Supplemental Privacy Notice for US Residents

Effective as of November 1, 2024

If you are a resident of California, this notice applies to you and supplements the Progress Privacy Policy. This notice is intended to provide certain information to you as required by the California Consumer Privacy Act (CCPA)/California Privacy Rights Act (CPRA).

If you are resident of Virginia, Connecticut, Colorado, Utah or another US state which have comprehensive privacy laws, this notice and the Progress Privacy Policy applies to you only if you act in an individual or household consumer context. This notice does not apply for natural persons acting in a commercial or employment context unless otherwise provided in the applicable US privacy law.

This notice applies to information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household such as your real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, other similar identifiers (“Personal Information”) or Social Security number (SSN), driver’s license, state identification card, or passport number; account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account (“Sensitive Personal Information”). Personal information does not include publicly available information, deidentified or aggregated consumer information and certain other information that is regulated by other applicable laws.

In this notice we talk about “selling” your personal information. Under the law, “selling” is broadly defined as “selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.” This means that when Progress shares your information with our Partners so that they can contact you about our products and related services they may offer you, we are “selling” or sharing your information as determined by the law. Progress does not sell customer lists or any of your personal information to third parties other than as expressly stated in this notice.

Information We Collect

We do not knowingly collect the personal information of consumers under 16 years of age:

We do not collect or process sensitive personal information for the purpose of inferring characteristics about you or for purposes other than the described in this notice.

We collect the following categories of personal information:

• Identifiers (e.g. real name, address, social security number)
• Characteristics of protected classification under California or Federal law;
• Commercial information (e.g. products purchased, obtained, or considered, or other purchasing or consuming histories)
• Internet or other electronic network activity (e.g. browsing history, search history, or a consumer’s interaction with a website)
• Geolocation data
• Audio, visual, and similar information
• Professional or employment related information
• Education information (information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act)
• Inferences drawn from any of the information above to create a profile about a consumer (reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities and attitudes)
• Account log-in, password, or credentials allowing access to an account.
• Communication and chat transcripts: If you are interacting with us or our web properties, including chat bots we may keep a record of this communication and/or chat transcripts which may contain your personal information such as name, company name, email address, phone number, country, state. The chat tool may also process web activity/cookie Information, IP address/location subject to our Cookie Policy and manageable by the respective cookie preferences.

We obtain the categories of Personal Information listed above from the following categories of sources:

• Directly from you. For example, from forms you complete, interactions with chat bots, or products and services you purchase from us.
• Indirectly from you. For example, from observing and/or tracking your browsing activity on our websites.
• From our Partners. For example, when they register your contact information with us as a lead or an end user.
• From third-party marketing companies who provide us with sales leads.
• Through your interactions with us on social media (e.g., Facebook, LinkedIn, Twitter, Instagram, etc.)
• From events or webinars organized or sponsored by us.

Our business purposes for the collection and use of this information are:

• To fulfill or meet the reason you provided the information. For example, to respond to an enquiry about our products and services, provide you with pricing information, facilitate the delivery of products you have licensed.
• To fulfill our contractual obligations with you.
• To provide you with maintenance and support, including to investigate and address issues and monitor and improve our responses.
• To improve our website, products and services.
• To optimize our marketing operations.
• To personalize your website experience and to deliver content, product and service offerings relevant to your interests, including targeted offers and ads through our website and via email.
• To send you updates about our company.
• For targeted marketing campaigns.
• To create, maintain, customize and secure your account with us (if applicable).
• To respond to law enforcement requests and as required by applicable law, litigation, court order, or governmental regulations.
• As described to you when collecting your personal information or as otherwise set forth in the applicable law.
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our website users or customers is among the assets transferred.

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, disproportional, or incompatible with the original purposes without providing you notice.

Information We Share

We may share, disclose your personal information to a third party for a business purpose or “sell” or share your personal information (in the limited circumstances described below), subject to your right to opt-out of those sales or sharing.

We may share your personal information with the following categories of third parties:

• Service Providers, who provide us with services and do not use your information for any purpose other than the performance of their contract with us.
• Our Partners
• Progress subsidiaries and affiliates
• Internet cookie data recipients, data analytics providers, and social media networks
• Industry Analysts

We do not knowingly sell or share the personal information of consumers under 16 years of age.

How long do we keep your personal information?

Progress may retain your information for a period of time consistent with the original purpose of collection. For instance, we may retain your information during the time in which you have an account to use our Sites or Services and for a reasonable period of time afterward or within the retention period required by the applicable law. We also may retain your information during the period of time needed for Progress to pursue our legitimate business interests, conduct audits, comply with our legal obligations, resolve disputes and enforce our agreements.

If you make a request to know, erase, correct your personal information, we may be required to maintain records of these requests and how we responded to the requests for at least 24 months.

Your Rights

The CCPA/CPRA allows you to request, twice in any 12-month period, information about how we collect, store, share or sell your personal information. You can submit such requests online by clicking here or by calling +1 (888) 914-9661 (toll-free) and entering the Progress unique PIN 689 150 when prompted. We will evaluate the request and take action where required to do so.

If you are resident of Virginia, Connecticut, Colorado, Utah or another US state which have comprehensive privacy laws, this section applies to you only if you act in an individual or household consumer context and it does not apply for natural persons acting in a commercial or employment context unless otherwise provided by the applicable law. However, if you have questions or you want to exercise any of the privacy rights feel free to reach out to us as indicated below.

Subject to some limitations and exceptions you have the following rights:

Right to Know

You have the right to know what personal information about you that we have collected and maintain about you on or after January 1, 2022, including beyond the 12-month period preceding the receipt of your request, if applicable and unless doing so is impossible or would involve disproportionate effort, or you request data for a specific time period. After we receive your verified request (see below for an explanation), we will provide you with the following in accordance with the time period allowed under the CCPA/CPRA or another comprehensive US privacy law with a similar effect:

• The categories of personal information we have collected about you
• The categories of sources from which we have collected your personal information
• Our business or commercial purpose(s) for collecting or selling your personal information
• The categories of third parties with whom we have shared your personal information; and
• The specific pieces of personal information we have collected about you

After we receive your verified request (see below for an explanation), we will provide you with the following in accordance with the time period allowed under the applicable law:

• The categories of personal information we have collected from you
• The categories of personal information we have sold/shared about you and the categories of third parties to whom we sold/shared such information, by category or categories of personal information for each category of third parties to whom the personal information was sold/shared; and
• The categories of personal information that we disclosed about you for a business purpose

Right to Delete

You have the right at any time to request that we delete your personal information, which you can do by clicking here. However, in some cases we cannot delete all or some of your personal information, as required or permitted by applicable laws.

Right to Opt-Out

You have the right at any time to opt-out of the sale or sharing your personal information by clicking here.

Right to Correct

You have the right to ask at any time to correct your personal information that is inaccurate or changed over time by submitting a request here.

You are always encouraged to access, delete, or correct your personal information from the self-service options in your account (if applicable).

Right to Non-Discrimination

We will not discriminate against you for exercising your rights under the CCPA/CPRA, such as denying you products and services, charging you different rates or prices including use of discounts or penalties, or suggesting or providing a different level of service or quality of products to you. However, we may charge a different price or provide a different level or quality of products and services only if the price or difference is directly related to the value provided to you by your personal information.

Opt Out Preference signal

The residents of some US states such as California may choose to activate Opt-Out Preference Signal on their browsers which is known also as Global Privacy Control (GPC). To download and use a browser supporting the GPC browser signal, click here: https://globalprivacycontrol.org/orgs. If you choose to use the Opt out preference signal, you will need to turn it on for each supported browser or browser extension you use. If we detect such signal, e.g. from California, we`ll stop sharing or selling data for cross-context behavioral advertising.

Please note that it is not always possible to make connection between your browser and a profile associated with this browser or your account (if applicable) when you send the opt-out of “sale” / “sharing” of your personal information request or GPC signal. This means that if you have not yet opted out of “sale” / “sharing” your personal information, we recommend you submit the Do Not Sell or Share Personal Information form.

Verifying Your Identity:

Depending on the nature of your request, we may have to verify your identity when you contact us. We do this by:

• Requiring you to provide sufficient information in your request that allows us to reasonably verify you are the person about whom we collected personal information, or an authorized representative of that person.
• Sending an email to the primary email address you submit in your request and, if applicable, to any other email address we have on record for you requiring you to verify that you made the request.

You may also use an authorized agent to exercise your rights on your behalf. If you wish to use an authorized agent, we require that your authorized agent provides written proof to us that he or she is authorized to act on your behalf, and we may also require your authorized agent to verify his or her own identity. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.

We do not verify your identity when you make a request to opt-out of sale/sharing or make a request to limit (if the latter is applicable). However, we may ask for the information necessary to complete the request.

We will only use personal information provided in your request to verify your identity or authority to make the request. If, however, we cannot verify your identity of from the information already maintained by us, we may request additional information from you or your authorized representative, which will only be used for the purposes of verifying your identity and authority to exercise your rights, security, or fraud-prevention.

We endeavor to respond to your request as soon as we can. If we are not able to respond to your request within 45 days, we will let you know that we may require additional time (up to 90 total days) and give you the reason for the extension of time.

Date of last update: November 1, 2024