U.S. State Privacy Rights Addendum
This Addendum applies to residents of U.S. states that have enacted comprehensive consumer privacy laws. It describes the categories of personal information we handle, the rights available to you, and how to exercise them. Terms used here that are defined in an applicable state privacy law have the meaning given in that law.
OnVirtu is primarily a business-to-business distributor. Much of the information we handle relates to individuals acting on behalf of a business. Some state laws exempt business-to-business contact information; where an exemption applies, the rights below may be limited. We will tell you if we deny a request on that basis.
1. Categories of personal information we collect
In the preceding twelve (12) months, we have collected the following categories of personal information. The categories below use the definitions in the California Consumer Privacy Act, as amended (the "CCPA").
A. Identifiers
What we collect: Name, postal address (billing and shipping), email address, telephone number, mobile number, account username, IP address, unique online identifiers
Where it comes from: Directly from you; automatically from your device; from our resellers and referral partners
Disclosed for a business purpose to: Hosting and IT providers, CRM and email providers, payment processors, carriers and fulfillment providers, professional advisers
B. Customer records (Cal. Civ. Code § 1798.80)
What we collect: Name, address, telephone number, and payment card or bank account information. Full card and bank account numbers are collected by our payment provider, Stripe, and are not stored by us.
Where it comes from: Directly from you; from Stripe
Disclosed for a business purpose to: Stripe, fulfillment providers, accounting providers
C. Commercial information
What we collect: Products and services purchased, quotes requested, trial equipment issued, order and RMA history, purchasing preferences
Where it comes from: Directly from you; generated through your transactions with us
Disclosed for a business purpose to: CRM provider, fulfillment providers, manufacturers for warranty and RMA handling
D. Internet or network activity
What we collect: Pages viewed, referring and exit pages, clickstream data, date and time of visit, search terms, error logs, interactions with our emails
Where it comes from: Automatically through cookies, tags and analytics tools
Disclosed for a business purpose to: Analytics providers, hosting provider, advertising partners
E. Geolocation data
What we collect: Approximate location derived from your IP address (city or region level). We do not collect precise geolocation.
Where it comes from: Automatically from your device
Disclosed for a business purpose to: Analytics providers, hosting provider
F. Audio, electronic and visual information
What we collect: The content of emails, text messages, contact form submissions and recorded support calls where applicable
Where it comes from: Directly from you
Disclosed for a business purpose to: Email, SMS and customer service providers
G. Professional or employment information
What we collect: Company name, job title, business role, fleet or deployment details you share with us
Where it comes from: Directly from you; from your employer; from publicly available business sources
Disclosed for a business purpose to: CRM provider, professional advisers
H. Inferences
What we collect: Preferences and product interests drawn from your interactions with us
Where it comes from: Generated by us from the categories above
Disclosed for a business purpose to: CRM and marketing providers
I. Sensitive personal information
What we collect: Account log-in credentials in combination with a password. We do not collect government identifiers, racial or ethnic origin, religious beliefs, union membership, health data, biometric data, genetic data, precise geolocation, or the contents of mail or messages not directed to us.
Where it comes from: Directly from you
Disclosed for a business purpose to: Hosting and IT providers
We do not collect the following CCPA categories: protected classification characteristics under California or federal law; biometric information; or education information.
2. Why we collect it
We use each category above for the business and commercial purposes described in the "How We Use Personal Information" section of our Privacy Policy, including to fulfill orders and provide our services, to administer accounts and trial equipment, to provide customer support, to send administrative and marketing communications, to secure our systems and prevent fraud, to comply with legal obligations, and to analyze and improve our business.
3. Sale, sharing and targeted advertising
We do not sell personal information for money.
However, we use analytics and advertising technologies that may disclose identifiers and internet activity information to third-party advertising partners in a way that qualifies as a "sale" or "share" for cross-context behavioral advertising under the CCPA, and as "targeted advertising" under other state privacy laws. Where that occurs, it involves Category A (identifiers) and Category D (internet or network activity).
We do not sell or share the personal information of consumers we know to be under 16 years of age.
SMS opt-in data and consent information will not be shared or sold to third parties for promotional or marketing purposes. Mobile numbers, opt-in records and text message content collected through our text messaging program are excluded from the "sale" and "sharing" described above, are not used for targeted advertising, and are disclosed only to the messaging provider that delivers the messages on our behalf. This applies regardless of any consent given elsewhere. See our SMS Terms and Conditions.
We do not use or disclose sensitive personal information for purposes other than those permitted under CCPA § 1798.121(a), so the right to limit the use of sensitive personal information does not apply to our processing.
How to opt out
Cookie controls. Use the cookie banner shown on your first visit, or the "Manage cookies" option available on our site, to decline non-essential cookies.
We are working to recognize opt-out preference signals such as Global Privacy Control. In the meantime, please use the cookie controls or submit a request as described below
Submit a request. Email contact@onvirtu.com with the subject line "Do Not Sell or Share My Personal Information."
Third-party industry tools. You can also use the opt-out tools offered by the Network Advertising Initiative and the Digital Advertising Alliance.
4. How long we keep personal information
We retain each category of personal information for as long as needed for the purpose it was collected, and then for the period required by our legal, tax, accounting and recordkeeping obligations. In practice this means:
Order, invoice and trial equipment records: the life of the customer relationship plus 7 years, to meet tax and warranty recordkeeping obligations.
Account and contact records: for as long as your account is open, and then up to 24 months.
Marketing contact records: until you unsubscribe, and then only as needed to honor your opt-out.
Website analytics and log data: up to 26 months.
Support correspondence: up to 36 months.
Where longer retention is required by law, or is necessary to establish, exercise or defend legal claims, we keep the information for that longer period.
5. Your rights
Depending on your state of residence, you may have some or all of the following rights:
Right to know or access — to confirm whether we process your personal information and to obtain a copy, including the categories collected, the sources, the purposes, and the categories of third parties to whom we disclose it.
Right to correct — to have inaccurate personal information corrected.
Right to delete — to have personal information we collected from you deleted, subject to legal exceptions.
Right to data portability — to receive a copy in a portable and, where technically feasible, readily usable format.
Right to opt out of the sale or sharing of personal information, of targeted advertising, and of profiling in furtherance of decisions that produce legal or similarly significant effects.
Right to limit the use of sensitive personal information — see Section 3 above; this right does not apply to our processing.
Right to non-discrimination — we will not deny you goods or services, charge you a different price, or provide a different level of quality because you exercised a privacy right. We do not offer financial incentives in exchange for personal information.
Right to appeal — if we decline your request, you may appeal (see Section 8).
Not every right is available in every state, and each state's law sets its own conditions and exceptions. For example, Iowa and Utah do not provide a right to correct personal information. We honor each right to the extent your state's law provides it.
6. States with comprehensive privacy laws
The following state privacy laws are in effect. If you are a resident of one of these states, the rights described in Section 5 are available to you as provided under your state's law.
California — California Consumer Privacy Act, as amended by the CPRA · in effect since January 2020 · Opt-out preference signals honored
Virginia — Consumer Data Protection Act · in effect since January 2023
Colorado — Colorado Privacy Act · in effect since July 2023 · Opt-out preference signals honored
Connecticut — Connecticut Data Privacy Act · in effect since July 2023 · Opt-out preference signals honored from January 2026
Utah — Utah Consumer Privacy Act · in effect since December 2023
Florida — Florida Digital Bill of Rights · in effect since July 2024
Oregon — Oregon Consumer Privacy Act · in effect since July 2024 · Opt-out preference signals honored from January 2026
Texas — Texas Data Privacy and Security Act · in effect since July 2024 · Opt-out preference signals honored
Montana — Montana Consumer Data Privacy Act · in effect since October 2024 · Opt-out preference signals honored
Delaware — Delaware Personal Data Privacy Act · in effect since January 2025 · Opt-out preference signals honored
Iowa — Iowa Consumer Data Protection Act · in effect since January 2025
Nebraska — Nebraska Data Privacy Act · in effect since January 2025
New Hampshire — New Hampshire Privacy Act · in effect since January 2025 · Opt-out preference signals honored
New Jersey — New Jersey Data Privacy Act · in effect since January 2025 · Opt-out preference signals honored
Minnesota — Minnesota Consumer Data Privacy Act · in effect since July 2025 · Opt-out preference signals honored
Tennessee — Tennessee Information Protection Act · in effect since July 2025
Maryland — Maryland Online Data Privacy Act · in effect since October 2025 · Opt-out preference signals honored
Indiana — Indiana Consumer Data Protection Act · in effect since January 2026
Kentucky — Kentucky Consumer Data Protection Act · in effect since January 2026
Rhode Island — Rhode Island Data Transparency and Privacy Protection Act · in effect since January 2026
This list reflects laws in effect as of the "Last updated" date above. We review it periodically as additional state laws take effect.
7. How to submit a request
You may submit a request in any of the following ways:
Email: contact@onvirtu.com
Web form: onvirtu.com/contact
Telephone: (470) 668-4782
Mail: OnVirtu, LLC, Attn: Privacy, 21561 Surveyor Circle, Huntington Beach, CA 92646, USA
Verification
To protect your information, we verify your identity before acting on a request to know, correct, delete or port. We will ask you to provide information we already hold about you — typically your name, email address, and details of a recent order or interaction — and we match it against our records. We will not ask for more information than is necessary, and we use any information provided for verification only. If we cannot verify your identity, we will tell you and explain why.
Authorized agents
You may use an authorized agent to submit a request on your behalf. We will ask the agent for written permission signed by you, and we may ask you to verify your own identity directly with us and to confirm that you gave the agent permission. An agent registered with the California Secretary of State acting under a valid power of attorney may submit a request without those additional steps.
Our response times
We confirm receipt of a request within ten (10) business days. We respond substantively within forty-five (45) days. Where reasonably necessary, we may extend that period by an additional forty-five (45) days and will notify you of the extension and the reason for it within the initial period. Opt-out requests are acted on within fifteen (15) business days.
8. Appeals
If we decline to act on your request, we will tell you why. You may appeal that decision within [30] days by emailing contact@onvirtu.com with the subject line "Privacy Request Appeal" and including the reference number from our response. We will respond to your appeal in writing within sixty (60) days, explaining the reasons for our decision. If we deny your appeal, we will provide you with a method to contact your state Attorney General to submit a complaint.
9. California "Shine the Light"
California Civil Code § 1798.83 permits California residents to request, once per year and free of charge, information about the categories of personal information we disclosed to third parties for those third parties' direct marketing purposes in the preceding calendar year. We do not disclose personal information to third parties for their own direct marketing purposes. To make a request under this section, email contact@onvirtu.com.
10. Contact
OnVirtu, LLC
21561 Surveyor Circle
Huntington Beach, CA 92646
USA
Telephone: (470) 668-4782
Email: contact@onvirtu.com
Because email is not always secure, please do not include payment card numbers or other sensitive information in emails to us.