Backblaze Privacy Notice for California Residents

The purpose of this Notice at Collection is to provide you with timely notice, at or before the point of collection, about the categories of personal information to be collected from you and the purposes for which the personal information will be used, including whether that information is sold or shared.


General Personal Information

Do We collect?	Categories of Personal Information	Purposes for Collection	Sold to Third Parties or Shared with Third Parties for Cross-Context Behavioral Advertising
Yes	Identifiers: For example, a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address	To provide and deliver Backblaze products and services, as well as process transactions related to Backblaze products and services including subscriptions, purchases, and payments.	Yes
Yes	Personal Information Categories from Cal. Civ. Code § 1798.80(e): For example, a name, address	To provide and deliver Backblaze products and services, as well as process transactions related to Backblaze products and services including subscriptions, purchases, and payments.	No
Yes	Internet or Other Similar Network Activity: For example, browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement	To measure use of, analyze performance of, fix errors in, provide support for, improve, and develop Backblaze products and services. To recommend Backblaze products and services. that might be of interest to you, identify your preferences, and personalize your experience with Backblaze products and services.	Yes
Yes	Geolocation Data: For example, information that can be used to determine a device’s physical location	To provide Backblaze’s “Locate My Computer” service/ feature. For more information on how to disabled the “Locate My Computer” feature please click here .	No

We do not collect General Personal Information in the following categories

Characteristics of CA or federal protected classifications, commercial information, biometric information, sensory or surveillance data, professional or employment-related information, education information, or profile data.


Sensitive Personal Information

Do We collect?	Categories of Sensitive Personal Information	Purposes for Collection	Sold to or Shared with Third Parties for Cross-Context Behavioral Advertising
Yes	Precise geolocation	To provide Backblaze’s “Locate My Computer” service/ feature. For more information on how to disabled the “Locate My Computer” feature please click here .	No

We do not collect Sensitive Personal Information in the following categories

Government identification, consumer finances, race, religion and union membership, communications, genetics, biometrics, health, or sexual orientation


Retention of Personal Information

We retain your General Personal Information and Sensitive Personal Information as reasonably necessary and proportionate to the purpose for which the personal information in each category was collected and will be processed. We may also retain your information with your consent. We seek to minimize the personal information needed to achieve the purpose for which the information is retained. We further employ safeguards for the personal information to address any possible negative impacts to data that is retained.

We will not collect additional categories of personal information without providing you a new Notice at Collection disclosing those categories.

If you wish to opt out of the selling and sharing of your personal information, please click the link here, and complete and submit the form: Do Not Sell or Share My Personal Information

2. Privacy Notice for California and Virginia Residents

The purpose of this privacy notice is to provide you with a comprehensive description of our online and offline practices regarding the collection, use, disclosure, retention, sharing, and sale of personal information and of your rights regarding your personal information as a resident of California or Virginia.


Your Right to Know

You have the right to request that we disclose what personal information we collect, use, disclose, sell, or share with third parties for cross-context behavioral advertising (e.g. targeted advertising). You have the right to request any of the following:

• the categories of personal information we have collected about you
• the categories of sources from which the personal information is collected
• the business or commercial purpose for collecting, selling, or sharing with third parties for cross context behavioral advertising (e.g. targeted advertising)
• the categories of third parties to whom we disclose personal information
• the specific pieces of personal information we have collected about you

You can do this through a verified consumer request. That process is described below in the section, “Submitting a Verified Consumer Request.”

We collect personal information, which means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“personal information”). The following table includes disclosures for the preceding 12 months of: categories of personal information we have collected about consumers, the categories we have disclosed for a business purpose, and categories of third parties with whom we shared the personal information during that period.


General Personal Information

Category	In the preceding 12 months this category was:		Business or Commercial Purpose for Collection & Disclosure	Categories of third parties to whom the information was disclosed
	Collected	Disclosed
Identifiers	Yes	Yes	To provide Backblaze products and services To service transactions and accounts (e.g., customer service, maintaining and servicing accounts, customer verification, payment processing) To share the personal information with service providers to carry out other business purposes.	Advertising networks Social networks E-mail distribution service providers Customer relationship management tool providers
B. Personal Information Categories from Cal. Civ. Code § 1798.80(e)	Yes	Yes	To provide Backblaze products and services To service transactions and accounts (e.g., customer service, maintaining and servicing accounts, customer verification, payment processing) To share the personal information with service providers to carry out other business purposes.	E-mail distribution service providers Customer relationship management tool providers
F. Internet or Other Similar Network Activity	Yes	Yes	To share the personal information with service providers to carry out other business purposes.	Advertising networks Social networks
G. Geolocation Data	Yes	No	To provide Backblaze products and services	N/A

In the preceding twelve months we have not collected General Personal Information from the following categories:

Characteristics of CA or federal protected classifications, commercial information, biometric information, sensory or surveillance data, professional or employment-related information, education information, or profile data


Sensitive Personal Information

We do not use or disclose the below sensitive personal information for purposes beyond the minimum purposes specified under CPRA.

Category	In the preceding 12 months this category was:		Business or Commercial Purpose for Collection & Disclosure	Categories of third parties to whom the information was disclosed
	Collected	Disclosed
Precise geolocation	Yes	No	To provide Backblaze’s “Locate My Computer” service/ feature. For more information on how to disabled the “Locate My Computer” feature please click here.	N/A

In the preceding twelve months we have not collected Sensitive Personal Information in the following categories: Government identification, consumer finances, race, religion and union membership, communications, genetics, biometrics, health, or sexual orientation

The categories identified as collected in the tables above were collected from the following categories of sources:

• You directly
• Advertising networks
• Data analytics providers
• Social networks

What We Sell to Third Parties or Share with Third Parties for Cross-Context Behavioral Advertising and Right to Opt-Out

We have sold or shared with third parties for cross-context behavioral advertising personal information to third parties in the preceding 12 months as disclosed in the table below.


General Personal Information

Categories sold to or shared with third parties over the last 12 months	Categories of third parties to whom this category of personal information has been sold or shared
Identifiers	Social Networks, Advertising Networks
Internet or Other Similar Network Activity	Social Networks, Advertising Networks

We have not sold or shared the following categories of General Personal Information to or with third parties for cross-context behavioral advertising in the preceding 12 months: Personal Information, Categories from Cal. Civ. Code § 1798.80(e), Characteristics of CA or Federal Protected Classifications, Commercial Information, Biometric Information, Sensory or Surveillance Data, Professional or Employment-Related Information, Education Information or Profile Data


Sensitive Personal Information

We have not sold or shared any Sensitive Personal Information to or with third parties for cross-context behavioral advertising in the preceding 12 months.


Your Right to Opt-out

You may exercise your Right to Opt-Out by:

1. Clicking “Do Not Sell or Share My Personal Information” to use the interactive form,
2. Submitting your request through an opt-out preference signal (described further in the section titled “Opt-Out Preference Signals”), or
3. Submitting a request to privacy@backblaze.com

Authorized Agent for Opt-Out: If you use an authorized agent to exercise your right to opt-out of the sale or sharing of personal information, please note that Backblaze requires that the authorized agent submit documentation signed by you that verifies the authorized agent has been authorized to act on your behalf.

Once you make an opt-out request, we will comply within 15 business days. We will wait at least twelve (12) months before asking you to reauthorize personal information sales or sharing. However, you may change your mind and opt back into personal information sales or sharing at any time by emailing us at privacy@backblaze.com .

We do not have actual knowledge that we sell the personal information of minors under 16 years of age.


Your Right to Request Correction of Inaccurate Personal Information

You have the right to request correction of inaccurate personal information maintained by us. We may request documentation from you to determine the accuracy of the information maintained by us. If you provide us documentation either upon our request or through your own initiative, that documentation will only be used or maintained by us for the purpose of correcting your personal information and complying with our recordkeeping requirements under CCPA/ CPRA and VCDPA . We may deny your request if we have previously denied your same request to correct an alleged inaccuracy in the past six (6) months, unless you provide new or additional documentation that the information at issue is inaccurate.

As an alternative to correction, we may delete the inaccurate information if it does not negatively impact you or if you consent to this deletion. We reserve the right to deny this request if allowed under law, or if we determine that the contested information is more likely than not accurate, based on the totality of circumstances. You can submit a correction request through a verified consumer request. That process is described below in the section, “Submitting a Verified Consumer Request.”


Your Right to Limit Use and Disclosure of Sensitive Personal Information

You have the right to limit our use and disclosure of your sensitive personal information collected by us for the purposes of inferring characteristics about you, which is called the “Right to Limit.”

However, you do not have the right to limit certain uses and disclosures of your sensitive personal information for the following purposes:

• Providing our goods or services reasonably expected of an average consumer;
• Detecting security incidents affecting personal information, provided that the use of the consumer’s personal information is reasonably necessary and proportionate for this purpose;
• Resisting malicious, fraudulent, or illegal actions against us and prosecuting persons responsible for such actions, provided that the use of the consumer’s personal information is reasonably necessary and proportionate for this purpose;
• Ensuring the physical safety of an individual, provided that the use of the consumer’s personal information is reasonably necessary and proportionate for this purpose;
• Short-term, transient use, including non-personalized advertising shown as part of a consumer’s current interaction with us, provided that we do not build a profile about the consumer or alter the consumer’s experience outside their current interaction with us;
• Performing services on behalf of another business (e.g., maintaining accounts, processing orders or transaction);
• Verifying or maintaining the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, or improving, upgrading, or enhancing the services or device owned, manufactured, manufactured for, or controlled by us.

Because the only Sensitive Personal Information we use is your precise geolocation ONLY when you have “Find My Computer” enabled in your Backblaze account, you may exercise your Right to Limit by:



Authorized Agent for Request to Limit If you use an authorized agent to exercise your right to limit the use or disclosure of your sensitive personal information, please note that Backblaze requires that the authorized agent submit proof in the form of an authorization signed by you that the authorized agent has been authorized to act on your behalf.

Once you make a request to limit, we will comply within 15 business days. We will wait at least twelve (12) months before asking you to reauthorize the use or disclosure of your sensitive personal information beyond the limited purposes specified above. However, you may change your mind and opt back into certain uses and disclosures of your sensitive personal information at any time by emailing us at privacy@backblaze.com .


Your Right to Request Deletion of Your Personal Information

You have the right to request that we delete any of your personal information collected by us, subject to certain exceptions. You can do this through a verified consumer request. That process is described below in the section, “Submitting a Verified Consumer Request.”

We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

• Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated by the consumer within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
• Debug products to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
• Engage in public or peer-reviewed scientific, historical, or statistical research that conforms or adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the ability to complete such research, if you previously provided informed consent.
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us and is compatible with the context in which you provided the information.
• Comply with a legal obligation.

Submitting a Verified Consumer Request

You have the right to submit verified consumer requests to know information, to correct information, or for deletion.

The response to a request to know will provide all personal information collected and maintained about you since January 1, 2022, unless doing so proves impossible or would involve disproportionate effort. Please note that we are not required to provide personal information to you more than twice in a 12-month period. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

You may submit the request to our Support Team here . Additionally, you can submit requests by emailing us at privacy@backblaze.com .

If you submit a request that is not through one of these designated methods or is deficient in some manner unrelated to verification, we will either treat it as if it had been submitted in accordance with our designated methods or provide you with information on how to submit the request or remedy any deficiencies.

Your request will be verified by matching the information you provide to information that we have collected. To verify your identity for your consumer request Backblaze will require one of the following (depending upon your request type):

1. You will need to provide your name as it appears on your Backblaze Account and send your request from your email associated with your Backblaze Account.
2. If you want to send your request from an email not associated with your Backblaze Account, you will need to provide your name as it appears on your Backblaze Account and sign into your email address associated with your Backblaze account to confirm your identity in a manner provided by the verification email sent to you by Backblaze.
3. If you make a request that requires Backblaze to provide you with any of your sensitive personal information we may have stored you will need to complete either step 1 or 2, as well as provide additional verifying personal information we may request of you to account for the more sensitive nature of your request.

Once we receive your verifiable consumer request, we will confirm receipt of the request within 10 business days describing our verification process. We will respond to your request within 45 calendar days, if we are able to verify your identity. Requests for deletion will require a separate confirmation that you want your information deleted.

If requests from you are manifestly unfounded or excessive in particular because of their repetitive character, we may either charge a reasonable fee or refuse to act on the request, notifying you of our reason for refusing to act. If we determine that the request warrants a fee, we will notify you of the reason for that determination and provide you with a cost estimate before completing your request.

Please note that, in responding to your request, we are not permitted to disclose or provide you with your Social Security number, driver’s license number or other government-issued identification number, financial account number, any health insurance or medical identification number, an account password, security questions and answers, or unique biometric data generated from measurements or technical analysis of human characteristics. However, we will inform you with sufficient particularity that we have collected the type of information without disclosing the actual data.

Requests to Know or Delete for Child Under the Age of 13: We do not knowingly collect information of minors under the age of 13.


Using an Authorized Agent to Submit a Request

Only you, or a natural person or a business entity registered with the Secretary of State to conduct business in California that you have authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. If you use an authorized agent, you may provide a power of attorney executed pursuant to California Probate Code sections 4000 to 4465. If a power of attorney that meets those provisions is not submitted, you will be required to provide the authorized agent signed permission to submit a request, verify your identity directly with us, and directly confirm with us that you provided the authorized agent permission to submit the request.

If you’re an authorized agent making a request you need to do the following:

(a) e-mail a copy of a power of attorney provided to you by the consumer pursuant to Probate Code sections 4000 to 4465; or

(b) e-mail proof of signed permission along with a copy of your ID and have the consumer direct confirm with us that they provided you permission to submit the request by sending an e-mail.


Opt-Out Preference Signals

You may use an Opt-Out Preference Signal, such as the Global Privacy Control (GPC), to opt-out of the sale/sharing of your personal information.

If you do not have a Backblaze account or if you are not logged into your Backblaze account, your request to opt-out of sale/sharing will be linked to your browser identifier only and not linked to any account information because the connection between your browser and the account is not known to us.

If you would like us to make the connection between your browser and your account, and you have not yet opted out of sale/sharing your personal information, please click here to submit the form.


Your Right to Non-Discrimination for the Exercise of a Privacy Right

We will not discriminate against you for exercising any of your CCPA/ CPRA or VCDPA rights. Unless permitted by the CCPA/ CPRA or VCDPA, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
• Retaliate against you, as an employee, applicant for employment, or independent contractor.

Other California Privacy Rights

California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our Website that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please send an email to privacy@backblaze.com .

Backblaze responds to Do Not Sell Opt-Out requests as disclosed in the section “What we Sell and Right to Opt-Out.” Otherwise, Company does not respond to Web browser “do not track” signals or other mechanisms.

Other parties may collect personally identifiable information about your activities over time and across different Web sites when a consumer uses our Web site or service.


Changes to Our Privacy Notice

We reserve the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on the Website and update the notice’s effective date. Your continued use of our Website following the posting of changes constitutes your acceptance of such changes.


Contact Us for More Information

If you have any questions or comments about this notice, the ways in which we collect and use your information, your choices and rights regarding such use, or wish to exercise your rights under California or Virginia law, please do not hesitate to contact us at:

Website: https://www.backblaze.com/
Email: privacy@backblaze.com