US State Privacy Notice

Effective Date: December 1, 2024

Certain states, including California, Colorado, Connecticut, Texas, Utah, and Virginia require additional information regarding our privacy practices and your privacy rights. Depending on whether you are a resident of those states (“Consumer”), we provide you additional notices about our privacy practices and consumer rights relating to your personal information or personal data, as defined under those laws (“Personal Information”).

Cumulocity GmbH, a corporation organized under the law of Germany, and its affiliates and subsidiaries, including Cumulocity, Inc. (collectively, “Cumulocity,” “we,” “us,” or “our”) provide this State Privacy Notice at Collection and Privacy Rights (the “State Privacy Notice”) to supplement the information contained in the Cumulocity Privacy Notice. Where we specifically identify certain states, these additional disclosures apply to residents in those states.

California, Colorado, Connecticut, Texas, Utah and Virginia Notice of Information Collected and/or Disclosed

The California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”) and privacy laws in Colorado, Connecticut, Texas, Utah, and Virginia afford consumers residing in those states certain rights with respect to their Personal Information. If you are a California resident, including a business contact of one of our vendors or other type of business which transacts with Cumulocity (collectively, “CA Business Contact”), or a Colorado, Connecticut, Texas, Utah, and Virginia resident, this section applies to you.

Collection And Use of Personal Information

We may collect Personal Information from you in a variety of different situations, including, but not limited to our websites, your mobile device, through email, in physical locations, through the mail, over the telephone, and/or in any other situation where we interact with you. More specifically, Cumulocity collects the following categories of Personal Information from its Consumers, which will depend on the particular Business Purpose for which we collect it.

What the law regulates	CA Business Contact	What Cumulocity does in terms of data collection and processing
Identifiers: A real name, alias, postal address unique personal identifier, online identifier, Internet Protocol address, phone number, email address, account name, date of birth, names of children who use club services, photos.	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, phone number, email address, account name.	To fulfill or meet the purpose for which you provided the information. For example, if you disclose your name and contact information to ask us a question or inquire about our products or services, we will use that Personal Information to respond to your inquiry. When you purchase a product or service, we may use your information to facilitate communication about that product, or service. If we seek to or do engage you as a vendor or other type of business relationship, we use your Personal Information to communicate about our potential, current, or former business relationship. To contact you and to inform you about products, services, promotions, special offers, and/or events that may interest you. To provide you information about our products and services, such as providing you updates and information about classes you have enrolled in To enable you to participate in online classes, training programs, or other events. To provide, support, personalize, and develop our Website, App, products, and services. To create, maintain, customize, and secure your account with us. To process your requests, purchases, transactions, and payments, and prevent transactional fraud. To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses. To personalize your Website experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our Website, App, third-party sites, and via email or text message (with your consent, where required by law). To help maintain the safety, security, and integrity of our Website, products and services, databases and other technology assets, and business. For research, analysis, and business development, including to develop and improve our Website, products, and services. To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations. As described to you when collecting your Personal Information or as otherwise set forth in the CCPA or other applicable state laws, or subsequently agreed to by you.
California Customer Records or similar information in states with applicable privacy laws: A name, signature, physical characteristics or description, address, telephone number, date of birth, financial account information, credit card number, debit card number, photos, medical, health, exercise, or sleep information.	Signature, business address, telephone number.	To fulfill or meet the purpose for which you provided the information. For example, if you disclose your name and contact information to ask us a question or inquire about our products or services, we will use that Personal Information to respond to your inquiry. When you purchase a product or service, we may use your information to facilitate communication about that product, or service. If we seek to or do engage you as a vendor or other type of business relationship, we use your Personal Information to communicate about our potential, current, or former business relationship. To contact you and to inform you about products, services, promotions, special offers, and/or events that may interest you. To provide you information about our products and services, such as providing you updates and information about classes, training programs or tutorials you have enrolled in. To enable you to participate in online classes, training programs, tutorials or other events To provide, support, personalize, and develop our Website, products, and services. To create, maintain, customize, and secure your account with us. To process your requests, purchases, transactions, and payments, and prevent transactional fraud. To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses. To personalize your Website experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our Website, App, third-party sites, and via email or text message (with your consent, where required by law). To help maintain the safety, security, and integrity of our Website, products and services, databases and other technology assets, and business. For research, analysis, and business development, including to develop and improve our Website, products, and services. To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations. As described to you when collecting your Personal Information or as otherwise set forth in the CCPA or other applicable state laws, or subsequently agreed to by you.
Protected classification characteristics under the applicable state privacy laws or federal law: Age, marital status, medical condition, physical disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), veteran or military status.	None.	Cumulocity does not collect or process Protected classification characteristics information.
Commercial information: Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	None.	To fulfill or meet the purpose for which you provided the information. To contact you and to inform you about products, services, promotions, special offers, and/or events that may interest you. To provide you information about our products and services, such as providing you updates and information about classes you have enrolled in. To provide, support, personalize, and develop our Website, products, and services. To create, maintain, customize, and secure your account with us. To process your requests, purchases, transactions, and payments, and prevent transactional fraud. To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses. To personalize your Website experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our Website, third-party sites, and via email or text message (with your consent, where required by law). To help maintain the safety, security, and integrity of our App or Website, products and services, databases and other technology assets, and business. For research, analysis, and business development, including to develop and improve our Website, products, and services. As described to you when collecting your Personal Information or as otherwise set forth in the CCPA or other applicable state laws, or subsequently agreed to by you.
Internet or other similar network activity: Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.	None.	To provide, support, personalize, and develop our Website, products, and services. To create, maintain, customize, and secure your account with us. To process your requests, purchases, transactions, and payments, and prevent transactional fraud. To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses. To personalize your Website experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our Website, third-party sites, and via email or text message (with your consent, where required by law). To help maintain the safety, security, and integrity of our Website, products and services, databases and other technology assets, and business. For research, analysis, and business development, including to develop and improve our Website, products, and services.
Geolocation data:Approximate physical location based on IP address.	None.	To fulfill or meet the purpose for which you provided the information. To provide you information about our products and services, such as providing you updates and information about classes you have enrolled in. To enable you to participate in online classes, training programs, tutorials or other events. To provide, support, personalize, and develop our Website, products, and services. To personalize your Website experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our Website, App, third-party sites, and via email or text message (with your consent, where required by law). As described to you when collecting your Personal Information or as otherwise set forth in the CCPA or other applicable state laws, or subsequently agreed to by you.
Audio, visual, or sensory data: Audio, visual, heart rate, pulse, and other activity data. Video recordings when you visit our facilities.	None.	Cumulocity does not collect Audio, visual, or sensory data.
Professional or employment-related information: Job title or related information.	Job title.	To fulfill or meet the purpose for which you provided the information. To create, maintain, customize, and secure your account with us. As described to you when collecting your Personal Information or as otherwise set forth in the CCPA or other applicable state laws, or subsequently agreed to by you.
Inferences drawn from other personal information: Profile reflecting a person’s preferences, characteristics, or behavior.	None.	To contact you and to inform you about products, services, promotions, special offers, and/or events that may interest you. To provide you information about our products and services, such as providing you updates and information about training or tutorials you have enrolled in. To provide, support, personalize, and develop our Website, products, and services. To personalize your Website experience and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our Website, third-party sites, and via email or text message (with your consent, where required by law). For research, analysis, and business development, including to develop and improve our Website, products, and services.
Sensitive Personal Information: Driver’s license, state identification card, or passport number; account log-in, financial account, debit card, or credit card number in combination with any required security or access code in order to process payments; racial or ethnic origin; Social Security Number, citizenship or immigration status, personal information collected and analyzed concerning a consumer’s health (including mental or physical health diagnosis); personal data collected from a known child, the contents of a consumer’s mail, email and text messages, unless the business is the intended recipient of the communication.	None.	Cumulocity does not collect Sensitive Personal Information.

We may collect the personal information that you provide about other individuals in certain cases. For example, we may collect information about other individuals from your contact list, with your permission, from your mobile device for the purposes of enabling you to easily share guest passes, event invitations, and more. By providing such information, you are representing that you have the required permissions and consents to disclose such information.

Personal Information does not include deidentified information or aggregate consumer information.

Sources of Personal Information

Cumulocity obtains the categories of Personal Information listed above from the following categories of sources:

Directly from you. For example, from forms you complete or products and services you purchase, or when you communicate with us about our ongoing business relationship.

Indirectly from you. For example, from observing your actions on our website or from information your computer or mobile device transmits when interacting with our website or mobile applications, among other things.

Retention of Personal Information

We will not retain your Personal Information for longer than is reasonably necessary to carry out the purposes we disclose in this policy.

Information Relevant to California and Other States

The CPRA requires that we notify you if we “Share” your Personal Information with third parties. For purposes of the CPRA, “Sharing” means that we make available or otherwise disclose your information to third parties for cross-context behavioral advertising, such as targeting of advertising to you based on your Personal Information obtained from your activity across businesses, websites, apps, and services other than our Services.

Similarly, Colorado, Connecticut, Texas, Utah, and Virginia requires that we notify you if we use your information for Targeted Advertising. “Targeted Advertising” means displaying advertisements to you where the advertisement is selected based on Personal Information obtained from your activities over time and across non-affiliated websites or online applications to predict your preferences or interests.

Accordingly, we “Share” and use your information for Targeted Advertising. Specifically, we disclose your identifiers and internet or other network activity with Service Providers.

Cumulocity also Shares your Personal Information with partner businesses for joint advertising, promotion and marketing (as described above) in California, Colorado, Connecticut, Texas, Utah, and Virginia. You have the option to opt-out of sharing or Targeted Advertising through this Privacy Notice.

Sales of Personal Information

California law provides for certain disclosures about Personal Information we “sell,” which means certain scenarios in which Cumulocity has disclosed Personal Information with third parties or affiliates, in exchange for valuable consideration, which could include situations where we “Share” your personal information as described above for cross-context behavioral advertising.

Sensitive Personal Information

Privacy laws in California, Colorado, Connecticut, Texas, Utah, and Virginia specify certain rights with respect to our collection of certain information those laws designate as “Sensitive Personal Information.” We obtain consent to collect that information in those states where consent is required. Moreover, each state’s privacy laws may consider different pieces of information to be “Sensitive Personal Information.” When we notify residents of certain states that we collect Sensitive Personal Information, that means that we collect Sensitive Personal Information within the meaning of the law of that particular state. We collect Sensitive Personal Information in California, Colorado, Connecticut, Texas, Utah, and Virginia. We collect the types of Sensitive Personal Information, to the extent included in your state’s definition, listed above in the Categories of Personal Information we collect. We do not use Sensitive Personal Information to infer characteristics about you.

Cumulocity does not collect Sensitive Personal Information.

Your Consumer Rights and Choices

Subject to certain limitations, depending on our state of residence, you have the right to (1) request to know more about the categories and specific pieces of Personal Information we collect, use, disclose, and sell, and to access your information, (2) request deletion of your Personal Information, (3) request correction of your Personal Information and (4) not be discriminated against for exercising these rights. If you are a Texas resident, you may have the right to receive a copy of the Personal Information that you have provided to us in a portable and, to the extent technically feasible, readily usable format.

Exercising Your Privacy Rights

To exercise the rights described above, please submit a verifiable consumer request to us by email to the following email address: dataprotection@cumulocity.com

Only you, or a person authorized to act on your behalf, may make a verifiable consumer request related to your Personal Information. If we receive your request from an authorized agent and they do not provide a valid power of attorney, we may ask the authorized agent to provide proof that you gave the agent signed permission to submit the request to exercise rights on your behalf. In the absence of a valid power of attorney, we may also require you to verify your own identity directly with us or confirm to us that you otherwise provided the authorized agent permission to submit the request.

Contact Information

You may appeal a decision relating to your consumer privacy rights request by contacting us by mail at Cumulocity GmbH, Toulouser Allee 25, 40211 Düsseldorf, Germany, or by email at dataprotection@cumulocity.com.

If you would like to submit a verifiable consumer rights request, please do so via one of the two designated methods described above. If you have concerns about the result of an appeal, you may contact the attorney general in the state where you reside.

Changes to Our State-Specific Privacy Notice

We may change this privacy notice from time to time. If we make changes to this privacy notice, we will notify you by revising the Effective Date at the top of this policy and in, in some cases, we may provide you with additional notice, such as adding a statement of notice on the App and Website or sending you a notification. We encourage you to review this policy regularly to stay informed about our information practices and the choices available to you.