SupplyOn-Websites – California Annex

Categories of Personal Information	1. Identifiers (e.g., name, postal address, unique personal identifiers, online identifiers, IP address, email address) 2. Personal information categories listed in the California Customer Records statute (e.g., name, signature, address, telephone number) 3. Internet or other electronic network activity information (e.g., usage information, computer and connection information, the IP address of your internet service provider or proxies, the session cookies, the web browser used, the website you are visiting from, the pages you visit on our site, the date and time of access, the amount of data transferred and the access status)
Sources of Information	– Directly from individuals – Third parties (e.g., companies with which you or your company have entered into a contractual relationship and wish to communicate with you using the SupplyOn platform).
Business Purpose for which Personal Information was Collected/Used	– Identify you and manage our relationship with you, including communicate with you, deliver products/services and related information to you, meet compliance obligations, and manage safety – Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity – Performing services, including maintaining or servicing accounts, providing customer service, verifying customer information, or marketing services, conducting Web analytics, or similar services – Undertaking internal research for technological research and development – Undertaking activities to verify or maintain the quality or safety of a service or to improve, upgrade, or enhance the service, owned or controlled by the business – Debugging to identify and repair errors that impair existing intended functionality
Categories of Third Parties to with Whom the Personal Information is Disclosed	– Vendors, service providers, and other partners who support our business, such as providing technical infrastructure services – Subsidiaries, affiliates, and other entities controlled by SupplyOn – Other third-party service providers that process Personal Information on behalf of SupplyOn

In addition to the purposes identified above, we may also use and share the categories of Personal Information when doing so is necessary to:

• Comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies.
• Protect our customers, for example to prevent attempts to defraud users of our services, or to help prevent the loss of life or serious injury of anyone; or
• Operate and maintain the security of our products, including preventing or stopping an attack on our computer systems or networks.
• Otherwise disclose in accordance with directions from you.

 Data Retention: SupplyOn retains Personal Information for as long as necessary to provide the services you have requested, comply with our legal obligations, resolve disputes, enforce our agreements, and other legitimate and lawful business purposes as listed in the General Privacy Notice. Due to the varying purposes, actual retention periods may differ based on criteria such as user /vendor relationships, and our legal or contractual obligations. For more information on our retention schedules, please contact the SupplyOn Data Privacy team at: dpo@supplyon.com.

Section 2. Does SupplyOn Sell or Share My Personal Information?

Under the CCPA and CPRA, “Sell,” “selling,” “sale,” or “sold,’’ means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s Personal Information by the business to a third party for monetary or other valuable consideration, unless:

• A consumer uses or directs the business to intentionally disclose Personal Information or interact with one or more third parties.
• The business uses or shares an identifier for a consumer who has opted out of the sale of the consumer’s Personal Information or limited the use of the consumer’s sensitive Personal Information for the purposes of alerting persons that the consumer has opted out of the sale of the consumer’s Personal Information or limited the use of the consumer’s sensitive Personal Information.
• The business transfers to a third party the Personal Information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other similar transaction.

“Share,” “shared,” or “sharing” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s Personal Information by the business to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration, including transactions between a business and a third party for cross-context behavioral advertising for the benefit of a business in which no money is exchanged, unless:

• A consumer uses or directs the business to intentionally disclose Personal Information or intentionally interact with one or more third parties.
• The business uses or shares an identifier for a consumer who has opted out of the sharing of the consumer’s Personal Information or limited the use of the consumer’s sensitive Personal Information for the purposes of alerting persons that the consumer has opted out of the sharing of the consumer’s Personal Information or limited the use of the consumer’s sensitive Personal Information.  
• The business transfers to a third party the Personal Information of a consumer as an asset that is part of a merger, acquisition, bankruptcy, or other similar transaction.

We have not sold or shared your Personal Information in the preceding twelve (12) months and will not sell or share your Personal Information to third parties

Section 3.  What Rights Do I Have Under the CCPA and CPRA?

You may have rights under the CCPA and CPRA. The CCPA and CPRA grant consumers certain rights regarding Personal Information that relates to them.

As regards SupplyOn B2B consumers, the rights under the CCPA and CPRA include:

• Right to Opt-Out of Sale of Personal Information – The right to direct the business to not sell your Personal Information.
• Right of Non-Discrimination – The right to not be discriminated against for exercising your rights under the CCPA and CPRA. 

Section 4. How Do I Assert a Right Under the CCPA and CPRA?

You may exercise your right(s) under the CCPA and CPRA by using one of the following methods:

• Online: Contract Questions Form under https://contact.supplyon.com
• Email: dpo@supplyon.com  
• Telephone:  1.866.787.7596 (free of charge)

If submitting by email, please be sure to include what right(s) you are seeking to assert and provide what data or information your request is concerning so that your request can be properly and timely addressed.

Since we can only respond to a verified request, we may request information from you to confirm that you, or an authorized agent designated by you, are the one exercising your right as a consumer. We may request that you send your request through your account (if you have an account) or we may ask certain security questions to verify your identity before we respond to your request. You do not need to create an account with SupplyOn to exercise any of your individual rights.

Section 5. Who Can I Contact for Additional Information?

You can email SupplyOn Data Privacy team at: dpo@supplyon.com.