Colorado Privacy Notice

Last Updated: March 4, 2024.

Unless otherwise defined in this Colorado Privacy Notice (this “Notice”), all terms defined in the Privacy Policy and all other terms defined in the Colorado Privacy Act, including its implementing regulations (“CPA”) retain the same meaning when used in this Notice.

SCOPE

This Notice supplements the information contained in our Privacy Policy and applies solely to individual residents of Colorado (“consumers” or “you”).

This Notice describes how we collect, use, disclose, and otherwise process personal data of individual residents of the State of Colorado, within the scope of the CPA.

PERSONAL DATA DISCLOSURES

When we use the term “personal data” in this Notice, we mean information that is linked or reasonably linkable to an individual who can be readily identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, specific geolocation data, or an online identifier.

For this Notice, personal data does not include:

  • De-identified data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual, or a device linked to such an individual.
  • Publicly available information that is lawfully made available from federal, state, or local government records and that we have a reasonable basis to believe a consumer has lawfully made available to the general public.
  • Information about an individual acting in a commercial or employment context, as a job applicant, or as a beneficiary of someone acting in an employment context.

We process the categories of personal data further described in the “Information Collected” and “Information From Third Parties” sections of the Privacy Policy and as shown in the table below.

As described further in the “How We Share Personal Information” section of the Privacy Policy, we share personal data with service providers or processors that help us operate our Platform and business. We may also share personal data with a variety of third parties, including for marketing purposes; if we are subject to certain corporate transactions or reorganizations; with third parties to comply with law or to protect our rights or the rights and safety of others; or for purposes otherwise disclosed or for which you have consented.

For purposes of this Notice, when we use the term “third party” we mean entities that are not processors providing services for us and that are not entities with whom you interact directly.

We have collected each of the categories of personal data noted in the list below and disclosed it to the categories of third parties listed below, and when we have sold the category of personal data to third parties or processed such personal data for targeted advertising.

  • Identifiers, such as name, email address, and other information.
    • Disclosed for specific processing purposes with third parties in the following categories: Service Providers and Contractors, such as: Marketing/Advertising/Media Agencies, Analytics Vendors, Fulfillment Partners, Payment Processing Vendors, Data Management Platforms, Social Networks, Law Enforcement, Affiliates, Regulatory Bodies, Government Authorities, Government Agencies
    • Processed or sold for targeted advertising with third parties in the following categories: Marketing/Advertising/Media Partners and Platforms; Data Analytics Providers

  • Commercial Information, such as products or services purchased, obtained or considered, and other information relating to your hobbies, interests and shopping behavior.
    • Disclosed for specific processing purposes with third parties in the following categories: Service Providers and Contractors, such as: Marketing/Advertising/Media Agencies, Analytics Vendors, Fulfillment Partners, Payment Processing Vendors, Data Management Platforms, Social Networks, Law Enforcement, Affiliates, Regulatory Bodies, Government Authorities, Government Agencies
    • Processed or sold for targeted advertising with third parties in the following categories: Marketing/Advertising/Media Partners and Platforms; Data Analytics Providers

  • Biometric Data, such as any of the following intended to be used, singly or in combination with each other or other personal data for identification purposes: data generated by the technological processing, measurement, or analysis of an individual’s biological, physical, or behavioral characteristics that can be processed to uniquely identify an individual, including but not limited to a fingerprint, a voiceprint, scans or records of eye retinas or irises, facial mapping, facial geometry, facial templates, or other unique biological, physical, or behavioral patterns or characteristics.
    • Disclosed for specific processing purposes with third parties in the following categories: Service Providers and Contractors, such as: Website Optimization Vendors
    • Not processed or sold for targeted advertising with third parties.

  • Internet/Network Information, such as browsing history, search history, IP address, Device Information, and log and analytics data.
    • Disclosed for specific processing purposes with third parties in the following categories: Service Providers and Contractors, such as: Marketing/Advertising/Media Agencies, Analytics Vendors, Fulfillment Partners, Payment Processing Vendors, Data Management Platforms, Social Networks, Law Enforcement, Affiliates, Regulatory Bodies, Government Authorities, Government Agencies
    • Processed or sold for targeted advertising with third parties in the following categories: Marketing/Advertising/Media Partners and Platforms; Data Analytics Providers

  • Geolocation Data, such as location information from your device or estimated based on your IP address.
    • Disclosed for specific processing purposes with third parties in the following categories: Service Providers and Contractors, such as: Marketing/Advertising/Media Agencies, Analytics Vendors, Fulfillment Partners, Payment Processing Vendors, Data Management Platforms, Social Networks, Law Enforcement, Affiliates, Regulatory Bodies, Government Authorities, Government Agencies
    • Processed or sold for targeted advertising with third parties in the following categories: Marketing/Advertising/Media Partners and Platforms; Data Analytics Providers

  • Other Personal Data, such as information you post on our Platform or on social media pages, and information you submit to us.
    • Disclosed for specific processing purposes with third parties in the following categories: Service Providers and Contractors, such as: Marketing/Advertising/Media Agencies, Analytics Vendors, Fulfillment Partners, Payment Processing Vendors, Data Management Platforms, Social Networks, Law Enforcement, Affiliates, Regulatory Bodies, Government Authorities, Government Agencies
    • Processed or sold for targeted advertising with third parties in the following categories: Marketing/Advertising/Media Partners and Platforms; Data Analytics Providers

  • Profiles, such as information generated by automated processes performed on personal data to evaluate, analyze or predict your economic situation, health, personal preferences, interests, behavior, location, reliability, or movements.
    • Disclosed for specific processing purposes with third parties in the following categories: Service Providers and Contractors, such as: Marketing/Advertising/Media Agencies, Analytics Vendors, Fulfillment Partners, Payment Processing Vendors, Data Management Platforms, Social Networks, Law Enforcement, Affiliates, Regulatory Bodies, Government Authorities, Government Agencies
    • Processed or sold for targeted advertising with third parties in the following categories: Marketing/Advertising/Media Partners and Platforms; Data Analytics Providers

  • Sensitive Personal Data, such as personal data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, sex life or sexual orientation, citizenship or citizenship status, genetic or biometric data that may be processed for the purpose of uniquely identifying an individual, or personal data from a known child (under age 13).
    • Disclosed for specific processing purposes with third parties in the following categories: Service Providers and Contractors, such as: Marketing/Advertising/Media Agencies, Analytics Vendors, Fulfillment Partners, Payment Processing Vendors, Data Management Platforms, Social Networks, Law Enforcement, Affiliates, Regulatory Bodies, Government Authorities, Government Agencies
    • Not processed or sold for targeted advertising with third parties.

We sell personal data and process it for targeted advertising purposes. Targeted advertising means when we display advertisements to you based on information we obtain about you through nonaffiliated websites, applications, or online services to predict your preferences or interests. Please see your rights to opt-out from these activities listed in the “How To Share Your Colorado Privacy Rights” Section below.

We process personal data for different purposes, depending on how you interact with the Platform. We process personal data about you for the purposes described in the “Use of Personal Information” section of the Privacy Policy.

We sell or share your personal data for the purposes further described in the “How We Share Personal Information” section of the Privacy Policy.

YOUR COLORADO PRIVACY RIGHTS

As a Colorado resident, you may be able to exercise the following rights concerning the personal data that we have collected about you (subject to certain limitations and exceptions at law):

Right To Know:

The right to confirm whether or not we are processing your personal data.

Right to Access /Data Portability:

The right to access and obtain a copy of personal data you previously provided to us, in a readily usable format that allows you to transmit the information to another entity without hindrance, to the extent technically feasible.

Right To Correct:

The right to request that we correct your inaccurate personal data maintained by us.

Right to Request Deletion:

The right to request the deletion of personal data we have collected from or about you, subject to certain exceptions.

Right to Opt Out:

The right to direct us not to process your personal data for certain types of targeted advertising, to sell your personal data, or to process your personal data for profiling in furtherance of decisions that produce legal or similarly significant effects on you.

DO NOT SELL OR SHARE MY PERSONAL DATA

Right To Appeal:

The right to submit an appeal if your request is denied.

HOW TO EXERCISE YOUR COLORADO PRIVACY RIGHTS

To Exercise Your Rights to Know, Access / Data Portability, Correct or Delete

Please submit a request by filling out our Privacy Rights Request Form or by emailing compliance@xendurance.com.

We will need to verify your identity and confirm you are a resident of the State of Colorado before processing most requests, which may require us to request additional personal data from you. To verify your identity, we will generally require either the successful authentication of your account or the matching of sufficient information you provide us to the information we maintain about you in our systems. Please provide your name, email address, and mailing address in the original request, as well as an explanation of the rights you wish to exercise. We will only use the personal data provided in connection with a Colorado Privacy Rights Request to review and comply with the request. If you do not provide this information, we may not be able to verify or complete your request in all circumstances.

If you wish to submit a verifiable consumer request on behalf of a Colorado resident (including a minor child), then we will also need sufficient information to verify that the individual is the person about whom we collected personal data and that you are authorized to submit the request on their behalf.

To Exercise Your Right to Appeal

In certain circumstances, we may decline a request to exercise the rights described above. If your request is denied, we will provide an explanation for the denial and instructions on how you may appeal a denied request. You may appeal a denied request by contacting us at compliance@xendurance.com

To Exercise Your Right to Opt-Out of Targeted Advertising, Sales, or Profiling

You do not need to create an account with us to exercise your Right to opt out of Targeted Advertising, Sales, or Profiling. However, we may ask you to provide additional personal data (including your name, email address, and mailing address) so that we can properly identify you in our dataset to facilitate the opt-out request. If you choose not to provide this information, we may only be able to process your request to the extent we can identify you in our data systems.

Once you make an opt-out request, you may change your mind and opt back into personal data sales at any time by contacting us at info@compliance.com

To exercise your right to opt out of targeted advertising, personal data sales, or profiling, please submit a request by clicking the button below:

DO NOT SELL OR SHARE MY PERSONAL DATA

In addition, as is common practice among companies that operate online, we permit third-party advertising networks, social media companies, and other third-party businesses to collect personal information directly from your browser or device through cookies or similar online tracking technologies when you visit or interact with our websites, use our apps or otherwise engage with us. For example, they may collect Internet/Network information, such as a cookie or device ID, browsing history and website usage, geolocation data, commercial information, and inferences generated from your browsing history and interactions with our service as well as other sites and services. These third parties use this information to serve more relevant ads, for ad campaign measurement and analytics, and for fraud detection and reporting and may sell or share that information with other businesses for advertising and other purposes. Please see the section entitled “Advertising/Targeted Advertising and Online Tracking; How to Opt-Out” in our Privacy Policy to learn how you may exercise your choice over this data collection for advertising purposes.

Sensitive Personal Data and Personal Data of Children Under Age 13

We will only process your Sensitive Personal Data per applicable law, including obtaining your consent before processing. We will not process the personal data of consumers we know to be less than 13 years of age unless we receive affirmative authorization from the parent or guardian of a child less than 13 years of age. If a parent, guardian, or child has provided affirmative authorization, they may opt out of future processing at any time by contacting us at compliance@xendurance.com

NONDISCRIMINATION

We do not discriminate against you in processing your data in accordance with applicable laws or for requesting any of the rights noted above. We are permitted to deny or limit your request in accordance with applicable laws.

HOW TO CONTACT US

If you have any questions, comments, or concerns concerning our privacy practices or this Notice, or wish to update your information, please feel free to contact us at compliance@xendurance.com or by mail at Xendurance, 8465 N 90th St. Suites 6-7 Scottsdale, AZ 85258

CHANGES IN NOTICE

From time to time, we may change this Notice. We will notify you of any material changes to this Notice as required by law. We will also post an updated copy of this Notice on our Platform. Please check our Platform periodically for updates.