U.S. State Privacy Rights Notices

Purpose and Scope

This Notice supplements our Privacy Policy by describing the rights afforded to residents of specific U.S. states under each applicable state’s privacy law. If you are a resident of one of the states listed below, the rights and procedures set out in the relevant section apply to you. The mechanisms for exercising your rights — submitting a verifiable consumer request — are common to every state and are described at the end of this Notice.

For California-specific rights, see our California Consumer Notice and CCPA/CPRA Compliance Policy.

Virginia — VCDPA

The Virginia Consumer Data Protection Act, Va. Code Ann. § 59.1-575 et seq., effective January 1, 2023, grants Virginia residents the following rights:

• Right to confirm whether we are processing your personal data and to access that data;
• Right to correct inaccuracies in your personal data;
• Right to delete personal data provided by or obtained about you;
• Right to data portability — receive a copy of your personal data in a portable format;
• Right to opt out of (i) targeted advertising, (ii) the sale of your personal data, and (iii) profiling in furtherance of decisions producing legal or similarly significant effects.

Authenticated requests are processed within forty-five (45) days. Appeals of a denial may be submitted within sixty (60) days; we will respond to appeals within sixty (60) days. If your appeal is denied, you may contact the Virginia Attorney General at oag.state.va.us.

Colorado — CPA

The Colorado Privacy Act, Colo. Rev. Stat. § 6-1-1301 et seq., effective July 1, 2023, grants Colorado residents:

• Right of access;
• Right to correct;
• Right to delete;
• Right to data portability;
• Right to opt out of targeted advertising, sale of personal data, and profiling producing legal or similarly significant effects.

Beginning July 1, 2024, Upmos honors universal opt-out mechanisms (including the Global Privacy Control browser signal) as a valid opt-out request under the CPA. Authenticated requests are processed within forty-five (45) days. Appeals to the Colorado Attorney General may be filed at coag.gov.

Connecticut — CTDPA

The Connecticut Data Privacy Act, Conn. Gen. Stat. § 42-515 et seq., effective July 1, 2023, parallels the VCDPA. Connecticut residents have the rights to confirm/access, correct, delete, port, and opt out of targeted advertising, sale, and profiling. Universal opt-out signals (including GPC) are honored. Appeals: portal.ct.gov/ag.

Utah — UCPA

The Utah Consumer Privacy Act, Utah Code § 13-61-101 et seq., effective December 31, 2023, grants Utah residents the rights to access, delete, port, and opt out of the sale of personal data and targeted advertising. Utah does not provide a right to correct or to opt out of profiling. Appeals: attorneygeneral.utah.gov.

Texas — TDPSA

The Texas Data Privacy and Security Act, Tex. Bus. & Com. Code § 541.001 et seq., effective July 1, 2024, grants Texas residents the rights to access, correct, delete, port, and opt out of targeted advertising, sale of personal data, and profiling producing legal or similarly significant effects.

The TDPSA also requires us to disclose, when we sell sensitive personal data: “NOTICE: We may sell your sensitive personal data.” Upmos does not sell sensitive personal data. The TDPSA further requires the disclosure: “NOTICE: We may sell your biometric personal data.” Upmos does not sell biometric personal data. Appeals: Texas Attorney General at texasattorneygeneral.gov.

Florida — FDBR

The Florida Digital Bill of Rights, Fla. Stat. § 501.701 et seq., effective July 1, 2024, applies to controllers with annual gross revenues exceeding $1 billion. Florida residents whose data is processed by a covered entity have rights similar to those described above, plus specific opt-out rights regarding the collection of personal data via voice recognition or facial recognition. Appeals: Florida Attorney General at myfloridalegal.com.

Oregon — OCPA

The Oregon Consumer Privacy Act, ORS 646A.570 et seq., effective July 1, 2024, grants Oregon residents the rights to confirm/access, correct, delete, port, and opt out of targeted advertising, sale, and profiling. Universal opt-out signals are honored. Appeals: doj.state.or.us.

Montana — MCDPA

The Montana Consumer Data Privacy Act, Mont. Code Ann. § 30-14-2801 et seq., effective October 1, 2024, parallels Connecticut’s CTDPA. Universal opt-out signals are honored beginning January 1, 2025.

Iowa, Tennessee, Indiana, New Hampshire, Delaware, New Jersey, Minnesota, Maryland, Rhode Island, Kentucky

Other states with privacy laws taking effect on or before December 31, 2026 are honored under the same framework: Iowa (effective Jan 1, 2025), Tennessee (Jul 1, 2025), Indiana (Jan 1, 2026), New Hampshire (Jan 1, 2025), Delaware (Jan 1, 2025), New Jersey (Jan 15, 2025), Minnesota (Jul 31, 2025), Maryland (Oct 1, 2025), Rhode Island (Jan 1, 2026), Kentucky (Jan 1, 2026), and Nebraska (Jan 1, 2025). Residents of these states are entitled to the same core rights described above; we will adopt state-specific procedural variations where required.

How to Submit a Verifiable Consumer Request

You may submit a privacy-rights request through any of the following channels:

• Web form at /privacy-request/ (available in every state);
• Email privacy@upmos.com with subject line “[State] Privacy Request”;
• Toll-free hotline: +1 (713) 555-0142;
• Postal mail to the address below, marked “Attention: Privacy Officer.”

We will verify your identity using reasonable methods commensurate with the sensitivity of the data and the risk of the request. We will respond within forty-five (45) days; if a response requires more time, we will notify you and extend by up to forty-five (45) additional days.

Authorized Agents

You may designate an authorized agent to submit a request on your behalf. The agent must provide written authorization signed by you (or a power of attorney). We may require you to verify your identity directly with us, even when an agent is acting on your behalf.

Non-Discrimination

We will not discriminate against you for exercising any right under any state’s privacy law. We will not deny you goods or services, charge different prices, provide a different level of service, or suggest you may receive any of those differences because you exercised a privacy right.

Contact

Email: privacy@upmos.com

How Can You Contact Us About This Policy?

If you have any further questions or comments or wish to report any problematic Content or Contribution, you may contact us by:

General Contact

• Phone: 1(855)637-2433 (Mon–Fri, 7 AM–8 PM CT)
• General Support: support@upmos.com
• Report Issue: upmos.com/report
• Send Feedback: upmos.com/feedback

Department Directory

Mailing Address

Upmos Inc.
9896 Bissonnet St
Houston, TX 77036
United States