U.S. State Supplement to Zuora Privacy Statement

The following information shall serve to supplement (“Supplement”) the Zuora Privacy Statement (“Statement”) by explaining how Zuora, Inc. (“Zuora”) collects, processes, discloses, shares, and sells personal information of residents covered by State Privacy Law. For the purposes of this Supplement, “State Privacy Law” means, collectively, all United States state privacy laws and their implementing regulations, as amended or superseded from time to time, that apply generally to the processing of individuals’ personal information and that do not apply solely to specific industry sectors (e.g., financial institutions), specific demographics (e.g., children), or specific classes of information (e.g., health or biometric information). State Privacy Laws include, among other laws, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (California Civil Code §§ 1798.100 to 1798.199) (“CCPA”) and the Colorado Privacy Act. The terms “personal information”, “sale”, “selling”, “share”, and “sharing” will have the meaning defined under State Privacy Law (as applicable). Unless defined specifically in this Supplement, capitalized terms shall have the meaning set forth in the Statement.

Please note that this Supplement only applies to the extent we offer our Services as a “Business” or “Controller” under State Privacy Law. To the extent that we are a “Service Provider,” “Contractor,” or “Processor” under State Privacy Law in relation to our offerings, this Supplement may not apply.

This Supplement also serves as our “Notice at Collection” for purposes of the CCPA.

Personal Information Zuora Collects, Processes, and Discloses under State Privacy Law

We collect and process personal information, and have for the preceding 12 months, including the following:

• If you request product information or customer support, or if you register to receive newsletters or other promotional material, we may collect your personal information including name, work email, employer name, job title, work phone number, work location, and IP address in response to a request. We may also collect personal information if someone refers you to us or if you refer someone to us to receive information about our products and services.
• If you submit information to us, such as filling out a survey about your user experience.
• If you use social media features or interact with our Site (e.g., “like” or “share” buttons), we collect your personal information. The other website may also collect your personal information. Your interactions with the other site’s features are subject to the terms of the company providing that site.

Our sources of personal information may include:

• You, such as through your use of our Site, products, or services;
• Our affiliate companies or third parties; and
• Referring individuals who think you may be interested in our products or

We disclose the personal information described in the “Categories of Data and Business Purpose” section (see below) to third parties as required for business purposes or under applicable law, including:

• Our affiliates, contractors, vendors, or third parties who process personal information on our behalf;
• Channel partners such as distributors and resellers; and
• Any parties to whom we are legally required to disclose your personal

Categories of Data and Business Purpose 

Zuora collects and processes, and has for the preceding 12 months, the following categories of personal information about residents covered by State Privacy Law:

Category of Personal Information	Examples
Identifiers, including any categories of Personal Information listed in Section 1798.80 of the California Civil Code	Name, address, email address, telephone number, employer information, IP address, or other similar identifiers, or transactions information
Commercial information	Records of products or services requested or considered
Internet or other electronic network activity information	Browsing history and information regarding interaction with the web site
Location data	Location information you provide as part of your request or registration or approximate location based on your IP address
Professional or employment-related information	Employer name or job title that you provide as part of your request or registration

Zuora does not collect or process sensitive personal information in its capacity as a controller and therefore does not use or disclose sensitive personal information for purposes other than those permitted under applicable State Privacy Law.

We may use your personal information, including for the following purposes to:

• Respond to requests or product inquiries, and to provide services or support; to provide security and safety of the site, our IT, and users of the site; and also to prevent and detect fraud;
• Provide a customized web experience, including tracking your activities to understand site usage and improve the content and offerings of the website;
• Operate our business, which includes analysis of our website performance, research, and improvement and development of our products and services;
• Comply with and enforce legal and contractual obligations; and
• Target ads to you

Zuora does not use your personal information for purposes of profiling in furtherance of decisions that produce a legal or similarly significant effect concerning a consumer.

Sale and Sharing of Personal Information

Please note that, under some states’ privacy laws, the exchange of personal information for nonmonetary consideration can qualify as a sale. Our “sales” of personal information are limited to exchanges of personal information for nonmonetary consideration. Meanwhile, under the CCPA, “sharing” of personal information is defined as the disclosing of personal information to a third party for purposes of cross-context behavioral advertising.

We “sell” and “share” personal information, including IP addresses and information gathered through cookies, to our advertising and analytics partners. We sell and share your personal information to deliver targeted ads to you, to understand Site usage, and to improve the content and offerings of the Site.

We do not have actual knowledge that we sell or share the personal information of individuals under the age of 16.

Your Consumer Rights

Depending on your location and subject to applicable State Privacy Law, you may have the following rights with regard to your personal information:

1. The right to know what personal information, if any, we have collected about you, including the categories of personal information collected, the categories of sources from which the personal information is collected, the categories of personal information that we have disclosed for a business or commercial purpose, the categories of third parties to which such personal information was disclosed, and the business or commercial purposes for such activities;
2. The right to access a copy of your personal information in a portable format;
3. The right to delete personal information provided by you or obtained from you, subject to certain exceptions;
4. The right to correct inaccurate personal information that we maintain about you;
5. The right to opt-out of the “sale” or “sharing” of personal information;
6. The right to limit the use of your sensitive personal information;
7. The right not to receive discriminatory treatment from us for exercising your rights under applicable State Privacy Law;
8. The right to opt-out of the use of your personal information for targeted advertising purposes;
9. The right to restrict or object to the processing of your personal information (such as for direct marketing purposes);
10. The right to restrict or opt-out of the use of your personal information for certain automated decision-making (including profiling in furtherance of decisions that produce legal or similarly significant effects);
11. The right to revoke your consent (to the extent applicable);
12. The right to confirm whether personal information about you is being processed; and
13. The right to obtain a list of specific third parties (or categories of third parties) to which we have disclosed your personal information or any personal information.

How To Exercise Your Rights

You may submit a request to exercise any of the above rights by contacting us at support@zuora.com.

We will respond to your request as soon as reasonably possible and within the timeframe required under applicable law. We will allow you to appeal any decision we make in response to such request in accordance with applicable law. Appeals may be submitted to support@zuora.com with the subject line “Appeal of Decision Related to Privacy Rights Request.”

For security purposes, we may request additional information (including your name, email address, and other identifying information) to verify your identity before further action is taken on your request.

You may authorize an agent to make a request on your behalf. To designate an agent, please provide a written and signed document by both you and the agent that authorizes the agent to act on your behalf. You may also use a power of attorney. We will still require you to provide information to allow us to reasonably verify that you are the person about whom we collected personal information.

If you have implemented an opt-out preference signal (sometimes known as a global privacy control) through your browser or device, we will treat that opt-out preference signal as a valid request to exercise the opt-out rights available to you under your jurisdiction’s privacy law(s). Once we recognize the opt-out preference signal on our Site, we will automatically apply your right to opt-out to the browser or device through which we recognize the signal. The Site responds to opt-out preference signals in a frictionless manner (i.e., you do not need to take any additional steps for your opt-out preference signal to be recognized). To learn more about opt-out preference signals, please visit https://globalprivacycontrol.org/.

To opt-out of interest-based advertising by participating companies in the following consumer choice mechanisms, please visit:

• Digital Advertising Alliance (DAA)’s self-regulatory opt-out page and mobile application-based “AppChoices” download page;
• European Interactive Digital Advertising Alliance (EDAA)’s consumer opt-out page; and
• Network Advertising Initiative (NAI)’s self-regulatory opt-out page.

For more information on how to manage cookies on the Site, see our Cookie Policy.

Children

Content on this Site is directed at individuals over the age of 18 and is not directed at children under the age of 13. We do not knowingly collect or process personally identifiable information from children under the age of 13.

California Shine the Light Law

California’s “Shine the Light” law, Civil Code section 1798.83, requires certain businesses to respond to requests from California customers asking about the businesses’ practices related to disclosing personal information to third parties for the third parties’ direct marketing purposes. We do not disclose your personal information for these purposes.

Contact Us 

If you have any questions regarding this Supplement, you may write to us at privacy@zuora.com.

Date Last Updated:  October 30, 2023

Location:  https://www.zuora.com/us-state-privacy-supplemental-notice/