BLOOMREACH CALIFORNIA PRIVACY NOTICE

Last Updated: February 18, 2026 

This California Privacy Notice (“Notice”) supplements the Bloomreach Privacy Policy and applies solely to California residents. This Notice describes how Bloomreach, Inc. (“Bloomreach,” “we,” or “us”) collects, uses, discloses, and retains personal information, and explains your rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”).

1. Our Role Under the CCPA

Bloomreach acts in two capacities under the CCPA:

As a Business. When we collect personal information about visitors to our websites (such as bloomreach.com), marketing contacts, event attendees, job applicants, employees, and vendors, we act as a “business” and determine how that information is used. This Notice describes our practices in that capacity.

As a Service Provider. When we process personal information on behalf of our customers through our Discovery, Content, and Engagement products, we act as a “service provider.” In that capacity:

• We process personal information only as directed by our customers pursuant to written agreements
• We do not sell or share customer data for our own commercial purposes
• We do not combine personal information collected from one customer’s digital properties with data from another customer’s properties
• We do not track consumers across unrelated third-party websites or online services

If you are a consumer who interacted with a Bloomreach customer’s website or application and wish to exercise your CCPA rights regarding that data, please contact that business directly. They control the personal information collected through their digital properties and are responsible for responding to your requests.

2. Personal Information We Collect

Category	Examples	Sources	Business Purpose	Disclosed To
Identifiers	Name, email address, postal address, phone number, IP address, device identifiers, unique device identification numbers, account name, hashed email addresses	You; automatic collection; marketing providers; conference and co-sponsored events; publicly available sources	Providing services; account management; marketing; analytics; security	Authorized service providers; advertising partners (including Google); Bloomreach affiliates
Customer Records (Cal. Civ. Code § 1798.80(e))	Name, address, telephone number, credit card details, billing address, employment information	You	Processing transactions; providing services; account management	Service providers; payment processors
Commercial Information	Products or services purchased, purchase history, transactional records, preferences	You; automatic collection	Service delivery; personalization; marketing; analytics	Service providers
Internet/Network Activity	Browsing history, search history, pages accessed, links clicked, interactions with websites and emails, page load times, crash logs, referring URLs	Automatic collection (cookies, pixels, log files)	Analytics; personalization; advertising; improving services; security	Service providers; advertising partners
Geolocation Data	Approximate location derived from IP address; country or city-level location	Automatic collection	Content localization; analytics; security	Service providers
Professional/Employment Information	Job title, employer, department, organization name, country, professional history	You; third-party business data providers; conference events	Marketing; providing services; recruitment	Service providers
Inferences	Profiles reflecting preferences, characteristics, interests, and behavior predictions derived from other personal information	Derived internally from information listed above	Personalization; predictive marketing; targeted advertising	Service providers
Sensitive Personal Information	Account login credentials combined with required security or access credentials	You	Account security; authentication	Service providers
Communications	Communications between you and Bloomreach regarding inquiries, support, feedback, and marketing responses	You; automatic collection	Responding to inquiries; providing support; improving services	Service providers

3. How We Use Personal Information

We use personal information for the following business and commercial purposes:

• Providing, maintaining, and improving our products, services, and websites
• Processing transactions and fulfilling requests
• Creating and managing accounts
• Responding to inquiries and providing customer support
• Communicating with you about services, updates, and promotional offers
• Personalizing your experience on our websites and in our products
• Conducting analytics and research to improve our offerings
• Marketing and advertising, including serving personalized advertisements
• Measuring the effectiveness of our marketing campaigns
• Detecting, preventing, and responding to security incidents, fraud, and illegal activity
• Debugging and repairing errors in our products and services
• Complying with legal obligations
• Exercising and defending legal claims
• As otherwise disclosed to you at the time of collection

We do not use personal information for purposes materially different from those disclosed without providing you notice.

4. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients:

• Bloomreach Group Companies. We share personal information with companies owned or controlled by Bloomreach. These companies use personal information in the same way we can under this Notice. A list of Bloomreach group companies is available at bloomreach.com/en/legal/group-companies.
• Service Providers. We share personal information with third-party service providers who perform services on our behalf, including hosting, analytics, payment processing, customer support, marketing tools, event management, communication platforms, and data storage. A list of our subprocessors is available at bloomreach.com/en/legal/subprocessors.
• Advertising Partners. We share personal information with advertising partners, including Google, to serve personalized advertisements and measure advertising effectiveness. For details on how Google uses personal information, see Google’s Business Data Responsibility policy at business.safety.google/privacy.
• Marketing Partners. We share personal information with marketing partners for co-branded or co-sponsored events and promotions.
• Professional Advisors. We share personal information with legal counsel, accountants, auditors, and consultants as needed.
• Government Entities. We disclose personal information to law enforcement, regulatory agencies, courts, or other government bodies when required by law or to protect our legal rights.
• Transaction Parties. We may transfer personal information to a potential buyer or successor in connection with a merger, acquisition, or sale of assets.
• With Your Consent. We may disclose personal information to other parties with your consent, such as posting testimonials you have authorized.

5. Sale and Sharing of Personal Information

Sale. Bloomreach does not sell personal information for monetary consideration.

Sharing. Bloomreach shares certain personal information with advertising partners for cross-context behavioral advertising purposes. Specifically, we share identifiers (such as device identifiers, cookie data, and hashed email addresses) and internet activity information (such as browsing behavior and interactions with our websites) with advertising partners, including Google. This allows our partners to recognize your device and deliver personalized advertisements to you across devices and browsers. Under the CCPA, this constitutes “sharing.”

Opt-Out. You have the right to opt out of sharing. To exercise this right:

• Click “Do Not Sell or Share My Personal Information” in our website footer
• Submit a request at bloomreach.com/en/legal/control-your-data
• Enable Global Privacy Control (GPC) or another browser-based opt-out preference signal, which we will process as a valid opt-out request for that browser

6. Sensitive Personal Information

We collect account login credentials as sensitive personal information solely for account security and authentication purposes. We do not use sensitive personal information for purposes beyond those permitted by the CCPA, such as inferring characteristics about you.

You have the right to limit our use of sensitive personal information to purposes necessary to perform the services you request. Because our current use is already limited to such purposes, no action is required. If you wish to confirm or modify these preferences, you may submit a request as described in Section 9.

7. Profiling and Automated Decision-Making

Bloomreach may use automated processing to analyze personal information and create profiles reflecting your preferences, characteristics, and predicted interests. We use these profiles to:

• Personalize content and recommendations on our websites
• Deliver targeted advertisements that may be more relevant to you
• Help our customers personalize their communications with their own consumers (when we act as a service provider)

You have the right to:

• Opt out of profiling for purposes of targeted advertising by submitting an opt-out request or enabling Global Privacy Control
• Request information about the logic involved in automated decision-making processes that produce legal or similarly significant effects concerning you

We do not use automated decision-making to make decisions that produce legal or similarly significant effects without human involvement.

8. Retention

We retain personal information for as long as reasonably necessary to fulfill the purposes for which it was collected, including:

• Providing requested products and services
• Maintaining business records for legal and operational purposes
• Complying with legal, accounting, and reporting obligations
• Resolving disputes and enforcing agreements

The retention period depends on the nature of the data and the legal basis for processing. For data processed based on consent, we retain it until you withdraw consent. For data processed to perform a contract, we retain it for the duration of the relationship plus any applicable limitation period. For data retained to comply with legal obligations, we follow retention periods prescribed by applicable law.

When personal information is no longer needed, we securely delete or anonymize it.

9. Your California Privacy Rights

If you are a California resident, you have the following rights:

Right to Know. You may request that we disclose:

• The categories of personal information we collected about you
• The categories of sources from which we collected your personal information
• Our business or commercial purposes for collecting, selling, or sharing your personal information
• The categories of third parties to whom we disclosed your personal information
• The specific pieces of personal information we collected about you

Right to Delete. You may request that we delete your personal information, subject to certain exceptions. We may deny your request if retaining the information is necessary to:

• Complete a transaction or provide a service you requested
• Detect and protect against security incidents, fraud, or illegal activity
• Debug or repair errors in our systems
• Exercise free speech or another legal right
• Comply with a legal obligation
• Conduct research in the public interest (with appropriate safeguards)
• Enable solely internal uses reasonably aligned with your expectations

Right to Correct. You may request that we correct inaccurate personal information we maintain about you, taking into account the nature of the information and the purposes of processing.

Right to Opt Out of Sale/Sharing. You may direct us not to sell or share your personal information for targeted advertising purposes.

Right to Limit Use of Sensitive Personal Information. You may limit our use of sensitive personal information to purposes necessary to provide the services you request. Our current use is already limited to such purposes.

Right to Know About Automated Decision-Making. You may request meaningful information about the logic involved in automated decision-making processes and the likely outcome of such processes with respect to you.

Right to Non-Discrimination. We will not discriminate against you for exercising your privacy rights. We will not deny you services, charge you different prices, provide a different quality of service, or retaliate against you for exercising any right under the CCPA.

10. How to Submit a Request

To exercise your rights, you may:

• Online: bloomreach.com/en/legal/control-your-data
• Phone: 1-888-263-3917 (toll-free)
• Email: [email protected]

11. Verification

When you submit a request to know, delete, or correct personal information, we will verify your identity before processing the request. We verify your identity via email by asking you to confirm information that matches what we have on file, such as the email address associated with your account or other identifying details you previously provided to us.

12. Authorized Agents

You may designate an authorized agent to submit requests on your behalf. To do so:

• Provide the agent with signed, written permission authorizing them to act on your behalf
• Verify your identity directly with us (unless the agent has a valid power of attorney under California Probate Code sections 4121 to 4130)

We may deny requests from agents who do not provide adequate proof of authorization.

13. Response Timing

We will acknowledge your request within 30 business days of receipt.

We will respond to verifiable requests to know, delete, or correct within 45 calendar days. If we require additional time (up to 90 days total), we will notify you in writing of the reason and the expected response date.

We will process requests to opt out of sale/sharing within 30 business days.

14. Financial Incentives

Bloomreach does not offer financial incentives for the collection, sale, retention, or deletion of personal information.

15. Contact Us

If you have questions about this Notice or our privacy practices:

Bloomreach, Inc. Attn: Privacy Team / Data Protection Officer 700 E. El Camino Real, Suite 130 Mountain View, CA 94041

Email: [email protected] Phone: 1-888-263-3917

16. Changes to This Notice

We may update this Notice to reflect changes in our practices or applicable law. When we make material changes, we will update the “Last Updated” date and post the revised Notice on our website. We encourage you to review this Notice periodically.