Regional Information

REGIONAL INFORMATION

Last Updated: July 1, 2023

The information on this Regional Information page supplements the information contained in our Privacy Policy and applies solely to individuals located or residing in certain jurisdictions, as specified below. Unless otherwise expressly stated, all terms used below have the same meanings ascribed to them in our Privacy Policy.

We reserve the right to change the information on this page at any time. The "Last Updated" date at the top of this page indicates when it was last revised. We encourage you to review this page periodically for changes.

If you have questions about the information that appears on this page, please contact us at privacy@five9.com.

SUPPLEMENTAL NOTICE FOR EEA, SWITZERLAND, AND UK RESIDENTS

The EU General Data Protection Regulation (“GDPR”) and other applicable data protection legislation provides individuals located in the European Economic Area (“EEA”), Switzerland, and the United Kingdom (“UK”) with certain rights with respect to their personal information.

Pursuant to applicable legislation, this section provides additional details regarding our processing of personal information relating to individuals located in the EEA, Switzerland, and the UK. This section also describes the legal rights available to individuals in the EEA, Switzerland, and the UK in relation to their personal information and how they can exercise their rights.

Legal basis for processing

Applicable law in certain jurisdictions requires us to set out the “legal basis” on which we rely to collect and use your personal information. Where applicable, the legal bases that we rely on to collect and use your personal information are as follows:

Compliance with a Legal Obligation. We are subject to various legal requirements in the jurisdictions in which we operate, including tax and accounting obligations. Accordingly, we will process your personal information as necessary for us to comply with a legal obligation arising under applicable law.
Consent. We may process your personal information on the basis of the consent that you provide at the point of information collection or disclosure. Where required by law, we will rely on your consent for direct marketing and to collect information from your device via cookies and other similar technologies.
Contractual Necessity. We may process certain personal information where it is either necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract. This may include personal information used to provide you with the Services.
Legitimate Interests. We may process your personal information to the extent necessary to carry out our legitimate interests (or those of a third party), provided that such interests do not outweigh your interests or fundamental rights and freedoms. For example, we may process your personal information in reliance on a legitimate interest in managing our relationship with you; conducting and managing our business; providing you with customer support; developing and improving the Services; detecting and preventing fraud and other harmful activities; and monitoring and maintaining the security of our systems and networks.

Your legal rights

Under applicable law, you may have certain rights in relation to your personal information, including the right to:

request confirmation as to whether we are processing your personal information, and, if so, to request access to your personal information and details regarding our processing;
request correction or rectification of any inaccurate or incomplete personal information that we hold about you;
request deletion of your personal information (subject to applicable exceptions);
object to our processing of your personal information under certain circumstances;
request that we restrict our processing of your personal information in certain circumstances;
request that we transmit your personal information to a third party (where technically feasible);
withdraw the consent you have provided us to process your personal information (without affecting the lawfulness of any processing carried out before you withdrew your consent); and
lodge a complaint about the way we handle or process your personal information with the appropriate data protection regulator.

If you are interested in exercising any of the above-listed rights, you can do so by emailing us at privacy@five9.com with the subject line “EEA, Switzerland, and UK Resident Privacy Rights Request.”

In order to protect your privacy and confirm that you are entitled to exercise the abovelisted rights, we may need to request specific information from you to help us confirm your identity. Where applicable, we will use the requested information for verification purposes only.

SUPPLEMENTAL NOTICE FOR CALIFORNIA RESIDENTS

The California Consumer Privacy Act, as amended by the California Privacy Rights Act and its implementing regulations (collectively, the “CCPA”) provides California residents with certain rights with respect to their personal information. Pursuant to the CCPA, this section provides details regarding the categories of personal information relating to California residents that we collect, use, and disclose. This section also describes the legal rights available to California residents in relation to their personal information and how they can exercise their rights.

Personal information collection and disclosure

The following chart details which categories of personal information we have collected from and about California residents in the past twelve (12) months, the source(s) of each category of information, the categories of third parties to whom we have disclosed each category of information for a business purpose, and the categories of third parties with whom we have “shared” (as defined in the CCPA) each category of information (where applicable).

Please note that the first column in the chart lists by category the types of information described in the “Collection of Personal Information” section of our Privacy Policy, as required by the CCPA.

Category of Personal Information	Categories of Sources	Disclosures of Personal Information for a Business Purpose	Sale or Sharing of Personal Information
Identifiers, including names, postal addresses, email addresses, online identifiers, IP addresses, account names, and other similar identifiers	Directly from individuals Through automated means Third-party sources	We have disclosed this category of information for a business purpose in the past 12 months to the following categories of third parties: Our affiliates and subsidiaries Our service providers Our analytics providers	We have sold or shared this category of information in the past 12 months with the following categories of third parties: Our analytics providers Our marketing and advertising partners (including social media platforms)
Personal information categories listed in the California Customer Records statute, including names, telephone numbers, and employmentrelated information.	Directly from individuals	We have disclosed this category of information for a business purpose in the past 12 months to the following categories of third parties: Our affiliates and subsidiaries Our service providers
Commercial information , including products or services purchased, obtained, or considered.	Directly from individuals Through automated means	We have disclosed this category of information for a business purpose in the past 12 months to the following categories of third parties: Our affiliates and subsidiaries Our service providers Our analytics providers	We have sold or shared this category of information in the past 12 months with the following categories of third parties: Our analytics providers Our marketing and advertising partners (including social media platforms)
Internet or other electronic network activity information , including information about interactions with the Site and advertisements	Through automated means Third-party sources	We have disclosed this category of information for a business purpose in the past 12 months to the following categories of third parties: Our affiliates and subsidiaries Our service providers Our analytics providers	We have sold or shared this category of information in the past 12 months with the following categories of third parties: Our analytics providers Our marketing and advertising partners (including social media platforms)
Geolocation data, such as IP location	Through automated means	We have disclosed this category of information for a business purpose in the past 12 months to the following categories of third parties: Our affiliates and subsidiaries Our service providers Our analytics providers	We have sold or shared this category of information in the past 12 months with the following categories of third parties: Our analytics providers Our marketing and advertising partners (including social media platforms)
Audio, electronic, visual, or similar information , including phone call recordings	Directly from individuals	We have disclosed this category of information for a business purpose in the past 12 months to the following categories of third parties: Our affiliates and subsidiaries Our service providers
Professional or employmentrelated information, including employer names and job roles/titles	Directly from individuals Third-party sources	We have disclosed this category of information for a business purpose in the past 12 months to the following categories of third parties: Our affiliates and subsidiaries Our service providers
Inferences, meaning inferences drawn from any of the information in the above-listed categories of information	Directly from individuals Third-party sources	We have disclosed this category of information for a business purpose in the past 12 months to the following categories of third parties: Our affiliates and subsidiaries Our service providers
Sensitive personal information , including log-in information for accounts in combination with passwords allowing access to the accounts	Directly from individuals	We have disclosed this category of information for a business purpose in the past 12 months to the following categories of third parties: Our affiliates and subsidiaries Our service providers

Purposes for collecting personal information

As described in more detail in the “Use of Personal Information” section of our Privacy Policy, we collect personal information to manage the Site, conduct and improve our business and provide you with the Services, and as otherwise necessary or appropriate in connection with the fulfillment of other legitimate business or commercial purposes.

Disclosures of personal information

As described in more detail in the “Disclosures of Personal Information” section of our Privacy Policy, we disclose personal information to fulfill the purposes described above. We may also disclose certain categories of personal information to competent governmental and public authorities and other third parties as necessary or appropriate, including when we have a legal or contractual obligation to disclose the information.

Sale and sharing of personal information

As detailed in the chart above, we “sell” and “share” (as such terms are defined in the CCPA), certain categories of personal information to and with third parties and have “sold” and “shared” certain categories of personal information in the past twelve (12) months. Please refer to the chart above for additional details.

We do not have actual knowledge that we “sell” or “share” the personal information of individuals under 16 years of age.

Use and disclosure of sensitive personal information

As detailed in the chart above, we collect certain “sensitive personal information” (as defined in the CCPA). However, we do not use or disclose sensitive personal information for any purpose other than those expressly permitted under the CCPA. These purposes include providing the Services and preventing, detecting, and investigating security incidents.

Retention of personal information

We will retain your personal information as long as necessary to fulfill the purpose(s) for which it was collected, unless a longer retention period is required or allowed under law. Additional details regarding our information retention practices can be found in the “Information Retention” section of our Privacy Policy.

Your legal rights

As a California resident, you have the right to request that we:

Disclose to you the following information covering the twelve (12) months preceding your request:

the categories of personal information we have collected about you and the categories of sources from which we collected such information;
the specific pieces of personal information we have collected about you;
the business or commercial purposes for collecting, selling, or sharing your personal information;
the categories of third parties to whom we disclosed your personal information; and
if we sold, shared, or disclosed your personal information for a business purpose, two separate lists disclosing:

sales and shares, identifying the personal information categories that each category of recipient received; and
disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.

Delete the personal information that we have collected from you, subject to certain exceptions.
Correct inaccurate personal information that we have collected about you, taking into account the nature of the personal information and the purposes of the processing.

We will not discriminate against you if you decide to exercise your rights under the CCPA.

If you are interested in exercising any of the above-listed rights, you can do so by sending an email to privacy@five9.com with the subject line “CA Resident Privacy Rights Request.”

You are not required to create an account with Five9 to exercise your rights. However, in order to protect your privacy, we may require the matching of up to three pieces of personal information provided with your request with information we maintain in order to verify that it is you making the request. Where applicable, we will use the requested information for verification purposes only. Please note that we may decline a request where we are unable to verify your identity and confirm that the personal information we maintain relates to you.

Authorized agents

You may authorize someone to submit a privacy rights request on your behalf (an “authorized agent”). An authorized agent will need to demonstrate that you have authorized them to act on your behalf, unless you have provided the agent with power of attorney pursuant to applicable law. Depending on the evidence provided, we may also contact you to verify your identity with us or request confirmation from you that the agent is authorized to submit the request on your behalf.

Exercising your sale and sharing opt-out right

As detailed in the chart above, we sell and share certain categories of personal information to and with third parties. If you are 16 years of age or older, in addition to the rights described above, you have the right to direct us to not sell or share your personal information at any time. To exercise your opt-out right, you may submit a request to us by:

clicking the “Your Privacy Choices” link located in the footer of the Site and following the instructions; or
sending an email to privacy@five9.com with the subject line “Do not sell or share my personal information.”

Alternatively, where available, you can use certain preference signals to exercise your sharing opt-out right automatically with all businesses that you interact with online, including Five9. If you enable a browser-based opt-out preference signal that complies with the CCPA, such as Global Privacy Control (GPC), upon receipt or detection, we will treat the signal as a valid request to opt out of the sharing of personal information linked to that browser and any consumer profile we have associated with that browser. Please note that if you use different browsers or browser profiles, you will have to enable the signal on each one that you use.

An authorized agent may also use the methods described above to submit an opt-out request on your behalf if you provide the agent with signed permission to do so. Please note that we may request from the agent documentation demonstrating that they have your authority to act on your behalf.

SUPPLEMENTAL NOTICE FOR OTHER U.S. STATE RESIDENTS

Applicable law in Colorado, Connecticut, Utah, and Virginia provides residents with certain rights with respect to their personal information. This section provides additional details regarding our handling of personal information relating to individuals residing in these states. This section also describes the legal rights available to individuals residing in these states in relation to their personal information and how they can exercise their rights.

Personal information collection and use

Depending on the nature of our relationship with you, we may collect a variety of personal information from and about you. The “Collection of Personal Information” section of our Privacy Policy describes in detail the categories of personal information we collect.

As described in the “Use of Personal Information” section of our Privacy Policy, we collect personal information to manage the Site, conduct and improve our business and provide you with the Services, and as otherwise necessary or appropriate in connection with the fulfillment of other legitimate business or commercial purposes.

Disclosures of personal information

As described in more detail in the “Disclosures of Personal Information” section of our Privacy Policy, we disclose personal information to fulfill the purposes described above. We will also disclose certain categories of personal information to government and public authorities and other third parties as necessary or appropriate, including when we have a legal or contractual obligation to disclose the information.

Targeted advertising

As described in the “Use of Personal Information” section of our Privacy Policy, we (and our partners) use cookies and other similar technologies to collect and transfer personal information that is used to display advertisements to you. The use of your personal information to display certain advertisements to you constitutes “targeted advertising” under applicable law. Details on how you can opt out of our use and disclosure of your personal information for “targeted advertising” purposes can be found below.

Your legal rights

If you reside in Colorado, Connecticut, Utah, or Virginia, under applicable law, you may have certain rights in relation to your personal information, including the right to:

• request confirmation as to whether we are processing your personal information and request access to such personal information;
request that we correct inaccuracies in your personal information, taking into account the nature of the personal information and the purposes of the processing;
request that we delete your personal information, subject to certain exceptions;
request that we provide a copy of your personal information in a portable, and to the extent technically feasible, readily usable format;
opt out of the use and disclosure of your personal information for “targeted advertising” purposes (as defined in applicable law) (where applicable);
opt out of the "sale" (as defined in applicable law) of your personal information (where applicable); and
opt out of “profiling” in furtherance of certain decisions (where applicable).

To exercise the rights listed above, please send an email to privacy@five9.com with the subject line “U.S. State Privacy Rights Request” and specify in the email which right(s) you wish to exercise.

If you are interested in opting out of the sale of your personal information or our use and disclosure of your personal information for “targeted advertising” purposes, you may also be able to submit a request by clicking the “Your Privacy Choices” link located in the footer of the Site and following the instructions.

Upon receipt of your request, we will endeavor to honor it based on the information that we collect and maintain.

We will not discriminate against you if you decide to exercise your rights under applicable law.

You are not required to create an account with us to exercise your rights. However, in order to protect your privacy, we may require proof of your identity before acting on your request. Where applicable, we will use the requested information for verification purposes only. Please note that we may decline certain requests if we cannot verify your identity and confirm that the personal information we maintain relates to you.

Authorized agents

If you reside in Colorado or Connecticut, you may authorize someone to submit an optout request on your behalf using the submission methods outlined above. Where appropriate, we will request information or documentation to verify your identity as well as the agent's authority to act on your behalf.

Appealing privacy rights requests decisions

If you reside in Colorado, Connecticut, or Virginia, in the event that we do not take action on your request, you also have the right to appeal our decision. To appeal our decision, please send an email to privacy@five9.com with the subject line “U.S. State Privacy Rights Request Appeal.” If you are unsatisfied with the way that we have handled your appeal, you have the right to complain to your state's Attorney General.