incidents, delete or return personal data at the end of the Term as stated in section 7(c), and impose the same duties on Sub-processors listed in Annex III. CPA consumer rights (Colorado residents). If RELAYTO Limited is the controller for your data, or if we can fulfill the request on a Customer's behalf, a Colorado resident may: (1) access personal data; (2) correct inaccuracies; (3) delete personal data; (4) obtain a portable copy; (5) opt out of targeted advertising; (6) opt out of the sale of personal data; and (7) opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. How to submit a request. Email support@relayto.com with the subject line "Colorado privacy request," "California privacy request," or "US state privacy request." Say which right you want to use and how we can verify you (account email is enough in most cases). If you are an authorized agent, attach proof of authority. RELAYTO Limited will log the request, confirm receipt, and respond within 45 days. We may extend once by 45 days if the request is complex, and we will tell you why. That mailbox is the intake for CPA, CCPA/CPRA, and other US state consumer requests described in this addendum. CPA appeal. If we deny a Colorado resident's request, you may appeal within a reasonable time by emailing support@relayto.com with the subject line "Colorado privacy appeal." We will decide the appeal within 45 days (extendable by 60 days if reasonably necessary) and explain the outcome in writing. If we deny the appeal, we will tell you how to contact the Colorado Attorney General. Sale, targeted advertising, and profiling. RELAYTO Limited does not sell personal data for money. RELAYTO Limited does not use RELAYTO AI personal data for third-party cross-context targeted advertising. RELAYTO Limited does not profile consumers to make legal or similarly significant decisions about them. If that changes, we will update this addendum and offer an opt-out before the new use starts. Universal opt-out. For any processing that becomes targeted advertising or a sale under the CPA, RELAYTO Limited will honor a recognized universal opt-out mechanism, including the Global Privacy Control signal, as required by Colorado rule. Sensitive data. The Services do not require CPA sensitive data (race, ethnicity, religion, mental or physical health, sex life or sexual orientation, citizenship or immigration status, genetic or biometric data used for identification, children's data, or precise geolocation). Customer must not upload that data unless the Customer has a lawful basis, including consent where the CPA requires it, and the parties have agreed in writing. Children. RELAYTO AI is not for children under 13. Customer must not allow users under 13. Colorado treats data of a known child under 13 as sensitive data. Data protection assessments. RELAYTO Limited will conduct and maintain a data protection assessment for processing that the CPA treats as higher risk (including any future targeted advertising, sale, certain profiling, or sensitive-data processing) and will produce that assessment to the Colorado Attorney General on lawful request. California (CCPA / CPRA). California residents may request to know, delete, or correct personal information, and to opt out of sale or sharing, through the same email. RELAYTO Limited does not sell or share personal information as those words are defined in the CCPA. We will not discriminate against a consumer for exercising a CCPA right. We will confirm receipt and respond within the CCPA statutory period (45 days, one 45-day extension). CPRA notice at collection (when RELAYTO Limited is the business). Categories collected: identifiers (name, email, account id); commercial information (subscription and billing metadata); internet or electronic activity (app usage, device and IP data used for security and product analytics); professional information if 14 of 53