CCPA / CPRA Privacy Notice

California Consumer Privacy Act (as amended by the California Privacy Rights Act)

This privacy notice for SPD Technology (“SPD Technology”, “we”, “us”, or “our”) describes how we collect, store, use, and share (“process”) your information when you use our services (“Services”), including when you:

• Visit our website at https://spd.tech/, or any website of ours that links to this privacy notice;
• Engage with us in other related ways, including any sales, marketing, or events.

Questions or concerns? Contact us at [email protected].

Summary of key points

Contents

1. What information do we collect?
2. How do we process your information?
3. What legal bases do we rely on?
4. When and with whom do we share your personal information?
5. How long do we keep your information?
6. How do we keep your information safe?
7. Do we collect information from minors?
8. Privacy rights for EEA, UK, and other jurisdictions
9. Controls for Do-Not-Track and Global Privacy Control
10. Your California Privacy Rights (CCPA / CPRA)
11. Do we make updates to this notice?
12. How can you contact us?
13. How can you review, update, or delete the data we collect?

1. What information do we collect?

1.1 Personal information you provide to us

In Short: We collect personal information that you voluntarily provide to us.

We collect personal information that you voluntarily provide when you express interest in our Services, participate in activities on the Services, or otherwise contact us. The personal information we collect may include:

• Names, job titles, company names;
• Business email addresses and phone numbers;
• Postal / business addresses;
• Contact preferences.

Sensitive Personal Information (SPI). We do not intentionally request or collect Sensitive Personal Information through our website contact forms. However, if you voluntarily provide Sensitive Personal Information in a message or inquiry, we will process such information only as necessary to respond to your request, provide requested services, comply with legal obligations, or as otherwise permitted by applicable law. See Section 1.3 for the categories of Sensitive Personal Information under the CPRA.

Please ensure that the information you provide is accurate and up to date and notify us of any relevant changes.

1.2 Information collected automatically

In Short: Some information is collected automatically when you visit our website.

We automatically collect certain technical information when you visit, use, or navigate the Services. This information does not on its own reveal your specific identity but may include:

• Log and Usage Data: IP address, browser type and settings, device information, operating system, referring URLs, pages and files viewed, date/time stamps, and other actions you take on the Services.
• Device Data: Computer, phone, or tablet information including IP address, device identifiers, hardware model, internet service provider, and system configuration.
• Location Data: We may infer a general (city/country-level) location from your IP address. We do not collect or process “precise geolocation” (within a radius of 1,850 feet / 1/3 mile) as defined under the CPRA without your prior consent. If a feature requiring precise geolocation is introduced, we will update this Notice and seek your consent.
• Cookie-related data: See our Cookie Notice for full details of cookies and similar technologies we use.

1.3 Categories of personal information collected (CPRA table)

The following table reflects categories of personal information we have collected in the preceding 12 months. It also identifies whether each category constitutes Sensitive Personal Information (SPI) under Civil Code § 1798.140(ae).

We may also collect personal information outside these categories in the context of: (a) customer support interactions; (b) customer surveys; and (c) delivery of our Services and response to your enquiries.

2. How do we process your information?

In Short: We process your information to provide and improve our Services, communicate with you, manage recruitment processes, maintain the security of our website and systems, and comply with legal obligations.

We process your personal information for the following purposes:

• To respond to enquiries and provide support: to respond to your requests, questions, and communications and to resolve any issues you raise.
• To manage recruitment processes: to review and assess applications, evaluate qualifications, communicate with candidates regarding employment opportunities, and maintain recruitment records where appropriate.
• To send administrative information: including information about our Services, updates to our terms, policies, security practices, and other important notices.
• To send marketing communications: where permitted by applicable law, including where you have provided consent or where we have a legitimate interest in contacting business representatives regarding our services, subject to your right to opt out.
• To operate, maintain, and improve our website: including the use of analytics data (subject to your cookie preferences) to understand website usage, improve functionality, enhance user experience, and develop our content and services.
• To protect the security and integrity of our website, systems, and business operations: including detecting, preventing, and investigating fraud, security incidents, unauthorized access, and other misuse.
• To comply with legal obligations and exercise or defend legal rights: including compliance with applicable laws, regulations, legal processes, contractual obligations, and the establishment, exercise, or defense of legal claims.

We apply the principles of data minimisation and purpose limitation when processing personal information. We collect only the personal information that is reasonably necessary for the purposes described in this Notice and do not use personal information for purposes that are materially different, unrelated, or incompatible with those purposes without providing additional notice where required by law.

3. What legal bases do we rely on?

In Short: We process your personal information only where we have a valid legal reason under applicable law.

• We process personal information where necessary to perform a contract with you, respond to your request prior to entering into a contract, or manage a business relationship with you or the organization you represent.
• We process personal information submitted through recruitment forms and job applications to assess candidates, communicate regarding employment opportunities, and manage our recruitment processes.
• We process personal information to comply with applicable legal obligations.
• We process personal information in furtherance of our legitimate business interests, including improving our Services, maintaining website and information security, managing recruitment processes, preventing fraud, conducting analytics, and communicating with business contacts regarding our services, provided such interests are not overridden by your privacy rights.
• Where we rely on your consent (for example, for marketing communications, optional cookies, or similar activities), you may withdraw your consent at any time.

4. When and with whom do we share your personal information?

In Short: We may share information in specific situations with specific third parties. We do not sell personal information. We do not share personal information for cross-context behavioural advertising.

• Service providers (processors): We may share personal information with service providers and contractors that help us provide, maintain, and improve our Services, under written contracts that restrict use of the personal information to the contracted services and comply with applicable California privacy requirements.
• Business transfers: We may share or transfer personal information in connection with a merger, sale of company assets, financing, or acquisition of all or a portion of our business.
• Legal proceedings: We may share personal information to comply with applicable law, enforce our terms, or protect the rights, property, or safety of SPD Technology, our clients, or others.
• No selling or sharing for advertising: SPD Technology has not sold or shared any personal information to or with third parties for business, commercial, or advertising purposes in the preceding 12 months, and does not intend to do so in the future.

5. How long do we keep your information?

In Short: We keep your personal information only for as long as necessary for the purposes described in this Notice, unless a longer retention period is required or permitted by law.

Retention periods vary depending on the category of personal information and the purpose for which it was collected:

• Website enquiry and contact form data: up to 3 years from the last contact, unless you request earlier deletion and we are not required to retain the data for legal or legitimate business purposes.
• Marketing contact records: for as long as you remain subscribed or until you opt out or withdraw consent, plus a limited period to record and enforce the opt-out.
• Business relationship records (where you are a representative of an SPD Technology client): see our B2B Privacy Notice for applicable retention periods, which are based on contractual and statutory requirements and are generally 5–7 years from contract end, where applicable.
• Server logs and analytics data: up to 26 months, depending on the configuration of the applicable analytics tools.

When we no longer have a need to process your personal information, we will delete or anonymise it. Where deletion is not immediately possible, including in backup archives, we will securely store the data and isolate it from further processing until deletion is possible.

6. How do we keep your information safe?

In Short: We have organisational and technical security measures in place.

We have implemented appropriate technical and organisational measures designed to protect your personal information, including encrypted transmission (TLS), access controls, multi-factor authentication, and regular security monitoring.

However, no method of transmission over the internet or method of electronic storage is 100% secure, and we cannot guarantee that unauthorised third parties will not be able to defeat our security measures. You should access the Services only within a secure environment.

In the event of a personal data breach, we will notify affected individuals and, where required by applicable law, relevant authorities.

7. Do we collect information from minors?

In Short: We do not knowingly collect data from or market to children under 16 years of age.

We do not knowingly solicit data from or market to individuals under the age of 16. Our Services are directed at business professionals and are not intended for use by minors. If you are under 16, please do not submit any personal information through our website.

If we learn that personal information from individuals under 16 has been collected, we will take reasonable steps to delete such data. If you believe we may have collected data from a minor, please contact us at [email protected].

Note on under-16 opt-in (CPRA § 1798.120(c)): We do not sell or share the personal information of consumers under 16. No opt-in to sale or sharing has been sought or obtained.

8. Privacy rights for EEA, UK, and other jurisdictions

In Short: If you are located in the EEA, UK, or other jurisdictions with applicable data protection laws, you have additional rights.

If you are located in the European Economic Area (EEA) or United Kingdom, your rights under the EU GDPR and UK GDPR are described in full in our B2B Privacy Notice and our Recruitment & Employment Privacy Notice. For all data protection enquiries, contact [email protected].

You also have the right to lodge a complaint with your local supervisory authority:

• Romania: ANSPDCP
• United Kingdom: ICO
• Switzerland: FDPIC

9. Controls for Do-Not-Track and Global Privacy Control

In Short: We honour the Global Privacy Control (GPC) signal as an opt-out of sale/sharing.

Do-Not-Track (DNT): Most web browsers include a Do-Not-Track feature. There is no uniform standard for recognising DNT signals under U.S. law, and we do not currently respond to DNT signals specifically.

Global Privacy Control (GPC): We recognize a valid Global Privacy Control (GPC) signal as a request to opt out of the sale or sharing of personal information for the browser or device from which the signal is sent. If your browser or device sends a valid GPC signal when you visit https://spd.tech/, we will treat it as an opt-out request and will not sell or share your personal information for that browser or device. The GPC opt-out does not affect our use of strictly necessary cookies or our ability to send communications necessary to provide the Services.

10. Your California Privacy Rights (CCPA / CPRA)

In Short: California residents have the following specific rights regarding their personal information under the CCPA as amended by the CPRA.

The CPRA (effective 1 January 2023) significantly expanded the rights originally established by the CCPA. The full set of rights available to California residents is set out below.

10.1 Right to Know (Request to Know)

You have the right to request that we disclose the following information about our collection and use of your personal information during the 12-month period preceding your request, or beyond that period where applicable:

• The categories of personal information we collected about you;
• The categories of sources from which we collected personal information;
• The business or commercial purposes for collecting, selling, or sharing personal information;
• The categories of third parties to whom we disclosed personal information;
• The specific pieces of personal information we collected about you, subject to applicable law and verification requirements.

We are not required to provide or delete de-identified information in response to a consumer request, or to reidentify de-identified data to verify a request.

10.2 Right to delete (request to delete)

You have the right to request that we delete personal information we have collected from you, subject to certain exceptions, including where retention is necessary to:

• Complete a transaction or provide a requested service;
• Detect, prevent, or investigate security incidents or fraud;
• Comply with a legal obligation;
• Exercise or defend legal claims.

10.3 Right to correct

You have the right to request that we correct inaccurate personal information we maintain about you, taking into account the nature of the personal information and the purposes for which we process it. We will use commercially reasonable efforts to correct the information as directed by you.

10.4 Right to limit use and disclosure of sensitive personal information (SPI) (NEW — CPRA)

If we were to collect SPI (as defined in Cal. Civ. Code § 1798.140(ae) and listed in Section 1.3, category L), you would have the right to direct us to limit our use and disclosure of that SPI to what is necessary to perform the Services or as otherwise permitted under Cal. Civ. Code § 1798.121.

As stated in Section 1.3, SPD Technology does not currently collect SPI categories through its website or standard B2B operations. This right is included for completeness. If SPI collection is introduced, this Notice will be updated and a “Limit the Use of My Sensitive Personal Information” link will be added to the website footer.

10.5 Right to Opt-Out of automated decision-making / profiling (NEW — CPRA)

The CPRA grants consumers the right to opt out of the use of automated decision-making technology, including profiling, in connection with decisions that produce legal or similarly significant effects on consumers. SPD Technology does not use automated decision-making that produces legal or similarly significant effects concerning California residents based on their website visits or contact-form submissions. If this changes, we will update this Notice and provide an opt-out mechanism.

10.6 Right to Opt-Out of sale or sharing of personal information (CPRA)

You have the right to opt out of the sale of your personal information and the sharing of your personal information for cross-context behavioural advertising (Cal. Civ. Code § 1798.120).

10.7 Right to Non-Discrimination

We will not discriminate against you for exercising any of your rights under the CCPA/CPRA. Specifically, we will not deny you goods or services, charge you different prices or rates, provide you with a different level or quality of goods or services, or suggest that you may receive a different price or rate or a different level or quality of goods or services.

10.8 Authorised Agents

You may designate an authorised agent to make a CCPA/CPRA request on your behalf. We may deny a request from an authorised agent if the agent cannot demonstrate that they have been validly authorised to act on your behalf. We may also require you to verify your own identity directly with us, even where you have used an authorised agent.

10.9 Verification Process

Upon receiving your request, we will verify your identity before responding to confirm that you are the person about whom we have collected personal information. We may ask you to provide information that matches information we already maintain, or we may contact you through a previously provided communication channel. We will only use personal information provided in connection with a verification request for the purpose of verification.

If we cannot verify your identity based on the information already available to us, we may request additional information. Any additional information we collect for verification purposes will be used only to verify your identity and will be deleted once verification is complete, unless we are required to retain it by law.

We will respond to verifiable consumer requests within 45 days. If we need more time, we may extend the response period by up to 45 additional days and will notify you within the initial 45-day period. We do not charge a fee to process or respond to verifiable consumer requests unless permitted by applicable law.

10.10 “Shine the Light” (Cal. Civ. Code § 1798.83)

California residents may also request, once per year and free of charge, information about any personal information disclosed to third parties for direct marketing purposes in the preceding calendar year. As stated above, SPD Technology does not disclose personal information to third parties for direct marketing purposes. Requests under this provision may be submitted to [email protected].

10.11 How to exercise your California rights

To exercise any of the rights described in this Section 10, please contact us using one of the following methods:

• Email: [email protected] (please include “California Privacy Request” in the subject line)
• Postal address: SOFTWARE PRODUCT DEVELOPMENT GLOBAL LTD, 20 Birchin Court, Birchin Lane, London EC3V 9DJ, United Kingdom (marked “FAO: Data Protection Coordinator — California Privacy Request”)

The California Privacy Protection Agency (CPPA) — established under the CPRA — is the state-level enforcement authority. You may also contact the California Office of the Attorney General. If you believe we have not responded appropriately to your request, you may file a complaint with the CPPA at https://cppa.ca.gov/.

11. Do we make updates to this notice?

In Short: Yes, we will update this notice as necessary to stay compliant with relevant laws.

We may update this privacy notice from time to time. The updated version will be indicated by an updated “Last updated” date at the top. If we make material changes, we will either post a prominent notice on our website or notify you directly. We encourage you to review this notice periodically.

12. How Can You Contact Us?

If you have questions or comments about this notice, or wish to exercise your rights, please contact us:

13. How Can You Review, Update, or Delete the Data We Collect?

Based on applicable California law and, where relevant, the EU/UK GDPR, you may have the right to request access to, correction of, or deletion of personal information we hold about you. To make such a request, please contact us at [email protected] with the subject line “Data Subject Request”. We will respond within 45 days (CCPA/CPRA) or one month (GDPR) as applicable.