We adopt this section of this Notice to comply with the required “Notice at Collection” disclosures under California Consumer Privacy Act of 2018 (the “CCPA”), as amended by the California Privacy Rights Act of 2020 (the “CPRA”) and its implementing regulations (together, the “California Privacy Laws”). This section applies to California consumers, including employees, job applicants, and contractors (“you”). Any terms defined in the California Privacy Laws have the same meaning when used in this California section of this Notice.

Categories of Personal Information We Collect

We may collect or receive (and may have collected or received during the 12-month period prior to the Last Updated date of this Notice) the categories of personal information listed in the table below. Not all categories will be collected or received for every individual.

We may obtain and combine personal information from different sources, as described in the Information We Collect & How We Collect It section of this Notice. As further described in the How We Use Your Information section of this Notice, we generally collect and use the above-listed categories of personal information to present our Website and its contents to you, provide requested information or services, fulfill purposes for which you provide the information, carry out contractual obligations, notify you about changes, and for any other purpose described at the time of collection or with your consent.

Sharing Personal Information

We do not rent, sell, or use for targeted advertising, the personal information we collect. We may disclose your personal information to our third-party service providers for a business purpose as described in the Disclosure of Your Information section of this Notice. We only make these business purpose disclosures under written contracts that describe the purposes, require the recipient to keep the personal data confidential, and prohibit using the disclosed information for any purpose except performing the contract.

In the preceding twelve (12) months, Tonkon Torp has disclosed personal information for a business purpose to the following categories of third parties:

• Our hosting provider.
• Our Website creator.
• Data analytics providers and internet cookie data recipients, like Google Analytics.
• Third-party software-as-a-solution providers, like Salesforce Pardot which we use to automate and streamline marketing and sales processes.
• Operation systems and platforms.

Data Retention

We retain each category of personal information that we collect for as long as necessary to fulfill the purposes described in the How We Use Your Information, section of this Notice, including to satisfy legal or reporting requirements. What this means in practice will vary for different types of information, but the criteria assessed in the data retention analysis consider ongoing business or legal needs for the information, for example in relation to tax, health and safety, and potential or actual disputes or investigations.

Your California Privacy Rights

If you are a California resident, you can make certain requests regarding your personal information. Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the information applies. If we are unable to comply with your request in whole or in part, we will notify you with reasons for the denial. Your rights include:

• Right to Know. You have the right to request that we disclose to you the categories of personal information we have collected about you, as well as the sources of such personal information, the purposes, and the categories of third parties with whom such personal information is shared.
• Right to Access. You have the right to request, up to two times each year, access to categories and specific pieces of personal information about you that we collect, use, disclose, sell, and share.
• Right to Delete. You have the right to request that we delete personal information that we collect from you, subject to applicable legal exceptions.
• Right to Correct. You have the right to request that we correct inaccurate personal information that we maintain about you, subject to applicable legal exceptions.
• Right to Opt Out of Sale or Sharing of Personal Information. You have the right to “opt out” of the “sale” or “sharing” of your “personal information” to or with “third parties” (as those terms are defined by California Privacy Laws). Please note that we do not use your personal information in this way.
• Right Not to Receive Discriminatory Treatment. You have the right not to receive discriminatory treatment for the exercise of your privacy rights. If you choose to exercise any of these rights, you will not receive different prices or quality of services unless permitted by applicable law, including if those differences are reasonably related to your information. For example, if you exercise your right to opt out of “sale” or “sharing” of your ”personal information,” the ads you view may not be tailored to your interests.

Exercising Your California Privacy Rights

• Making Requests to Know, Access, Delete, or Correct Your Personal Information. To exercise your rights to know, access, delete, or correct your personal information, please submit a request by either emailing us at privacy@tonkon.com or filling out our contact form at tonkon.com/about/contact/. Only you, or someone legally authorized to act on your behalf, may make a request related to your personal information. You may only submit a request to know twice within a 12-month period. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. We will only use personal information provided in a request to review and comply with the request. You do not need to create an account with us to submit a request to know or delete. We endeavor to substantively respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing.  We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. We will delete or de-identify personal information not subject to a legal exception from our records and will direct our service providers to take similar action. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
• Instructions for Using an Authorized Agent to Make Requests. You may use an authorized agent to submit a request to know or access, deletion, correction, or opt-out requests on your behalf. An authorized agent must have your signed permission to submit a request on your behalf or provide proof that they have power of attorney in accordance with applicable law. Before completing requests from authorized agents, we may contact you directly to confirm you’ve given your permission and/or to verify your identity. Authorized agents may submit requests by emailing us at privacy@tonkon.com.

Contact Information

If you have any questions or comments about this California section of our Notice, or wish to exercise your California privacy rights, please do not hesitate to email us at privacy@tonkon.com.

We adopt this section of this Notice to give Oregon residents (“you”) additional information required by the Oregon Consumer Privacy Act (the “OCPA”). This Oregon section applies to you when you are acting in an individual or household context, but not when you are acting in a commercial or employment context, including as a job applicant. Any terms defined in the OCPA have the same meaning when used in this Oregon section of this Notice.

Categories of Personal Data We Collect

We may collect or receive (and may have collected or received during the 12-month period prior to the Last Updated date of this Notice) the categories of personal data listed below. Not all categories will be collected or received for every individual. For more information on the categories of personal data we collect, please see the Information We Collect & How We Collect It section of this Notice.

• Personal identifiers, such as name, telephone number, physical address, email address, or other similar identifiers.
• Device Information and Online Activity. Device and online identifiers, keystroke patterns indicative of human or bot website usage, mobile and web network activity and related information (such as Mac address, IP address, cookie IDs, browser activity, and other information associated with your browsing history), and social media information (if you engage with us on social media platforms).
• Commercial Information. Commercial information and service testimonials.
• Communication details (such as the content of emails, text messages, or other communications), call logs, and calendar information where we are a party to the exchange.
• Anonymized geolocation data, showing only city and state.

We do not collect sensitive personal data.

Collection, Use, and Sharing of Your Personal Data

We do not rent, sell, or use for targeted advertising, the personal data we collect. We may disclose your personal data to our third-party service providers for a business purpose as described in the Disclosure of Your Information section of this Notice. We only make these business purpose disclosures under written contracts that describe the purposes, require the recipient to keep the personal data confidential, and prohibit using the disclosed information for any purpose except performing the contract.

In the preceding twelve (12) months, Tonkon Torp has disclosed personal data for a business purpose to the following categories of third parties:

• Our hosting provider.
• Our Website creator.
• Data analytics providers and internet cookie data recipients, like Google Analytics.
• Third-party software-as-a-solution providers, like Salesforce Pardot which we use to automate and streamline marketing and sales processes.
• Operation systems and platforms.

Data Retention

We retain each category of personal data that we collect for as long as necessary to fulfill the purposes described in the How We Use Your Information section of this Notice, including to satisfy legal or reporting requirements. What this means in practice will vary for different types of information, but the criteria assessed in the data retention analysis consider ongoing business or legal needs for the information, for example in relation to tax, health and safety, and potential or actual disputes or investigations.

Your Oregon Privacy Rights

If you are an Oregon resident, you can make certain requests regarding your personal data. Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the data applies. If we are unable to comply with your request in whole or in part, we will notify you with reasons for the denial. Your rights include:

• Right to Know. You have the right to know whether we control the collection of your personal data.
• Right to Access. You have the right see what personal data we have collected about you in a usable format.
• Right to Delete. You have the right to request that we delete personal data that we collect from you, subject to applicable legal exceptions.
• Right to Correct. You have the right to request that we correct inaccurate personal data.
• Right to Opt Out of Sale of Personal Data and Targeted Advertising. You have the right to “opt out” of “targeted advertising,” certain types of profiling, and the “sale” of your “personal data” (as defined in the OCPA). Please note that we do not use your personal data in this way.

Exercising Your Oregon Privacy Rights

• Making Requests to Know, Access, Delete, or Correct Your Personal Information. To exercise your rights to know, access, delete, or correct your personal information, please submit a request by either emailing us at privacy@tonkon.com or filling out our contact form at tonkon.com/about/contact/. Only you, or someone legally authorized to act on your behalf, may make a request related to your personal information. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. We will only use personal information provided in a request to review and comply with the request. You do not need to create an account with us to submit a request to know or delete. We endeavor to substantively respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. We will delete or de-identify personal information not subject to a legal exception from our records and will direct our service providers to take similar action. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
• Instructions for Using an Authorized Agent to Make Requests. You may use an authorized agent to submit a request to know or access, deletion, correction, or opt-out requests on your behalf. An authorized agent must have your signed permission to submit a request on your behalf or provide proof that they have power of attorney in accordance with applicable law. Before completing requests from authorized agents, we may contact you directly to confirm you’ve given your permission and/or to verify your identity. Authorized agents may submit requests by emailing us at privacy@tonkon.com.

How to Submit an Appeal

To appeal our decision regarding a request to these rights, you may email us at privacy@tonkon.com.

Contact Information

If you have any questions or comments about this Oregon section of our Notice, or wish to exercise your Oregon privacy rights, please do not hesitate to email us at privacy@tonkon.com.

We adopt this section of this Notice to give Texas residents (“you”) additional information required by the Texas Data Privacy and Security Act (the “TXDPSA”). This Texas section applies to you when you are acting in an individual or household context, but not when you are acting in a commercial or employment context, including as a job applicant. Any terms defined in the TXDPSA have the same meaning when used in this Texas section of this Notice.

Collection, Use, and Sharing of Your Personal Data

We may obtain and combine personal information from different sources, as described in the Information We Collect & How We Collect It section of this Notice. As further described in the How We Use Your Information section of this Notice, we generally collect and use the above-listed categories of personal information to present our Website and its contents to you, provide requested information or services, fulfill purposes for which you provide the information, carry out contractual obligations, notify you about changes, and for any other purpose described at the time of collection or with your consent.

We do not collect sensitive personal data, nor do we rent, sell, or use for targeted advertising, the personal data we collect.

We may disclose your personal data to our third-party service providers for a business purpose as described in the Disclosure of Your Information section of this Notice. We only make these business purpose disclosures under written contracts that describe the purposes, require the recipient to keep the personal data confidential, and prohibit using the disclosed information for any purpose except performing the contract.

Your Texas Privacy Rights

If you are a Texas resident, you can make certain requests regarding your personal data. Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the data applies. If we are unable to comply with your request in whole or in part, we will notify you with reasons for the denial. Your rights include:

• Right to Know. You have the right to know whether we control the collection of your personal data.
• Right to Access. You have the right see what personal data we have collected about you in a usable format.
• Right to Delete. You have the right to request that we delete personal data that we collect from you, subject to applicable legal exceptions.
• Right to Correct. You have the right to request that we correct inaccurate personal data.
• Right to Opt Out of Sale of Personal Data and Targeted Advertising. You have the right to “opt out” of “targeted advertising,” certain types of profiling, and the “sale” of your “personal data” (as defined in the TXDPSA). Please note that we do not use your personal data in this way.

Exercising Your Texas Privacy Rights

• Making Requests to Know, Access, or Delete Your Personal Information. To exercise your rights to know, access, delete, or correct your personal data, please submit a request by emailing us at privacy@tonkon.com or by filling our electronic contact form at www.tonkon.com/about/contact/. Only you, or someone legally authorized to act on your behalf, may make a request related to your personal data. We cannot respond to your request or provide you with personal data if we cannot verify your identity or authority to make the request and confirm the personal data relates to you. We will only use personal data provided in a request to review and comply with the request. You do not need to create an account with us to submit a request to know or delete. We endeavor to substantively respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. We will delete or de-identify personal data not subject to a legal exception from our records and will direct our service providers to take similar action. For data portability requests, we will select a format to provide your personal data that is readily useable and should allow you to transmit the data from one entity to another entity without hindrance.
• Instructions for Using an Authorized Agent to Make Requests. You may use an authorized agent to submit a request to know or access, deletion, correction, or opt-out requests on your behalf. An authorized agent must have your signed permission to submit a request on your behalf or provide proof that they have power of attorney in accordance with applicable law. Before completing requests from authorized agents, we may contact you directly to confirm you’ve given your permission and/or to verify your identity. Authorized agents may submit requests by email us at privacy@tonkon.com.

How to Submit an Appeal

To appeal our decision regarding a request to these rights, you may email us at privacy@tonkon.com.

Contact Information

If you have any questions or comments about this Texas section of our Notice, or wish to exercise your Texas privacy rights, please do not hesitate to email us at privacy@tonkon.com.