CPA (Colorado) Privacy

Colorado Privacy Policy

Last Updated: July 14, 2026 
  
1. Scope of This Notice
This Colorado Privacy Notice (“Notice”) supplements Navien, Inc.’s Privacy Policy and applies to Colorado residents. This Notice explains how Navien, Inc. (“Navien,” “we,” “us,” or “our”) collects, uses, discloses, and retains personal data, and describes the rights Colorado residents may have under the Colorado Privacy Act and its implementing rules, as amended (the “CPA”).  
 
For purposes of this Notice, “personal data,” “sensitive data,” “controller,” “processor,” “sale,” “targeted advertising,” “profiling,” and other defined terms have the meanings given to them under the CPA. Personal data does not include de-identified data or publicly available information, and certain categories of information may be excluded from the CPA’s scope, such as information governed by HIPAA, GLBA, FCRA, FERPA, COPPA, or other applicable laws.  
 
2. Personal Data We Collect
Depending on how you interact with us, we may collect the following categories of personal data: 

 

Category Examples
Identifiers and Contact Information Name, postal address, ZIP code, email address, telephone number, IP address, online identifier, device identifier, connected device identifier, connected device MAC address, account identifier, user ID, hashed email address, or similar identifiers.
Product, Warranty, and Service Information Product model, serial number, installation date, installation address, product registration information, warranty records, service history, repair records, installation images, and related correspondence.
Commercial Information Products or services purchased, obtained, registered, viewed, considered, or inquired about; rebate activity; locator activity; product category interest; and related customer or commercial records.
Internet or Electronic Network Activity Browser type, operating system, device identifiers, cookie identifiers, pixel data, advertising identifiers, referring URLs, pages viewed, links clicked, search or navigation activity, video engagement, form interactions, product-interest signals, app usage information, connected device telemetry, operational status information, diagnostic information, connectivity information, and interactions with our digital properties, mobile applications, connected devices, or advertisements.
Geolocation Data ZIP code, approximate location derived from IP address, location information entered into rebate or locator tools, general location information derived from installation information, such as state or city, and precise geolocation if you enable location-based features, such as the NaviLink App, the Navien Sphere App, or any successor or replacement Navien mobile application real-time weather feature.
Sensory or Visual Information Installation photographs or other visual materials submitted for warranty, registration, service, quality assurance, or related business purposes.
Inferences Commercial profiles, audience segments, or summaries of apparent product interests, preferences, behavior, or purchasing tendencies derived from website activity, product engagement, rebate activity, locator activity, registration activity, advertising interactions, or other information.
Sensitive Data Precise geolocation if you enable location-based features, including the NaviLink App, the Navien Sphere App, or any successor or replacement Navien mobile application real-time weather feature; biometric identifiers or biometric data if ever collected; personal data from a known child or minor where applicable; or other data treated as sensitive under the CPA. We collect sensitive data only in limited circumstances and where permitted by law or with consent where required.

 

The examples above are illustrative and may not reflect every type of personal data we collect in a particular context. Whether a category is collected depends on your interaction with us and the applicable product, service, website, form, feature, or digital property.  
 
For users of the NaviLink App, the Navien Sphere App, or any successor or replacement Navien mobile application and connected Navien devices, we may collect account identifiers, user ID, email address, connected device identifiers, connected device MAC address, app or device telemetry, operational status information, diagnostic information, connectivity information, and general location information derived from installation information, such as state or city. If a user enables the NaviLink App, the Navien Sphere App, or any successor or replacement Navien mobile application real-time weather feature, we may also collect precise geolocation data for the purpose of providing localized weather functionality and related support for that feature.

3. Sources of Personal Data  
We collect personal data from the following categories of sources:

  • Directly from you, such as when you submit forms, register products, request warranty or service support, use rebate or locator tools, sign up for communications, or otherwise communicate with us.
  • Automatically from your browser, device, mobile application, connected Navien device, or use of our digital properties, including through cookies, pixels, tags, SDKs, local storage, analytics tools, session replay or heatmap tools, advertising technologies, server logs, app telemetry, connected device telemetry, and similar technologies.
  • From processors, service providers, contractors, vendors, and business partners that help us operate our websites, mobile applications, online forms, warranty systems, customer service systems, CRM systems, marketing systems, analytics tools, advertising tools, rebate tools, locator tools, and other business platforms. 
  • From advertising, analytics, and social media platforms, where permitted by law and subject to your privacy choices.

4. Processing Purposes
We process personal data for the following purposes:

  • To respond to inquiries, requests, and communications.
  • To provide, operate, maintain, secure, personalize, and improve our websites, mobile applications, digital tools, products, and services. 
  • To process product registrations, administer warranties, validate installation information, maintain service and repair histories, and support quality assurance.
  • To provide location-based features, including localized rebate information, installers, service providers, distributors, sales representatives, and real-time weather guidance where enabled.
  • To operate and support the NaviLink App, the Navien Sphere App, or any successor or replacement Navien mobile application and connected Navien devices, monitor service availability, evaluate product performance, monitor device operation and system status, diagnose errors or connectivity issues, maintain service reliability, support warranty, safety, and customer service activities, and improve connected-device functionality.
  • To send service, transactional, warranty, safety, recall, administrative, or other non-marketing communications.
  • To send marketing communications, product updates, promotional communications, event information, or other communications where permitted by law or with consent where required.
  • To analyze trends, measure engagement, evaluate advertising performance, create audience segments, perform campaign measurement, conduct market research, and understand customer interests.
  • To process personal data for targeted advertising, audience matching, campaign optimization, advertising attribution, and similar marketing activities, subject to your opt-out rights and applicable consent requirements.
  • To prevent fraud, protect the security and integrity of our systems, debug problems, enforce our terms, and protect our rights, property, employees, customers, users, and the public.
  • To comply with legal, regulatory, tax, accounting, warranty, product safety, and recordkeeping obligations, respond to lawful requests, and establish, exercise, or defend legal claims.
  • To evaluate or conduct a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or similar business transaction.

We do not use connected device MAC addresses, NaviLink App, the Navien Sphere App, or any successor or replacement Navien mobile application diagnostic information, or precise geolocation collected for the NaviLink/Navien Sphere App real-time weather feature for advertising or marketing purposes.

5. Categories of Personal Data Disclosed to Processors and Third Parties  
We may disclose the categories of personal data described above to processors, service providers, contractors, vendors, and third parties for the purposes described in this Notice and our Privacy Policy. These recipients may include:

  • Cloud-based form, database, CRM, customer support, email marketing, workflow-management, hosting, storage, and business operations providers.
  • Warranty, product-registration, customer service, service-record, quality-assurance, and technical support providers.  
    Installers, contractors, distributors, sales representatives, service providers, and other business partners as needed to respond to your requests or provide requested services.
  • Parent company and affiliates located in Korea, for NaviLink App, the Navien Sphere App, or any successor or replacement Navien mobile application and connected-device operation, service availability monitoring, performance monitoring, diagnostic, support, security, warranty, product improvement, and related business purposes.
  • Analytics providers, session replay or heatmap providers, advertising networks, advertising technology providers, social media platforms, and similar marketing or measurement partners. 
  • Rebate, incentive, locator, embedded media, security, fraud prevention, consent-management, and website functionality providers.
  • Professional advisers, auditors, insurers, legal counsel, regulators, law enforcement, courts, and government authorities where required or permitted by law. 
  • Parties involved in a merger, acquisition, financing, restructuring, bankruptcy, sale of assets, or similar business transaction.

For NaviLink App, the Navien Sphere App, or any successor or replacement Navien mobile application and connected-device services, the information disclosed to our parent company and affiliates in Korea may include masked account identifiers, connected device MAC address, device status information, diagnostic information, and general location information derived from installation information, such as state or city. We do not disclose raw latitude/longitude coordinates collected for the NaviLink App, the Navien Sphere App, or any successor or replacement Navien mobile application real-time weather feature to our parent company in Korea.

6. Sale of Personal Data, Targeted Advertising, and Profiling 
We do not sell personal data for money. However, the CPA defines “sale” broadly, and certain disclosures of personal data to third parties may be considered a sale depending on the circumstances. We may process personal data for targeted advertising by disclosing identifiers, internet or electronic network activity information, commercial information, geolocation information, and inferences to advertising networks, analytics providers, social media platforms, and similar third parties for advertising measurement, audience matching, campaign optimization, advertising attribution, and related marketing purposes.  
 
We do not process precise geolocation collected for the NaviLink App, the Navien Sphere App, or any successor or replacement Navien mobile application real-time weather feature, connected device MAC addresses, NaviLink App, the Navien Sphere App, or any successor or replacement Navien mobile application connected-device telemetry, or diagnostic information for targeted advertising. 
 
We do not process personal data for profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer unless expressly disclosed and permitted by applicable law. You may opt out of sale, targeted advertising, and profiling as described below. 

7. Sensitive Data, Biometric Data, and Minors 
We process sensitive data only in limited circumstances and with consent where required by the CPA. Sensitive data may include precise geolocation, biometric data, personal data from a known child or minor where applicable, or other data treated as sensitive under the CPA.  
 
For example, if a user enables the NaviLink App, the Navien Sphere App, or any successor or replacement Navien mobile application real-time weather feature, we may collect precise geolocation data to provide localized weather functionality and related support for that feature. We do not use precise geolocation collected for the NaviLink App, the Navien Sphere App, or any successor or replacement Navien mobile application real-time weather feature for advertising or marketing purposes, and we do not disclose raw latitude/longitude coordinates collected for that feature to our parent company in Korea. 
 
We do not currently collect biometric identifiers or biometric data through the main Navien website. If we begin collecting biometric identifiers or biometric data in a manner subject to Colorado law, we will provide any required notice and obtain any required consent before collection or processing.  
 
We do not knowingly process personal data of known minors for targeted advertising, sale, profiling in furtherance of decisions that produce legal or similarly significant effects, or other restricted purposes unless the required consent has been obtained. For known minors under 13, consent must be provided by the parent or legal guardian where required. For known minors who are at least 13 but under 18, consent must be obtained from the minor where required by Colorado law. 

8. Universal Opt-Out Mechanisms and Global Privacy Control 
We honor universal opt-out mechanisms and opt-out preference signals, including Global Privacy Control, as required by the CPA. When we receive and process a valid opt-out preference signal, we treat it as a request to opt out of sale and targeted advertising for the browser or device through which the signal is sent, subject to applicable law and technical limitations.  
 
9. Retention of Personal Data 
We retain personal data for as long as reasonably necessary to fulfill the purposes described in this Notice and our Privacy Policy, including to provide services, administer warranties, maintain service records, comply with legal and regulatory obligations, resolve disputes, enforce agreements, prevent fraud, and establish, exercise, or defend legal claims.  
 
Retention periods vary depending on the category of personal data, the purpose for which it was collected, the nature of your relationship with us, warranty or product safety obligations, legal requirements, and our legitimate business needs. We may de-identify or aggregate personal data and use such information for lawful purposes. We maintain and use de-identified data without attempting to re-identify it, except as permitted by law, and require recipients to comply with applicable obligations for de-identified data where required.  

10. Your Colorado Privacy Rights 
Subject to applicable limitations and exceptions, Colorado residents may have the following rights:

  • Right to Access. You may request confirmation of whether we process your personal data and access to such personal data. 
  • Right to Correct. You may request that we correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of processing. 
  • Right to Delete. You may request deletion of personal data concerning you. 
  • Right to Data Portability. You may request a copy of personal data you previously provided to us in a portable and, to the extent technically feasible, readily usable format. 
  • Right to Opt Out. You may opt out of the processing of personal data for targeted advertising, sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. 
  • Right to Appeal. You may appeal our decision if we decline to take action on your request. 

11. How to Submit Requests 
To submit a Colorado privacy request, you may contact us through one of the following methods: 

For opt-out requests relating to sale, targeted advertising, or profiling, you may also use any applicable cookie or privacy preference center, “Do Not Sell or Share My Personal Information” or similar link, or universal opt-out mechanism that we are required to honor under the CPA.

12. Verification and Response Timing
We may verify your request by matching information you provide with information we maintain, such as your first and last name, email address, postal address, telephone number, state of residence, product registration information, or other information reasonably necessary to verify your identity and process your request. We will use information provided for verification only to verify and process your request unless otherwise permitted by law.  
 
We will respond to requests within the time required by the CPA. If additional time is reasonably necessary due to the complexity or number of requests, we will notify you as required by law. If a request is manifestly unfounded, excessive, or repetitive, we may charge a reasonable fee or decline to act on the request, as permitted by law.  
 
13. Appeals
If we decline to take action on your request, you may appeal our decision by contacting us at contactus@navien.com or through the method identified in our response. Please include “Colorado Privacy Appeal” in the subject line or body of your request and provide enough information for us to identify the request you are appealing.  
We will respond to appeals within the time required by the CPA. If your appeal is denied, you may contact the Colorado Attorney General regarding your concerns.

14. Changes to This Notice
We may update this Notice from time to time. When we make material changes, we will provide notice as required by applicable law, which may include posting the updated Notice on our website, updating the effective date, or providing another appropriate notice.  
 
15. Contact Information
Navien, Inc.
20 Goodyear
Irvine, CA 92618
Telephone: (800) 519-8794
Email: contactus@navien.com
Website: https://www.navieninc.com/contact

Chat