You may have certain rights with respect to your Personal Information, in addition to any rights discussed elsewhere in this Policy. Please note your rights and choices vary depending upon factors like your location, your country/state of residence, and the type of Personal Information at issue.

HOW TO CONTROL YOUR MARKETING & COMMUNICATIONS PREFERENCES

We do not target survey Respondents with correspondence. We may send communications and marketing that may be of interest to our Customers.  If you do receive communications from us, you can stop receiving such promotional email communications, by clicking on the “unsubscribe” or similar link provided in such communications, by texting a reply of “STOP”, by adjusting your account settings to reflect your communications preferences, or by contacting us as described below. We make every effort to promptly process all unsubscribe requests.

STATE DATA PRIVACY LAWS 

California law requires us to provide California residents with certain specific information regarding how we collect, use, and share “Personal Information” as such term is defined in the California Consumer Privacy Act, as amended by the California Privacy Rights Act and its implementing regulations (“CPRA”) (collectively known as the “CCPA”)).  Following California’s passage of the CCPA, other states have passed similar data privacy laws, including the Virginia Consumer Data Protection Act (“VCDPA”), effective January 1, 2023; the Colorado Privacy Act (“CPA”), effective July 1,2023; the Connecticut Data Privacy Act (“CDPA”), effective July 1, 2023; and the Utah Consumer Privacy Act (“UCPA”), effective December 31, 2023, and other states continue to pass new privacy laws. 

For clarity and ease of reference, we may refer to CPRA, VCDPA, CPA, CDPA, and UCPA, or other state laws as they develop, collectively as “State Data Privacy Laws”. 

State Data Subject Requests 

If you are a resident of certain states, applicable State Data Privacy Laws require us to provide you with some additional information about your rights with respect to your “Personal Information” (as defined in CCPA and similar State Data Privacy Laws). Personal information does not include publicly available information from government records or de-identified or aggregate consumer information.  Specifically, certain State Data Privacy Laws provides you with the right to:

• know what Personal Information we collected about you during certain periods, including the categories of Personal Information, the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom we disclose Personal Information, and the specific pieces of Personal Information we collected about you;
• delete Personal Information that we collected from you, subject to certain exceptions;
• correct inaccurate Personal Information that we maintain about you;
• receive non-discriminatory treatment for the exercise of privacy rights conferred by CCPA or certain State Privacy Laws, including the right not to be retaliated against for the exercise of their rights described above or otherwise provided in CCPA and certain State Privacy Laws.
• opt-out of the sale or sharing of your Personal Information, to the extent we sell your Personal Information or share your Personal Information for the purposes of cross-context behavioral/targeted advertising; 

If you would like further information regarding your legal rights under CCPA or any other State Data Privacy Law or would like to exercise any of the rights available under such laws, please contact us as described in section 13 below.  We will honor the requests described above and otherwise available to you under applicable State Privacy Laws, but these rights do not always apply, and exemptions exist that may be relied upon in denying or only partially fulfilling your request. We may, in response to a request, ask you to verify your identity and/or provide information that helps us to better understand your request. If we do not comply with your request, we will explain why. 

Requests Submitted by Authorized Representatives.

You may submit a request through someone holding a valid Power of Attorney or an authorized agent acting on your behalf.  Authorized agents must have, and provide us with, written permission to make a request on your behalf and must provide necessary information to verify your own identity directly with us.  We will require any purported authorized agent to submit proof of authorization to make requests on your behalf.

No Sale or Sharing of Personal Information

CCPA and other State Data Privacy Laws sets forth certain obligations for businesses that “sell” Personal Information or “share” Personal Information for purposes of cross-context behavioral or targeted advertising as defined by the CCPA and applicable State Data Privacy Laws.  Upwave does not “sell” your Personal Information or “share” your Personal Information as defined by the CCPA and State Data Privacy Laws (in other words, we do not accept money or other things of value in exchange for your Personal Information or otherwise share your Personal Information for purposes of targeted advertising).

De-Identification

To the extent Upwave receives deidentified data that is subject to State Data Privacy Laws, we do not attempt to re-identify the information.

Categories of Personal Information, Purposes and Disclosures

Please see sections 1, 2, 3 & 4 above for more information about the categories of Personal Information we collect, and the sources, purposes and sharing of such Personal Information. In addition, we have provided a privacy snapshot chart (“Privacy Snapshot”) at the bottom of this Privacy Policy that provides you with a snapshot of the categories of Personal Information we have collected in the preceding 12 months, the sources of such collection, the categories of third parties we may share such Personal Information with for a business or commercial purpose, and the categories of third parties with whom we may sell or share such Personal Information (as is defined by State Privacy Laws).

ADDITIONAL INFORMATION FOR EEA AND UK RESIDENTS

If you are resident in the European Economic Area (“EEA”) or the United Kingdom (“UK”), you have the following rights, upon a verified request, with respect to your Personal Information that we hold:

• Right of access. You have the right to obtain:

(i) confirmation of whether, and where, we are processing your personal information;

(ii) information about the categories of personal information we are processing, the purposes for which we process your personal information and information as to how we determine applicable retention periods;

(iii) information about the categories of recipients with whom we may share your personal information; and

(iv) a copy of the personal information we hold about you.

• Right of portability. You have the right, in certain circumstances, to receive a copy of the personal information you have provided to us in a structured, commonly used, machine-readable format that supports re-use, or to request the transfer of your personal data to another person.

• Right to rectification. You have the right to obtain rectification of any inaccurate or incomplete personal information we hold about you without undue delay.

• Right to erasure. You have the right, in some circumstances, to require us to erase your personal information without undue delay if the continued processing of that personal information is not justified.

• Right to restriction. You have the right, in some circumstances, to require us to limit the purposes for which we process your personal information if the continued processing of the personal information in this way is not justified, such as where the accuracy of the personal information is contested by you.

• Right to object. You have a right to object to any processing based on our legitimate interests where there are grounds relating to your particular situation. There may be compelling reasons for continuing to process your Personal Information, and we will assess and inform you if that is the case. You can object to marketing activities for any reason.

Data Protection Authority. You also have the right to lodge a complaint to your local data protection authority. Further information about how to contact your local data protection authority is available at http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.