Privacy Policy - US Baseline (Alabama)

[COMPANY NAME] ALABAMA PRIVACY NOTICE

Effective Date: [__/__/____]

Last Updated: [__/__/____]

This Privacy Notice explains how [COMPANY LEGAL NAME] ("Company," "we," "us," or "our") collects, uses, retains, and discloses personal data through [LIST COVERED WEBSITES, APPLICATIONS, PRODUCTS, SERVICES, AND OFFLINE INTERACTIONS] (collectively, the "Services").

1. SCOPE AND CONTACT DETAILS

Company address: [________________________________]

Privacy email: [________________________________]

Request form: [________________________________]

Telephone: [________________________________]

This Notice applies to: [DESCRIBE COVERED INDIVIDUALS AND INTERACTIONS].

This Notice does not apply to: [IDENTIFY SEPARATELY NOTICED EMPLOYEE, APPLICANT, BUSINESS-CONTACT, OR OTHER PROCESSING].

2. PERSONAL DATA WE COLLECT

We may create aggregated or deidentified information. We will maintain deidentified information in that form and will not attempt to reidentify it except as permitted by applicable law.

3. HOW WE USE PERSONAL DATA

We use personal data, as applicable, to:

• provide, maintain, personalize, and improve the Services;
• create and administer accounts and transactions;
• communicate about services, support, security, and offers;
• measure performance and conduct analytics and research;
• provide advertising described in this Notice;
• authenticate users and detect fraud, abuse, and security incidents;
• comply with law, legal process, and enforceable governmental requests;
• establish, exercise, or defend legal claims; and
• evaluate or complete a corporate transaction.

We will provide additional notice or obtain consent before processing personal data for another purpose when applicable law requires it.

4. HOW WE DISCLOSE PERSONAL DATA

Our processor and service-provider contracts include confidentiality, security, use-restriction, assistance, deletion or return, and subcontractor terms required for the applicable relationship.

5. SALE, TARGETED ADVERTISING, AND PROFILING

During the period covered by this Notice, we:

☐ did not sell personal data.

☐ sold these categories of personal data: [________________________________].

☐ did not process personal data for targeted advertising.

☐ processed these categories for targeted advertising: [________________________________].

☐ did not process personal data for profiling in furtherance of solely automated significant decisions.

☐ conducted this profiling: [________________________________].

Privacy choices link: [________________________________]

Other opt-out method: [________________________________]

Opt-out preference signal implementation: [________________________________]

6. COOKIES AND TRACKING TECHNOLOGIES

Browser Do Not Track response: [________________________________]

Whether other parties collect activity over time and across different websites or services: [________________________________]

7. RETENTION AND SECURITY

We retain each category of personal data only for the period reasonably necessary and proportionate to its disclosed purpose, subject to legal, accounting, security, fraud-prevention, and dispute-resolution needs.

We maintain administrative, technical, and physical safeguards designed to protect personal data. No security measure is guaranteed to prevent every incident.

8. PRIVACY REQUESTS

Before May 1, 2027, Alabama law does not provide the general consumer-rights program described in the future-effective section below. The Company will process requests under other applicable law and any rights it elects to offer voluntarily.

Voluntary or otherwise applicable requests may include:

• access to personal data;
• correction of inaccurate personal data;
• deletion of personal data;
• a portable copy of personal data; and
• opt-out of sale, targeted advertising, or covered profiling.

Request methods: [________________________________]

We may authenticate a request and apply exceptions permitted by applicable law. A voluntary response does not concede that a law applies.

9. CHILDREN'S PRIVACY

☐ The Services are general audience, are not directed to children under 13, and we do not knowingly collect personal information online from a child under 13.

☐ The Services are child-directed or we have actual knowledge of collection from a child under 13. Our children's notice is at [LINK], and we provide notice and obtain verifiable parental consent as required by the Children's Online Privacy Protection Act and 16 C.F.R. Part 312 unless an exception applies.

Contact us at [PRIVACY EMAIL] if you believe a child provided personal information contrary to this Notice.

10. DATA INCIDENTS

If an incident involves sensitive personally identifying information covered by Alabama law, we will investigate and provide legally required notices. Alabama's current breach law generally requires notice to affected residents without unreasonable delay and within 45 days after a covered entity determines that a breach occurred and is reasonably likely to cause substantial harm. It also requires Attorney General notice when the number of individuals the covered entity is required to notify exceeds 1,000, and nationwide consumer-reporting-agency notice when more than 1,000 individuals require notice at one time.

11. FUTURE-EFFECTIVE ALABAMA RIGHTS — MAY 1, 2027

The Alabama Personal Data Protection Act applies to persons doing business in Alabama or producing products or services targeted to Alabama residents that either control or process personal data of more than 25,000 consumers, excluding payment-transaction-only data, or derive more than 25 percent of gross revenue from the sale of personal data. The statute contains substantial entity- and data-level exemptions.

If the Act applies, Alabama consumers may request confirmation and access, correction, deletion, and a portable copy, and may opt out of targeted advertising, sale, and profiling in furtherance of solely automated significant decisions. We will respond within 45 days, subject to one reasonably necessary 45-day extension.

We will obtain consent before processing sensitive data as required, provide a clear sale or targeted-advertising disclosure and opt-out method when applicable, and process qualifying opt-out preference signals. The privacy notice and request methods above must be conformed to the Act before its effective date.

12. CHANGES AND CONTACT

The "Last Updated" date identifies the latest version. We will provide additional notice and obtain consent before a material change when required.

Questions, requests, or complaints may be sent to:

[COMPANY LEGAL NAME]

Attn: [PRIVACY TEAM OR OFFICER]

[ADDRESS]

[EMAIL]

[PHONE]

SOURCES AND REFERENCES

• 15 U.S.C. § 45
• 15 U.S.C. § 6502
• 16 C.F.R. Part 312
• Alabama Code, Chapter 8-38
• Alabama Personal Data Protection Act, H.B. 351 enrolled

Conform this notice to the Company's data inventory, request operations, vendor contracts, advertising technologies, retention schedule, incident-response plan, and coverage analysis before publication.