CCPA Privacy Rights

CALIFORNIA CONSUMER PRIVACY ACT COMPLIANCE

This document explains the privacy rights available to California residents under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), and how RentalTide respects and facilitates these rights.

1. Introduction to CCPA/CPRA

The California Consumer Privacy Act (CCPA) and its amendment, the California Privacy Rights Act (CPRA), provide California residents with specific rights regarding their personal information. RentalTide Inc. ("RentalTide," "we," "us," or "our"), a corporation incorporated in Delaware, United States, with additional registration in Canada, is committed to protecting these rights and providing transparency about our data practices.

Effective Date: January 1, 2020 (CCPA) / January 1, 2023 (CPRA) California Privacy Contact: RentalTide Inc. (Delaware) 110 Didsbury Road, Ottawa, Ontario K2J 4T4, Canada, 1111B S Governors Ave STE 48363, Dover, DE 19904, United States Email: california-privacy@rentaltide.com Phone: 888-709-2650

2. Scope and Applicability

2.1 Who is Covered

These privacy rights apply to:

• California residents using our services
• California employees (if any) of RentalTide
• Business contacts located in California
• Website visitors accessing our services from California

2.2 What Information is Covered

"Personal Information" under CCPA/CPRA includes:

• Identifiers: Names, addresses, email addresses, IP addresses
• Commercial information: Purchase history, rental preferences
• Biometric identifiers: If collected (fingerprints, facial recognition)
• Internet activity: Browsing history, search history, website interactions
• Geolocation data: Precise or approximate location information
• Professional information: Employment details, business information
• Inferences: Profiles, preferences, characteristics derived from other PI

2.3 Our Role Under CCPA/CPRA

RentalTide acts as a:

• Business for our own operations and direct customer relationships
• Service Provider when processing data on behalf of rental operators
• Third Party when receiving data from other businesses for specific purposes

3. Categories of Personal Information We Collect

3.1 Information Collected in the Last 12 Months

*For advertising and analytics purposes only. We do not sell personal information in the traditional sense.

3.2 Sources of Personal Information

We collect personal information from:

• Directly from you: Account registration, bookings, communications
• Automatically: Website usage, device information, cookies
• Third parties: Payment processors, identity verification services, marketing partners
• Business partners: Rental operators, integration partners
• Public sources: Business directories, social media (business accounts only)

3.3 Business Purposes for Collection

We use personal information for:

• Service provision: Account management, booking processing, customer support
• Payment processing: Transaction completion, billing, refunds
• Communications: Service notifications, customer support, marketing
• Legal compliance: Tax reporting, fraud prevention, regulatory requirements
• Business operations: Analytics, service improvement, security monitoring
• Marketing: Advertising, promotional offers, customer engagement

4. Your California Privacy Rights

4.1 Right to Know (CCPA Section 1798.110)

You have the right to request information about:

• Categories of personal information we collect about you
• Categories of sources from which we collect personal information
• Business or commercial purposes for collecting personal information
• Categories of third parties with whom we share personal information
• Specific pieces of personal information we have collected about you

How to Exercise:

• Submit request through california-privacy@rentaltide.com
• Use our online privacy request form (when available)
• Call our privacy hotline at 888-709-2650
• Response time: Within 45 days (extendable to 90 days for complex requests)

4.2 Right to Delete (CCPA Section 1798.105)

You have the right to request deletion of personal information we have collected from you, subject to certain exceptions.

Exceptions (we may retain information when necessary for):

• Completing transactions or providing requested services
• Security purposes: Detecting and preventing fraud or illegal activity
• Legal compliance: Meeting legal obligations or defending legal claims
• Internal uses: Compatible with consumer expectations based on relationship
• Research: Public interest research with appropriate safeguards

How to Exercise:

• Same methods as Right to Know requests
• Specify what information you want deleted
• We will confirm deletion or explain why retention is necessary

4.3 Right to Correct (CPRA Addition)

You have the right to request correction of inaccurate personal information we maintain about you.

How to Exercise:

• Log into your account to make direct corrections
• Email corrections to california-privacy@rentaltide.com
• Provide supporting documentation for requested corrections
• Response time: Within 45 days

4.4 Right to Opt-Out of Sale/Sharing (CCPA Section 1798.120)

You have the right to opt-out of the "sale" or "sharing" of your personal information.

What We Consider "Sale" or "Sharing":

• Disclosing personal information to advertising networks for targeted advertising
• Sharing data with analytics providers that use it for their own purposes
• Cross-context behavioral advertising activities

What We Don't Consider "Sale":

• Sharing with service providers who process data solely on our behalf
• Necessary disclosures for business operations
• Sharing with rental operators to complete your bookings

How to Exercise:

• Click "Do Not Sell or Share My Personal Information" link to send email opt-out request
• Email request to california-privacy@rentaltide.com
• Call 888-709-2650 and request opt-out
• Effective: Immediately upon request processing

4.5 Right to Limit Use of Sensitive Personal Information (CPRA)

You have the right to limit our use and disclosure of sensitive personal information to:

• Performing services reasonably expected by consumers
• Ensuring security and system integrity
• Short-term, transient use for immediate context
• Verifying or maintaining service quality
• Certain specified business purposes

Our Sensitive Personal Information:

• Account login credentials (encrypted)
• Payment card information (tokenized by Stripe)
• Precise geolocation (when GPS is enabled)
• Health information (only when relevant to rental activities)

4.6 Right to Non-Discrimination (CCPA Section 1798.125)

You have the right not to receive discriminatory treatment for exercising your CCPA rights.

We will not:

• Deny goods or services to you
• Charge different prices or rates
• Provide different levels or quality of services
• Suggest you might receive different treatment

We may offer financial incentives for data collection if:

• The incentive is reasonably related to the value of the data
• We provide clear terms and obtain opt-in consent
• You can withdraw from the program at any time

5. How We Sell or Share Personal Information

5.1 Definition Under CCPA/CPRA

"Sale" under CCPA/CPRA is broadly defined and includes:

• Selling, renting, releasing, disclosing, or disseminating personal information
• Making available personal information for monetary or other valuable consideration
• Sharing personal information for cross-context behavioral advertising

5.2 Our Sharing Practices

We do NOT sell personal information in the traditional sense.

We do share personal information for:

• Advertising: With advertising networks for targeted advertising
• Analytics: With analytics providers for website and service improvement
• Marketing: With marketing partners for promotional activities (with consent)

5.3 Categories of Personal Information Sold/Shared

5.4 Opt-Out Mechanisms

Global Opt-Out:

• Honors Global Privacy Control (GPC) signals
• Respects browser Do Not Track settings where applicable
• Provides clear opt-out links on website

Granular Controls:

• Cookie preference management
• Email marketing unsubscribe options
• Account-level privacy settings

6. Service Providers and Contractors

6.1 Service Provider Relationships

We share personal information with service providers who:

• Process data solely on our behalf for specified business purposes
• Are contractually prohibited from using data for their own purposes
• Must implement security measures to protect personal information
• Cannot sell, share, or retain personal information except to perform services

6.2 Current Service Providers

Core Service Providers:

• AWS: Cloud hosting and data storage
• Stripe: Payment processing and identity verification
• Auth0: Authentication and identity management
• SendGrid: Email delivery services
• Twilio: SMS and communication services

Business Service Providers:

• Google Workspace: Internal business operations
• Intercom: Customer support platform
• Slack: Internal team communications

6.3 Contractor Agreements

All service providers and contractors must:

• Sign data processing agreements with CCPA compliance terms
• Implement appropriate security measures
• Limit use of personal information to contract purposes
• Notify us of any data breaches or unauthorized access
• Submit to audits and compliance monitoring

7. Exercising Your Rights

7.1 Verification Process

To protect your privacy, we verify your identity through:

• Account authentication: Login to your RentalTide account
• Email verification: Confirmation email to registered address
• Information matching: Verification of account details you provide
• Additional verification: For sensitive requests or high-value accounts

7.2 Authorized Agents

You may use an authorized agent to submit requests by:

• Providing written permission for the agent to act on your behalf
• Verifying your identity through our standard process
• Agent providing proof of authorization (power of attorney or signed letter)

7.3 Response Timeline

• Acknowledgment: Within 10 business days of receipt
• Response: Within 45 days (extendable to 90 days for complex requests)
• Urgent requests: Expedited processing when possible
• Incomplete requests: We will specify what additional information is needed

7.4 Request Methods

Online:

• Privacy request form: [Available on our website]
• Account dashboard: Direct access through your account settings

Email:

• california-privacy@rentaltide.com
• Include "CCPA Request" in subject line
• Provide detailed description of your request

Phone:

• 888-709-2650
• Ask for California Privacy Rights department
• Available during business hours (9 AM - 6 PM PT)

Mail:

• California Privacy Rights, RentalTide Inc.
• 110 Didsbury Road, Ottawa, Ontario K2J 4T4, Canada
• 1111B S Governors Ave STE 48363, Dover, DE 19904, United States

8. Minors' Privacy Rights

8.1 Children Under 16

We do not knowingly sell or share personal information of consumers under 16 years of age without affirmative authorization.

For children under 13:

• We do not knowingly collect personal information
• Parental consent required for any collection
• Enhanced protections and safeguards applied

For children 13-15:

• Opt-in consent required before selling or sharing personal information
• Parental consent may be required in certain circumstances
• Special protections for educational and health information

8.2 Parental Rights

Parents and guardians can:

• Access their child's personal information
• Request deletion of their child's personal information
• Opt-out of sale/sharing on behalf of their child
• Correct inaccurate information about their child

9. Financial Incentives and Loyalty Programs

9.1 Current Programs

We may offer financial incentives such as:

• Account creation bonuses: Credits for new account registration
• Referral programs: Rewards for referring new customers
• Loyalty discounts: Reduced fees for frequent users
• Marketing participation: Incentives for providing feedback or reviews

9.2 Value Calculation

We calculate the value of personal information based on:

• Cost savings: Reduced marketing and customer acquisition costs
• Service improvement: Value derived from analytics and personalization
• Market research: Benefits from understanding customer preferences
• Administrative efficiency: Streamlined operations through data insights

9.3 Program Terms

All incentive programs include:

• Clear description of benefits and requirements
• Opt-in consent - participation is voluntary
• Withdrawal rights - exit anytime without penalty
• Equal treatment - no discrimination for non-participation
• Value disclosure - explanation of why incentive is offered

10. Data Retention and Deletion

10.1 Retention Periods

We retain personal information for:

• Active accounts: Duration of business relationship
• Closed accounts: 2 years for account recovery and compliance
• Transaction records: 7 years for tax and legal requirements
• Marketing data: Until consent is withdrawn
• Security logs: 2 years for fraud prevention

10.2 Automated Deletion

We implement automated systems to:

• Flag data for review when retention periods expire
• Delete data automatically when legally permissible
• Archive data that must be retained but not actively used
• Purge backups according to established schedules

10.3 Manual Deletion

Upon valid deletion requests, we:

• Remove data from active systems within 45 days
• Update backup systems during next backup cycle
• Maintain deletion logs for compliance verification
• Notify third parties to delete shared data when contractually required

11. Third-Party Links and Integrations

11.1 External Websites

Our platform may contain links to third-party websites that:

• Have their own privacy policies governing data collection
• Are not covered by this CCPA notice
• May collect personal information through cookies and tracking
• Should be reviewed independently for their privacy practices

11.2 Business Integrations

We integrate with business partners who:

• May collect personal information through our platform
• Act as independent businesses with their own privacy obligations
• Have direct relationships with you as their customer
• Are responsible for their own CCPA compliance

11.3 Your Rights with Third Parties

You should exercise your CCPA rights directly with:

• Each business that collects your personal information
• Third-party websites you visit through our links
• Business partners you interact with through our platform
• Independent rental operators using our services

12. Updates to This Notice

12.1 Notice Changes

We may update this CCPA notice to reflect:

• Changes in law or regulatory guidance
• New business practices or service features
• Enhanced privacy protections or consumer rights
• Feedback from consumers and privacy advocates

12.2 Notification Methods

Material changes will be communicated through:

• Email notification to account holders
• Website banner highlighting changes
• Updated effective date at the top of this notice
• Summary of changes for significant modifications

12.3 Your Continued Rights

Regardless of notice updates:

• Your fundamental rights under CCPA/CPRA remain protected
• Existing opt-outs continue to be honored
• Previous consents are not invalidated by updates
• New rights may be added but existing rights are not diminished

13. Contact Information

13.1 California Privacy Rights Inquiries

Email: california-privacy@rentaltide.com Phone: 888-709-2650 Mail: California Privacy Rights, RentalTide Inc. 110 Didsbury Road, Ottawa, Ontario K2J 4T4, Canada, 1111B S Governors Ave STE 48363, Dover, DE 19904, United States

13.2 General Privacy Questions

Email: privacy@rentaltide.com
Data Protection Officer: dpo@rentaltide.com

13.3 Legal and Compliance

Email: legal@rentaltide.com
CCPA Compliance Officer: ccpa-compliance@rentaltide.com

---

Last Updated: November 14, 2025
Effective Date: February 1, 2025
Version: 1.0

Notice to California Residents: This notice is provided pursuant to the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA). If you are a California resident, you have the rights described in this notice. For questions about your rights or to submit a request, contact us using the information provided above.

Do Not Sell or Share My Personal Information: Click here to opt-out of the sale or sharing of your personal information →

This notice supplements our general Privacy Policy and provides California-specific information required under state law.