16. Where we store your Personal Information.

17. Update this Privacy Policy.

18. How to contact us

Appendix III: Virginia Consumer Data Privacy Act (“VCDPA”).

• Scope. 

If you are a resident of the Commonwealth of Virginia and we process data about you that might be considered Personal Information under the VCDPA, this Appendix shall apply.

• Your rights as a data subject. 

You have the rights indicated in Section 7 in accordance with the provisions of the VCDPA. You also have the following right:

• Right to receive a copy of your personal information.

You have the right to request a copy of the Personal Information we have collected about you in a portable and, to the extent technically feasible, readily usable format to allow you to transmit your Personal Information to another entity without hindrance if the processing is carried out by automated means.

1. Right to opt-out of the processing of Personal Information for purposes of targeted advertising and profiling.

Jointly with the right to opt-out of the sale or sharing of your Personal Information, you have the right to opt-out of the processing of your Personal Information for purposes of targeted advertising and profiling in furtherance of decisions that produce legal or similarly significant effects to you.

• How to exercise your rights. 

We shall take all the appropriate measures to provide you with any information you have requested.

We shall answer your request within 45 days from the date on which it was received. Please bear in mind that –in certain situations (e.g. the complexity of your request)– we may extend the term by 45 additional days. In such case, we will inform you within the initial 45-day term together with the reasons for the extension.

In case we decline your request, we will inform you no later than 45 days from the date on which your request was received. If you want to appeal our decision, send your appeal request to the following address [email protected] with the header “Appeal to Denial of Request”.

We will answer your appeal within 60 days from the date on which it was received, which will include a written explanation for the decision taken. If we deny your appeal, you may contact Virginia’s Attorney General to submit a complaint by visiting https://www.virginia.gov/agencies/office-of-the-attorney-general/.

• Restrictions to your rights. 

Please note that the exercise of your rights is subject to certain restrictions pursuant to the VCDPA (e.g. if your request is manifestly unfounded, excessive, or repetitive, we may charge you a reasonable fee to cover up the costs of analyzing your request; if we are unable to authenticate your request by using reasonable commercial efforts, we shall not analyze it; we shall provide you the requested information free of charge up to twice annually, etc.).

• Sensitive Personal Information.

Under the VCDPA, Personal Information is considered sensitive in the following cases:

1. Personal Information revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status.
2. Genetic or biometric data processed for the purpose of uniquely identifying a natural person.
3. The Personal Information collected from a known child.
4. Precise geolocation data.

In case we process Sensitive Personal Information, we will only carry out such processing if you have given us your consent to do so. 

• Use of our services by children.

Under the VCDPA, a child is any natural person under 13 years old. The processing of Personal Information related to a child is lawful if it is done in accordance with the provisions set forth in the Children’s Online Privacy Protection Act (“COPPA”).

Please note that, under the VCDPA, the child’s parents and/or legal guardian may exercise the rights described above on behalf of the child. In case we receive a request from a child’s parent and/or legal guardian, we will both analyze and reply to it within the legal terms granted by the VCDPA. 

• How secure is your Personal Information. 

We design our systems with your security and privacy in mind. We are firmly committed to the security of your Personal Information. That’s why we implement administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of your Personal Information. 

In case of a data breach, please note that the Code of Virginia Title 18.2 Chapter 6, Article 5 Subsections 18.2-186.6 might apply.

Appendix IV: Colorado Privacy Act (“CPA”).

• Scope.

If you are a resident of the State of Colorado and we process data about you that might be considered Personal Information under the CPA, this Appendix shall apply.

• Your rights as a data subject.

You have the rights indicated in Section 7 in accordance with the provisions of the CPA. You also have the following right:

• Right to data portability.

You have the right to obtain your Personal Information in a portable and, to the extent technically feasible, readily usable format to allow you to transmit your Personal Information to another entity without hindrance.

• Right to opt-out of the processing of Personal Information for purposes of targeted advertising and profiling.

Jointly with the right to opt-out of the sale or sharing of your Personal Information, you have the right to opt-out of the processing of your Personal Information for purposes of targeted advertising and profiling in furtherance of decisions that produce legal or similarly significant effects to you.

• How to exercise your rights.

We shall take all the appropriate measures to provide you with any information you have requested. 

We shall answer your request within 45 days from the date on which it was received. Please bear in mind that –in certain situations (e.g. the complexity of your request)– we may extend the term by 45 additional days. In such case, we will inform you within the original 45-day term together with the reasons for the extension.

In case we decline your request, we will inform you no later than 45 days from the date on which your request was received, together with the reasons that support our decision and the instructions to appeal.

In case you want to appeal our decision, send your appeal request to the following address [email protected] with the header “Appeal to Denial of Request”.

We will answer your appeal within 45 days from the date on which it was received. Please bear in mind that –in certain situations (e.g. the complexity of your request)– we may extend the term by 60 additional days. In such case, we will inform you within the original 45-day term, together with the reasons for the extension. 

If you have any concerns about our response to your appeal, you may contact Colorado’s Attorney General to submit a complaint by visiting https://coag.gov.

• Restrictions to your rights.

Please note that the exercise of your rights is subject to certain restrictions pursuant to the CPA (e.g. we shall not comply with your request if, after making reasonable commercial efforts, we cannot authenticate your request; we may charge you a reasonable fee to cover up the costs of answering your request if you have submitted a second or subsequent request within a 12-month period, etc.).

• Sensitive Personal Information.

Under CPA, Personal Information is considered sensitive in the following cases: 

1. Personal Information revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, sex life or sexual orientation, or citizenship or immigration status.
2. Genetic or biometric data that may be processed for the purpose of uniquely identifying an individual.
3. Personal Information from a known child.

In case we process Sensitive Personal Information, we will only carry out such processing if you have given us your consent to do so.

• Use of our services by children.

Under the CPA, a child is any individual who is under 13 years old. The processing of Personal Information related to a child is lawful only if the child´s parents or legal guardian have given their consent.

• How secure is your Personal Information.

We design our systems with your security and privacy in mind. We are firmly committed to the security of your Personal Information. That’s why we implement reasonable measures to protect your Personal Information. In case of a security breach, we will notify you without undue delay, no later than 30 days after we become aware of the incident pursuant to Title 6, Article 1, Part 7 Section 6-1-716 of the 2022 Colorado Code. Please note that certain exceptions may apply (e.g. if our internal investigation determines that the misuse of your Personal Information has not occurred and is not reasonably likely to occur). 

Appendix V: Connecticut Data Privacy Act (“CDPA”).

• Scope. 

If you are a resident of the State of Connecticut and we process data about you that might be considered Personal Information under CDPA, this Appendix shall apply.

• Your Rights as a data subject. 

You have the rights indicated in Section 7 in accordance with the provisions of the CDPA. You also have the following right.

• Right to obtain a copy of the personal information.

You have the right to obtain your Personal Information in a portable and, to the extent technically feasible, readily usable format to allow you to transmit your Personal Information to another entity without hindrance where the processing is carried out by automated means.

1. Right to opt-out of the processing of Personal Information for purposes of targeted advertising and profiling.

Jointly with the right to opt-out of the sale or sharing of your Personal Information, you have the right to opt-out of the processing of your Personal Information for purposes of targeted advertising and profiling in furtherance of decisions that produce legal or similarly significant effects to you.

• How to exercise your rights.

We shall take all the appropriate measures to provide you with any information you have requested. 

We shall answer your request no later than 45 days from the date on which it was received. Please bear in mind that –in certain situations (e.g. complexity of your request/number of requests received)– we may extend the term by 45 additional days. In such case, we will inform you within the original 45-day term together with the reasons for the extension.

In case we decline your request, we will inform you no later than 45 days from the date on which your request was received, together with the reasons that support our decision. If you want to appeal our decision, you must send your appeal request to the following address [email protected] with the header “Appeal to Denial of Request.”

If you decide to appeal our decision, we will answer your appeal no later than 60 days from the date on which it was received. If we deny your appeal, you may contact Connecticut’s Attorney General to submit a complaint by visiting https://portal.ct.gov/AG. 

• Restrictions to your rights. 

Please note that the exercise of your rights is subject to certain restrictions pursuant to the CDPA (e.g. we shall not comply with your request if, after making reasonable commercial efforts, we cannot authenticate your request or identity or the identity of the agent acting on your behalf; we shall not comply with your opt-out request if we have a good faith, reasonable and documented belief that such request is fraudulent; if your request is manifestly unfounded, excessive, or repetitive, we may charge you with a reasonable fee to cover up the costs of analyzing your request; we may give you the data requested free of charge up to once during a 12-month-period; we shall not comply with your request if the confirmation or access to your Personal Information would require us to reveal a trade secret, we shall not comply with your right to obtain a copy if that would require us to reveal a trade secret, etc.).

• Sensitive Personal Information.

Under CDPA, Personal Information is considered sensitive in the following cases:

1. Data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation or citizenship or immigration status.
2. Genetic or biometric data processed only for the purpose of uniquely identifying an individual.
3. Personal Information collected from a known child.
4. Precise geolocation data.

In case we process Sensitive Personal Information, we will only carry out such processing if you have given us your consent to do so.

• Use of our services by children. 

Under the CDPA, a child is any individual who is under 13 years old. The processing of Personal Information related to a child is lawful if it is done in accordance with the provisions set forth in the Children’s Online Privacy Protection Act (“COPPA”).

Please note that, under the CDPA, the child’s parents and/or legal guardian may exercise the rights described above on behalf of the child. In case we receive a request from a child’s parent and/or legal guardian, we will both analyze and reply to it within the legal terms granted by the CDPA. 

• How secure is your Personal Information.

We design our systems with your security and privacy in mind. We are firmly committed to the security of your Personal Information. That’s why we implement administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of your Personal Information.

Appendix VI: Argentine Personal Data Protection Act No. 25,326 (“PDPA”).

• Scope. 

If you are a resident of Argentina and we process data about you that might be considered Personal Information under PDPA, this Appendix shall apply.

• Your rights as a data subject. 

You have the rights indicated in Section 7 in accordance with the provisions of the PDPA. You also have the following rights:

• Right to update your personal information. 

You may request us to update the Personal Information we have collected about you.

• Right to request information. 

You have the right to request information to the supervisory authority about the existence of databases, the controller’s identity, and the purposes for which the Personal Information has been processed.

• How to exercise your rights. 

If you exercise any of these rights, we will check your entitlement and respond to you within 10 (ten) calendar days from the date on which your request to access your Personal Information was received; or 5 (five) business days from the date on which (i) your request for any rectification, update, or deletion of your Personal Information was received; or (ii) we noticed a mistake on your Personal Information.

To exercise your rights, please contact us at [email protected].

You represent and warrant that you have been duly informed that: “The data subject has the right to access your Personal Data at intervals of not less than six months free of charge unless there is a specified legitimate interest agreed upon by the interested party as established in section 14, paragraph 3 of Act 25,326, by submitting an email to the following email address: [email protected]. The AGENCY OF ACCESS TO PUBLIC INFORMATION, in its function of Controlling Entity of Act 25,326, has the attribution to attend any complaints or reports related to the infringement of personal data regulations”.

• Restrictions to your rights. 

Please note that the exercise of your rights is subject to certain restrictions pursuant to Section 17 of the PDPA. For example, we have the right to not delete your Personal Information when we are required to retain such data based on a legal obligation or if such deletion affects a third party.

• Sensitive Personal Information.

Under PDPA, Personal Information is considered sensitive if it reveals: 

1. Racial or ethnic origin.
2. Political opinions.
3. Religious or philosophical beliefs.
4. Trade union membership.
5. Data concerning health or data concerning a natural person’s sex life or sexual orientation.

• Use of our services by children.

In Argentina, a child is a person under 18 years old. Pursuant to Criteria No. 5 of Annex I of the Resolution AAIP 4/2019, the processing of Personal Information of a child in Argentina will be lawful if: a) The child has given its consent based on the progressive autonomy principle, as set forth in Sections 26 and 639 of the Argentine Federal Civil and Commercial Code, taking into account the child’s psychophysical characteristics, aptitudes, and development; b) The consent has been given by the child´s holder of parental responsibility, parent and/or legal guardian when the child’s psychophysical characteristics, aptitudes, and development do not allow the child to give its consent.

• How secure is your Personal Information.

We design our systems with your security and privacy in mind. We are firmly committed to the security of your Personal Information. That’s why we implement administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of your Personal Information, in compliance with Sections 9 and 10 of the PDPA and Resolution AAIP 47/2018.