Modular Privacy Policy – US Multi-State (TDPSA/CPA/CPRA)

MODULAR U.S. MULTI-STATE PRIVACY POLICY

Company: [________________________________]

Effective Date: [__/__/____]

Last Updated: [__/__/____]

PART I — CORE NOTICE

1. Who We Are and What This Notice Covers

[COMPANY LEGAL NAME] ("Company," "we," "us," or "our") provides [DESCRIBE SERVICES]. This Privacy Policy explains how we collect, use, retain, and disclose personal data through [LIST COVERED WEBSITES, APPLICATIONS, PRODUCTS, AND OFFLINE INTERACTIONS].

This Policy applies to: [________________________________].

This Policy does not apply to: [IDENTIFY SEPARATELY NOTICED EMPLOYEE, APPLICANT, BUSINESS-CONTACT, OR OTHER PROCESSING].

2. Data-Practice Matrix

We may use personal data to provide and improve the Services, administer accounts and transactions, communicate with users, personalize experiences, conduct analytics and advertising described below, secure the Services, prevent fraud and abuse, comply with law and legal process, protect rights and safety, and complete corporate transactions.

We will provide additional notice or obtain consent before processing personal data for another purpose when applicable law requires it.

3. Processors, Service Providers, and Other Recipients

We disclose personal data to the recipient categories identified in the matrix, which may include hosting and security providers, payment processors, analytics providers, advertising partners, customer-support and fulfillment providers, professional advisers, affiliates, governmental authorities, litigants, and parties to a corporate transaction.

Contracts with processors or service providers include the terms required for the applicable processing relationship.

4. Retention

We retain each category of personal data only for the period reasonably necessary and proportionate to its disclosed purpose, taking into account the nature and sensitivity of the data, the relationship with the individual, security and fraud-prevention needs, legal and accounting requirements, and pending or anticipated disputes.

Retention schedule or summary: [________________________________]

5. Security

We maintain administrative, technical, and physical safeguards designed to protect personal data and appropriate to the nature and volume of the data processed. No method of storage or transmission is guaranteed to be completely secure.

6. Contact Information

Privacy contact: [________________________________]

Email: [________________________________]

Postal address: [________________________________]

Toll-free number, if applicable: [________________________________]

Request form: [________________________________]

PART II — OPTIONAL PROCESSING MODULES

Module A — Sale, Sharing, and Targeted Advertising

During the period required by applicable law, we [DID / DID NOT] sell personal data and [DID / DID NOT] share or process personal data for targeted advertising.

Consumers may submit an applicable opt-out request through [PRIVACY CHOICES LINK] or [OTHER METHOD]. Where required, we treat a recognized universal opt-out preference signal as a browser- or device-level request to opt out of the processing covered by the signal.

Module B — Sensitive Personal Data

We process the following sensitive personal data: [________________________________].

We use it for: [________________________________].

Where required, we obtain consent before processing and provide a method to withdraw consent. Where a right to limit use or disclosure applies, consumers may submit a limitation request through [METHOD].

We [DO / DO NOT] use or disclose sensitive personal data to infer characteristics about an individual. If yes, describe: [________________________________].

Module C — Profiling and Automated Decision-Making

We [DO / DO NOT] process personal data for profiling in furtherance of decisions that produce legal or similarly significant effects.

If yes, describe:

• decision and consequence: [________________________________];
• personal data and logic involved: [________________________________];
• role of human review: [________________________________];
• accuracy, bias, and risk controls: [________________________________]; and
• access, explanation, correction, appeal, or opt-out method required by applicable law: [________________________________].

California's adopted 2026 regulations set January 1, 2027 as the compliance date for their automated-decisionmaking-technology requirements. Do not describe those California ADMT access, appeal, or opt-out procedures as currently available unless the Company has implemented them voluntarily or the compliance date has arrived.

Module D — Financial Incentive or Loyalty Program

Program name: [________________________________]

Material terms and benefit: [________________________________]

Personal data involved: [________________________________]

Method used to estimate the value of the data: [________________________________]

Opt-in and withdrawal method: [________________________________]

Module E — Cookies and Tracking Technologies

Browser Do Not Track response: [________________________________]

Whether other parties collect activity over time and across different websites or services: [________________________________]

Module F — Children's Data

☐ The Services are general audience, are not directed to children under 13, and we do not knowingly collect personal information online from a child under 13.

☐ The Services are child-directed or we have actual knowledge of collection from a child under 13. Our children's notice is at [LINK]. We provide the notices and obtain the verifiable parental consent required by the Children's Online Privacy Protection Act and 16 C.F.R. Part 312 unless an exception applies.

Contact for a parent or guardian: [________________________________]

PART III — RIGHTS MODULES

Module G — Access, Copy, Correction, and Deletion

Depending on applicable law, a consumer may request confirmation of processing, access to personal data, a portable copy, correction of inaccurate data, or deletion. A right is subject to authentication and statutory exceptions and is offered only where the applicable law provides it or the Company elects to offer it voluntarily.

Request methods: [________________________________]

Module H — Opt-Out Rights

Depending on applicable law, a consumer may opt out of sale, sharing, targeted advertising, or profiling in furtherance of decisions producing legal or similarly significant effects.

Privacy choices method: [________________________________]

Universal opt-out signal implementation: [________________________________]

Module I — Appeals

If applicable law grants an appeal, a consumer may appeal a refusal to act by using [APPEAL METHOD]. We will decide the appeal within the applicable period and provide any regulator-contact information required after a denied appeal.

Module J — Authorized Agents

Where applicable law permits an authorized agent, the agent may submit an opt-out or other covered request on a consumer's behalf. We may request proof of authority and direct confirmation from the consumer, subject to applicable law.

Module K — Nondiscrimination

We will not unlawfully discriminate against a consumer for exercising an applicable privacy right. Any legally permitted difference in service, price, or benefit will be described in the relevant financial-incentive or loyalty-program notice.

PART IV — CALIFORNIA MODULE

California Notice at Collection

At or before the point of collection, the Company will make available a notice that identifies the categories of personal information and sensitive personal information collected, the purposes for collection or use, whether the categories are sold or shared, and the retention period or criteria, together with the links and methods required by the CCPA regulations.

California Prior 12-Month Disclosure

California request methods: [________________________________]

Do Not Sell or Share link or alternative opt-out link: [________________________________]

Limit the Use of My Sensitive Personal Information link, if required: [________________________________]

Authorized-agent process: [________________________________]

PART V — APPLICABILITY AND OPERATIONS WORKBOOK

1. State Activation Matrix

2. Request Workflow Matrix

3. Opt-Out Signal Test Record

4. Processor Contract Register

5. Data Protection Assessment Register

PART VI — CHANGES AND FINAL CONTACT

We may revise the published Policy. The "Last Updated" date will identify the latest version. We will provide additional notice and obtain consent when required before a material change applies to affected processing.

Questions, requests, or complaints may be sent to:

[COMPANY LEGAL NAME]

Attn: [PRIVACY TEAM OR OFFICER]

[ADDRESS]

[EMAIL]

[PHONE]

SOURCES AND REFERENCES

• 15 U.S.C. § 45
• 15 U.S.C. § 6502
• 16 C.F.R. Part 312
• California CCPA Regulations effective January 1, 2026
• Official state-law sources in the State Activation Matrix

Remove all drafting instructions, complete every selected module, and test the request and opt-out workflows before publishing the assembled Policy.