the United States and may be accessible to United States authorities under United States law. Questions about Turn’s handling of personal information in Canada may be directed to privacy@turn.ai.
Where Turn processes Personal Data for Partners subject to applicable data protection laws, the Data Processing Agreement at turn.ai/dpa provides additional contractual terms governing that processing.
Turn may need to update this Policy from time to time. We will post the updated Policy at turn.ai/privacy with the date it takes effect. A revised Policy takes effect on the date stated when it is posted, and posting is the only notice we are required to give. Your continued use of the Sites, Apps, or Services on or after that date means you accept the revised Policy. Where Turn processes personal data on behalf of a Partner, changes to this Policy do not modify the Data Processing Agreement at turn.ai/dpa, and where a Partner has a separately signed data processing agreement, that agreement governs. Changes to this Policy do not amend our Terms of Use, including the arbitration agreement in Section 13 of those Terms.
You must be 18 years of age or older to register for an account or otherwise use our Services on your own behalf. That requirement governs who may use our Services. It does not describe everyone whose information we may process. Employers in some industries lawfully hire workers who are under 18, and when a Partner engages us to prepare a background screening report about someone under 18, we process that individual’s personal information at the Partner’s direction, in reliance on the disclosure and written authorization the Partner is required to obtain from that individual’s parent or legal guardian. We do not collect that authorization ourselves, and we do not knowingly prepare background screening reports about individuals under 13 years of age. Where someone under 18 needs to provide information to us or exercise a privacy right described in this Policy, a parent or legal guardian must do so on that individual’s behalf. We do not knowingly collect personal information directly from children under the age of 13 through our Sites, Apps, or Services. Please contact us using the contact information in Section 12 below if you are a parent or guardian who believes your child under the age of 13 has provided personal information to us via the Services. If we discover that an individual under 13 has provided us with personal information, we will take steps to delete any such personal information if required by applicable law.
If you have any questions about this Policy, you may contact our legal team at support@turn.ai, or +1 (888) 499-8876, or mail addressed to Turn Technologies, Inc., Attn: Privacy Policy Issues, 311 West Monroe Street, 3rd floor, Chicago, IL 60606.
Download SOC 3 Report
Get a high-level overview of Turn’s security controls and compliance practices.
