Acumatica, Inc.
Acumatica Platform Privacy Statement

Last Updated August 2026

Purpose and Scope

Acumatica, Inc. (“ Acumatica,” “us” or “ we”) provides this services privacy statement (“ Platform Privacy Statement”) to explain how we collect, use and share your personal information and your data protection rights when you purchase or use our cloud-based enterprise resourcing platform and related services (such as our mobile application) that we provide to our customers (the “Services”).

In this Platform Privacy Statement , the organizations that have procured and contracted for our Services are referred to as our “customers”, and “users” or “you” refers to individuals authorized by our customers to use the Services Further information about our Services is available here: https://www.acumatica.com/cloud-erp-software.

References in this Platform Privacy Statement to “personal information” mean any information that directly or indirectly identifies or relates to a particular individual, and also includes information referred to as “personal data” under applicable data protection/data privacy laws . This Platform Privacy Statement provides information about our collection and use of your personal information. Depending on the jurisdiction in which you are located and applicable data protection laws , specific disclosures may apply; p lease see the heading titled ” Supplemental region -specific privacy requirements” for further jurisdiction specific disclosures, where applicable.

Please note that this Platform Privacy Statement does not apply to personal information that Acumatica processes as a processor or service provider on behalf of our customers in connection with the Services. Such activities fall outside the scope of this Platform Privacy Statement and are governed by our agreements with those customers. If you have any specific questions about information processed in this context, please contact the relevant business customer (who will be the controller of this information).

This Platform Privacy Statement also does not cover any information or data collected by Acumatica for other purposes outside of the Services. Please see our Website Privacy Statement for details on our privacy practices with respect to data collected on our websites and at events.

Quick Links

If there is a specific section of this Platform Privacy Statement that you wish to read, you can most easily navigate to that section by clicking on the appropriate link below.

1. Personal information Acumatica collects

2. How Acumatica uses personal information

3. How Acumatica shares personal information

4. Cookies and other tracking technologies

5. Links to other websites and third party functionality

6. Data retention

7. Privacy Rights

8. Minors

9. Changes to this Platform Privacy Statement

10. Contacting us 11. Supplemental region-specific privacy requirements

• EEA and UK
• California
• Canada

1. Personal information Acumatica collects

The personal information we collect from you, either directly or indirectly, will depend on how you interact with us. We collect personal information about you from the following different sources .

Sources of personal information

Information you voluntarily provide If you are a user, you may provide personal information to us through the Services. For example, when you sign up to access and use the Services, when you contact customer support (for example, to make a support request), send us an email or communicate with us in connection with the Services in any way , you may choose to provide us with certain personal information . If you communicate with us directly, we may retain a record of such communications.

Information we collect automatically When you use the Services, we collect information automatically about your web browser, mobile, or other device and use of the Services. In some countries (like those in the European Economic Area), this information may be considered personal information.

Information we process on behalf of our Customers When our customers use our Services to upload or store personal information about their customers, prospects, partners, employees and other personnel, we typically act as a processor or service provider and process such personal information on their behalf in accordance with our contract with our customer. This means such information is only processed for purposes of providing the Services and in accordance with our customer’s instructions. This Platform Privacy Statement does not cover such information . If you have questions about the use of personal information in this context, please contact the relevant customer.

Information from third parties From time to time, we may receive personal information about you from third party sources including: our affiliates; our business customers (who may provide personal information about their employee users for example); third party vendors and service providers who help us operate our business; and publicly available sources.

Categories of personal information

The table below describes the categories of personal information we collect from and about you through our Services, as well as the source of that information.

Category of Personal Information Description Source Contact Data Name, company, address, phone number, email address.

Directly from you Third parties Account/Administration Data Log-in credentials (user ID, password).

Directly from you Device and Electronic Identification Data IP address, device identifiers and attributes (e.g. hardware model, operating system, browser type and version, language, time zone, unique device identifiers ); connection information (for example, mobile operator or Internet Service Provider).

Automatic collection Location Data Longitude, latitude, GPS, IP – derived general location.

Automatic collection Bank, Transaction and Billing Data Bank and transaction data which may include bank names, bank account details, partial card numbers, transaction and merchant data.

Directly from you Third Parties Professional or Employment – Related Data Company name, job title, work email address, country, current or past job history or performance evaluations.

Directly from you Third Parties Marketing Data Email address and contact preferences.

Directly from you Troubleshooting, Support and Communications Data Troubleshooting and support requests and related data, including the content of chats and communications you have with Acumatica for support in connection with the use of our Directly from you Services, authentication data, and contact details.

Data contained in business communications with you, including emails, personalised marketing communications, and sales or account related communications.

Product Usage and Telemetry Data Service usage data, which may include page views, feature interactions, navigation patterns, time on screen, pseudonymized visitor and account IDs and related metadata (such as product edition, deployment type, and user role data). Other Service related data including crash logs, customer storage configuration settings, and technical data relating to devices accessing and using the Services and the performance of the Services in doing so. Telemetry data, including server activity telemetry logs which may contain user IDs and related technical metadata, generated through the use of the Services.

Automatic collection

2. How Acumatica uses personal information

The table below sets out the purposes for which we process your personal information (each a “Business Purpose”), and where data privacy laws (such as the GDPR) require us to identify a legal basis for such processing, the relevant legal basis for processing your personal information:

Purpose/Activity Types of Personal Information Legal Basis To provide Service and account-related communications: Advise you about any updates or changes to the Services that may be of interest to you, including certain features or functionalities o f the Services, and technical and other

• Contact Data
• Device and Electronic

Identification Data

• Location Data
• Product Usage and

Telemetry Data Legitimate Interests (in providing and administering our Services to our Customers and registered Users) administrative communications or notifications about product or Service updates.

• Troubleshooting,

Support and Communications Data To personalize our Services and to deliver content and features relevant to your interests and preferences

• Contact Data
• Device and Electronic

Identification Data

• Location Data
• Product Usage and

Telemetry Data

• Troubleshooting,

Support and Communications Data Legitimate Interests (in providing tailored and relevant features to our Customers and registered Users) For c ustomer relationship management purposes: To establish you as a Customer on our systems, including to create, maintain, customize, and secure your account with us, provide you with information on our Services that you have requested or purchased, to develop and maintain our customer relationship with you , and to communicate with you.

• Contact Data
• Bank, Transaction and

Billing Data

• Account/Administration

Data

• Product Usage and

Telemetry Data

• Troubleshooting,

Support and Communications Data Performance of a contract with you Legitimate Interest s (including fulfilling our obligations under contract to you or otherwise in connection with the administration of our customer relationship).

Execution of Service related transactions: To complete transactions and send you related information, including purchase confirmations and invoices, in order to perform our contract with you.

• Contact Data
• Account/Administration

Data

• Bank, Transaction and

Billing Data Performance of a contract with you Compliance with our Legal obligations Legitimate Interest s (including fulfilling our obligations under contract to you or otherwise in connection with the administration of our customer relationship).

Security and compliance : To protect and maintain the safety, security and integrity of our Services, databases, and other technology assets, detect

• Device and Electronic

Identification Data

• Location Data
• Account/Administration

Data Legitimate Interest s (to detect , prevent, mitigate and investigate potential risk, security issues, suspicious activity, as well as fraudulent or unauthorized security incidents , investigate and prevent fraudulent transactions, unauthorized access to the Services, and other illegal activit ies such as fraud, theft, and abuse. transactions and breaches of our policies and terms) Compliance with our Legal obligations To handle , analyze and respond to customer support requests: To respond to your inquiries, fulfil your requests and provide you with related support , including to investigate and address your concerns , monitor and improve our responses , and generate business insights and responses through our customer support interactions.

• Contact Data
• Account/Administration

Data

• Troubleshooting,

Support and Communications Data Legitimate Interest s (to communicate with you in order to resolve your customer support queries and requests , improve our responses, and generate business insights and analysis through our customer support interactions) To send m arketing and sales communications: about our products and Services, including surveys, features, newsletters, promotions events, research or evaluations we think may be of interest to you.

• Contact Data
• Device and Electronic

Identification Data

• Location Data
• Account/Administration

Data

• Marketing Data

Legitimate Interest s (to send marketing communications to you about our products and Services which may be of interest to you) Consent (where required by applicable law) Analytics and product development: analysis of personal information, including usage and telemetry data, including metadata, to develop and improve the Services and Service features.

• Device and Electronic

Identification Data

• Product Usage and

Telemetry Data

• Troubleshooting,

Support and Communications Data Legitimate Interest (to develop and improve the Services and Service features) Consent (where required by applicable law) For capacity planning and product roadmap decisions: analysis of usage and telemetry data, including server activity telemetry logs and related technical metadata, to understand resource utili zation such as storage, memory and

• Account/Administration

Data

• Device and Electronic

Identification Data

• Product Usage and

Telemetry Data Legitimate Interest (to understand resource utilization to develop and improve our capacity planning and product roadmap decisions , including through the use of aggregated data where feasible) compute usage, to inform our capacity planning and product roadmap decisions. Where feasible, we also use aggregated data for these purposes.

To comply with our legal obligations: including to respond to requests from and otherwise cooperate with law enforcement agencies, regulators, courts, and/or government authorities in accordance with our legal obligations.

• Contact Data
• Account/Administration

Data

• Device and Electronic

Identification Data

• Location Data
• Bank, Transaction and

Billing Data

• Troubleshooting,

Support and Communications Data Compliance with our Legal obligations Legitimate Interests (including to defend or pursue a dispute or legal proceeding) In the event of a possible or actual corporate transaction: including to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our users is among the assets assessed, transferred or liquidated.

• Contact Data
• Account/Administration

Data

• Device and Electronic

Identification Data

• Location Data
• Bank, Transaction and

Billing Data

• Professional or

Employment-Related Data

• Marketing Data
• Troubleshooting,

Support and Communications Data

• Product Usage and

Telemetry Data Legitimate Interests (including to further our business interests related to a corporate transaction or similar process).

3. How Acumatica shares personal information

We may disclose personal information for any of the purposes listed above with the following third parties:

Third Party Recipient Personal Information Our group companies and affiliates to assist us in providing the Services.

• Contact Data
• Account/Administration Data
• Device and Electronic Identification Data
• Location Data
• Bank, Transaction and Billing Data
• Professional or Employment-Related Data
• Marketing Data
• Troubleshooting, Support and

Communications Data

• Product Usage and Telemetry Data

Service providers and vendors: who assist us in the operation, management, improvement, research and analysis of the Services , including: cloud infrastructure and data hosting providers; an open banking information service provider ; analytics providers (including service usage analytics providers ); p ayment processors ; marketing service providers; telemetry and logging service providers; and AI service providers.

• Contact Data
• Account/Administration Data
• Device and Electronic Identification Data
• Location Data
• Transaction and Billing Data
• Product Usage and Telemetry Data
• Marketing Data
• Troubleshooting, Support and

Communications Data Financial institutions. By providing customers in the UK with access to bank feeds (for customers who choose to link their bank account(s) to their Acumatica account), Acumatica acts as an agent of Plaid. Plaid provides you with regulated account information services through Acumatica as its agent.

• Contact Data
• Account/Administration Data
• Location Data
• Transaction and Billing Data

Auditors, advisors, legal representatives in connection with the advisory services they provide to us for legitimate business purposes.

• Contact Data
• Account/Administration Data
• Professional or Employment-Related Data
• Device and Electronic Identification Data
• Location Data
• Support and Communications Data
• Transaction and Billing Data
• Product Usage and Telemetry Data

Law enforcement bodies, regulatory or governmental agencies, and/or courts, pursuant to a lawful request for information (which we may respond to in accordance w ith applicable laws or regulations) We may be requested to provide any of the personal information we hold; however, we will seek to limit to disclosures to what is necessary and lawful in the context of the request.

An a ctual or potential buyer (including its agents and advisors) in connection with a sale or business transaction, including any proposed purchase, merger or acquisition of any part of our business by a potential buyer.

• Contact Data
• Device and Electronic Identification Data
• Account/Administration Data
• Transaction and Billing Data

Any other person with your consent to the disclosure As applicable based on consent

4. Cookies and other tracking technologies

We use tracking technologies to automatically collect certain technical information from your web browser, mobile, or other device when you visit or use the Services, as further described above in the ” Information we collection automatically ” section. For further information about the types of cookies we use, why and how you can control cookies, see our Cookie Notice.

5. Links to other websites and third party functionality

The Services may contain links to other websites or applications, or other functionality or integrations not operated or controlled by Acumatica, including certain banking or financial services (“ Third Party Services”). You will generally have discretion and control over the Third Party Services with whom you elect to interact and share your information, except as otherwise provided in this Platform Privacy Statement .

These Third Party Services include API finance solutions provided by Plaid. The information that you share with Third Party Services will be governed by the specific privacy policies and terms of service of the Third Party Services and not by this Platform Privacy Statement. Please contact the Third Party Services directly for information on their privacy practices and policies.

In connection with our Service s, we use Plaid to gather your information from financial institutions. The Personal Data to which you may choose to provide us access via Plaid includes , for example, contact information, account information(s) and payments activity. Plaid provides you with regulated account information services through Acumatica as its agent. By using such feature, you grant us and Plaid the right, power, and authority to act on your behalf to access and transmit personal and financial information fro m the relevant financial institution(s). You further agree to your personal and financial information being transferred, stored, and processed by Plaid in accordance with the Plaid Privacy Policy , which is available at https://plaid.com/legal.

6. Data retention

In accordance with and as permitted by applicable law and regulations, Acumatica will retain your personal information as long as necessary to serve you, to maintain your account for as long as your account is active, or as otherwise as long as is necessary for the uses described in this Platform Privacy Statement .

For Acumatica’s hosted Services, its backup policy is set forth on the Acumatica SaaS FAQ page.

When your account expires or becomes disabled, Acumatica will retain your information for at least 30 days before it is permanently removed from all of Acumatica’s systems. Acumatica will retain information about its customers and their users as required by applicable regulations and to comply with its legal and reporting obligations, resolve disputes, enforce agreements, complete any outstanding transactions and for the detection and prevention of fraud.

7. Privacy Rights

Please see the heading ” Supplemental region -specific privacy requirements ” for further information about the specific privacy rights you can exercise depending on the jurisdiction you are in and the relevant data protection laws that apply to you.

If you wish to exercise any rights in relation to the personal information that Acumatica collects and uses about you (including rights of access, correction or deletion, where applicable), please contact us using the details provided below. Acumatica will fulfil any data protection rights requests in accordance with its obligations under applicable data protection laws.

8. Minors

The Services are not intended for anyone under the age of 18, and we do not intend to, or knowingly, collect or solicit personal information online f rom anyone under the age of 18 . If you are a parent or guardian and you believe we have collected information from your child in a manner not permitted by law, contact us using the contact details provided below under the “Contact Us” section . Acumatica will delete any personal information which it becomes aware it has received from a minor in accordance with applicable laws.

9. Changes to this Platform Privacy Statement

Acumatica will occasionally update this Platform Privacy Statement to reflect changes in Services, laws and regulations, or privacy practices, as well as customer feedback. When Acumatica posts changes to this Platform Privacy Statement , the “last updated” date at the top of this Platform Privacy Statement will be revised. If there are material changes to this Platform Privacy Statement or in how Acumatica will use your personal information, Acumatica will notify you by prominently posting a notice of such changes prior to implementing the change. Acumatica encourages you to periodically review this Platform Privacy Statement to be informed of how Acumatica is protecting your personal information.

10. Contacting Us

Acumatica welcomes your comments regarding this Platform Privacy Statement . If you have questions about this Platform Privacy Statement, please contact Acumatica at:

Email: privacy@acumatica.com Phone: 1-888-228-8300 Mail: Acumatica, Inc.

Attn: Acumatica Privacy 3075 112th Avenue NE, Suite 200 Bellevue, WA 98004 USA

Supplemental region-specific privacy requirements

EEA and UK

If you are located in the EEA or the United Kingdom, the following will be incorporated into the Platform Privacy Statement:

Legal basis for processing

If you are a resident of the EEA or the UK, we are required to explain the legal basis for processing your personal information. Our legal basis for collecting and using your personal information depend s on the personal information concerned and the specific context in which we collect it. The legal basis we rely upon for each of our processing purposes can be found above, in section 2 (” How Acumatica uses personal information”). For more general information about each of the legal bases on which we rely, please see below:

• Consent: we may use your personal information when we have your explicit consent to do so,

where required or permitted under applicable law.

• Legitimate Interests : we may use your personal information when the processing is in our

legitimate interests or the legitimate interests of a third party. Where we rely on legitimate interests, we have provided further details of the interest in question, above. Before relying on legitimate interests, we have assessed that these legitimate interests are not overridden by your data protection interests or fundamental rights and freedoms.

• Performance of a contract with you : we may use your personal information in order to perform

our obligations and otherwise fulfil a contract with have entered into with you.

• Compliance with our legal obligations: we may use your personal information in order to comply

with a legal obligation under applicable laws, or to protect your vital interests or those of another person. If we ask you to provide personal information to comply with a legal requirement, we will make this clear at the relevant time and advise you whether the provision of personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information).

For further detailed information about our legal basis for processing your personal information specific to each category of personal information, please see the section How Acumatica uses personal information above.

If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided under the “Contacting Us” heading above.

International Data Transfers

Your personal information may be transferred to, and processed in countries other than the country in which you are resident. These countries may have data protection laws that are different to the laws of your country and in some cases, may not be as protective.

Specifically, Acumatica is headquartered in the United States and we largely manage our Services from this location. The data for our Services (including personal information processed in connection with the Services) is hosted in the US, Canada and the UK with data back-ups hosted in [other locations]. This means that when we collect your personal information we will access it from and process it in the US and the other locations specified. Our service providers, who process personal information to help us provide the Services, may be located around the world. Whenever your personal data is transferred by Acumatica to a jurisdiction outside of the EEA or UK to a jurisdiction which is not recognised as being “adequate” by the European Commission of UK Government, w e have implemented appropriate safeguards , including entering into Standard Contractual Clauses approved by EEA and UK authorities where necessary to require that your personal information will remain protected in accordance with this Platform Privacy Statement and applicable data protection laws. If you have any questions about our use of Standard Contractual Clauses, please contact us using the details set out in this Platform Privacy Statement.

Specific rights for UK and EEA based visitors

You may have the following data protection rights:

• To access, correct, update or request deletion of your personal information , object to

processing of your personal information, ask us to restrict processing of your personal information or request portability of your personal information. You can exercise these rights by contacting us using the contact details provided under the “Contacting Us” heading.

• To opt-out of marketing communications we send you at any time. You can exercise this right

by clicking on the “unsubscribe” or “opt-out” link in the marketing e-mails we send you. To opt-out of other forms of marketing (such as postal marketing or telemarketing), then please contact us using the contact details provided under the “Contacting Us” heading.

• If we have collected and process your personal information with your consent, then you can

withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent .

• If you have a complaint about our handling of your personal information or the administration of

your rights, you can submit a complaint to us any time by sending an email to privacy@acumatica.com. You also have the right to complain to a data protection authority about our collection and use of your personal information. For EEA residents please use the following website: https://edpb.europa.eu/about-edpb/board/members_en. UK residents should contact the ICO whose contact details can be found at www.ico.org.uk.

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws. If you request to exercise your rights above, we may require verification of your identity before we respond to any such request. Any requests to exercise the above-listed rights may be made as specified above, via the Privacy Choices Page, or by sending an email to privacy@acumatica.com.

The data controller of your personal information is Acumatica, Inc. who can be contacted using the contact details set out in this Platform Privacy Statement.

California

If you are using the Services as a Californian resident, the following will be incorporated into the Platform Privacy Statement:

Categories of personal information we collected about California residents

In the preceding twelve (12) months, we have collected the following categories of personal information:

Category of personal information Do we collect? Do we disclose for Business Purposes? A.

Name, contact information, and other identifiers such as a real name, alias, address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers including pseudonymized visitor and account identifiers.

Yes Yes B.

Personal information categories listed in the California Customer Records statute, such as name, signature, physical characteristics or description, address, telephone number and financial information. Some personal information included in this category may overlap with other categories.

Yes Yes C.

Characteristics of protected classifications under California or federal law such as race, color, sex, age, religion, national origin, and disability.

Yes Yes D.

Commercial information such as records of products or services purchased, obtained, or considered, or other purchasing or use histories or tendencies.

Yes Yes E.

Biometric Information such as physiological or behavioral characteristics that can be used alone or in combination with each other to establish individual identity, including facial recognition (subject to applicable laws and where relevant to the Services we provide to you).

Yes Yes F.

Usage data such as internet or other electronic network activity information, including, but not limited to, browsing history, clickstream data, search history, page views, navigation patterns, time on screen, related metadata, and information regarding a resident’s interaction with an internet website, application, or advertisement. Usage data may also telemetry data generated through use of the Services, including server activity telemetry logs that may contain user IDs and related technical metadata.

Yes Yes G. Geolocation data such as precise geographic location information about a particular individual or device. Yes Yes H.

Audio, video, sensory and other electronic data: audio, electronic, visual, or similar information such as, video footage, photographs, and call recordings.

Yes Yes I. Professional or employment-related information, such as current or past job history or performance evaluations. Yes Yes J.

Non-public education information, such as education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.

Yes Yes K.

Profiles and Inferences such as inferences drawn from Personal Information to create a profile reflecting a resident’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes.

Yes Yes L.

Information qualified as “sensitive personal information” under California law, such as social security number, driver’s license, state identification number, passport number, financial information, precise geolocation, racial and ethnic origin (when hired for a position), the contents of communications where Acumatica is not an intended recipient, personal information collected and analyzed concerning health and other similar information.

Yes Yes If you have specific questions about the personal information that we collect about you or would like to exercise any of your privacy rights, please see the section below titled ” Exercising Your Rights ” for the different ways you can contact us.

Categories of sources of personal information that we collect

• Directly from you. For example, when you sign up to access and use the Services, when you contact

customer support or send us an email or communicate with us in connection with the Services in any way (for example, to make a support request).

• Directly and indirectly from activ ity on our Services . The section “Information we collect

automatically” above describes the types of data that we collect.

• Service p roviders who provide services on our behalf such as those used to assist us in the

operation, management, improvement, research and analysis of the Services, including cloud infrastructure and data hosting providers, open bank ing information service provider, analytics providers, product usage analytics providers , payment processors , marketing service providers , telemetry logging service providers, and AI service providers.

Business or commercial purposes

We may use the personal information identified above for one or more Business Purposes identified in the section “How Acumatica uses personal information” above.

Sale or sharing of personal information

When we disclose personal information for a Business Purpose, we enter into a contract that describes the purpose and requires the recipient (i.e. the service provider under CCPA) to keep that personal information confidential and use only for performance of the contract, and not for any other purpose. We share or make your information available, including any personal information, in the circumstances described below.

We do not sell your personal information to third parties for business or commercial purposes , nor do we share personal information for cross-context behavioral advertising purposes, as those terms are defined under the CCPA . Accordingly, we do not knowingly sell or share the personal information of consumers under 16 years of age.

We may disclose personal information that we collect and use , as described in this Platform Privacy Statement and any other applicable privacy notices or opt -ins that you receive , to the following categories of third parties:

• Analytics providers, including products analytics providers and telemetry logging providers;
• Payment processors;
• Open banking information service provider;
• Other third party marketing service providers;
• AI service providers;
• Financial institutions, if you choose to link your Acumatica account with your bank account(s); and
• Affiliated persons or third -party service providers assisting us in the operation, management,

improvement, research and analysis of the Services. Affiliated persons or our third party service providers may augment, extend, and combine non-personally identifiable information with data from additional third party sources in order to assist us with the above. Use of information by affiliated persons and third party service providers will be subject to this Platform Privacy Statement or an agreement that is at least as restrictive as this Platform Privacy Statement.

In the preceding twelve (12) months, we have disclosed the following categories of personal information for the purposes described in this Platform Privacy Statement ‘s Section titled ” How Acumatica uses personal information”:

• Category A: Identifiers such as those set forth above;
• Category B: Personal information categories listed in the California Customer Records statute
• Category F: Usage data, including Internet or other electronic network activity information;
• Category C: Demographic information / Classification characteristics;
• Category D: Commercial information;
• Category G: Geolocation data;
• Category H: Audio, video and other electronic data; and
• Category K: Profiles and inferences.

By way of reminder, personal information under California law does not include:

• Publicly available information from government records;
• De-identified or aggregated consumer information; and
• Information excluded from the scope of the California Consumer Privacy Act (“CCPA”), as amended

by the California Privacy Rights Act (CPRA), including, without limitation:

• Health or medical information covered by the Health Insurance Portability and

Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data; and

• personal information covered by certain sector -specific privacy laws, including the Fair

Credit Reporting Act (FRCA), the Gramm -Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.

Data protection rights for Californian residents

Right to Access Information and Data Portability Right You may have the right under the CCPA to request that we disclose certain information to you about our collection and use of your personal information over the past twelve (12) months. Once we receive and confirm your verifiable consumer request, we will disclose to you:

• The categories of personal information that we have collected about you.
• The categories of sources for the personal information that we have collected about you.
• Our business or commercial purpose for collecting or making available that personal information.
• The categories of third parties with whom we share that personal information.
• The specific pieces of personal information that we have collected about you (also called a data

portability request).

• If we disclosed your personal information for a Business Purpose, the Business Purpose for which

such personal information was disclosed, and the personal information categories that each category of recipient obtained.

• If applicable, (1) the categories of your personal information that we have made available for

valuable consideration; (2) the categories of third parties to whom such personal information was made available; and (3) the category or categories of personal information that we have made available to each category of third parties.

You also have a right to know if we have sold or shared your personal information for a business purpose.

As mentioned above, we do not sell your personal information to third parties for business or commercial purposes, nor do we share personal information for cross-context behavioral advertising purposes.

Right to Delete You may have the right under the CCPA to request that we delete any of your personal information that we have collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.

We may deny your deletion request if retaining the information is necessary for us or our service provider(s) or vendor(s) to:

• Complete the transaction for which we collected the personal information, provide a good or service

that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.

• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or

prosecute those responsible for such activities.

• Debug products to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or

exercise another right provided for by law.

• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et.

seq.).

• Engage in public or peer -reviewed scientific, historical, or statistical research in the public interest

that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the rese arch’s achievement, if you previously provided informed consent.

• Enable solely internal uses that are reasonably aligned with consumer expectations based on your

relationship with us.

• Comply with a legal obligation or legal order.
• Make other internal and lawful uses of that information that are compatible with the context in which

you provided it.

Right to Correct Inaccurate Personal Information You have the right to request that we correct inaccurate personal information that we maintain about you.

We will take into account the nature of the personal information and the purposes for which we process it.

We may require documentation from you in order to process your request, including your name, email address, phone number, and request details.

Right to Opt-Out of Sale or Sharing of Personal Information We do not sell your personal information to third parties for business or commercial purposes , nor do we share personal information for cross-context behavioral advertising purposes, as those terms are defined under the CCPA. We also do not knowingly sell or share the personal information of consumers under 16 years of age.

Right to Limit the Use of Sensitive Personal Information We do not process information that is subject to this limitation.

Right to not receive discriminatory treatment You have the right to not receive discriminatory treatment for exercising your CCPA privacy rights. We do not use the fact that you have exercised or requested to exercise any CCPA rights for any purpose other than facilitating a response to your request.

Exercising Your Rights

To exercise the access , correction, data portability, and deletion rights described above, or to access this policy in an alternative format, please submit a verifiable consumer request to us by:

• Completing and submitting a web form located here: https://www.acumatica.com/access-correct-

delete-my-information-request/

• Sending us an e-mail at privacy@acumatica.com: Once we receive your request, we are required

to verify that you are the person that is the subject of the request. The verification process consists of matching identifying information provided by you with the information we have about you in our records. Upon making a request, you will be asked to provide your name, email address, phone number, and request details. A confirmation email will be sent to the email address you provide to begin the process to verify your identity. If we cannot verify your identity, we will not be able to respond to your request.

Only you, or an authorized agent that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. We may also request that your authorized agent ha s written permission from you to make requests on your behalf, and we may also need to verify your authorized agent’s identity to protect your personal information.

You may only make such a request for access or data portability twice within a twelve (12) month period.

The verifiable consumer request must provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative, and describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

We will respond to verifiable requests received from California residents as required by law. Any disclosures we provide will only cover the twelve (12) month period preceding the verifiable consumer request’s receipt.

The response we provide will also exp lain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination

As mentioned above, w e will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or

other benefits, or imposing penalties.

• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or

quality of goods or services.

However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your personal information’s value and cont ain written terms that describe the program’s material aspects.

Participation in a financial incentive program requires your prior opt in consent, which you may revoke at any time.

California Shine the Light Law

California Civil Code § 1798.83 permits users who are California residents to obtain from us once a year, free of charge, a list of third parties to whom we have disclosed personal information (if any) for direct marketing purposes in the preceding calendar year. If you are a California resident and you wish to make such a request, visit the Privacy Choices Page or send an e -mail with “California Privacy Rights” in the subject line to privacy@acumatica.com. In your request, please attest to the fact that you are a California resident and provide a current California address. We will reply to valid requests by sending a response to the email address or physical address from which you submitted your request. Please note that not all information sharing is covered by the “Shine the Light” requirements and only information on covered sharing and the relevant details required by the Shine the Light law will be included in our response.

Minors If you are a California resident who is under age 18 and you are unable to remove publicly-available content that you have submitted to us, you may request removal by contacting us at: privacy@acumatica.com.

When requesting removal, you must specify the information you want removed and provide us with specific information, such as the URL for each page where the information was entered, so that we can find it. We are not required to remove any content or inf ormation that: (1) federal or state law requires us or a third party to maintain; (2) was not posted by you; (3) is anonymized so that you cannot be identified; (4) you do not follow our instructions for removing or requesting removal; or (5) you received compensation or other consideration for providing the content or information. Removal of your information from the Services does not ensure complete or comprehensive removal of that information from our systems or the systems of our service providers. Please note that we are not required to delete information posted by you; our obligations under California law are satisfied so long as we anonymize the information or render it invisible to other users and the public.

Canada

If you are using the Services as a Canadian resident, the following will be incorporated into the Platform Privacy Statement:

The Services and our privacy practices are compliant with The Personal Information Protection and Electronic Documents Act (“PIPEDA”) fair information principles. In addition to the disclosures made above, we:

• Have appointed a privacy officer to monitor our compliance with PIPEDA.
• Only collect personal information for the uses described herein.
• Only use and disclose personal information as described herein.
• Take reasonable steps to verify the accuracy of the personal information that we collect.
• Take appropriate safeguards to protect the personal information, as further described herein.

Data protection rights for Canadian residents

You have the right to request access to the existence, use and disclosure of your personal information .

Additionally, you have the right to challenge the accuracy and completeness of the information and request to have it amended as appropriate. Finally, you have the right to challenge Acumatica’s compliance with the PIPEDA fair information principles by con tacting our privacy officer. To exercise your rights under this Section, please send an e-mail to privacy@acumatica.com or write us at the address listed above.