Last Updated: July 21st, 2020

This California Consumer Privacy Act Addendum provides additional details regarding our collection, use, and disclosure of Personal Information relating to California residents, pursuant to the California Consumer Privacy Act of 2018 (“CCPA”).  This Addendum does not apply to our job applicants, employees, contractors, owners, directors, or officers where the Personal Information we collect about those individuals relates to their current, former, or potential role at our company.  For purposes of this Addendum, “Personal Information” means information that identifies, relates to, or could reasonably be linked with a particular California resident or household.  

Collection of Personal Information

We plan to collect, and have collected within the preceding 12 months, the following categories of Personal Information, as listed in the CCPA:

• “Identifiers.” Identifiers such as name, postal address (including billing and shipping addresses), telephone number, email address, username, unique identifier assigned to your Equipment, and certain Personal Information from your social media account that you share with us if you connect your social media account to your Services account with us, and IP address.
• “Customer Records Information.” Personal information as defined in the California customer records law, such as name, contact information, and credit and debit card number.
• “Protected Class Information.” Characteristics of protected classifications under California or federal law, such as age (date of birth), gender, gender identity, or sex, and disabilities such as physical limitations.
• “Transaction Information.” Commercial information, such as transaction information and purchase history.
• “Online Use Information.” Internet or network activity information, such as history of online Equipment use, including frequency and length of workouts, workout start and end times, exercises performed, the number of sets and repetitions for each exercise and the amount of weight lifted, and your interactions with our Services and other users with whom you share the Equipment or with whom you connect and interact through the Services.
• “Geolocation Data.”  Geolocation data such as approximate location derived from IP address.
• “Audio/Video Data.” Audio, electronic, and visual information, such as your profile picture, other images or videos you have uploaded to the Services, and telephone call recordings.
• “Inferences.” Inferences drawn from any of the Personal Information listed above to create a profile about, for example, an individual’s fitness level, regimen, goals, and preferences.

We collect this Personal Information from you and the third-party devices you have chosen to integrate with our Services and from our data analytics providers, third-party ad networks, and joint marketing partners. 

Use of Personal Information

We may use this Personal Information for the purposes described in “Use of Personal Information” and “Other Uses and Disclosures,” above.

Disclosure of Personal Information

We share Personal Information with the following categories of third parties: 

• “Service Providers.” Our trusted third party service providers carry out activities at our direction, such as website hosting, data analysis, payment processing, order fulfillment, information technology and related infrastructure provision, customer service, email delivery, auditing, and other services.  
• “Connected Applications.” If you enable third-party products or applications, such as Apple Health or Strava, to track your workouts with our Equipment, Apps, or other Services, we share Personal Information with the providers of those third-party products and applications.
• “Ad Networks.” We share Personal Information with third-party ad networks to permit them to serve advertisements regarding goods and services that may be of interest to you when you access and use the Services and other websites or online services.
• “Promotion Sponsors.” We share Personal Information with third-party sponsors of sweepstakes, contests, and similar promotions. 
• “Equipment Owner.” When you log in to your account on Equipment that you do not own, we share your Personal Information with the Equipment owner; in this case, the information shared with the Equipment owner may include your name, email, Equipment use history and metrics.
• “Social Media.” When you connect your social media account and share your activity, we share Personal Information with your friends associated with your social media account, other website users and your social media account provider. By connecting your Services account and your social media account, you authorize us to share information with your social media account provider, and you understand that the use of the information we share will be governed by the social media site’s privacy policy.
• “Public Audience.” When you post information and materials on message boards, chat, profile pages, blogs and other services on which you are able to post. Please note that any information you post or disclose through these services will become public information.
• “Legal Authorities.” We may share Personal Information to cooperate with public and government authorities, including law enforcement, and to protect and defend our legal rights and those of others. 

In the preceding 12 months, we disclosed for our operational business purposes the following categories of Personal Information to the following categories of third parties:

Categories of Personal Information	Disclosed to Which Categories of Third Parties for Operational Business Purposes
Identifiers	Service Providers; Connected Applications; Equipment Owner; Social Media; Public Audience; Legal Authorities
Customer Records Information	Service Providers; Equipment Owner; Social Media; Public Audience; Legal Authorities
Protected Class Information	Service Providers; Connected Applications
Transaction Information	Service Providers; Social Media
Online Use Information	Service Providers; Connected Applications; Equipment Owner; Social Media; Public Audience
Geolocation Data	Service Providers; Connected Applications; Equipment Owner; Social Media; Legal Authorities
Audio/Video Data	Service Providers; Connected Applications; Social Media; Public Audience; Legal Authorities
Inferences	Service Providers

Sale of Personal Information

We have not “sold” Personal Information for purposes of the CCPA, including, to our knowledge, the Personal Information of minors under 16.  For purposes of this Addendum, “sold” or “sale” means the disclosure of Personal Information for monetary or other valuable consideration, subject to certain exceptions.

Your CCPA Rights

Requests to Know and Delete

If you are a California resident, you may make the following requests:

(1)  “Request to Know”

You may request that we disclose to you the following information covering the 12 months preceding your request: 

• The categories of Personal Information we collected about you and the categories of sources from which we collected such Personal Information;
• The specific pieces of Personal Information we collected about you; 
• The business or commercial purpose for collecting Personal Information about you; and 
• The categories of Personal Information about you that we otherwise shared or disclosed, and the categories of third parties with which we shared or to which we disclosed such Personal Information (if applicable). 

(2)  “Request to Delete”

You may request that we delete Personal Information we collected from you.

To make a Request to Know or Request to Delete, please contact us at 855.698.6625 or support@tonal.com.  We will verify and respond to your request consistent with applicable law, taking into account the type and sensitivity of the Personal Information subject to the request.  We may need to request additional Personal Information from you, such as name, email address, state of residency, and zip code, in order to verify your identity and protect against fraudulent requests.  If you maintain a password-protected account with us, we may verify your identity through our existing authentication practices for your account and require you to re-authenticate yourself before disclosing or deleting your Personal Information. If you make a Request to Delete, we may ask you to verify your request before we delete your Personal Information.  We will respond to your Request to Know or Request to Delete consistent with applicable law.

Right to Non-Discrimination

You have the right to be free from unlawful discrimination for exercising your rights under the CCPA.

Authorized Agents

If you want to make a request as an authorized agent on behalf of a California resident, you may use the submission methods noted above.  As part of our verification process, we may request that you provide, as applicable: 

• Proof of your registration with the California Secretary of State to conduct business in California;
• A power of attorney from the California resident pursuant to Probate Code sections 4000-4465;
• Written permission that the California resident has authorized you to make a request on the resident’s behalf.  This permission must be signed (via physical or e-signature) by the California resident. 

If you are making a Request to Know or a Request to Delete on behalf of a California resident and have not provided us with a power of attorney from the resident pursuant to Probate Code sections 4000-4465, we may also require the resident to:

• Provide you with a written permission signed by the resident to make the Request to Know or Request to Delete on the resident’s behalf;
• Verify the resident’s own identity directly with us;
• Directly confirm with us that the resident provided you permission to submit the Request to Know or Request to Delete.

Contact Us

Please contact us at support@tonal.com, if you have any questions regarding this CCPA Addendum.