In the twelve (12) months preceding the Last Updated date above, we have collected the categories of personal information described in Section 3 of the Privacy Policy. For ease of reference, the CCPA-framework categories and subcategories we collect include:

• Identifiers (name, email, postal address, phone, IP address, cookie IDs, device identifiers, authenticated account identifiers)
• Customer records (offline or online customer records, including those from Merchants' order systems)
• Commercial information (transaction, purchase, and fulfillment records)
• Internet or other electronic network activity (website, widget, pixel, extension, and mobile-app activity)
• Geolocation data (approximate geolocation derived from IP; precise geolocation only in the context of shipment fulfillment)
• Professional or employment-related information (limited to Merchant account users)
• Inferences (drawn from the foregoing to create profiles reflecting preferences, characteristics, and behavior)
• Sensitive personal information (authentication credentials, in hashed form; shipment-level precise geolocation)

The purposes for which we collect each category, the sources from which we collect it, and the categories of recipients with whom we share it are described in Sections 4, 5, and 6 of our Privacy Policy.

Under the CCPA, “sale” and “share” have specific meanings that can include disclosures for cross-context behavioral advertising and certain analytics activities, even without monetary consideration.

Sales. We do not sell personal information in exchange for money.

Shares. Where a Merchant opts in to Commercial Activation (Section 7 of the Privacy Policy), we share hashed identifiers with advertising platforms (Meta, Google, LinkedIn, TikTok) for the purpose of audience matching and cross-context behavioral advertising. These disclosures may constitute “sharing” under the CCPA.

Sensitive PI. We do not use or disclose sensitive personal information for purposes other than those specified in 11 C.C.R. § 7027(m).

Minors. We do not sell or share personal information of any consumer we actually know to be under the age of 16 absent affirmative opt-in (opt-in from a parent or guardian if the consumer is under 13).

California residents have the following rights:

• Right to know. What categories and specific pieces of personal information we have collected, sources, purposes, recipients, and retention.
• Right to delete. Deletion of personal information we have collected, subject to exceptions in Cal. Civ. Code § 1798.105(d).
• Right to correct. Correction of inaccurate personal information.
• Right to opt out of sale / sharing. Opt out at Do Not Sell or Share My Personal Information or by enabling the Global Privacy Control (GPC) signal in your browser.
• Right to limit use of sensitive personal information.
• Right to portability.
• Right against retaliation. We will not deny or materially alter the Services because you exercise a right.
• Right to appeal. See Section 17.5 of the Privacy Policy.

Submit a rights request through:

• Email: privacy@packageretriever.com
• Self-service portal: packageretriever.com/privacy/request
• Postal mail: Package Retriever, Inc., Attn: Privacy Office, [Street Address], [City], Wyoming [ZIP]

We verify identity using information we already hold about you (such as email, phone, postal address, or recent order numbers). For sensitive requests we may request additional verification. Authorized agents may submit a request on your behalf with documented authority. We respond within 45 days and may extend by an additional 45 days when reasonably necessary, with notice.

We use automated decision-making technology as described in Section 9 of the Privacy Policy. California residents have rights to pre-use notice, meaningful disclosure, the right to opt out for certain uses, and the right to appeal adverse decisions, consistent with the California Privacy Protection Agency's regulations on automated decision-making technology.

California's “Shine the Light” law (Cal. Civ. Code § 1798.83) permits California residents to request a notice disclosing the categories of personal information we shared with third parties for their direct marketing purposes in the preceding calendar year. To request this notice, email privacy@packageretriever.com.

For questions about this Notice, contact us at privacy@packageretriever.com.