The following information shall serve to supplement (“Supplement”) the Zuora Privacy Statement (“Statement”) by explaining how Zuora, Inc. (“Zuora”) collects, processes, discloses, shares, and sells personal information of residents covered by State Privacy Law. For the purposes of this Supplement, “State Privacy Law” means, collectively, all United States state privacy laws and their implementing regulations, as amended or superseded from time to time, that apply generally to the processing of individuals’ personal information and that do not apply solely to specific industry sectors (e.g., financial institutions), specific demographics (e.g., children), or specific classes of information (e.g., health or biometric information). State Privacy Laws include, among other laws, the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (California Civil Code §§ 1798.100 to 1798.199) (“CCPA”) and the Colorado Privacy Act. The terms “personal information”, “sale”, “selling”, “share”, and “sharing” will have the meaning defined under State Privacy Law (as applicable). Unless defined specifically in this Supplement, capitalized terms shall have the meaning set forth in the Statement.
Please note that this Supplement only applies to the extent we offer our Services as a “Business” or “Controller” under State Privacy Law. To the extent that we are a “Service Provider,” “Contractor,” or “Processor” under State Privacy Law in relation to our offerings, this Supplement may not apply.
This Supplement also serves as our “Notice at Collection” for purposes of the CCPA.
We collect and process personal information, and have for the preceding 12 months, including the following:
Our sources of personal information may include:
We disclose the personal information described in the “Categories of Data and Business Purpose” section (see below) to third parties as required for business purposes or under applicable law, including:
Zuora collects and processes, and has for the preceding 12 months, the following categories of personal information about residents covered by State Privacy Law:
|Category of Personal Information||Examples|
|Identifiers, including any categories of Personal Information listed in Section 1798.80 of the California Civil Code||Name, address, email address, telephone number, employer information, IP address, or other similar identifiers, or transactions information|
|Commercial information||Records of products or services requested or considered|
|Internet or other electronic network activity information||Browsing history and information regarding interaction with the web site|
|Location data||Location information you provide as part of your request or registration or approximate location based on your IP address|
|Professional or employment-related information||Employer name or job title that you provide as part of your request or registration|
Zuora does not collect or process sensitive personal information in its capacity as a controller and therefore does not use or disclose sensitive personal information for purposes other than those permitted under applicable State Privacy Law.
We may use your personal information, including for the following purposes to:
Zuora does not use your personal information for purposes of profiling in furtherance of decisions that produce a legal or similarly significant effect concerning a consumer.
Please note that, under some states’ privacy laws, the exchange of personal information for nonmonetary consideration can qualify as a sale. Our “sales” of personal information are limited to exchanges of personal information for nonmonetary consideration. Meanwhile, under the CCPA, “sharing” of personal information is defined as the disclosing of personal information to a third party for purposes of cross-context behavioral advertising.
We “sell” and “share” personal information, including IP addresses and information gathered through cookies, to our advertising and analytics partners. We sell and share your personal information to deliver targeted ads to you, to understand Site usage, and to improve the content and offerings of the Site.
We do not have actual knowledge that we sell or share the personal information of individuals under the age of 16.
Depending on your location and subject to applicable State Privacy Law, you may have the following rights with regard to your personal information:
You may submit a request to exercise any of the above rights by contacting us at firstname.lastname@example.org.
We will respond to your request as soon as reasonably possible and within the timeframe required under applicable law. We will allow you to appeal any decision we make in response to such request in accordance with applicable law. Appeals may be submitted to email@example.com with the subject line “Appeal of Decision Related to Privacy Rights Request.”
For security purposes, we may request additional information (including your name, email address, and other identifying information) to verify your identity before further action is taken on your request.
You may authorize an agent to make a request on your behalf. To designate an agent, please provide a written and signed document by both you and the agent that authorizes the agent to act on your behalf. You may also use a power of attorney. We will still require you to provide information to allow us to reasonably verify that you are the person about whom we collected personal information.
If you have implemented an opt-out preference signal (sometimes known as a global privacy control) through your browser or device, we will treat that opt-out preference signal as a valid request to exercise the opt-out rights available to you under your jurisdiction’s privacy law(s). Once we recognize the opt-out preference signal on our Site, we will automatically apply your right to opt-out to the browser or device through which we recognize the signal. The Site responds to opt-out preference signals in a frictionless manner (i.e., you do not need to take any additional steps for your opt-out preference signal to be recognized). To learn more about opt-out preference signals, please visit https://globalprivacycontrol.org/.
To opt-out of interest-based advertising by participating companies in the following consumer choice mechanisms, please visit:
Content on this Site is directed at individuals over the age of 18 and is not directed at children under the age of 13. We do not knowingly collect or process personally identifiable information from children under the age of 13.
California Shine the Light Law
California’s “Shine the Light” law, Civil Code section 1798.83, requires certain businesses to respond to requests from California customers asking about the businesses’ practices related to disclosing personal information to third parties for the third parties’ direct marketing purposes. We do not disclose your personal information for these purposes.
If you have any questions regarding this Supplement, you may write to us at firstname.lastname@example.org.
Date Last Updated: October 30, 2023