Privacy Notice for PERI Partners and for Website / Social Media Audiences

PERI Formwork Systems, Inc. (hereinafter "PERI", "We" or "Us") is committed to respecting your privacy. To ensure transparency, we have developed this Privacy Notice (hereinafter this " Notice") to clearly communicate how we collect, use, disclose, protect, store, and transmit your personal data. We encourage you to take a moment to carefully read through this Notice. Should you have any inquiries or concerns, please feel free to contact us.
This Notice applies to PERI's business interactions with our prospective and existing customers, suppliers, other business partners, as well as website and social media visitors. 

1. Responsible PERI Entity and Data Controller

Data controller is the responsible entity for the processing of your personal data outlined in this Notice. To contact the Data Controller or to make any inquiry or request regarding this Notice, please call or send a written notice to:

PERI Formwork Systems, Inc.
7135 Dorsey Run Road
Elkridge, MD 21075
United States

Email: privacy@peri-usa.com
Toll Free Number: 1-888-533-0559
www.peri-usa.com

You can also directly contact the Privacy & Compliance Officer of PERI Formwork Systems, Inc. if you have any concerns or inquiries regarding the processing of your personal data. The contact details are as follows:

Nicolas Granjon
7135 Dorsey Run Road
Elkridge, MD 21075
United States

Email: data.protection@peri-usa.com

2. Types of Data Collected and Processed

The personal data collected and processed will depend on the context of your interactions with us and the services you use. The categories of personal data we collect and process include, with examples provided:

• Contact and Company Information: Full name, job title, salutation, position, company name, registration details, phone number, email, postal address, fax, communication preferences, and records of correspondence.
• Transaction Information: Details related to orders, offers, products or services, payment, tax IDs, shipping information, signed agreements, and billing data.
• User Account Information: Account name, email, user ID, login credentials, preferences, profiles, and activity logs.
• Website Usage and Technical Data: IP address, browser type, device identifiers, session data, and cookies as well as other online identifiers.
• Personal Image: Photo and video records.
• Social Media Information: Social media usernames, profiles, posts, comments, and other interactions with our social media accounts.
•  Event Participation Information: Participation details for events such as exhibitions, trainings, or other online/offline campaigns, including data related to registration, preferences, feedback, and travel booking information.
• Payment Information: Credit card or debit card information and information about payment methods and services used in connection with our services.  
• Geolocation Data: General geographic location such as country, state or province, or city, and precise geolocation data.    
• De-Identified Data: We may process de-identified data. When we do so, we take reasonable measures to ensure the data cannot be associated with a specific individual, publicly commit not to attempt to re-identify the data, contractually require recipients of de-identified data to refrain from attempting to re-identify it and to comply with applicable law, and maintain safeguards designed to prevent the inadvertent release of information that could re-identify an individual.
• Sensitive Personal Data: We obtain your affirmative, prior consent before processing sensitive personal data, and you may withdraw consent at any time using the methods in Section 9 (Data Subject Rights).  Place the statement after the sensitive data description

We may obtain data about you from publicly and commercially available sources or collect data about you through third-party services to the extent permitted by law. This may include social media platforms, company profile databases, contact forms, analytics features, advertising features, account sign-up forms and related information, billing information submitted, tenders, public records, and other companies affiliated with PERI ("PERI Group").

3. Purposes and Usage of the Data Processing

In order to provide the services you request and to fulfill our contractual obligations to you and/or our legal obligations, we collect and process personal data reasonably necessary and proportionate to those purposes. Unless otherwise stated in this Notice, if you object to or restrict the collection and processing of your personal data for the purposes of providing these services or performing the contract, you may no longer be able to use the relevant service(s), or we may be unable to fully perform the contract, in whole or in part.

• Contract Fulfillment and Orders: We process your Contact and Company Information, Transaction Information, User Account Information to manage contracts, carry out due diligence, handle invoicing and bookkeeping, deliver products and services, and provide customer support.
• Account Management: We process your User Account Information to create and manage your user account, including access to our services. If you have activated the Single-Sign-On feature (e.g., via Microsoft or Google), your login credentials remain with the provider and are not transferred to us. Please refer to your provider's terms for details (e.g., Microsoft Single-Sign-On).
• Event Registration: We process your Contact and Company Information and Event Participation Information to process your requests, register you for events, fulfill event terms and conditions, and manage activities such as event-specific contests or giveaways.
• For purposes related to our legitimate (commercial) interests, we process the following categories of personal data for the associated purposes.
• Customer Service: We may process your Contact and Company Information, Transaction Information, User Account Information, Social Media Information and Event Participation Information to assist with inquiries about our products, services, or events..
• Marketing and Promotional Activities: We may process your Contact and Company Information, Social Media Information, and Personal Image to conduct marketing and promotional activities. This often includes taking group photos or videos of events you have participated in, sharing information about our products and services that are similar to those you have previously ordered from us, and events similar to those in which you have participated, gathering your feedback, sending printed brochures, and making posts and interactions with you on social media or websites.
• Technical Operation and Maintenance: We may process your User Account Information, Website Usage and Technical Data, and other non-personal metadata to perform technical operation and maintenance tasks and implement security measures, ensuring the smooth and secure use of our products and services.
• Customer Experience Improvement and Business Analysis: We may process your Contact and Company Information, Transaction Information, User Account Information, Website Usage and Technical Data, Social Media Information and Event Participation Information to conduct business analysis, risk management, internal learning, and statistical reporting for providing you with the best products and services. Before processing for these purposes, we always implement pseudonymization or anonymization to the best of our ability, adhering to privacy-by-design and privacy-by-default principles.

On the basis of your separate and specific consent, we process the following personal data for the associated purposes. You can revoke your consent at any time with effect for the future. The lawfulness of data processing prior to your withdrawal remains unchanged.

• Direct Marketing: With your consent, we process your Contact and Company Information for direct marketing purposes, such as, newsletters or customer satisfaction surveys. You can withdraw consent at any time by clicking the "unsubscribe" button in our communications or contacting the provided contact.
• Commercial Use of Personal Image: With your consent, we take and post close-up Personal Image of you on our company's social media accounts, websites, or other media for brand communication and sharing success stories. You can revoke your consent at any time under the conditions specified in the signed consent declaration form by reaching out to your contact person at PERI.

In addition, we may process your personal data as necessary to comply with legal obligations, including responding to data subject requests, fulfilling tax and accounting requirements, and asserting or defending our legal rights, as well as to prevent, detect, and pursue potential fraud or cyber-attacks.  We limit our collection and processing to what is adequate, relevant, and reasonably necessary in relation to the purposes disclosed in this Notice.

4. Cookies and Similar Technologies

In our online service, we use 'cookies'—a term that encompasses not only traditional small text files stored on your device but also other similar technologies, including pixel technology and log file analysis. These cookies and technologies collectively facilitate various functionalities and tracking capabilities during your visit to our site.

We categorize our cookies based on their necessity: essential cookies are critical for the technical operation of our service, while functional and marketing cookies are not. You can manage your consent for these non-essential cookies at any time through our cookie banner or cookie settings.

If you wish to deactivate all cookies, this can be done through your browser settings. However, be aware that doing so may impact the website's functionality. Deactivating cookies may restrict the capabilities of our online service since essential cookies are crucial for its technical operation.

4.1 Essential cookies

By "essential cookies', we refer to cookies that are essential for the technical functioning of an online service. These cookies enable websites to remember your preferences, such as language, font size on your computer or mobile device, and other browser settings. As a result, you do not need to reconfigure your preferences every time you visit the site. Conversely, without these cookies, websites would treat you as a new visitor each time you load a page. We process the personal data obtained through the essential cookies exclusively for the purpose of providing you with a fully functional online service based on our legitimate interests. Detailed information about each essential cookie can be found at: https://www.peri-usa.com/cookies.html.

4.2 Functional cookies

By 'functional cookies', we refer to cookies that are used to enhance the user experience and perform statistical analysis on an online service. These cookies are instrumental in integrating external services for location-based features, video/stream services, enriching the user interface and overall site functionality. They remember your preferences such as user name, language, or region, providing enhanced and more personal features. These cookies can also be used for services you have requested, like route planning or location-specific recommendations. The data collected through functional cookies may be anonymized, ensuring your browsing activity on other websites is not tracked. While these cookies are not essential for the basic functionality of the website, they play a crucial role in enriching your online experience. We process the personal data obtained through functional cookies based on user consent, aiming to provide a more personalized and improved online service. Detailed information about each of the functional cookies used is provided at: https://www.peri-usa.com/cookies.html.

4.3 Marketing cookies

By 'marketing cookies', we refer to cookies that are specifically used for marketing purposes and to tailor advertising to individual users on an online service. These cookies track and analyze user behavior across various websites to deliver targeted advertising based on user interests. They enable the collection of information about your browsing habits, helping advertisers to understand your preferences and present you with ads that are more relevant to you. Marketing cookies may also be used to limit the number of times you see an advertisement and help measure the effectiveness of advertising campaigns. While these cookies are not crucial for the functioning of the website, they play a significant role in providing customized marketing content that aligns with user interests. We process the personal data obtained through marketing cookies based on user consent, aiming to enhance the relevance and effectiveness of the advertisements presented to you. Detailed information about each of the marketing cookies used is provided at: https://www.peri-usa.com/cookies.html.  

5. Social Plugins and Social Media

At PERI, we enhance our Service with the integration of social plugins, such as social media icons and "like" buttons, from various social networks. These plugins are specifically designed to foster user interaction and engagement, ensuring smooth integration with popular social platforms. It's important to note that these plugins remain inactive by default and only become operational when you explicitly choose to activate them, giving you full control over the sharing of your data.
We strongly encourage you to first familiarize yourself with how these platforms use your data before activating the social plugins. This proactive approach ensures that you are well-informed about the data handling practices of the social platforms. Upon activation, the plugins enable the transmission of data, which may include details of your site visit, browser information, and other relevant metadata. Additionally, when you engage with our social media accounts via these platforms, similar data processing activities may occur. Please be aware that PERI does not have control over the operational mechanisms of these social plugins, the data collection by the social platforms, or their subsequent processing and use of this data. For detailed insights into the data usage policies of these social platform providers, we advise consulting their respective privacy policies, which are listed below for your reference and understanding.
Privacy Policy of Each Social Platform

• Facebook (Meta): https://www.facebook.com/privacy/policy/
• LinkedIn: https://www.linkedin.com/legal/privacy-policy
• Instagram: https://privacycenter.instagram.com/policy
• X (Twitter): https://twitter.com/en/privacy
• XING: https://privacy.xing.com/en/privacy-policy
• YouTube: https://policies.google.com/privacy?hl=en

6. Data Sharing and Transfers

• Disclosure to service providers: We work with PERI Group internal and external service providers, including payment services, IT support (including various IT services such as digital workplace solutions, ERP systems, and AI services for administrative support, e.g. translation), customer service agencies, warehousing service providers, marketing agencies, campaign organizers and repair companies, to provide you with the best and trouble-free services. They only have access to your personal data to the extent that this is necessary to fulfill their contractual obligations to us. Our service providers have been carefully selected and commissioned by us and are contractually bound. They will not process your personal data for any other purposes.
• Disclosure to third parties: Where we engage service providers to process personal data on our behalf, they act as our processors/contractors under written agreements that require confidentiality, security measures, and processing only on our documented instructions; they are prohibited from processing personal data for any other purpose.   We disclose your personal data to third parties only when necessary for the fulfillment of services requested by you. For instance, we may share your Contact and Company Information with logistics providers or product manufacturers to deliver or collect equipment and products. Your Transaction Information may be exchanged securely with payment providers, banks, or other financial institutions to process payments and credits. Additionally, your Event Participation Information may be shared with transportation or hospitality service providers to facilitate your travel arrangements. With prior alignment with you, we may register your Contact and Company Information to invite you to join customer, industry, or supplier networks. Your Contact and Company Information and other insurance-related documents may also be shared with insurers or brokers for the handling of insurance claims and refunds. In cases where local business follow-ups are required based on your request or interest, your Contact and Company Information may be shared with the relevant PERI Group company in your country to respond to your inquiry or interest in the best possible way. This may also include scenarios where one PERI Group company sells products or services on behalf of another PERI Group company, in which case your Contact and Company Information, User Account Information and Transaction Information may be shared with the relevant PERI Group company for order fulfillment, license registration, or service activation.
• Legal or regulatory disclosures: PERI may disclose your personal data to comply with the requirements of applicable laws and regulations, to respond to requests from regulatory authorities, courts or government agencies, or to assert or defend our legal rights.
• Cross-border transfer: Your personal data may be transferred to jurisdictions outside the territory defined by local data protection laws as constituting a 'cross-border' transfer. This could mean transfers outside a particular state or the United States, including to or outside of the European Economic Area (EEA). Such transfers will only occur when necessary or legally mandated, when you have provided explicit consent, and/or as part of our contractual obligations with you. We have implemented appropriate safeguards for these transfers, which include transfers to countries recognized as having an adequate level of data protection by the respective jurisdiction, the execution of data processing/sharing agreements based on model or standard contractual clauses, and other equivalent measures recognized or mandated by the respective jurisdiction, to ensure an adequate level of data protection.  Where our processing presents a heightened risk (e.g., targeted advertising or profiling with legal or similarly significant effects), we conduct appropriate assessments before commencing such activities.

7. Data Security

PERI is committed to protecting your personal data and takes all necessary technical and organizational measures to ensure an appropriate level of security. Our employees and service providers are contractually obliged to maintain confidentiality and comply with applicable data protection laws.
In particular, we implement a range of safeguards to protect your personal data from unauthorized access, loss, destruction, manipulation, or disclosure. These include, for example:

• Administrative measures such as internal data protection policies and regular employee training;
• Technical measures such as access controls and permission management, encryption of personal data, secure logging, antivirus software, and other IT security programs;
• Physical measures such as access restrictions to IT systems, server rooms, and data archives.

Our security practices are continuously improved in line with technological advancements. In the event of a data breach affecting personal information, we will provide notifications to affected individuals and regulators as required by applicable state laws and in accordance with our incident response procedures

8. Data Retention and Disposal

We will not retain your personal data for longer than is necessary to provide our goods and services, fulfill the purposes set out in this Privacy Notice, and comply with legal obligations. Unless exceptions apply for unforeseen dispute resolution or legal claims, this includes adhering to the following specific retention periods, which are regularly reviewed to ensure ongoing compliance and relevance:

• Contact and Company Information: This information is processed for the handling and documentation of the partnership and is retained, after termination of the partnership, for the duration of the applicable statutory commercial retention and record-keeping obligations.
• Transaction Information: Your Transaction Information is retained in accordance with accounting and taxation laws, as well as our Group-internal bookkeeping requirements.
• User Account Information: Your User Account Information will be deleted no later than 13 months after the termination of your use of our services. Information processed for logging and security audit purposes will be retained only as long as necessary for system operations and securely deleted upon system decommissioning.
• Website Usage and Technical Data: These data are primarily processed during your visits to our websites or services. For additional details regarding data retention and storage via cookies and similar technologies, please refer to Section 4.
• Personal Image: Your Personal Image processed with your consent will be retained in accordance with the conditions outlined in the consent declaration form, taking into full consideration legal requirements regarding portrait rights and copyrights. Event imagery, such as photos or videos taken during your participation in events (with best efforts to avoid personal identification), will be maintained and processed in line with the rotation concept for marketing materials and as disclosed in our on-site notification.
• Social Media Information: Social media posts and interactions will be processed in accordance with the terms and conditions of each respective social platform. For more information about privacy terms on these platforms, please refer to Section 5.
• Event Participation Information: Your Event Participation Information will be deleted once it is no longer required for post-event follow-up and no statutory retention or limitation periods apply.
• Payment Information: Your Payment Information will be deleted once it is no longer required in connection with our services or in connection with any particular laws or records retention policies and no statutory retention or limitation periods apply.  
• Geolocation Data: Your Geolocation Data will be deleted once it is no longer required in connection with our services or in connection with any particular laws or records retention policies and no statutory retention or limitation periods apply.  

9. Data Subject Rights

Should you wish to exercise your data rights, you can always contact us using the contact information provided in Section 1 of this Notice.
Depending on your state of residency, you may have certain rights regarding your personal data, including:  

• Right to access: You can request confirmation as to whether or which personal data concerning you is being processed and, if applicable, obtain a copy of the personal data processed about you and obtain a list of specific third parties to whom their personal data has been disclosed.
• Right to erasure ('Right to be forgotten'): You can have your data deleted under the conditions permitted by law. If we obtained personal data about you from a source other than you, we may comply with a deletion request, where permitted by applicable law, by retaining a record of the deletion request and the minimum data necessary to ensure your personal data remains deleted from our records and not using that retained data for any other purpose, or by opting you out of the processing of such personal data except as otherwise permitted by applicable law.
• Right to rectification: You can have your inaccurate data corrected and incomplete data completed.
• Withdrawal of consent: You can revoke a given consent to the processing of your personal data, without affecting the lawfulness of processing based on consent prior to its withdrawal.
• Right to object: You can object to the processing of your personal data under the conditions permitted by law.
• Right to restriction: You can ask us to restrict the processing of your personal data under the conditions permitted by law.
• Right not to be subject to automated decision-making: You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Please note that our current practices do not involve making such automated decisions, including profiling, but should this change, you will retain this right and be duly informed of any such processing.
• Right to opt out of personal information sales or sharing: We do not sell personal data; if that changes, we will provide a ‘Do Not Sell’ link and honor your opt-out.  
• Right to opt out of targeted advertising:  You may request that we do not sell or share your personal information for cross-context behavioral advertising purposes, including targeted advertising, sale of personal data and profiling.   
• Right to limit use of sensitive personal information: The collection, processing or sharing of sensitive data is done when strictly necessary to provide or maintain product or services requested by you.  “Sensitive data” may include personal data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life or sexual orientation, citizenship or citizenship status, and genetic or other personal data for uniquely identifying a person.  We will obtain your consent before collecting or processing sensitive data for purposes that require consent. You may withdraw your consent at any time by contacting us at privacy@peri-usa.com or calling us toll free at 1-888-533-0559; your withdrawal will not affect processing that occurred before the withdrawal.  You have the right to limit our use and disclosure of your sensitive personal information to uses necessary to perform services or provide goods you have requested, or for other purposes permitted under applicable law.
• Biometric Data: We do not collect, sell or transfer any biometric data.
• Right to data portability: You may obtain your personal data in a portable, readily usable format allowing transmission to another controller, where processing is carried out by automated means.

To exercise any of these rights, please contact us at privacy@peri-usa.com or call us toll free at 1-888-533-0559. If permitted by applicable law, you may also designate an authorized agent to submit a request on your behalf. Any request submitted by an authorized agent is subject to verification of your identity and the agent's authority to act for you, and we may require documentation demonstrating such authority and, where permitted by law, verification of your identity directly with us. If we maintain an Internet website, we also provide a mechanism on the website for you to submit requests for information required to be disclosed under applicable data privacy laws. We will respond to your request without undue delay, and in any event no later than 45 days after receipt of your request. If reasonably necessary, taking into account the complexity and number of your requests, we may extend the response period once by an additional 45 days; if we do so, we will inform you within the initial 45-day period of the extension and the reason for it. Information provided in response to a request will be provided free of charge twice during any 12-month period. If a request is manifestly unfounded, excessive, or repetitive, we may charge a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request, as permitted by applicable law. If we decline to take action on your request, we will inform you without undue delay, and no later than 45 days after receipt of the request, of the justification for declining to take action and instructions for how to appeal the decision pursuant to Section 12 below.
Please also note the following:

Do Not Track Disclosure: Some web browsers may transmit “Do Not Track” signals to websites and online services. Because there currently is no commonly accepted standard for how to interpret these signals, our websites do not respond to browser “Do Not Track” signals except as otherwise required by applicable law. However, as described above, we recognize and process opt-out preference signals, such as the Global Privacy Control (GPC), where required by applicable law.

Third-Party Online Tracking Disclosure: We allow certain third parties, such as advertising networks, data analytics providers, and social media platforms, to collect personally identifiable information and other online activity information through cookies, pixels, and similar technologies on our websites and online services. These third parties may collect information about your online activities over time and across different websites and online services when you use our websites or services.

Opt-Out Preference Signals (Including Global Privacy Control): When we detect a valid opt-out preference signal, such as the Global Privacy Control (GPC), we will treat it as a request to opt out of the sale and sharing of personal information for that browser or device and any consumer profile associated with that browser or device, including pseudonymous profiles. If we can reasonably associate the browser or device with your account or otherwise know your identity, we will also treat the signal as a request to opt out for you as a consumer. You can use an opt-out preference signal by enabling it in a supported browser or browser extension that is designed to communicate your opt-out choice automatically to websites you visit. We will honor a valid signal without requiring you to provide additional information beyond what is necessary to send the signal, although we may offer you the option to provide additional information if doing so would help us apply your opt-out choice beyond the browser or device level. We process opt-out preference signals (including GPC) in a frictionless manner. You can implement the signal through supported browsers or extensions. You may also opt out via our website link, email, or toll-free number.

10. Notice at Collection 

At or before the time we collect your personal information, we provide you with notice of the categories of personal information we collect and the purposes for which we use those categories of personal information. Where we intend to process sensitive personal data, we will provide a clear notice and obtain your prior consent before such processing. This Notice serves as our notice at collection. The specific categories of personal information we collect are described in Section 2 (Types of Data Collected and Processed), and the purposes for which we use your personal information are described in Section 3 (Purposes and Usage of the Data Processing).

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice and, where required by law, obtaining your consent.

11. How We Verify Requests to Know, Delete, Correct, and Access automated decision-making technology (ADMT) information

To help protect your personal information, we use a verification process before responding to requests to know, delete, correct, and, if applicable, requests to access information about our use of automated decision-making technology for significant decisions. Our verification process is designed to confirm that the request is being made by, or on behalf of, the correct person and may vary depending on the type of request, the sensitivity of the personal information at issue, and whether you maintain an account with us. Depending on the circumstances, we may ask you to provide information such as your name, email address, telephone number, mailing address, account information, or details about prior interactions with us that we can match against our records. If a request is submitted by an authorized agent on your behalf, we may require information and documentation sufficient to verify your identity and confirm the authorized agent's authority to act on your behalf. If we are unable to authenticate a request to exercise applicable privacy rights using commercially reasonable efforts, we are not required to comply with the request until you provide additional information reasonably necessary to authenticate your identity and request, and we will notify you accordingly. We are not required to authenticate an opt-out request, but we may deny an opt-out request if we have a good-faith, reasonable, and documented belief that the request is fraudulent. If we deny an opt-out request on that basis, we will send notice to the person who made the request stating that we believe the request is fraudulent, why we believe it is fraudulent, and that we will not comply with the request. If you submit a request through an authorized agent, we may also require proof of the agent's authority as described above. We will use information collected in connection with your request only for verification, request fulfillment, security, fraud prevention, and recordkeeping related to your request.

12. Appeal Process  

Depending upon the state/jurisdiction in which you reside, you may appeal our refusal to take action on a request, including those specified in section 9 (or elsewhere in this policy) by contacting us at privacy@peri-usa.com or calling us toll-free at 1-888-533-0559 and clearly indicating that you are appealing a prior decision. We will inform you in writing of any action taken or not taken in response to the appeal within 60 days of receipt. If the appeal is denied, we will provide you with an online mechanism, if available, or another method through which you may contact the applicable state attorney general or other authority designated by applicable law to submit a complaint, if applicable by law. California residents may use the request methods described above to exercise their rights under the CCPA, and this Notice does not create an appeal right beyond those provided by applicable California law.

13. Children's Privacy 

Our services are not intended for, and we do not knowingly collect any personal data from, children under the age of 16. If we learn that we have collected or received personal data from a child under 16 years old without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 16, please contact us at privacy@peri-usa.com. Parents or guardians may contact us to revoke a minor's consent.

14. Changes to this Notice

We reserve the right to update this Privacy Notice as necessary to align with operational, technical and legal changes. Should there be any material modifications that substantially impact the processing of your personal data, we will keep you informed through individual notification or by posting an updated Notice on this website. Historical versions of this Privacy Notice can be accessed by contacting us using the contact information provided in Section 1 of this Notice.

15.  Right to Non-Discrimination and Non-Retaliation

We will not discriminate or retaliate against you for exercising any of privacy rights, including by:

• Denying you goods or services.
• Charging you different prices or rates for goods or services.
• Providing you a different level or quality of goods or services.
• Suggesting that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Additional Specific State Notices and Information:
CALIFORNIA:  
If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with specific rights regarding your personal information. This section describes your CCPA rights and explains how to exercise those rights.

Categories of Personal Information We Collect
We collect the following categories of personal information from California consumers:

• Identifiers, such as name, postal address, email address, phone number, IP address, and online identifiers.
• California Customer Records information (Cal. Civ. Code § 1798.80(e)), such as name, address, telephone number, credit card number, and other financial information.
• Commercial information, such as records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
• Internet or other electronic network activity information, such as browsing history, search history, and information regarding your interaction with our websites, applications, or advertisements.
• Geolocation data, such as precise physical location from your device.
• Professional or employment-related information, such as current or past job history.
• Inferences drawn from any of the above information to create a profile about you reflecting your preferences, characteristics, behavior, and attitudes.

Categories of Sensitive Personal Information We Collect
We may collect the following categories of sensitive personal information from California consumers to the extent we use such information to infer characteristics about you:

• Account login credentials in combination with any required security or access code, password, or credentials allowing access to an account.
• Precise geolocation data that can identify your location within a radius of 1,850 feet.

Sources of Personal Information
We collect personal information from the following categories of sources:

• Directly from you, such as when you provide information through forms, account registration, or communications with us.
• Automatically from your devices and interactions with our websites, applications, and services, including through cookies and similar technologies.
• From third parties, such as service providers, business partners, data brokers, social media platforms, and publicly available sources.

Purposes for Collecting and Using Personal Information
We collect and use the categories of personal information described above for the following business and commercial purposes:

• To fulfill or meet the reason you provided the information, such as processing transactions, providing customer service, and fulfilling orders.
• To provide, support, personalize, and develop our websites, products, and services.
• To create, maintain, customize, and secure your account with us.
• To process your requests, purchases, transactions, and payments.
• To provide you with support and respond to your inquiries.
• To personalize your experience and deliver content and product offerings relevant to your interests.
• To improve our websites, products, and services.
• To conduct research, analytics, and data analysis.
• For testing, research, analysis, and product development.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets.
• To detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, and prosecute those responsible for that activity.
• To debug to identify and repair errors that impair existing intended functionality.
• As described to you when collecting your personal information or as otherwise set forth in the CCPA.

Disclosure, Sharing, and Sale of Personal Information.  Disclosure for Business Purposes: We may disclose the following categories of personal information to service providers and contractors for business purposes:

• Identifiers
• California Customer Records information
• Commercial information
• Internet or other electronic network activity information
• Geolocation data
• Professional or employment-related information
• Inferences

We disclose personal information to the following categories of service providers and contractors for business purposes: IT service providers, payment processors, shipping and logistics providers, customer service providers, marketing and advertising service providers, data analytics providers, and security and fraud prevention service providers.

Sharing for Cross-Context Behavioral Advertising: We may share the following categories of personal information with third parties for cross-context behavioral advertising purposes:

• Identifiers
• Internet or other electronic network activity information
• Geolocation data
• Commercial information
• Inferences

We share personal information for cross-context behavioral advertising with the following categories of third parties: advertising networks, data analytics providers, and social media platforms.

Sale of Personal Information: We do not personal information to third parties, including advertising networks, data brokers, and marketing partners.

Sensitive Personal Information: We use and disclose sensitive personal information only for purposes permitted under the CCPA, including to perform services requested by you, to prevent and detect security incidents, to resist malicious or illegal actions, to ensure physical safety, and for short-term transient use. We do not use or disclose sensitive personal information for purposes of inferring characteristics about you beyond these permitted purposes.

Minors Under 16: We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age.

Retention of Personal Information
We retain each category of personal information for as long as reasonably necessary to fulfill the purposes described in this Notice and as required by applicable law. The specific retention periods for each category are described in Section 8 (Data Retention and Disposal).

Your California Privacy Rights
As a California resident, you have the following rights under the CCPA:
Right to Know: You have the right to request that we disclose to you the following information covering the 12 months preceding your request:

• The categories of personal information we collected about you.
• The categories of sources from which the personal information was collected.
• The business or commercial purpose for collecting, selling, or sharing personal information.
• The categories of third parties to whom we disclose personal information.
• The specific pieces of personal information we collected about you.

Right to Delete: You have the right to request that we delete personal information that we collected from you, subject to certain exceptions.

Right to Correct: You have the right to request that we correct inaccurate personal information that we maintain about you.

Right to Opt-Out of Sales or Sharing: You have the right to opt out of the sale or sharing of your personal information. To exercise this right, you may:

• Click on the "Do Not Sell or Share My Personal Information" link on our website at [insert link].
• Email us at privacy@peri-usa.com.
• Call us toll-free at 1-888-533-0559.
• Submit an opt-out preference signal, such as the Global Privacy Control (GPC), through your browser. When we detect such a signal from your browser, we will process it as a request to opt out of sales and sharing for that specific browser on that specific device.

Right to Non-Discrimination and Non-Retaliation: You have the right not to receive discriminatory treatment or retaliation for exercising your CCPA privacy rights. We will not discriminate or retaliate against you for exercising any of your CCPA rights, including by:

•  Denying you goods or services.
• Charging you different prices or rates for goods or services.
• Providing you a different level or quality of goods or services.
•  Suggesting that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

How to Exercise Your California Privacy Rights
To exercise your rights to know, delete, or correct, please submit a request by:

• Calling us toll-free at 1-888-533-0559.
• Emailing us at privacy@peri-usa.com.

Authorized Agents: Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a request to know, delete, or correct related to your personal information. A consumer may also designate an authorized agent to act on the consumer's behalf to opt out of the processing of the consumer's personal data for targeted advertising or the sale of personal data, including by using a technology such as a link to an Internet website, an Internet browser setting or extension, or a global setting on an electronic device that communicates the consumer's intent to opt out. An authorized agent may submit a request on your behalf by using the same request methods listed above. If an authorized agent submits a request on your behalf, we may require the agent to provide proof of signed permission or other documentation showing authority to act on your behalf, and we may require verification of your identity directly with us where permitted by law. We will comply with an opt-out request received from an authorized agent if we are able to verify, with commercially reasonable effort, your identity and the authorized agent's authority to act on your behalf.

Verification and Proof of Authority: Before processing a request, we will take steps to verify the identity of the requestor and, where applicable, the authorized agent's authority to act on the consumer's behalf. The information we request for verification will depend on the type of request and the sensitivity of the information requested, and may include your name, email address, phone number, or other information we maintain about you. If the authorized agent provides a valid power of attorney pursuant to California Probate Code sections 4121 to 4130, we will process the request in accordance with California law and will not require additional signed permission from you in order for the agent to act on your behalf. We will use personal information collected in connection with a request only for verification, request fulfillment, and fraud prevention.

Response Timing: We will confirm receipt of your request within 10 business days and will respond to your request within 45 days of receipt. If we require more time (up to an additional 45 days), we will inform you of the reason and extension period in writing. To help protect your information, we will verify your identity before acting on a request. If you submit a request through an authorized agent, we may require proof of the agent’s authority and may ask you to verify your identity directly.

California "Shine the Light" Law: California Civil Code Section 1798.83 permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please contact us at privacy@peri-usa.com or by calling 1-888-533-0559.