Ooma, Inc. Privacy Notice for Texas Residents

Effective as of: July 1, 2024

This Privacy Notice for Texas Residents supplements the information contained in Ooma, Inc.’s (“Ooma,” “we” or “us”) Privacy Policy and applies solely to all visitors, users, and customers who are natural persons (i.e., not businesses) who reside in the State of Texas (“consumers” or “you”). We adopt this notice to comply with the Texas Data Privacy and Security Act (as may be amended from time to time, the “TDPSA”) and any terms defined in the TDPSA or the Privacy Policy, as the case may be, have the same meaning when used in this notice.

We collect personal data, as that term is defined in the TDPSA, from and about Texas residents (“TDPSA personal data”). TDPSA personal data includes information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, device, or household, with certain exceptions for de-identified information, and other specific types of information.

Categories of Information We Collect

Here are the categories of TDPSA personal data we collect from or about consumers:

Use of Personal Data

We may use each of the categories of TDPSA personal data listed above for one or more of the business purposes described in our Privacy Policy, or for another purpose that we describe to you when or before collecting your TDPSA personal data. We will not collect additional categories of TDPSA personal data or use the TDPSA personal data we collected for materially different, unrelated, or incompatible purposes without providing you notice and obtaining any legally required consent.

Selling or Sharing Personal Data

Disclosures of Personal Data

We may disclose any of the categories of TDPSA personal data listed above to one or more of our service providers or other third party for the purpose of helping us engage in one or more of the purposes described in our Privacy Policy, or for another purpose that we describe to you when or before collecting your TDPSA personal data. For instance, we may sell or share your Identifiers, Commercial Information, Sensitive Personal Data and/or Internet or Electronic Network Activity Information to advertising, marketing, and analytics providers.

NOTICE: We may sell your sensitive personal data

Personal Data Automatically Collected

We automatically collect certain information when you visit, use, or navigate the Services. Please see Section 1.2 (Personal Information Collected via Automated Means) of our Privacy Policy for more information.

Actual Knowledge of Selling the Personal Data of Children under 13 Years of Age

We do not collect Personal Data directly from children known to be under 13 years of age. We will delete any Personal Data collected from children known to be under 13 years of age if we learn that we have shared their Personal Data without verification of their legal guardian, or on the basis of parental consent, as applicable.

Your Rights and Choices

The TDPSA provides consumers with specific rights regarding their TDPSA personal data. This section describes your TDPSA rights and explains how to exercise those rights.

Access to Specific Information and Data Portability Rights

You have the right to request that we disclose certain information to you about our collection and use of your TDPSA personal data. Once we receive and confirm your verifiable consumer request (see Exercising Your TDPSA Rights), we will disclose to you:

• The categories of TDPSA personal data we collected about you.
• The categories of sources for the TDPSA personal data we collected about you.
• Our business or commercial purpose for collecting or selling that TDPSA personal data.
• The categories of third parties with whom we share that TDPSA personal data.
• The specific pieces of TDPSA personal data we collected about you (also called a data portability request).
• If we sold or disclosed your TDPSA personal data for a business purpose, two separate lists disclosing:
• sales, identifying the TDPSA personal data categories that each category of recipient purchased; and
• the business purpose(s) for which the disclosure was made, identifying the TDPSA personal data categories that each category of recipient obtained.

Deletion Request Rights

You have the right to request that we delete any of your TDPSA personal data that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (see Exercising Your TDPSA Rights), we will delete (and direct our service providers to delete) your TDPSA personal data from our records, unless an exception applies.

Correction of Personal data

You have the right to request that we correct any factual errors in your TDPSA personal data that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (see Exercising Your TDPSA Rights), we will update any factual errors in your TDPSA personal data from our records, unless an exception applies.

Opt-Out of Selling or Sharing of Your Data

You have the right to opt out of the sale and/or sharing of your TDPSA personal data, subject to certain exceptions. You can exercise this right by: (1) following the instructions in the Exercising Your TDPSA Rights section below or (2) visiting our Your Privacy Choices webpage, which you can also access by clicking on the “Your Privacy Choices” link at the bottom of our website. Once we receive and confirm your verifiable consumer request we will stop sharing and/or selling your TDPSA personal data (if applicable), unless an exception applies. Any opt-out choices you make will only apply to the specific email address that you provide when making the request.

Exercising Your TDPSA Rights

To exercise your TDPSA rights described above, please submit a verifiable consumer request to us by either:

• Calling us at 1 (888) 711-6662.
• E-mailing privacy@ooma.com.

Only you, or your authorized agent, may make a verifiable consumer request related to your TDPSA personal data. You may also make a verifiable consumer request on behalf of your minor child, if applicable.

The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected TDPSA personal data or an authorized representative; in particular, we will validate your telephone number and/or email address maintained in our customer database from the communication we receive from you via email, telephone or through our online customer portal. In addition, we may also ask you to confirm your state of residence.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with TDPSA personal data if we cannot verify your identity or authority to make the request and confirm the TDPSA personal data relates to you.

Making a verifiable consumer request does not require you to create an account with us. However, we do consider requests made through your password protected account sufficiently verified when the request relates to TDPSA personal data associated with that specific account.

We will only use TDPSA personal data provided in a consumer request to verify the requestor’s identity or authority to make the request.

Response Timing and Format

We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 45 days), we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your TDPSA personal data that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance specifically Comma Separated Values (.csv).

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Denying Rights and Appeals Process

If we deny any of your rights granted by the TDPSA, you have the right to appeal our decision. You can send your appeal to us via email to privacy@ooma.com, and by including ‘Appeal’ in the subject line along with the prior request and related communications. We will notify you in writing of any action taken or not taken in response to your appeal not later than the 60th day after receiving your appeal. We will include a written explanation of the reason(s) for our decision. Additionally, you may contact the Texas Attorney General if you have concerns about the results of the appeal.

Private Right of Action and Complaints

The TDPSA does not have a “privacy right of action” provision. You may submit complaints regarding our compliance with the TDPSA via the Texas Attorney General’s website.

Retention of Your Personal Data

Please see Section 7 (How Long Do We Store Your Data?) of our Privacy Policy for more information.

Changes to Our Privacy Notice for Texas Residents

We reserve the right to amend this notice at our discretion and at any time. You should review this notice regularly for changes, which will be indicated by the “Last Updated” date at the top of this page. Your continued use of our website and Services following the posting of changes constitutes your acceptance of such changes.

Contact Information

If you have any questions or comments about this notice, the ways in which we collect and use your information described above and in the Privacy Policy, your choices and rights regarding such use, wish to exercise your rights under California law, or if you have a disability and need this notice in an alternative format, please contact us at:

Phone: 1 (888) 711-6662

Website: www.ooma.com

Email: privacy@ooma.com

Postal Address:

Ooma, Inc.

Attn: Compliance Officer

525 Almanor Ave, Suite 200, Sunnyvale, CA 94085