Privacy Policy

Last updated: Jun 9, 2020

The First Call IT Services Privacy Policy describes how we collect, use, and disclose your information in three different contexts:

·         When, as a Relying Party, you visit a web site secured with HTTPS that uses a certificate from First Call IT Services,

·         When you are a Subscriber, i.e., when you request and use certificates from First Call IT Services,

·         When you are a Visitor to the First Call IT Services web site, community discussion forum, other web pages under firstcallitservices.com, and third-party social media sites on which First Call IT Services operates an account.

Relying Party

When you use an HTTPS web site or other TLS service with a First Call IT Services certificate, your browser (or TLS client) may query First Call IT Services to check whether the certificate has been revoked (“OCSP request”). If your browser makes an OCSP request, our servers will automatically record your IP address, browser, and operating system in temporary server log files. We do not use data from OCSP requests to build profiles or identify individuals. Temporary server logs are used for operational purposes only and are normally deleted in less than seven days. We may retain a subset of server logs for longer periods in order to investigate software failures or abuse. If we do so, we will delete any stored logs when we are done investigating. We may also compute, retain and publish aggregate information from server logs, such as which certificates generate the largest volume of requests. We will always strive to ensure that such datasets do not contain information about the activities of identifiable users or devices.

Subscriber

If you are a Subscriber, you are requesting a trusted certificate from First Call IT Services intended to publicly vouch that you control a certain domain name or names that are reachable on the Internet. As part of the process of proving that control, First Call IT Services will collect various information related to certificate authentication and management. That information includes the IP addresses from which you access the First Call IT Services service; all resolved IP addresses for any domain names requested; server information related to any validation requests; full logs of all inbound HTTP / ACME requests, all outbound validation requests; and information sent by or inferred from your client software. We will store this information for a minimum of seven years per both contractual necessity and public interest. We need to be able to demonstrate to the public, including those who rely on the trustworthiness of our certificates, that our services perform as expected. As a result, we may be unable to delete information, including IP addresses. This information may be made public in a number of ways, including via public API, public repositories, and/or public discussions.

You may have the option to provide contact information, such as your email address, for account service and recovery purposes. Your contact information will not be made public, and it will only be shared per “Law Enforcement and Extenuating Circumstances,” below. By providing your email address, you are consenting to receive service-related emails from us. You may unsubscribe from service-related emails at any time by clicking the “unsubscribe” link at the bottom of our emails or by contacting us at [email protected]. We will not use your contact information for marketing or promotional purposes.

You may need to download client software from a repository such as those run by Debian, Ubuntu, Red Hat, or Github. Your interaction with such a software repository is governed by that repository’s own privacy policy and/or Terms of Use.

Visitor

When you are a Visitor browsing the First Call IT Services web site, you have the option to make a payment. Donations are processed by our trusted payment partners including DonorBox, Stripe, and PayPal, depending on the payment method selected. We collect your name and email address when you donate. We will not use your email address to contact you without your consent unless we feel it’s necessary to resolve an issue related to a particular payment. Your interactions with DonorBox, Stripe, and PayPal are governed by their respective privacy policies. We do not collect or retain any credit card or bank information related to donations. If we collect a physical address, we will only retain your physical address information for as long as is reasonably necessary to make the shipment that you requested.

You have the option to provide your email address to receive the First Call IT Services newsletter through a signup on this web site and via other marketing materials. The newsletter is delivered via MailChimp and your interactions with MailChimp are governed by its privacy policy. We may occasionally use your email address to send personalized communications related to First Call IT Services. We do not sell your information. You can request to have your email address removed from our list by opting out via MailChimp or emailing us at [email protected]

If you register to use the First Call IT Services community support forum, the personal information you provide and your actions there are governed by the privacy policy of our hosting and software provider for the forum, Civilized Discourse Construction Kit. We do not collect or maintain personal information through our offering of this support forum.

Additionally, we use Google Analytics to gauge traffic and popular pages on our web site. As part of that service, we place Google Analytics cookies on our site. These cookies do not contain personal information but can uniquely identify your browser software over time on our site. We respect the Do Not Track header by strictly limiting the information our analytics services can collect and share for all Visitors.

Law Enforcement Requests and Extenuating Circumstances

To the extent we possess it, we may disclose personally identifiable information about you to third parties in limited circumstances. Such circumstances include when we have your consent or when we have a good faith belief it is required by law, such as pursuant to a subpoena or other judicial or administrative order. We may also disclose account recovery information when we have a good faith belief it is necessary to prevent loss of life, personal injury, damage to property, or significant financial harm.

If we are required by law to disclose the information that you have submitted, we will attempt to provide you with prior notice (unless we are prohibited, or it would be futile) that a request for your information has been made in order to give you an opportunity to object to the disclosure. We will attempt to provide this notice by whatever means is reasonably practical. If you do not challenge the disclosure request, we may be legally required to turn over your information.

In addition, we reserve the right, solely at our discretion, to independently object to certain requests (for access to information about users of our products and technologies) that we believe to be improper.

What rights do European Economic Area relying parties, subscribers, and visitors have under GDPR, and how can I exercise them?

We process personal data as described in this policy. We rely on your consent to send emails. When we collect IP address, we process that data based on contractual necessity of being able to demonstrate that the service performs as expected. Please note that we may be unable to delete information, including IP addresses, as this information is necessary for others to rely on in determining the trustworthiness of our certificates. In some cases, we may process personal data pursuant to legal obligation or to protect your vital interests or those of another person.

Individuals located in the European Economic Area (EEA) have certain rights in respect to their personal information, including the right to access, correct, or delete personal data we process through your use of the site. If you’re a relying party, subscriber, or visitor based in the EEA, you can:

·         Request a personal data report by emailing us at [email protected]. This report will include the personal data we have about you, provided to you in a structured, commonly used, and portable format. Please note that we may request additional information from you to verify your identity before we disclose any information.

·         Request that your information be corrected or deleted by contacting us at [email protected].

·         Object to us processing your information. You can ask us to stop using your information, including when we use your information to send you service emails. You may withdraw your consent to receive service emails at any time by clicking the “unsubscribe” link found within First Call IT Services emails.

·         Complain to a regulator. If you’re based in the EEA and think that we haven’t complied with data protection laws, you have a right to lodge a complaint with your local supervisory authority.

For more information, or to report a privacy issue, please contact: [email protected]