Privacy Rights Notice (U.S.)

U.S. STATE PRIVACY RIGHTS NOTICE

Last Updated date: July 1, 2023

Plume Design, Inc. and its subsidiaries and affiliates (collectively, Plume or we ) provide this U.S. State Privacy Rights Notice (Notice) as a supplement to the Plume Privacy Policy and any other Plume privacy policy, notice or statement in which this Notice is linked or referenced.

DEFINITIONS

Throughout this Notice, we use the following terms with the following meanings:

• Business Purposes means performing the Plume Services; managing and processing interactions and transactions with Consumers; securing and debugging the Plume Services; advertising and marketing; quality assurance; research and development; and other business purposes as may be defined in CCPA from time to time.
• Consumer (or you) means an individual acting in a personal or household context who uses the Plume Services and individuals acting in a business-to-business context, such as authorized users of our Harvest Service. Consumers are a subset of "Customer," which are legal or natural persons that subscribe to or orders the Plume Services.
• Personal Information means information that identifies or can be used to identify an individual person.
• Plume Privacy Policy means the Plume Privacy Policy HERE.
• Plume Services means Plume's software, mobile applications (Plume Mobile Apps), hardware, Plume's user experience management platform and other related services that deliver smart home and enterprise-grade small business services built on self-optimizing WiFi technology.
• Processing means any operation (or set of operations), such as collecting, combining and storing, performed on personal information.
• U.S. Privacy Laws means the California Consumer Privacy Act (as amended by the California Privacy Rights Act) (CCPA); Colorado Privacy Act; Connecticut's Act Concerning Personal Data Privacy and Online Monitoring; Utah Consumer Privacy Act; and Virginia Consumer Data Protection Act; each as amended, repealed, consolidated or replaced from time to time.
• Vendors means service providers and processors that process personal information on behalf of Plume and contractors and other organizations with which Plume shares personal information pursuant to a contract for Business Purposes.

The terms CSP, Customer, Customer Network, Customer Network Equipment, HomePass Service, Mobile Device, Plume Services and WorkPass Service have the meanings given in the Plume Privacy Policy. Other capitalized terms used but not defined in this Notice have the meanings given to them in U.S. Privacy Laws.

This Notice also serves as our Notice at Collection for purposes of CCPA.

I. WHEN DOES THIS NOTICE APPLY?

This Notice covers the twelve (12) months prior to the "Last Updated" date above. This Notice is updated at least once per year. If this Notice conflicts with the Plume Privacy Policy, this Notice will govern as to Consumers, unless expressly stated otherwise. If Plume's processing materially changes between updates to this Notice, Plume will provide a supplemental notice when or before the changes apply.

II. TO WHICH PERSONAL INFORMATION PROCESSING DOES THIS NOTICE APPLY?

Plume collects personal information:

• directly from you (e.g., when you register for a HomePass account on plume.com)
• from your computer and Mobile Devices when you use the Plume Services
• from our affiliates
• from our service providers
• from public sources of data
• from other businesses or individuals.

Generally, Plume processes personal information to provide the Plume Services and as otherwise related to the operation of our business, including for Business Purposes. (See also Section V below.)

Plume also discloses personal information: to our Vendors; to you or to other third parties at your direction or through your actions; for the additional purposes explained at the time of collection (such as in the applicable privacy policy or notice); as required or permitted by applicable law; to the government or private parties to comply with law or legal process or protect or enforce legal rights or obligations or prevent harm; and as part of an acquisition, merger, asset sale or other transaction in which a third party assumes control over all or part of Plume's business. These disclosures are concluded in a context that is not a "sale" or "share" (as defined in the U.S. Privacy Laws).

Subject to restrictions and obligations under U.S. Privacy Laws, our Vendors may also use your personal information for Business Purposes and other approved purposes and may engage their own vendors to help perform services for us.

This Notice does not apply to Plume’s current and former employees and contractors as well as job applicants. Current and former employees, contractors and job applicants in California may request a copy of our Personnel Privacy Notice by contacting us at privacy@plume.com.

III. WHAT CATEGORIES OF PERSONAL INFORMATION DOES PLUME COLLECT FROM OR ABOUT CONSUMERS?

Plume may collect or receive (and may have collected or received during the 12-month period prior to the "Last Updated" date above) the categories of personal information listed below. (Not all categories are collected or received for every Consumer. Some personal information included in one category may overlap with other categories.)

• Personal Identifiers – Plume collects name, email address or other username, password, telephone number and similar contact information from or about Consumers making purchases through Plume's on-line store, Consumers who are users of a small business' Customer Network that allow the Customer Network administrator to identify who is connected to the Customer Network before access to the Customer Network is granted and other users of the Plume Services.

• Personal Records – Plume collects name, address, telephone number and financial purchase information. Some personal information included in this category may overlap with other categories.

• Personal Characteristics or Traits –In some circumstances, Plume receives personal information that receive special protections under U.S. law, such as age, gender and nationality. Plume only receives this category of personal information when a Consumer chooses to provide that information to Plume, which Plume will use for Business Purposes.

• Commercial Information – Plume collects purchase and transaction information, such as records of Plume products or services purchased or returned through Plume's on-line store, participation in promotional offers and product reviews or testimonials available on the Plume Services or offline. (Plume does not have access to complete bank account numbers, credit card numbers or debit card numbers. Payments for purchases are processed by third-party payment processors.) Plume also collects personal information from Consumers' internet-connected devices and services connected to a Customer Network when Consumers choose to use the Plume Command (Voice Assistant) feature to communicate with those devices. (Plume does not receive or process audio files.)

• Internet Usage Information – Plume collects Internet or other electronic network activity information when you interact with the Plume Services, including:

  • network addresses, Internet connections and operating statistics of Customer Network Equipment.
  • type, operating system and other identifying information about Customer Network Equipment and computers and Mobile Devices connected to a Customer Network.
  • Internet service provider name and Internet protocol (IP) address, Internet speeds and outages.
  • data about movement of computers and Mobile Devices while connected to Customer Networks.
  • log information from Customer Network Equipment, such as connected computers and Mobile Devices and their software and hardware versions and connection time.
  • Customer Network metadata, such as dynamic host configuration protocol fingerprint, hypertext transfer protocol user agent information, Universal Plug and Play discovery protocol and multicast domain name system discovery information related to identifying devices and IP addresses.
  • domain name system requests.
  • current and historical data transfer speeds and data amount consumed.
  • hostname and nicknames given to Customer Network Equipment and access points.
  • source and destination traffic headers, IP addresses, ports, size and counts of transferred bytes and packets, metadata from certificate handshake in a TLS / Https connection and DNS requests.
  • computers and Mobile Devices currently connected to a Customer Network.
  • how long a specific computer or Mobile Device is connected.
  • whether and which computer or Mobile Device was used to attempt access to a blocked domain.
  • motion in the home, which are collected as disruptions in Wi-Fi waves in the Customer Network and which collectively provide a pattern of motion and motion history.
  • metadata about time spent using various Internet applications that are accessed through the Customer Network.

• Sensory Data (audio, visual and similar information) – Plume collects audio information from interactions with Plume's customer service team. Plume also receives Consumers' profile photos when Consumers choose to share them, whether on the Plume Services or offline.

• Professional or Employment-Related Information – Plume collects professional or employment related information about Consumers who are users of the WorkPass Service and are personnel of Vendors and business partners, as well as other Consumers who choose to provide this category of information to Plume.

• Inferences from Personal Information – Plume collects inferences drawn from personal information to create a profile reflecting preferences, characteristics and behavior of Consumers who interact with Plume.

• Sensitive Personal Information – Plume generally does not collect personal information that is deemed sensitive under U.S. Privacy Laws.

Plume does not collect:

• Government Issued Identification Numbers (e.g., social security, driver's license, state identification card or passport number)
• Non-public Education Records as defined in Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99), i.e., education records directly maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, schedules, identification codes, financial information or disciplinary records
• Precise Geolocation, i.e., any data that is derived from a device and that is used or intended to be used to locate a consumer within a geographic area that is equal to or less than the area of a circle with a radius of 1,850 feet
• Communication Content (e.g., the contents of a consumer's mail, email and text messages, other than when Plume is the intended recipient of the communication)
• Genetic Data (the processing of genetic data to uniquely identify a natural person)
• Biometric Information (the processing of biometric information for the purpose of uniquely identifying a consumer)
• Health Information (personal information collected and analyzed concerning a consumer's health, medical history, mental or physical health, diagnosis/condition and medical treatment)
• Sex Life / Sexual Orientation (personal information collected and analyzed concerning a Consumer's sex life or sexual orientation)
• Children's Data (personal information collected from a known child)

Plume may collect other information that meets the definition of personal information under U.S. Privacy Laws but is not reflected by a category above. When this occurs, we treat the information as personal information as required by those laws but will not include it when we describe our practices in this Notice.

As permitted by applicable law, we do not treat deidentified data or anonymized Consumer information as personal information. We reserve the right to convert (or permit others to convert) personal information to deidentified or anonymous information and may elect not to treat publicly available information as personal information. We will not attempt to reidentify data that we maintain as deidentified data.

IV. WHAT ARE PLUME'S PERSONAL INFORMATION DISCLOSURE AND RETENTION PRACTICES?

Category of Personal Information Collected	Categories of Recipients	Retention Period
Personal Identifiers	Disclosures for Business Purposes: Vendors, such as data analytics, data security, ecommerce and marketing services providers, payment processors and consumer survey and research Business partners, such as the providers of the internet-connected devices and services that a customer chooses to connect to a Customer Network (e.g., Google Nest and Amazon Alexa). If you acquire the Plume Services through a CSP or reseller, Plume shares personal information with that CSP or reseller Other members of Plume's corporate group Law enforcement, government regulators and courts Other parties (e.g., professional advisors (accountants, lawyers), potential or actual acquirers or investors and their professional advisers in connection with any actual or proposed merger, acquisition or investment in or of all or any part of our business within the limits of Additional Business Purposes Sale/Share (as described in Section VI): CSPs that use the Plume Service known as Harvest. (Harvest is data-driven network insight and campaign automation software.)	We retain your personal information for as long as Plume has a legitimate purpose for retention. Unless stated otherwise, we retain personal information for as long as your account or the account with which your device(s) are linked (Plume Accounts) is active and for 12 months after the date that the Plume Account is deleted or after the date of last activity associated with the Plume Account. After this 12-month period, Plume retains personal information for two (2) years thereafter or, if longer, as required or permitted under applicable law.
Personal Records	Same as immediately above	We retain your personal information for as long as Plume has a legitimate purpose for retention. Unless stated otherwise, we retain personal information for as long as the Plume Account is active and for 12 months after the date that the Plume Account is deleted or after the date of last activity associated with the Plume Account. After this 12-month period, Plume retains personal information for two (2) years thereafter or, if longer, as required or permitted under applicable law.
Commercial Information	Disclosures for Business Purposes: Vendors, such as data analytics, data security, ecommerce and marketing services providers, payment processors and consumer survey and research Business partners, such as the providers of the internet-connected devices and services that a customer chooses to connect to a Customer Network (e.g., Google Nest and Amazon Alexa). If you acquire the Plume Services through a CSP or reseller, Plume shares personal information with that CSP or reseller Other members of Plume's corporate group Law enforcement, government regulators and courts Other parties (e.g., professional advisors (accountants, lawyers), potential or actual acquirers or investors and their professional advisers in connection with any actual or proposed merger, acquisition or investment in or of all or any part of our business within the limits of Additional Business Purposes Sale/Share (as described in Section VI): CSPs that use the Plume Service known as Harvest. (Harvest is data-driven network insight and campaign automation software.)	We retain your personal information for as long as Plume has a legitimate purpose for retention. Unless stated otherwise, we retain personal information for as long as the Plume Account is active and for 12 months after the date that the Plume Account is deleted or after the date of last activity associated with the Plume Account. After this 12-month period, Plume retains personal information for two (2) years thereafter or, if longer, as required or permitted under applicable law.
Internet Usage Information	Same as immediately above	We retain your personal information for as long as Plume has a legitimate purpose for retention. Unless stated otherwise, we retain personal information for as long as the Plume Account is active and for 12 months after the date that the Plume Account is deleted or after the date of last activity associated with the Plume Account. After this 12-month period, Plume retains personal information for two (2) years thereafter or, if longer, as required or permitted under applicable law.
Sensory Data (audio, visual and similar information)	Disclosures for Business Purposes: Vendors, such as data analytics, data security, ecommerce and marketing services providers, payment processors and consumer survey and research Business partners, such as the providers of the internet-connected devices and services that a customer chooses to connect to a Customer Network (e.g., Google Nest and Amazon Alexa). If you acquire the Plume Services through a CSP or reseller, Plume shares personal information with that CSP or reseller Other members of Plume's corporate group Law enforcement, government regulators and courts Other parties (e.g., professional advisors (accountants, lawyers), potential or actual acquirers or investors and their professional advisers in connection with any actual or proposed merger, acquisition or investment in or of all or any part of our business within the limits of Additional Business Purposes Sale/Share (as described in Section VI): CSPs that use the Plume Service known as Harvest. (Harvest is data-driven network insight and campaign automation software.)	We retain your personal information for as long as Plume has a legitimate purpose for retention. Unless stated otherwise, we retain personal information for as long as the Plume Account is active and for 12 months after the date that the Plume Account is deleted or after the date of last activity associated with the Plume Account. After this 12-month period, Plume retains personal information for two (2) years thereafter or, if longer, as required or permitted under applicable law.
Professional or employment-related information	Same as immediately above	We retain your personal information for as long as Plume has a legitimate purpose for retention. Unless stated otherwise, we retain personal information for as long as the Plume Account is active and for 12 months after the date that the Plume Account is deleted or after the date of last activity associated with the Plume Account. After this 12-month period, Plume retains personal information for two (2) years thereafter or, if longer, as required or permitted under applicable law.
Inferences from personal information	Same as immediately above	We retain your personal information for as long as Plume has a legitimate purpose for retention. Unless stated otherwise, we retain personal information for as long as the Plume Account is active and for 12 months after the date that the Plume Account is deleted or after the date of last activity associated with the Plume Account. After this 12-month period, Plume retains personal information for two (2) years thereafter or, if longer, as required or permitted under applicable law.

As required by California law, the table above includes Plume's general retention rules by personal information category. Actual retention periods may, however, vary because each category has several types of personal information and uses. We retain specific pieces of personal information for as long as we have a legitimate purpose for doing so.

V. HOW DOES PLUME USE AND DISCLOSE PERSONAL INFORMATION - BY PROCESSING PURPOSE?

Business Purposes: Plume uses and discloses personal information for Business Purposes which are:

1. Performing services

• Operate the Plume Services for Plume's business customers: enable Customer Network administration, such as by offering tools for administrators to manage access, security and confidentiality policies, blocking content identified as inappropriate in accordance with content filters set by the Customer Network administrator and generating live motion visuals and motion history for Customer Networks; schedule network optimizations and firmware updates for Customer Network Equipment
• Account management: create user accounts and verify user identity for the Plume Services.
• Customer Support: provide customer support and respond to customer requests and similar customer services related to the Plume Services.
• Communicate about the Plume Services: send you emails and electronic newsletters and push notifications to communicate with you about your use of the Plume Services and provide you with special offers or promotions.
• Process orders: process or fulfill an order or transaction through the Plume Store, track customer support, billing and account management.
• Contact You: contact you about your use of the Plume Services and, in our discretion, changes to the Plume Services or our policies.
• Payment and other purchase-related purposes: to facilitate a purchase made using the Plume Services, including payment.

2. Managing Interactions and Transactions: auditing related to counting ad impressions to unique visitors to Plume's marketing websites, auditing compliance with user interaction or transaction specifications and standards; offering data analytics tools that enable Customers to match and augment their own data sets with data generated by Customer Networks to improve audience segments and marketing, identify and analyze trends and create better advertising campaigns related to the Plume Services.

3. Security: to protect the security of the Plume Services and its users; identify security threats (e.g., malicious Internet locations or websites) and activity that may indicate unauthorized use of Customer Networks; detect and prevent fraud; prevent, investigate and/or report security incidents.

4. Debugging: identify and repair errors that impair existing intended functionality of the Plume Services.

5. Advertising & Marketing: conduct marketing about the Plume Services or related third-party products and services (where permitted); determine where and how to advertise and the success of advertising campaigns; conduct promotional activities and serve specific content and offers that are relevant to/customized for you (e.g., pricing and discounts based on your profile and shopping history).

6. Quality Assurance: verify or maintain the quality or safety of the Plume Services and improve, upgrade or enhance the Plume Services; analyze, measure the effectiveness of and improve the Plume Services.

7. Processing Interactions and Transactions: short-term, transient use, such as non-personalized advertising shown as part of a Consumer's current interaction with Plume and use of the Plume Services' features and functionality (e.g., transactions in the Plume Store).

8. Research & Development: research and analytics to better understand how users access and use the Plume Services, both on an aggregated and individualized basis and improve the Plume Services; administer market research and customer satisfaction surveys; respond to user preferences and for other research and analytical purposes; identify customer needs and develop new products and services to meet them; invite customers and others to participate in testing of current and new features or products; create statistical analyses and segment and combine data sets to identify trends. Plume also undertakes content filtering to block information deemed inappropriate according to the profile.

Additional Business Purposes. Plume uses and discloses personal information for the following:

• comply with applicable laws: to comply with legal obligations, as part of our general business operations and for other business administration purposes and in response to legal obligations or process.
• prevent illegal activities, fraud, injury to others, or violation of our terms and policies: to investigate, prevent or act if someone is or may be using information for illegal activities, fraud or in ways that may threaten someone's safety or violate our terms or this Notice.
• exercise our rights under contract: enforce Plume's customer contracts and other legal agreements and investigate actual or suspected violations of our legal agreements.
• protect legal rights: protect the safety, security and legal rights of customers and users of the Plume Services.
• monitor the service: detect, prevent and remediate fraud or other unlawful behavior, security issues and other technical issues related to the Plume Services.
• for related or compatible purposes: for purposes that are related to and/or compatible with any of the foregoing purposes.

For purposes disclosed at personal information collection: Plume may provide additional disclosures at the time of personal information collection.

Commercial Purposes: Plume uses and discloses personal information for strategic partnerships, such as with manufacturers of Plume SuperPods and routers and providers of complementary service offerings.

VI. WHAT PRIVACY RIGHTS ARE AVAILABLE AND HOW CAN YOU EXERCISE THEM?

1.Privacy Rights

Subject to our verification requirements, Plume provides Consumers with the privacy rights described in this section VI. For residents of states without privacy rights, Plume will consider requests but will determine in its sole discretion how to process those requests.

To submit a privacy rights request or to submit a request as an authorized agent, use Plume’s U.S. Privacy Request Form or email us at privacy@plume.com. You also may call us at 844-MY PLUME (844-697-5863). Plume does not accept or process requests through other means (e.g., via fax).

(a) Right to Access/Know

Residents of California, Virginia and Colorado are entitled to access personal information up to twice per 12-month period. Residents of Connecticut and Utah are entitled once every 12-month period to access personal information maintained by Plume. Plume may choose to provide you with access to personal information more often but a service fee may apply to these subsequent requests.

(1) Categories of Personal Information

California residents have a right to submit a request for any of the following for the 12-month period prior to the request date:

• The categories of personal information we collect from or about you or otherwise process.
• The categories of sources from which your personal information was collected.
• Plume's business purposes or commercial purposes for collecting and (if applicable) selling or sharing your personal information.
• The categories of third parties to which Plume disclosed your personal information.
• A list of the categories of personal information disclosed for a Business Purpose and, for each, the categories of recipients or that no disclosure occurred.
• A list of the categories of personal information Sold or Shared (each as defined below) about you and, for each, the categories of recipients or that no Sale or Share occurred.

(2) Specific Pieces of Personal Information

You may request to confirm if we are processing your personal information and, if we are, to obtain a transportable copy (subject to applicable request limits) of your personal information that we have collected and are maintaining. For your specific pieces of personal information, as required by applicable U.S. Privacy Laws, Plume will apply the heightened verification standards as described below. We have no obligation to re-identify information or to keep personal information longer than we need it or are required to by applicable law to comply with access requests.

(b) Right to Delete

You may request that Plume delete your personal information unless Plume has a basis for retaining it under applicable law. Depending on where you reside (e.g., California or Utah), Plume may not have the obligation to delete your personal information that we did not collect directly from you.

(c) Right to Correct Personal Information

You have the right to request that we correct inaccuracies that you find in the personal information about you maintained by us. You also can make certain changes to your online account (e.g., name and password) in the account settings section of the account. Changing your account settings will not, however, change your personal information that exists in other places.

(d) Do Not Sell / Share / Target

U.S. Privacy Laws have broad and differing concepts of Selling personal information for which an opt-out is required. California also has an opt-out from Sharing for Cross-Context Behavioral Advertising (i.e., use of personal information from different businesses or services to target advertisements). Other states have an opt-out of Targeted Advertising (defined differently but also addressing tracking, profiling and targeting of advertisements). Plume may Sell or Share your personal information and/or use your personal information for Targeted Advertising, as these terms apply under U.S. Privacy Laws. Plume does, however, provide Consumers an opt out of Sale/Sharing/Targeting that is intended to combine these state opt-outs into a single opt-out available regardless of state of residency.

Third-party digital businesses may associate cookies and other tracking technologies that collect personal information about you on the Plume Services or otherwise collect and process personal information that we make available about you, including digital activity information. We understand that giving access to personal information on the Plume Services or otherwise to a third-party digital business could be deemed a Sale and/or Share under some U.S. Privacy Laws. Plume will treat that personal information (e.g., cookie ID, IP address and other online IDs and internet or other electronic activity information) collected by a third-party digital business, which is not limited to acting as our Service Provider (or Contractor or Processor) as a Sale and/or Share and subject to a Do Not Sell/Share/Target opt-out request. We will not Sell your personal information, Share your personal information for Cross-Context Behavioral Advertising or process your personal information for Targeted Advertising if you make a Do Not Sell/Share/Target opt-out request.

Opt-out for non-cookie personal information: If you want to limit our processing of your non-cookie personal information (e.g., your email address) for Targeted Advertising or opt-out of the Sale/Sharing of such data, make an opt-out request as described below.

Opt-out for cookie personal information: If you want to limit our Processing of your cookie-related personal information for Targeted Advertising or opt-out of the Sale/Sharing of that personal information, you need to exercise a separate opt-out request on our cookie management tool by clicking on the "Cookies" link in the footer of www.plume.com. This is because we use different technologies to apply preferences for opting out of cookie personal information vs. non-cookie personal information. Our cookie management tool enables you to exercise an opt-out request and enable certain cookie preferences on your browser / device. You must exercise your preferences on the Plume Services that you use and from each browser you use and on each device that you use. Since your browser opt-out is designated by a cookie, if you clear or block cookies, your preferences are no longer effective and you must enable them again by clicking on the "Cookies" link in the footer of www.plume.com. Please also refer to our Cookie Policy for other ways to exercise preferences regarding cookies. If you use ad blocking software, our cookie banner may not appear when you visit the Plume Services and you may need to use the link above to access the cookie preference tools.

We do not knowingly Sell or Share the personal information of Consumers under age 16, unless we receive affirmative (opt-in) authorization from either the Consumer who is between age 13 and 16 or the parent or guardian of a Consumer who is less than 13 years old. If you think Plume may have unknowingly collected personal information of a Consumer under age 16, please contact us using the information in How to Contact Plume.

Plume may disclose your personal information for the following purposes (which are not a Sale or Share): (i) if you direct Plume to disclose personal information; (ii) to comply with any Consumer rights request you submit to Plume; (iii) disclosures among the entities that constitute Plume or as part of a corporate transaction; and (iv) as otherwise required or permitted by applicable law.

(e) Right to Limit Sensitive Personal Information Processing (if/when applicable)

Plume does not require that you provide sensitive personal information (as defined in U.S. Privacy Laws) to use the Plume Services. If you provide us with sensitive personal information, you have consented to Plume’s processing of the sensitive personal information for the purpose for which you provided it. You may also have certain privacy rights related to your sensitive personal information. Please contact us at privacy@plume.com.

(f) Automated Decision Making/Profiling (if/when applicable)

If Plume engages in processing that may constitute Automated Decision Making or Profiling under U.S. Privacy Laws, you have the right to opt-out of certain types of Automated Decision Making or Profiling processing. Currently, Plume does not engage in these activities.

2.How to Exercise Privacy Rights

To submit a request to exercise your Consumer privacy rights or to submit a request as an authorized agent, visit Plume’s U.S. Privacy Request Form, call us at 844-MY PLUME (844-697-5863) or email us at privacy@plume.com. Please check for and respond to any follow-up inquiries we make. Please be aware that we do not accept or process requests through other means (e.g., via fax).

3.Verification of Privacy Rights Requests

We may ask you to provide verifying information, such as your name, email, telephone number and/or account information, before we act on your request. We will review the information provided and may request additional information. We will not fulfill your Right to Know (Categories), Right to Know (Specific Pieces), Right to Delete or Right to Correction request unless you have provided sufficient information for us to reasonably verify you are the Consumer about whom we collected personal information. We do not verify opt-outs of Sell/Share/Target or Limitation of Sensitive personal information requests unless we suspect fraud.

We verify each request as follows:

• Right to Access/Know (Categories): We verify your Request to Access/Know categories of personal information to a reasonable degree of certainty. If we cannot do so, we will refer you to this Notice for a general description of our privacy practices.
• Right to Access/Know: We verify your Request To *Access/*Know specific pieces of personal information to a reasonably high degree of certainty. If you fail to provide requested information, we will be unable to verify you sufficiently to honor your request, but we will then treat it as a Right to Know Categories Request if you are a California resident.
• Do Not Sell/Share/Target: No specific verification required unless we suspect fraud.
• Right to Delete: We verify your Request to Delete to a reasonable degree of certainty or to a reasonably high degree of certainty depending on the sensitivity of the personal information and the risk of harm to the Consumer posed by unauthorized deletion. If we cannot verify you sufficiently to honor a deletion request, you can still make a Do Not Sell/Share/Target request.
• Correction: We verify your Request to Correct Personal Information to a reasonable degree of certainty depending on the sensitivity of the personal information and the risk of harm for unauthorized correction.

To protect Consumers, if we are unable to verify a privacy rights request, we are unable to honor the request. We will use personal information provided in a verified privacy rights request only to verify identity or authority to make the privacy rights request and to track and document responses unless Plume also received the personal information for another purpose.

4.Agent Requests

You may use an authorized agent to make a privacy rights request for you. Before you can authorize an agent, Plume requires that you complete and submit this Authorized Agent Authorization Form or call us at 844-MY PLUME (844-697-5863). We also may require you directly confirm that you authorized the agent to submit the request. Once confirmed, your Authorized Agent may exercise privacy rights on your behalf, subject to the requirements of applicable law.

5.Appeals

You may appeal Plume's decision regarding a request by email at legal@plume.com. Please use the same email address that you used to submit the initial privacy rights request to submit your Request to Appeal and please add “Request to Appeal” in the subject line of the email. If you do not use the same email address, Plume cannot link your Request to Appeal to your initial privacy rights request.

6.Plume's Responses

Some personal information that we maintain is insufficiently specific for us to be able to associate it with a verified Consumer (e.g., data tied only to a pseudonymous browser ID). We do not include that personal information in response to those requests. If we deny a request, in whole or in part, Plume will explain the reasons in our response.

Plume will make commercially reasonable efforts to identify personal information that we process to respond to a privacy rights request. In some cases, particularly with voluminous and/or typically irrelevant data, we may suggest you receive the most recent or a summary of your personal information and give you the opportunity to elect whether you want the rest. We reserve the right to direct you to where you may access and copy responsive personal information yourself. We will typically do not charge a fee to fully respond to your requests; provided, however, that we may charge a reasonable fee or refuse to act upon a request, if your request is excessive, repetitive, unfounded or overly burdensome. If we determine that the request warrants a fee or that we may refuse it, we will give you notice explaining why we made that decision. You will be provided a cost estimate and the opportunity to accept such fees before we will charge you for responding to your request.

VII. WHAT ELSE DO CONSUMERS NEED TO KNOW?

1. Non-Discrimination / Non-Retaliation

Plume will not discriminate or retaliate against you in a manner prohibited by applicable U.S. Privacy Laws for your exercise of your Consumer privacy rights. We may charge a different price or rate or offer a different level or quality of good or service, to the extent that doing so is reasonably related to the value of the applicable personal information.

2. Notice of Financial Incentive Programs

Plume does not currently offer discounts or other rewards to Consumers in exchange for personal information. If we do in the future offer these types of incentives, we will provide notice and obtain consent as required by applicable law.

3. Our Rights and the Rights of Others

Plume may collect, use and disclose your personal information as required or permitted by applicable law, which may override your rights under U.S. Privacy Laws. Plume is not required to honor requests if doing so would infringe Plume's or another party's rights or conflict with applicable law.

4. California Shine the Light Law

Plume does not share "personal information," as defined by California's "Shine the Light" law, with third parties for those third parties own direct marketing purposes. California residents may opt-out of this sharing by contacting us at privacy@plume.com or 325 Lytton Ave, Suite 200, Palo Alto, CA 94301 (Attn: Privacy).

Please add the statement "Shine the Light Request" in the subject line and in the body of your correspondence. Please also attest to the fact that you are a California resident and provide a current California address for your response. This right is available in addition to CCPA rights and requires a separate request. The Do Not Sell/Share/Target opt-out is broader and will limit our sharing with third parties for their own direct marketing purposes without the need for making a separate Shine the Light request.

Plume will not accept Shine the Light Requests by telephone or by fax and is not responsible for Shine the Light Requests not properly labeled or sent or that are incomplete.

VII. HOW TO CONTACT PLUME

If you have any questions, comments or concerns about our privacy practices, please contact us by email at privacy@plume.com, call us at 844-MYPLUME (844-697-5863) or visit HERE. (Email communications are not necessarily secure so please do not include sensitive information in an email.)