For purposes of the California Consumer Privacy Act (“CCPA”) and California Privacy Rights Act (“CPRA”), in collecting the information described above, we collect the following categories of Personal Information:

CCPA/CPRA Category	Description
Identifiers	Name, email address, username, unique personal identifier (collected via Account Information, Social Media Information, Feedback, Support Inquiries, and Contact Us data)
Categories described in the California Customer Records statute	Name, email address, username, and unique personal identifier (collected via Account Information, Social Media, Cookies, and Usage Information)
Internet or other electronic network activity information	Webpages visited; location, IP address, browser, and device data collected via Cookies and Usage Information
Geolocation data	Your geolocation while using the Site, collected via Cookies, Location Information, and Usage Information
Audio, electronic, visual, thermal, olfactory, or similar information	Used as set forth in the Privacy Policy
Commercial information	Preferred method of contact and message content (collected via Contact Us Data)
Professional or employment-related information	Work email, phone, company name, and address (collected via Account Information and Contact Us Data)
Inferences	Derivations drawn from the above information to create a profile reflecting preferences, characteristics, and behavior

Sharing of Personal Information

We may share limited information to help ensure you receive useful and relevant ads and to measure their effectiveness. We will not share Sensitive Personal Information for cross-context behavioral advertising purposes. We do not “sell” Personal Information as that term is used in the CCPA.

For more information, see the Cookies and Similar Technologies section of the complete Echo360 Privacy Policy.

Consumer Privacy Rights

Right to Know: Request disclosure of Personal Information we have collected, used, disclosed, or sold
Right to Delete: Request erasure of certain Personal Information we have collected or maintained
Right to Correct: Request correction of inaccurate Personal Information
Right to Opt-Out: Direct us to stop sharing Personal Information with third parties for cross-context behavioral advertising
Right to Limit Use of Sensitive Personal Information
Non-Discrimination: We will not discriminate against you for exercising your privacy rights

To submit a request, use your Account Page or refer to the Contact Us section of the complete Echo360 Privacy Policy. We will respond within 45 days of receiving a verifiable request.

California Shine the Light

Under California Civil Code Section 1798.83, California residents may request information about Personal Information shared with third parties for direct marketing purposes once per calendar year. At present, we do not share your Personal Information with third parties for their direct marketing purposes. Contact us at privacy@echo360.com.

Residents of Colorado, Connecticut, Delaware, Florida, Iowa, Indiana, Montana, Nebraska, New Jersey, Oregon, Tennessee, Texas, Utah and Virginia

If you are a resident of one of these states (or any other state with applicable privacy law), you may have certain privacy rights, including:

Right to Delete: Request that we delete Personal Information we have collected from you
Right to Access: Request confirmation and access to your Personal Information in a portable, readily usable electronic format
Right to Correct: Request correction of inaccuracies in your Personal Information
Right to Opt-Out of the Sale of Data: We do not sell data to third parties
Right to Appeal: If we are unable to fulfill a request, you may submit an appeal within 14 days of our decision

To exercise these rights, refer to the Contact Us section of the complete Echo360 Privacy Policy.

Oregon Residents

If you are an Oregon resident, you have the right to request the identity of specific third parties to which your personal data has been disclosed, subject to certain conditions. Provide your name and contact information in your request, and we will respond in accordance with Oregon law.

Canada Residents

Canadian residents have privacy rights under the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial privacy laws. Contact us at privacy@echo360.com to exercise your rights or for more information.

EU / UK — GDPR

Echo360 is compliant with the General Data Protection Regulation (GDPR) and the UK GDPR. Our legal bases for processing personal data include contractual necessity, legitimate interests, legal obligation, and consent where required.

Your Rights Under GDPR

Right to access your personal data
Right to rectification of inaccurate data
Right to erasure (“right to be forgotten”)
Right to restriction of processing
Right to data portability
Right to object to processing based on legitimate interests
Right to withdraw consent at any time

Data Transfers

Where we transfer personal data outside the EEA or UK, we rely on appropriate safeguards including Standard Contractual Clauses (SCCs) approved by the European Commission and UK International Data Transfer Agreements (IDTAs).

Contact Our DPO

To exercise your rights or for questions about our EU/UK data practices, contact our Data Protection Officer at dpo@echo360.com.

Australia

Echo360 complies with the Australian Privacy Act 1988 and the Australian Privacy Principles (APPs). We handle personal information in accordance with these principles and our Privacy Policy.

Your Rights

Access your personal information we hold
Request correction of inaccurate or incomplete personal information
Complain about a breach of the APPs

Cross-Border Disclosure

We may disclose personal information to overseas recipients (including cloud infrastructure providers). Where we do, we take reasonable steps to ensure those recipients handle your information consistently with the APPs.

Contact Us

To access or correct your information, or to make a complaint, contact us at privacy@echo360.com. If your complaint is not resolved, you may contact the Office of the Australian Information Commissioner (OAIC).