Consumer Privacy Rights Notice

This Consumer Privacy Rights Notice supplements the Exact Match Marketing, Inc. Privacy Policy and explains privacy rights that may be available to residents of certain U.S. states. This Notice applies to personal information that Exact Match Marketing, Inc. ("Exact Match," "we," "us," or "our") processes through exactmatch.io, exactmatchmarketing.com, our platform, and related services.

Rights vary by state, residency, request type, data type, processing context, and verification. We will honor applicable privacy rights as required by law and may deny, limit, or request more information for requests that are unverifiable, fraudulent, excessive, technically infeasible, outside the scope of applicable law, or subject to a legal exception.

1. Relationship to Our Privacy Policy

Our Privacy Policy describes the categories of personal information we collect, the sources of that information, how we use personal information, how we disclose personal information, our data broker activities, and our retention practices. This Notice provides additional state-specific information about consumer privacy rights, request procedures, appeal rights, universal opt-out mechanisms, and California data broker request procedures.

For purposes of this Notice, "personal information" or "personal data" has the meaning given under applicable state privacy law. Depending on the state, these terms may exclude publicly available information, deidentified information, aggregate information, certain business-to-business information, certain employee information, or information regulated by sector-specific laws.

2. State Privacy Rights

Depending on your state of residence, you may have some or all of the following rights:

3. State-Specific Rights and Limitations

Privacy rights vary by state. The rights available to you may depend on your state of residence, the type of request, the type of personal information involved, the source of the information, our role in processing the information, and applicable legal exceptions.

Where state laws differ, we will evaluate requests under the law applicable to the consumer, request type, data type, processing context, and our relationship to the data. We may respond differently to similar requests if different state laws, verification standards, exemptions, or data sources apply.

4. How to Submit a Privacy Request

You may submit a privacy request using the following methods:

• Online request form: https://exactmatch.io/legal/opt-out (also available through the Data Privacy Request link in the exactmatch.io website footer)
• Phone: (888) 555-0199

Please describe the right you want to exercise and provide enough information for us to verify and process your request. Depending on the request, we may ask for identifiers such as your name, email address, state of residence, or other information reasonably necessary to match your request to records we maintain.

We will use the information you provide in connection with your request to verify your identity, process the request, maintain compliance records, prevent fraud or abuse, and maintain suppression or do-not-serve records where appropriate.

5. Verification and Matching

We may need to verify that you are the person about whom the request relates. We generally apply a higher verification threshold before disclosing personal information than we do for deletion, opt-out, or suppression requests.

If we cannot reasonably verify your identity for an access, portability, or correction request, we may deny the request or ask for additional information. If we cannot verify a deletion or opt-out request, we may still treat the request as an opt-out or suppression request where reasonable and permitted by law.

We may decline to disclose specific pieces of personal information if disclosure would create a security risk, expose another person's information, reveal confidential commercial information, conflict with applicable law, or fall within another legal exception.

Additional Verification Detail

For deletion, correction, opt-out, and suppression requests, we may verify your identity using information such as name, email address, phone number, postal address, state of residence, email confirmation, information we maintain, or information available through verification vendors.

For access or portability requests that involve disclosure of personal information, we may require a higher level of verification, such as additional identifying information, account authentication, email confirmation, a signed declaration under penalty of perjury, or other reasonable verification methods.

We use information provided in connection with a privacy request to verify identity or authority, process and respond to the request, maintain records, and comply with applicable law. We do not use such information for unrelated purposes.

If we cannot verify your identity or an authorized agent's authority, we may deny the request, request additional information, or process the request in a more limited manner. Where permitted by law, we may still apply an opt-out, suppression, or deletion to identifiers reasonably associated with the request.

We may decline or further investigate requests we reasonably believe are fraudulent, abusive, duplicative, or submitted in bad faith.

6. Authorized Agents

You may use an authorized agent to submit a request where permitted by applicable law. We may require proof that the agent is authorized to act on your behalf. We may also require you to verify your identity directly with us or confirm that you provided the agent permission to submit the request.

For California residents, an authorized agent may submit requests consistent with California law. If we cannot verify the agent's authority, we may deny the agent request.

Additional Authorized Agent Detail

Before processing a request submitted by an authorized agent, we may require proof of authorization, verification of the agent's identity, and other information permitted by applicable law. Proof of authorization may include a written and signed permission, declaration, power of attorney, or other evidence that you authorized the agent to submit the request.

We may also require you to verify your identity directly with us or directly confirm that you authorized the agent, unless an exception applies under applicable law.

If we cannot verify your identity, the agent's authority, or the validity of the request, we may deny the request, request additional information, or process it in a more limited manner, such as by applying an opt-out or suppression without disclosing personal information.

7. Timing of Responses

We will respond to privacy requests within the time required by applicable law. Many state privacy laws require a response within 45 days after receipt of a verifiable request and allow an extension when reasonably necessary. Where permitted, we may extend the response period and will notify you of the extension and the reason for it.

For internal operations, we aim to route and evaluate consumer rights requests promptly after receipt so that we can preserve time for verification, matching, vendor coordination, and any required response.

Additional Response Timing Detail

We will respond to privacy requests within the period required by applicable law and, where permitted, may extend the response period when reasonably necessary.

If we require additional time, deny a request, or are unable to act on a request, we will provide the notice, explanation, and appeal information required by applicable law.

8. Appeals

If we deny your request and your state grants an appeal right, our response will explain how to appeal. To appeal, follow the instructions in the denial notice or contact us at support@exactmatch.io with the subject line "Privacy Request Appeal."

Please include your original request reference number if available, the right you attempted to exercise, and the reason you believe the decision should be reconsidered. We will review appeals and respond within the period required by applicable law. If the appeal is denied, we will provide any regulator complaint instructions required by applicable law.

State-Specific Appeal and Complaint Information

Appeal rights vary by state. If applicable law grants an appeal right and we deny your request, we will provide instructions for submitting an appeal in our response. Appeal response periods also vary by state. For example, many states require appeal responses within 45 or 60 days, depending on the applicable law. If we deny an appeal, we will provide information about how to contact the applicable attorney general or regulator where required by law.

You may submit an appeal by following the instructions in our denial response or by contacting us at support@exactmatch.io with the subject line "Privacy Request Appeal." Please include your original request reference number if available, the right you attempted to exercise, and the reason you believe the decision should be reconsidered.

9. Opting Out of Sale, Sharing, and Targeted Advertising

Exact Match receives, analyzes, licenses, discloses, and makes available personal information for advertising, audience creation, lead generation, enrichment, analytics, and related commercial purposes. These activities may be considered a sale, sharing, targeted advertising, or profiling under certain state privacy laws.

You may opt out by using https://exactmatch.io/legal/opt-out, which is also available through the Data Privacy Request link in the exactmatch.io website footer, or by contacting us at support@exactmatch.io. We may maintain your information on a suppression or do-not-serve list after processing your opt-out so that we can avoid providing your information in future products or services.

10. Universal Opt-Out Mechanisms and Global Privacy Control

Where required by law, we recognize legally required universal opt-out mechanisms, including Global Privacy Control signals, as requests to opt out of sale, sharing, or targeted advertising for the browser, device, or environment that sends the signal.

Because browser-based signals may not identify you across all devices, browsers, accounts, email addresses, or data records, you may also submit a broader opt-out request through https://exactmatch.io/legal/opt-out, which is also available through the Data Privacy Request link in the exactmatch.io website footer, or by contacting us at support@exactmatch.io. We may ask for additional information where necessary to connect your opt-out request to records we maintain.

11. California Data Broker and DROP Addendum

Exact Match may be considered a data broker under California and other state data broker laws because we may collect and sell or disclose personal information obtained from sources other than the consumer with whom we have a direct relationship.

California residents may submit data broker deletion requests through the California Delete Request and Opt-out Platform, known as DROP, administered by the California Privacy Protection Agency. DROP allows California residents to submit a single deletion request to registered data brokers.

Beginning August 1, 2026, California data brokers must begin processing deletion requests submitted through DROP. Data brokers must access DROP at least every 45 days, retrieve applicable deletion requests, evaluate and match requests against their records, delete covered personal information unless an exception applies, report request status through DROP, and maintain records or suppression information required by law.

If we receive or retrieve a valid DROP request that matches records we maintain, we will process the request as required by California law. Where deletion is not required or an exception applies, we may treat the request as an opt-out of sale or sharing and may maintain suppression information to help prevent future sale or sharing.

California data broker reporting and request metrics may include the number of requests received, complied with, denied, or processed, the basis for denial where required, and response timing metrics required by law. We will provide required data broker disclosures or metrics in the manner required by applicable law.

Additional Data Broker Request Procedures

Exact Match is registered, or will register, in applicable data broker registries where required by law, including California, Vermont, Texas, and Oregon, as applicable. Consumers may use the request methods described in this Notice to submit opt-out, deletion, suppression, access, correction, appeal, or other privacy requests available under applicable law.

Some data broker laws require requests to be submitted or processed through state-administered mechanisms, registries, or request systems. Where a state-administered mechanism applies, Exact Match will process requests received through that mechanism as required by applicable law. Where no state-administered mechanism applies or where direct requests are permitted, consumers may submit requests directly to Exact Match using the methods described in this Notice.

12. Oregon and Minnesota Third-Party Disclosure Rights

Oregon and Minnesota residents may have the right to request a list of specific third parties that received their personal data, rather than only categories of third parties. If a state law permits us to provide categories of third parties instead of specific third parties in certain circumstances, we will respond as permitted by that law.

For other states, the right to know or access generally includes categories of third parties or recipients, unless the applicable law requires a more specific disclosure.

13. Connecticut and Minnesota Profiling Rights

Connecticut and Minnesota provide expanded rights related to certain profiling activities. Depending on the state and context, these rights may include the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects.

Effective July 1, 2026, Connecticut law expands certain profiling-related rights, including rights related to inferences, profiling information, questioning profiling results, receiving reasons for certain decisions, reviewing data used, and, for certain housing-related decisions, correcting inaccurate data and requesting re-evaluation.

Minnesota provides expanded profiling rights that may include the right to question profiling results, receive reasons, review data used, correct inaccurate data, and request re-evaluation in applicable circumstances.

Exact Match does not authorize customers to use our services for eligibility decisions involving credit, employment, housing, insurance, healthcare, education, criminal justice, or other legally protected eligibility determinations unless expressly permitted under a separate written agreement and applicable law. Requests related to prohibited or restricted uses may require review of account activity, customer instructions, and applicable contractual restrictions.

14. Sensitive Personal Information

Some state laws impose special requirements for sensitive personal information. Depending on the state, sensitive personal information may include precise geolocation, racial or ethnic origin, religious beliefs, health information, biometric information, genetic data, citizenship or immigration status, children's data, or information revealing certain personal characteristics.

California residents may have the right to limit certain uses and disclosures of sensitive personal information. Maryland restricts the sale of sensitive data. Other states may require consent or provide opt-out rights for certain processing of sensitive data.

Exact Match applies product, contractual, and operational controls designed to restrict uses of sensitive data for prohibited eligibility, discrimination-sensitive, or regulated decisioning purposes.

15. State-Specific Limitations and Exceptions

Some states limit certain rights to personal data that the consumer provided to the controller, rather than all personal data maintained by the controller. This may affect portability, deletion, or correction requests in states such as Iowa, Nebraska, Minnesota, Indiana, and Kentucky.

Iowa does not provide a correction right or profiling opt-out right under its comprehensive consumer privacy law and defines sale more narrowly than many other states. Utah adds a correction right effective July 2026 and does not provide the same profiling opt-out right as many other state laws.

Additional State-Specific Limitations

Some state privacy laws limit certain rights to personal data provided by the consumer, while other states apply rights more broadly to personal data maintained by the controller. Some states provide a right to obtain categories of third parties that received personal data, while Oregon and Minnesota may require a list of specific third parties in certain circumstances. Maryland provides a right to request categories of third parties to which personal data was disclosed and restricts the sale of sensitive data. Connecticut and Minnesota provide expanded profiling-related rights in certain contexts.

Where state laws differ, we will evaluate requests under the law applicable to the consumer, request type, data type, processing context, and our relationship to the data.

California's profiling opt-out rights depend on CPPA rulemaking and effective dates. Where California automated decision-making or profiling rules apply, we will update our disclosures and request procedures as required.

16. Non-Discrimination

We will not unlawfully discriminate against you for exercising privacy rights. For example, we will not deny goods or services, charge a different price, or provide a different level of service because you exercised a privacy right, except as permitted by applicable law.

17. Contact Us

For more information about our general data practices, please see our Privacy Policy.