Privacy Supplement

ADDITIONAL STATE PRIVACY LAWS

Nevada Residents

Under Nevada law, certain Nevada consumers may opt out of the sale of “covered information” for monetary consideration to a person for that person to license or sell such information to additional persons. “Covered information” includes first and last name, address, email address, phone number, Social Security Number, or an identifier that allows a specific person to be contacted either physically or online. We do not engage in such activity; however, if you are a Nevada resident who has purchased services from or performed services for us, you may submit a request to opt out of any potential future sales under Nevada law by emailing us at [email protected]. Please note we will take reasonable steps to verify your identity and the authenticity of the request. Once verified, we will maintain your request in the event our practices change.

If you have additional questions about the supplement or how to exercise your rights under the supplement, please contact us as specified in Section 11 of our PRIVACY POLICY.

California Residents

Effective: January 1, 2023

If you are a California resident, the processing of certain personal data about you may be subject to the California Consumer Privacy Act of 2018, California Civil Code Sections 1798.100-1798.199 (“CCPA”), California Privacy Rights Act of 2020 (“CPRA”) and other applicable California state privacy laws. Beginning January 1, 2020, the CCPA gives you certain rights with respect to the processing of your personal data (known as “personal information”, as described under the CCPA). Beginning January 1, 2023, the CPRA amends CCPA and gives you certain rights with respect to the processing of your personal information as described under the CPRA.

This supplement provides additional privacy disclosures and informs you of your additional rights as a California resident, and should be read in conjunction with our PRIVACY POLICY, which describes what information we collect and how we use it.

Consumer Rights under CCPA and CPRA

Right to Request Disclosure of Personal Information Collected (Right of Access). A consumer shall have the right to request that a business that collects a consumer's personal information disclose to that consumer the categories and specific pieces of personal information the business has collected. (CCPA 1798.100(a), 1798.110(c)(5) and 1798.130(a)(5)(A)) (CPRA)
Right of Rectification. The right for a consumer to request that the incorrect or outdated personal information be corrected but not deleted. (CPRA)
Right to Request Deletion. A consumer shall have the right to request that a business delete any personal information about the consumer which the business has collected from the consumer unless exceptions apply. (CCPA 1798.105(a))(CPRA)
Right of Restriction. The right for a consumer to restrict a business’s ability to process personal information (i.e., sensitive information that reveals an individual’s government ID, finances, geolocation, race, religion, and union membership, consumer’s private communications, genetics, biometrics, consumer’s health, sexual orientation ) about the consumer. (CPRA)
Right to Request Disclosure of Personal Information Collected, Sources, Purposes for Collection or Sale and Third Parties with whom Shared (Right of Access). A consumer shall have the right to request that a business that collects personal information about the consumer disclose to the consumer the following:
The categories of personal information it has collected about that consumer in the preceding 12 months.
The categories of sources from which the personal information is collected.
The business or commercial purpose for collecting or selling personal information.
The categories of third parties with whom the business shares personal information.
The specific pieces of personal information it has collected about that consumer.

(CCPA 1798.110(a)-(b) and 1798.130(a)(3))(CPRA)

Right to Request Disclosure of Personal Information Collected, Sold and Disclosed and Third Parties to whom Sold (Right of Access). A consumer shall have the right to request that a business that sells the consumer's personal information, or that discloses it for a business purpose, disclose to that consumer:
The categories of personal information that the business collected about the consumer.
The categories of personal information that the business sold about the consumer in the preceding 12 months and the categories of third parties to whom the personal information was sold in the preceding 12 months, by category or categories of personal information for each category of third parties to whom the personal information was sold.
The categories of personal information that the business disclosed about the consumer for a business purpose in the preceding 12 months.

(CCPA 1798.115(a)-(b) and 1798.130(a)(4))(CPRA)

Right of Portability. The right for a consumer to request personal information about the consumer be disclosed in a common file format. (CCPA, CPRA)
Right to opt-out of sales. The right for a consumer to opt out of the sale of personal information about the consumer to third parties. (CCPA, CPRA)
Right Against Automated Decision making. A prohibition against a business making decisions about a consumer based solely on an automated process without human input. (CPRA)
Private Right of Action. The right for a consumer to seek civil damages from a business for certain violations of the statute.

Business Obligations under CCPA and CPRA

Opt-In Default (Requirement Age). A restriction placed on a business to treat consumers under a certain age (here, age 16) with an opt-in default for the sale of their personal information. (CCPA, CPRA)
Notice/Transparency Requirement. An obligation placed on a business to provide notice to consumers about certain data practices, privacy obligations and/or privacy programs. (CCPA, CPRA).
Risk Assessments. An obligation placed on a business to conduct formal risk assessments of privacy and/or security projects and or procedures (CPRA)
Prohibition on Discrimination (Exercising Rights)/Right of Non-Discrimination. A business shall not discriminate against a consumer because the consumer exercised any of the consumer's rights under this title, including, but not limited to, by:
Denying goods or services to the consumer.
Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties.
Providing a different level or quality of goods or services to the consumer.
Suggesting that the consumer will receive a different price or rate for goods or services or a different level or quality of goods or services.

(CCPA 1798.125(a))(CPRA)

Purpose/Process Limitation. Prohibits the collecting/processing of personal information except for a specific purpose (CCPA, CPRA)

To exercise your “right to know,” your “right to request deletion,” or any other right under the CCPA and CPRA, contact us as specified in Section 11 of our PRIVACY POLICY.

Please note that to protect your information and the integrity of our Service, we may need to verify your identity before processing your request. In some cases we may need to collect additional information to verify your identity, such as a government issued ID.

Under the CCPA, you may exercise these rights yourself or you may designate an authorized agent to make these requests on your behalf. We may request that your authorized agent have written permission from you to make requests on your behalf and may need to verify your authorized agent’s identity.

If you have additional questions about the supplement or how to exercise your rights under the supplement, please contact us as specified in Section 11 of our PRIVACY POLICY.

Virginia Residents

Effective: January 1, 2023

If you are a Virginia resident, the processing of certain personal data about you may be subject to the Virginia Consumer Data Protection Act of 2021, Chapter 53 Section 59.1-575 (“VCDPA”) and other applicable Virginia state privacy laws. Beginning January 1, 2023, the VCDPA gives you certain rights with respect to the processing of your personal data.

This supplement provides additional privacy disclosures and informs you of your additional rights as a Virginia resident, and should be read in conjunction with our PRIVACY POLICY, which describes what information we collect and how we use it.

Consumer Rights under VCDPA

Right of Access. A consumer shall have the right to confirm whether a controller is processing the consumer's personal data, the categories of personal data, the categories of personal data shared with third parties and with whom by category, the purpose for processing such personal data and to access such personal data.
Right of Rectification. The right for a consumer to correct inaccuracies in the consumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data.
Right of Deletion. A consumer shall have the right to request to delete personal data provided by or obtained about the consumer.
Right of Restriction. Obtain consumer consent before processing sensitive data, or, with regards to known children, process such data in accordance with the federal Children’s Online Privacy Protection Act. Sensitive data includes genetic data, biometric data, mental health diagnoses, physical health diagnoses, citizenship status, immigration status, and personal data collected from a known child.
Right of Portability. The consumer has a right to obtain a copy of the consumer's personal data that the consumer previously provided to the controller in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by automated means.
Right to Opt-Out. The right for a consumer to opt out of the processing of the personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

To exercise your “right to know,” your “right to request deletion,” or any other right under the VCDPA, contact us as specified in Section 11 of our PRIVACY POLICY.

In addition, except as otherwise provided under VCDPA, we shall comply with a request by a consumer to exercise the consumer rights authorized as follows:

We shall respond to you without undue delay, but in all cases within 45 days of receipt of the request submitted pursuant to the methods described here. The response period may be extended once by 45 additional days when reasonably necessary, taking into account the complexity and number of your requests, so long as we inform you of any such extension within the initial 45-day response period, together with the reason for the extension.
If we decline to take action regarding your request, we shall inform you without undue delay, but in all cases and at the latest within 45 days of receipt of the request, of the justification for declining to take action and instructions for how to appeal the decision.
Information provided in response to your request shall be provided by us to you free of charge, up to twice annually. If requests from you are manifestly unfounded, excessive, or repetitive, we may charge you a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request. We bear the burden of demonstrating the manifestly unfounded, excessive, or repetitive nature of the request.
If we are unable to authenticate the request using commercially reasonable efforts, we shall not be required to comply with a request to initiate an action under here and may request that you provide additional information reasonably necessary to authenticate you and your request.
Where we have obtained personal data about you from a source other than from you, we shall be deemed in compliance with your request to delete such data pursuant by either (i) retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring your personal data remains deleted from our records and not using such retained data for any other purpose or (ii) opting you out of the processing of such personal data for any purpose except for those exempted.
We have established a process for your appeal to our refusal to take action on a request within a reasonable period of time after your receipt of our decision. The appeal process is similar to the process for submitting requests to initiate action pursuant to above. You may appeal our refusal to take action on a request after receipt of our decision by submitting a request to us specifying you would like to appeal our decision. Your parent or legal guardian may invoke your rights on behalf of you regarding the appeal. Within 60 days of receipt of an appeal, we shall inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, we shall also provide you with an online mechanism, if available, or other method through which you may contact the Attorney General to submit a complaint.

Under the VCDPA, you may exercise these rights yourself or you may designate an authorized agent to make these requests on your behalf. We may request that your authorized agent have written permission from you to make requests on your behalf and may need to verify your authorized agent’s identity.

If you have additional questions about the supplement or how to exercise your rights under the supplement, please contact us as specified in Section 11 of our PRIVACY POLICY.

Colorado Residents

Effective: July 1, 2023

If you are a Colorado resident, the processing of certain personal data about you may be subject to the Senate Bill 21-190, Article 1-Title 6-Part 13 (the “CPA”). Beginning July 1, 2023, the Colorado Privacy Act gives you certain rights with respect to the processing of your personal data.

This supplement provides additional privacy disclosures and informs you of your additional rights as a Colorado resident and should be read in conjunction with our PRIVACY POLICY, which describes what information we collect and how we use it.

Consumer Rights under the CPA:

Right to Access
Right to Correct
Right to Delete Personal Data
Right to Opt-Out of targeted advertising, the Sale of Personal Data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer.

CPA 6-1-1306 (a)

Right to Opt-Out of the Collection and Use of Personal Data

Business Obligations under the Colorado Privacy Act:

To safeguard personal data
To provide clear understandable and transparent information to consumers about how their personal data is used
To strengthen compliance and accountability by requiring data protection assessments in the collection and use of personal data

To exercise your rights, contact us as specified in Section 11 of our PRIVACY POLICY.

Please note to protect your information and the integrity of our Service, we may need to verify your identity before processing your request. In some cases, we may need to collect additional information to verify your identity such as a government issued ID.

Under the Colorado Privacy Act, you may exercise these rights yourself or you may designate an authorized agent to make these requests on your behalf. We may request that your authorized agent have written permission from you to make requests on your behalf and may need to verify your authorized agent’s identity.

If you have additional questions about the supplement or how to exercise your rights under the supplement, please contact us as specified in Section 11 of our PRIVACY POLICY.

Connecticut Residents

Effective: July 1, 2023

If you are a Connecticut, the processing of certain personal data about you may be subject to the Connecticut Data Privacy Act, Public Act No. 22-15 (the “CTDPA”). Beginning July 1, 2023, the CTDPA gives you certain rights with respect to the processing of your personal data.

This supplement provides additional privacy disclosures and informs you of your additional rights as a Connecticut resident and should be read in conjunction with our PRIVACY POLICY, which describes what information we collect and how we use it.

Consumer Rights under the CTDPA:

Right to Access personal data that a business has collected about them. Right to obtain a copy of their personal data in a portable and readily usable format that allows them to transfer the data to another controller with ease. A consumer can request information from a controller free once every twelve (12) months. Under certain circumstances beyond the annual request, the controller may charge an administrative fee.
Right to Correct inaccuracies in their personal data
Right to Delete their personal data, including data that a business collected through third parties
Right to Opt-Out of sale of their personal data, the processing of personal data for the purposes of targeted advertising, and profiling that may have a legal or other significant impact.

Business Obligations under the CTDPA include:

To provide and maintain a privacy notice that clearly describes:
- The purpose(s) for processing the personal data, and whether and why the controller shares personal data with third parties, and
- How consumers may exercise their rights under the CTDPA. [Among other methods, a controller must provide an easily accessible link on its website through which consumers can opt-out of targeted advertising or the sale of their personal data. Soon, consumers will also be able to opt-out through universal opt-out mechanisms.]
To protect the personal data of children and teens. To permit a child’s parent or legal guardian to exercise privacy rights on the child’s behalf. To obtain opt-in consent before selling the personal data of a consumer under sixteen (16) years old or sending the consumer target ads. Controllers must follow all regulations concerning children’s online privacy established pursuant to the Children’s Online Privacy Protection Act (“COPPA”), including parental consent requirements.
To conduct assessments before processing personal data in a manner that presents a heightened risk of harm to consumers (called “Data Protection Assessments”). This includes processing personal data for the purposes of targeted advertising, sale, or profiling, and processing sensitive data.
To obtain consent before processing a consumer’s sensitive data. Sensitive data is a subset of personal data that includes:
Any data revealing racial or ethnic origins, religious beliefs, mental or physical health conditions or diagnoses, sexual activity or orientation, citizenship, or immigration status;
Genetic or biometric data used to uniquely identify an individual;
Personal data of a child under the age of thirteen (13); and
Information that identifies an individual’s specific location with a defined degree of precision and accuracy (called “precise geolocation data”).

To exercise your rights, contact us as specified in Section 11 of our PRIVACY POLICY.

Under the CTDPA, you may exercise these rights yourself or you may designate an authorized agent to make these requests on your behalf. We may request that your authorized agent have written permission from you to make requests on your behalf and may need to verify your authorized agent’s identity.

If you have additional questions about the supplement or how to exercise your rights under the supplement, please contact us as specified in Section 11 of our PRIVACY POLICY.

Utah Residents

Effective: December 31, 2023

Beginning December 31, 2023, the Utah Consumer Privacy Act gives you certain rights with respect to the processing of your personal data.

This supplement provides additional privacy disclosures and informs you of your additional rights as a Utah resident and should be read in conjunction with our PRIVACY POLICY, which describes what information we collect and how we use it.

Consumer Rights under the Utah Consumer Privacy Act:

Consumer Rights -- Access -- Deletion -- Portability -- Opt Out of Certain Processing:

(1) A consumer has the right to:

(a) confirm whether a controller is processing the consumer's personal data; and

(b) access the consumer's personal data.

(2) A consumer has the right to delete the consumer's personal data that the consumer provided to the controller.

(3) A consumer has the right to obtain a copy of the consumer's personal data, that the consumer previously provided to the controller, in a format that:

(a) to the extent technically feasible, is portable;

(b) to the extent practicable, is readily usable; and

(c) allows the consumer to transmit the data to another controller without impediment, where the processing is carried out by automated means.

(4) A consumer has the right to opt out of the processing of the consumer's personal data for purposes of:

(a) targeted advertising; or

(b) the sale of personal data.

(5) Nothing in this section requires a person to cause a breach of the security system as defined in Section 13-44-102 of the Utah Consumer Privacy Act.

Exercising Consumer Rights:

(1) A consumer may exercise a right by submitting a request to a controller, by means prescribed by the controller, specifying the right the consumer intends to exercise.

(2) In the case of processing personal data concerning a known child, the parent or legal guardian of the known child shall exercise a right on the child's behalf.

(3) In the case of processing personal data concerning a consumer subject to guardianship, conservatorship, or other protective arrangement under the Utah Uniform Probate Code Title 75, Chapter 5, Protection of Persons Under Disability and Their Property, the guardian or the conservator of the consumer shall exercise a right on the consumer's behalf.

Controller's Response to Requests:

(1) Subject to the other provisions of this chapter, a controller shall comply with a consumer's request under Section 13-61-202 of the Utah Consumer Privacy Act to exercise a right.

(2)

(a) Within 45 days after the day on which a controller receives a request to exercise a right, the controller shall: (i) take action on the consumer's request; and (ii) inform the consumer of any action taken on the consumer's request.

(b) The controller may extend once the initial 45-day period by an additional 45 days if reasonably necessary due to the complexity of the request or the volume of the requests received by the controller.

(c) If a controller extends the initial 45-day period, before the initial 45-day period expires, the controller shall: (i) inform the consumer of the extension, including the length of the extension; and (ii) provide the reasons the extension is reasonably necessary as described in Subsection (2)(b).

(d) The 45-day period does not apply if the controller reasonably suspects the consumer's request is fraudulent and the controller is not able to authenticate the request before the 45-day period expires.

(3) If, in accordance with this section, a controller chooses not to take action on a consumer's request, the controller shall within 45 days after the day on which the controller receives the request, inform the consumer of the reasons for not taking action.

(4)

(a) A controller may not charge a fee for information in response to a request, unless the request is the consumer's second or subsequent request during the same 12-month period.

(b) (i) Notwithstanding Subsection (4)(a), a controller may charge a reasonable fee to cover the administrative costs of complying with a request or refuse to act on a request, if:

(A) the request is excessive, repetitive, technically infeasible, or manifestly unfounded;

(B) the controller reasonably believes the primary purpose in submitting the request was something other than exercising a right; or

(C) the request, individually or as part of an organized effort, harasses, disrupts, or imposes undue burden on the resources of the controller's business.

(b) (ii) A controller that charges a fee or refuses to act in accordance with this Subsection (4)(b) bears the burden of demonstrating the request satisfied one or more of the criteria described in Subsection (4)(b)(i).

(5) If a controller is unable to authenticate a consumer request to exercise a right described in Section 13-61-201 of the Utah Consumer Privacy Act using commercially reasonable efforts, the controller: (a) is not required to comply with the request; and (b) may request that the consumer provide additional information reasonably necessary to authenticate the request.

Responsibilities of Controllers -- Notice -- Purpose Specification-- Security:

(1)

(a) A controller shall provide consumers with a reasonably accessible and clear privacy notice that includes:

(i) the categories of personal data processed by the controller;

(ii) the purposes for which the categories of personal data are processed;

(iii) how consumers may exercise a right;

(iv) the categories of personal data that the controller shares with third parties, if any; and

(v) the categories of third parties, if any, with whom the controller shares personal data.

(b) If a controller sells a consumer's personal data to one or more third parties or engages in targeted advertising, the controller shall clearly and conspicuously disclose to the consumer the manner in which the consumer may exercise the right to opt out of the:

(i) sale of the consumer's personal data; or

(ii) processing for targeted advertising.

(2)

(a) A controller shall establish, implement, and maintain reasonable administrative, technical, and physical data security practices designed to:

(i) protect the confidentiality and integrity of personal data; and

(ii) reduce reasonably foreseeable risks of harm to consumers relating to the processing of personal data.

(b) Considering the controller's business size, scope, and type, a controller shall use data security practices that are appropriate for the volume and nature of the personal data at issue.

(3) Except as otherwise provided in the Utah Consumer Privacy Act, a controller may not process sensitive personal data collected from a consumer without:

(a) first presenting the consumer with clear notice and an opportunity to opt out of the processing; or

(b) in the case of the processing of personal data concerning a known child, processing the data in accordance with the federal Children's Online Privacy Protection Act, 15 U.S.C. Sec. et seq., and the act's implementing regulations and exemptions.

To exercise your rights, contact us as specified in Section 11 of our PRIVACY POLICY.

Under the Utah Consumer Privacy Act, you may exercise these rights yourself or you may designate an authorized agent to make these requests on your behalf. We may request that your authorized agent have written permission from you to make requests on your behalf and may need to verify your authorized agent’s identity.

If you have additional questions about the supplement or how to exercise your rights under the supplement, please contact us as specified in Section 11 of our PRIVACY POLICY.

Ready to create impact?

Privacy Supplement

ADDITIONAL STATE PRIVACY LAWS

Nevada Residents

California Residents

Virginia Residents

Colorado Residents

Connecticut Residents

Utah Residents