Privacy Rights Notice (U.S.)

PLUME DESIGN, INC. CUSTOMER PRIVACY RIGHTS NOTICE

Last Updated: March 25, 2023
Effective: January 1, 2023

Plume Design, Inc. and its subsidiaries and affiliates (collectively, Plume or we) provide this Privacy Notice to inform residents of California, Virginia, Colorado, Connecticut and Utah about your rights to know and control your personal information that we process, and how you can exercise your rights. This Notice also provides California residents with information about the categories of personal information we collect and to whom we disclose such information for business purposes.

This Privacy Notice applies to the personal information we collect when you visit our website at www.plume.com or other websites or mobile apps that link to the Plume Privacy Policy, when you visit our offices, receive communication from us, register or attend our events or webinars, or ask questions about our products. This Notice supplements the Plume Privacy Policy. If any provisions in this Privacy Notice conflicts with the Plume Privacy Policy, this Notice controls in relation to the processing of personal information of residents of California, Virginia, Colorado, Connecticut and Utah.

We may change this Notice from time to time. We always indicate the date the last changes were published at the top of the Notice. If changes are significant, you will be notified prior to the change becoming effective either via a notice on our website or an email sent to the email address we have on file for you.

If you have a question about how we process your personal information, please contact us by email us at [email protected]. If you do not feel comfortable with any part of this Privacy Notice, you should cease using our website and services.

PRIVACY RIGHTS

Depending on the state where you reside, you may be able to assert certain rights identified below with respect to your personal information. Please refer to the table provided below to determine the rights you have.

Your rights in relation to your personal information are not absolute. Depending upon the applicable law, access to your rights under the applicable law may be denied: (i) when denial of access is required or authorized by law; (ii) when granting access would have a negative impact on another's privacy; (iii) to protect our rights and properties; or (iv) where the request is frivolous or vexatious, or for other reasons.

a) Right to Access. You may have the right to obtain a copy, or a list of categories of the personal information that we hold about you, as well as other supplementary information, such as the purposes of processing, and the entities to whom we disclose your personal information

b) Right to Correct. You may have the right to correct any of your personal information in our records and systems. You may request us to rectify, correct or update any of your personal information held by us that is inaccurate.

c) Right to Delete. Under certain circumstance, you may have the right to request that we delete the personal information that we hold about you. This right is not absolute, and we may refuse such a request if there are compelling legitimate grounds for keeping your Personal information, for legitimate purposes, or as required by law. In addition, in the event your deletion request is honored, we may retain a record of your deletion request as required under applicable law.

d) Right to Portability. You have the right to receive a copy of the personal information we have collected about you in a portable and (if technically feasible) commonly used and machine-readable format.

e) Right to Opt-Out of Sale. Like many websites, we use cookies, pixels, and similar technology, and we share information they collect, such as your IP address or device identifiers, to certain third-party advertisers to improve your user experience and to optimize our marketing activities. Under the broad definition of "sell" contained in certain jurisdictions' privacy laws, this could be considered a sale. To opt-out of having your personal information sold, please follow the instructions below.

f) Right to Opt-Out of Sharing for Targeted Advertising. You may have the right to opt-out of the sharing of your personal information for behavioral advertising purposes. Like many websites, we use cookies, pixels, and similar technology, and we share certain information, such as your IP address or device identifiers, to certain third-party advertisers in order to improve your user experience and to optimize our marketing activities. You have the right to direct us not to share or use your personal information for targeted advertising purposes.

g) Right to Opt-Out of Automated Decision-Making or Profiling. You may have the right not to be subject to a decision which significantly impact your rights that is based solely on automated processing (where a decision is taken about you using an electronic system without human involvement). No decision will be made by us about you solely on the basis of automated decision making which has a significant impact on you.

h) Right Against Discrimination. You may have the right not to be discriminated against for exercising any of the rights described in this section. We will not discriminate against you for exercising your rights.

i) Right to Appeal. If you are a resident of Virginia, Colorado or Connecticut, you have the right to appeal if we refuse to take action on your rights request. Instructions on how to appeal will be provided to you upon such a denial, but in any event, such instructions will be substantially similar to those provided below for submitting requests.

Resident of	Applicable Rights
California	(a) – (h), and see California Notice section below.
Virginia	(a) – (i)
Colorado	Starting July 1, 2023: (a) – (i)
Connecticut	Starting July 1, 2023: (a) – (i)
Utah	Starting December 31, 2023: (a), (c -f), (h)

Exercising Your Right to Access, Correct, Delete, and Port

To exercise your right to access, to correct, to delete, and to port, please submit this form or email us at [email protected] the subject line "Consumer Rights Request". In your request, please make clear which right you would like to exercise.

Before fulfilling your request to access, correct, delete, and port, we are required by law to have you to verify your identity. If we cannot verify your identity based on the personal information we have on file, we may request additional information from you, which we will only use to verify your identity, and for security or fraud-prevention purposes. To verify your identity, please authenticate your account by following instructions in the account verification email and providing data points that will allow us to verify you are the individual making the request so that we can process your request.

If you use the Privacy Request Form, please note to access your personal information, please select Download; to port your personal information please select Transfer; to correct your personal information, please select Update Inaccuracies, and if you wish to delete your personal information please select Delete.

Exercising Your Right To Opt-Out of Sale or Sharing

You may exercise your right to opt-out of sales or sharing for targeted advertising purposes by clicking here or by clicking the "Your Privacy Choices" link in our website footer. California and Colorado residents may also opt-out of sharing and sales by using an opt-out preference signal for each participating browser system that you use. We will honor and process the opt-out preference signal in a frictionless manner. To start using an opt-out preference signal, please refer to the instructions provided here. You will need to submit a separate opt-out of sharing request on each device and browser you use to visit our website Please note that you may still receive generalized ads after opting out of targeted advertising.

When you use our mobile application, we or our Third Party Marketing Partners may use one or more of several different identifiers for your mobile device, including Apple Identifier For Advertising (IDFA) or Android Advertising ID (AAID), to target and deliver ads to you in our app or other apps. This means that your device identifier may be accessed by third-party ad networks and used to (a) help manage the number and types of ads you see; (b) track the source of installs related to ads seen in other apps; and (c) identify your interests and behavior and target advertising to you based on those interests and behavior.

Apple requires app developers to ask for permission before they can track your activity across apps or websites they do not own in order to target advertising to you, measure your actions due to advertising, or to share your information with data brokers. If you previously gave our mobile app permission to track, you can tell our app to stop tracking your activity. On iOS or IPadOS, go to Settings, tap on our app, then tap to turn off Allow Tracking. You can also reset your IDFA from your mobile device's settings page, which will prevent continued use of existing behavioral data tied to your previous IDFA.

If you have an Android device, and are running Android 12 or above, you can delete your AAID permanently by opening Settings, navigating to Privacy > Ads, tapping "Delete advertising ID," then tapping it again on the next page to confirm. This will prevent any app on your phone from accessing it in the future. Please note that if you do so, you will still see advertisements, but they will not be tailored to your inferred interests.

You may also access industry-provided opt-out tools, although they are not tailored to our mobile applications. For instance, to opt-out of data collection by the Digital Advertising Alliance's participating member companies for interest-based advertising across mobile applications, download the DAA's App Choices mobile application opt-out offering at https://youradchoices.com/appchoices.

Authorized Agent

Residents of California, Colorado and Connecticut may use an authorized agent to submit a rights request on your behalf to access or delete your personal information. If you use an authorized agent to submit requests on your behalf, we will require you to directly verify your identity with us, or have you directly confirm with us that the authorized agent has been authorized to act on your behalf.

CALIFORNIA NOTICE

This section applies only to residents of California. Although we already explain what personal information we collect and why in the Plume Privacy Policy, California privacy law requires that Plume make certain disclosures.This section uses certain terms that have the meaning given to them in the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) and its implementing regulations.

When we use the term "personal information" in this section, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual, consumer or household. Personal information does not include: (i) publicly available information from government records; (ii) deidentified, aggregated or anonymized information that is maintained in a form that is not capable of being associated with or linked to a consumer; (iii) information excluded from the CCPA's scope, such a health or medical information covered by HIPAA or the CMIA, or covered by other sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.

Categories of Personal Information We Collect

We may collect or receive the categories of personal information listed below. Not all categories will be collected or received for every individual.

• Identifiers: Personal identifiers, such as name, telephone number, physical address, email address, national identification numbers, driver's license numbers, and signatures.
• Personal information listed in § 1798.80 of the California Customer Records statute: Name, signature, address, telephone number, billing and transactions information.
• Commercial Information: Purchase and transaction history information (such as products or services you have purchased, rented, or returned), product testimonials.
• Device Information and Online Activity: Device and online identifiers, keystroke patterns indicative of human or bot website/app usage, mobile and web network activity and related information (such as Mac address, IP address, cookie IDs, browser activity, and other information associated with your browsing history), and social media information.
• Audio or Visual Information: Photos or videos taken at our events.
• Communications: Communication details (such as the content of emails, text messages, or other communications), call logs, and calendar information where Plume is a party to the exchange
• Financial Information: Financial information, such as credit or debit card numbers, financial account numbers.
• Geolocation Data: Approximate physical location (derived from an IP address).
• Account Credential: Account credentials and log-in credentials to attend an event, customer connect log-in credentials.
• Inferences: Consumers preferences and interests drawn from any of the above.

We do not collect or process "Sensitive Personal Information" (as defined by applicable California law) for the purpose of inferring characteristics about consumers. To the extent we process any Sensitive personal information, it IS used only for purposes specified in Section 7027(m) of the California Consumer Privacy Act Regulations, and not to infer characteristics about consumers. .

Categories of Sources from Which We Collect personal information

We may obtain and combine personal information from different sources, as described in the Plume Privacy Policy, Section 2 - What Personal Information Does Plume Collect and Why, and as summarized below:

• Provided directly by you or a member of your household
• Collected from a device associated with you or your household
• Collected from another company within our family of companies
• Collected from an external third-party source
• Collected from another solution or asset
• Collected from other sources, when it is appropriate, to help us correct or supplement our records, improve the quality or personalization of our services, increase the appeal and relevance of advertising, and to prevent or detect fraud

Purposes for Which personal information is Collected and Used

See Plume Privacy Policy, Section 3 – How Does Plume Use Personal Information for information about how we use your personal information.

Disclosure of Personal Information for Business Purposes

In the preceding 12 months, we have disclosed the above categories of personal information for a business purpose such as to enable service providers to perform services on our behalf, to coordinate efforts among Plume entities, or to facilitate marketing and sales through our partners. We have made such disclosures to our subsidiaries and affiliates, service providers, and our business partners. Additionally, in the 12 months preceding the "Last Updated" date above, Plume may have disclosed for a business purpose all of the categories of personal information identified above as required or permitted by law.

Personal Information "Sold" or "Shared"

We do not sell or share personal information for money. However, under California law, some uses of cookies and similar tracking technologies may be characterized as "selling" or "sharing" personal information. Since we use such tracking technologies, in the preceding 12 months we may have "sold" or "shared" identifiers and online activity information for commercial purposes such as to serve advertisements, to analyze the success of marketing campaigns, or to understand the use of our websites, and such receiving entities may use the personal information for their own purposes, such as to improve their ability to target advertisements. The following personal information is "sold" or "shared" to advertising networks, social media networks and analytics partners.

Sale or Share of Personal Information of Consumers Under 16 Years of Age

Plume does not knowingly sell or share (for cross-context behavioral advertising) the personal information of consumers under 16 years of age. For more information about treatment of children's personal information, see the Plume Privacy Policy.

Retention of Personal Information

See Plume Privacy Policy, Section 7 – How Long Does Plume Retain personal information Plume Privacy Policy, Section 7 – How Long Does Plume Retain Personal Information for information about how long we retain your personal information.

Shine the Light

California residents have the right to request that we provide you with (a) a list of certain categories of personal information we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year and (b) the identity of those third parties. To exercise this right, contact us at [email protected].

Notice of Financial Incentive

If we provide a financial incentive, we will provide you with the details, including how the incentive is related to your data before you participate so that you may make an informed decision about whether and how to participate. In the event you decide to take advantage of a financial incentive, you will always have the right to withdraw from participation and we will provide you with directions on how to do so.

Do Not Track

Some Internet browsers, such as Internet Explorer, Firefox, and Safari, include the ability to transmit "Do Not Track" or "DNT" signals. Since uniform standards for "DNT" signals have not been adopted, our website does not currently process or respond to "DNT" signals.