TEXAS DATA PRIVACY AND SECURITY ACT (TDPSA) PRIVACY NOTICE

Effective Date: [DATE]
Last Updated: [DATE]

NOTICE TO TEXAS RESIDENTS

This Privacy Notice is provided pursuant to the Texas Data Privacy and Security Act, codified at Texas Business & Commerce Code Chapter 541 (TDPSA), which became effective July 1, 2024, with universal opt-out mechanism requirements effective January 1, 2025.

1. SCOPE AND APPLICABILITY

1.1 Who This Notice Applies To

This Notice applies to "consumers" as defined by Tex. Bus. & Com. Code Section 541.001, meaning natural persons who are Texas residents acting only in an individual or household context. This Notice does not apply to persons acting in a commercial or employment context.

1.2 Unique Applicability Features

Pursuant to Tex. Bus. & Com. Code Section 541.002, the TDPSA applies to persons that:

☐ Conduct business in Texas, OR

☐ Produce a product or service consumed by Texas residents, AND

☐ Process or engage in the sale of personal data, AND

☐ Are not a small business as defined by the U.S. Small Business Administration

Important: Unlike other state privacy laws, the TDPSA does NOT contain revenue thresholds or minimum consumer data processing thresholds for general applicability.

1.3 Small Business Exception

Small businesses (as defined by the federal Small Business Administration) are generally exempt from the TDPSA, EXCEPT that if a small business sells sensitive personal data, it must first obtain the consumer's consent pursuant to Section 541.101(b)(5).

1.4 Entity Exemptions

The following are exempt from the TDPSA pursuant to Tex. Bus. & Com. Code Section 541.002:

• State agencies and political subdivisions
• Financial institutions subject to the Gramm-Leach-Bliley Act (GLBA)
• Covered entities and business associates under HIPAA
• Nonprofit organizations
• Higher education institutions (public or private)
• Electric utilities

2. DEFINITIONS

Pursuant to Tex. Bus. & Com. Code Section 541.001:

"Personal Data" means any information, including sensitive data, that is linked or reasonably linkable to an identified or identifiable individual, excluding de-identified data and publicly available information.

"Sensitive Data" means personal data that includes:
- Racial or ethnic origin
- Religious beliefs
- Mental or physical health diagnosis (including pregnancy)
- Sexual orientation
- Citizenship or immigration status
- Genetic data or biometric data processed for identification
- Personal data collected from a known child
- Precise geolocation data

"Sale of Personal Data" means sharing, disclosing, or transferring personal data for monetary or other valuable consideration by the controller to a third party.

"Targeted Advertising" means displaying advertisements to a consumer based on personal data obtained from the consumer's activities across nonaffiliated websites or applications.

"Profiling" means any form of automated processing to evaluate, analyze, or predict personal aspects concerning an identified or identifiable individual.

3. CATEGORIES OF PERSONAL DATA PROCESSED

Pursuant to Tex. Bus. & Com. Code Section 541.101(a)(1), we process the following categories of personal data:

3.1 General Personal Data

3.2 Sensitive Data

Pursuant to Tex. Bus. & Com. Code Section 541.101(b)(5), we collect the following sensitive data ONLY with your consent:

4. PURPOSES OF PROCESSING

Pursuant to Tex. Bus. & Com. Code Section 541.101(a)(2), we process personal data for the following purposes:

4.1 Primary Purposes

☐ Providing products and services you request

☐ Processing transactions and sending related information

☐ Communicating with you about your account

☐ Responding to your inquiries and requests

☐ Maintaining and improving our services

☐ Ensuring security and preventing fraud

☐ Complying with legal obligations

4.2 Secondary Purposes

☐ Marketing and promotional communications

☐ Personalizing your experience

☐ Conducting research and analytics

☐ Targeted advertising

☐ [OTHER PURPOSES]

5. SALE OF PERSONAL DATA AND TARGETED ADVERTISING

5.1 Sale of Personal Data

Pursuant to Tex. Bus. & Com. Code Section 541.051(a)(4):

☐ We sell personal data to third parties

☐ We do not sell personal data to third parties

If we sell personal data, the following categories may be sold:

5.2 Targeted Advertising

Pursuant to Tex. Bus. & Com. Code Section 541.051(a)(4):

☐ We process personal data for targeted advertising

☐ We do not process personal data for targeted advertising

5.3 Profiling

Pursuant to Tex. Bus. & Com. Code Section 541.051(a)(5):

☐ We engage in profiling that produces legal or similarly significant effects

☐ We do not engage in such profiling

6. YOUR TEXAS PRIVACY RIGHTS

Pursuant to Tex. Bus. & Com. Code Section 541.051, Texas consumers have the following rights:

6.1 Right to Confirm (Section 541.051(a)(1))

You have the right to confirm whether we are processing your personal data.

6.2 Right to Access (Section 541.051(a)(1))

You have the right to access your personal data that we process.

6.3 Right to Correct (Section 541.051(a)(2))

You have the right to correct inaccuracies in your personal data, taking into account the nature of the data and the purposes of processing.

6.4 Right to Delete (Section 541.051(a)(3))

You have the right to delete personal data provided by or obtained about you.

6.5 Right to Data Portability (Section 541.051(a)(6))

You have the right to obtain a copy of your personal data in a portable and, to the extent technically feasible, readily usable format that allows transmission to another controller.

6.6 Right to Opt Out (Section 541.051(a)(4-5))

You have the right to opt out of:
- The sale of your personal data
- Processing for targeted advertising
- Profiling in furtherance of decisions that produce legal or similarly significant effects

7. UNIVERSAL OPT-OUT MECHANISM

7.1 Global Privacy Control (Effective January 1, 2025)

Pursuant to Tex. Bus. & Com. Code Section 541.055(e), as of January 1, 2025, we recognize and honor universal opt-out preference signals, including:

☐ Global Privacy Control (GPC)

☐ Other authorized universal opt-out mechanisms: [SPECIFY]

7.2 How Universal Opt-Out Works

When we detect a universal opt-out signal from your browser or device, we will treat it as a valid request to opt out of:
- The sale of your personal data
- Targeted advertising

8. EXERCISING YOUR RIGHTS

8.1 How to Submit a Request

Methods to Submit Requests:

☐ Online Portal: [URL]

☐ Email: [PRIVACY EMAIL]

☐ Phone: [PHONE NUMBER]

☐ Mail: [MAILING ADDRESS]

8.2 Verification Process

We will verify your identity using commercially reasonable methods before fulfilling your request, which may include:

• Matching information you provide with information we maintain
• Verification through your account (if applicable)
• Third-party identity verification services

8.3 Authorized Agents

You may designate an authorized agent to submit requests on your behalf. We may require:
- Written authorization signed by you
- Verification of your identity directly
- Verification of the agent's authority

8.4 Response Timeline

Pursuant to Tex. Bus. & Com. Code Section 541.051(c):

• Initial Response: Within 45 days of receipt
• Extension: May extend by an additional 45 days when reasonably necessary considering complexity and volume
• Notification: We will inform you of any extension and the reason

8.5 No Fee

We provide responses free of charge up to twice annually per consumer. We may charge a reasonable fee or decline to act on manifestly unfounded, excessive, or repetitive requests.

9. RIGHT TO APPEAL

9.1 Appeal Process

Pursuant to Tex. Bus. & Com. Code Section 541.051(d), if we decline your request, you have the right to appeal.

To Submit an Appeal:

☐ Email: [APPEAL EMAIL]

☐ Online Form: [URL]

☐ Mail: [ADDRESS]

9.2 Appeal Response

• We will respond to your appeal within 60 days
• If we deny your appeal, we will provide information on how to contact the Texas Attorney General

9.3 Contact the Attorney General

If you are not satisfied with our appeal decision, you may file a complaint with:

Office of the Attorney General of Texas
Consumer Protection Division
P.O. Box 12548
Austin, Texas 78711-2548
Phone: (800) 621-0508
Website: www.texasattorneygeneral.gov

10. NON-DISCRIMINATION

Pursuant to Tex. Bus. & Com. Code Section 541.051(b), we will not discriminate against you for exercising your privacy rights. This means we will not:

☐ Deny goods or services

☐ Charge different prices or rates

☐ Provide a different level or quality of goods or services

☐ Suggest you will receive different treatment

11. DATA PROTECTION ASSESSMENTS

Pursuant to Tex. Bus. & Com. Code Section 541.105, we conduct data protection assessments for processing activities that present a heightened risk of harm, including:

☐ Processing for targeted advertising

☐ Sale of personal data

☐ Processing for profiling with risk of unfair treatment, financial/physical injury, or privacy intrusion

☐ Processing of sensitive data

☐ Any processing presenting heightened risk of harm to consumers

12. DATA SECURITY

Pursuant to Tex. Bus. & Com. Code Section 541.101(a)(4), we maintain reasonable administrative, technical, and physical data security practices appropriate to the volume and nature of personal data processed.

Our security measures include:

☐ Encryption of data in transit and at rest

☐ Access controls and authentication measures

☐ Regular security assessments and audits

☐ Employee training on data protection

☐ Incident response procedures

☐ Vendor security assessments

13. CHILDREN'S PRIVACY

Pursuant to Tex. Bus. & Com. Code Section 541.101(b)(5), we obtain consent before processing personal data of known children. We comply with the Children's Online Privacy Protection Act (COPPA) for children under 13.

☐ We do not knowingly collect personal data from children under 13 without parental consent

☐ We have mechanisms to verify age and obtain parental consent

14. CONTROLLER AND PROCESSOR RELATIONSHIPS

14.1 Controller Information

[COMPANY NAME] is the controller of personal data processed under this Notice.

Controller Contact:
[ADDRESS]
[EMAIL]
[PHONE]

14.2 Processor Requirements

Pursuant to Tex. Bus. & Com. Code Section 541.104, our contracts with processors require:

• Clear instructions for processing
• Duty of confidentiality
• Appropriate security measures
• Subprocessor requirements
• Deletion or return of data upon termination
• Demonstration of compliance

15. CONTACT INFORMATION

Privacy Inquiries:

Name: [PRIVACY OFFICER NAME]
Title: [TITLE]
Email: [EMAIL]
Phone: [PHONE]
Address: [ADDRESS]

Consumer Rights Requests:

Email: [EMAIL]
Online: [URL]
Phone: [PHONE]

16. CHANGES TO THIS NOTICE

We may update this Notice to reflect changes in our practices or legal requirements. Material changes will be communicated:

☐ By posting an updated Notice on our website

☐ By email notification

☐ By notice within our application

DOCUMENT CONTROL

Legal Review: ☐ Completed Date: _________ Reviewer: _________

Next Review Date: _____________

This Notice is provided for informational purposes and compliance with the Texas Data Privacy and Security Act. It does not constitute legal advice. Consult with qualified legal counsel for specific compliance questions.