Annex I: Notice to United States Residents

1. OVERVIEW

United States state legislation such as the California Consumer Privacy Act (“CCPA”) provides residents of the applicable state with specific rights which are explained to these parties in the following sections of this privacy statement:

2. NOTIFICATION OF ADDITIONAL RIGHTS OF UNITED STATES RESIDENTS UNDER STATE LEGISLATION.

In addition to the other notices and disclosures that we have provided above in this Privacy Statement, we hereby provide the following notices to all US Residents regarding their rights under the CCPA or equivalent:

A. UNITED STATES RESIDENTS’ ACCESS TO SPECIFIC INFORMATION AND DATA PORTABILITY RIGHTS

Each US Resident has the right to request that ComponentSource disclose certain information to that US Resident about ComponentSource’s collection and use of that US Resident’s personal information over the past 12 months. Once ComponentSource receives and confirms a verifiable consumer request from that US Resident (see below Section D: Exercising A United States Resident’s Access, Data Portability, and Deletion Rights), ComponentSource will disclose to that US Resident (per such US Resident’s request):

• The categories of personal information that we collected about such US Resident.
• The categories of sources for the personal information that we collected about such US Resident.
• Our business or commercial purpose for collecting or selling that personal information.
• The categories of third parties with whom we share that personal information.
• The specific pieces of personal information that we collected about such US Resident (also called a data portability request).
• If we sold or disclosed such US Resident’s personal information for a business purpose; two separate lists disclosing:
  • Sales (if any), identifying the personal information categories that each category of recipient purchased; and
  • disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.

B. UNITED STATES RESIDENTS’ DELETION REQUEST RIGHTS

Each US Resident has the right to request that ComponentSource delete any of that US Resident’s personal information that ComponentSource collected from such US Resident and retained, subject to certain exceptions. Once ComponentSource receives and confirms a verifiable consumer request from such US Resident (see below Section D: Exercising A United States Resident’s Access, Data Portability, and Deletion Rights), ComponentSource will delete (and direct our service providers to delete) such US Resident’s personal information from our records, unless an exception applies. However, ComponentSource may deny such US Resident’s deletion request if retaining the information is necessary for ComponentSource or its service provider(s) to:

• Complete the transaction for which we collected the personal information, provide a good or service that such US Resident has ordered or requested, take actions reasonably anticipated within the context of our ongoing business relationship with such US Resident, or otherwise perform our contract with such US Resident;
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;
• Debug products to identify and repair errors that impair existing intended functionality;
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law;
• In the case of a California resident, comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.);
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if such US Resident previously provided informed consent;
• Enable solely internal uses that are reasonably aligned with consumer expectations based on the US Resident’s relationship with us; or
• Comply with a legal obligation; or
• Make other internal or lawful uses of that information that are compatible with the context in which the US Resident provided it.

C. NOTIFICATION TO UNITED STATES RESIDENTS REGARDING “SALE” (IF ANY) OF PERSONAL INFORMATION UNDER THE CCPA OR EQUIVALENT

In view of the definition of “sale” under the CCPA, we may, either now or in the future, exchange, share, and/or “sell” (as defined under the CCPA) certain personal information to certain third parties. CLICK HERE for ComponentSource’s “DO NOT SELL MY PERSONAL INFORMATION” notice to US Residents about their right to stop any such “sales”, if any such “sales” exist.

D. EXERCISING A UNITED STATES RESIDENT’S ACCESS, DATA PORTABILITY, AND DELETION RIGHTS

To exercise the access, data portability, deletion rights, and other rights of a US Resident described above, a US Resident must submit a verifiable consumer request to ComponentSource by:

• Emailing ComponentSource at: dpm@componentsource.com

Only a US Resident, or a person registered with the applicable Secretary of State that such US Resident authorize to act on such US Resident’s behalf, may make a verifiable consumer request to ComponentSource related to such US Resident’s personal information. The US Resident may also make a verifiable consumer request on behalf of your minor child. The US Resident may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows ComponentSource to reasonably verify that such US Resident is the person about whom we collected personal information or an authorized representative.
• Describe the US Resident’s request with sufficient detail that allows ComponentSource to properly understand, evaluate, and respond to it.

ComponentSource cannot respond to a US Resident’s request or provide a US Resident with personal information if ComponentSource cannot verify your identity or authority to make the request and confirm the personal information relates to such US Resident. Making a verifiable consumer request does not require the US Resident to create an account with us. ComponentSource will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

E. RESPONSE TIMING AND FORMAT

If a US Resident sends a verifiable consumer request as set forth in Section D above (Exercising A United States Resident’s Access, Data Portability, and Deletion Rights) ComponentSource will endeavour to respond to such verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to a total aggregate of 90 days), ComponentSource will inform such US Resident of the reason and extension period in writing. If such US Resident has an account with us, we will deliver our written response to that account. If such US Resident do not have an account with us, we will deliver our written response by mail or electronically. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt.

The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide such US Resident’s personal information that is readily useable and should allow such US Resident to transmit the information from one entity to another entity without hindrance. We do not charge a fee to process or respond to a US Resident’s verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell such US Resident why we made that decision and provide such US Resident with a cost estimate before completing such US Resident’s request.

F. NON-DISCRIMINATION NOTICE TO UNITED STATES RESIDENTS

ComponentSource will not discriminate against US Residents for exercising any of their rights under the CCPA or equivalent. Unless permitted by the CCPA or equivalent, we will not:

• Deny any such US Resident goods or services;
• Charge any such US Resident different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
• Provide any such US Resident a different level or quality of goods or services; or
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

G. SPECIAL NOTICE ABOUT EXCLUSION OF CERTAIN INFORMATION FROM GOVERNANCE OF THE CCPA OR EQUIVALENT

IN ACCORDANCE WITH THE CCPA, THE COLLECTION AND USE OF THE FOLLOWING INFORMATION IS NOT SUBJECT TO OR GOVERNED BY THE CCPA AND, THUS, IS EXCLUDED FROM THE TERMS AND CONDITIONS OF THIS PRIVACY STATEMENT WHICH ADDRESS THE RIGHTS OF UNITED STATES RESIDENTS UNDER THE CCPA OR EQUIVALENT:

• ANY HEALTH OR MEDICAL INFORMATION COVERED BY OR OTHERWISE SUBJECT TO: (A) THE U.S. FEDERAL HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA) AND ITS RELATED REGULATIONS; OR (B) IN THE CASE OF CALIFORNIA RESIDENTS THE CALIFORNIA CONFIDENTIALITY OF MEDICAL INFORMATION ACT (CMIA) AND ITS RELATED REGULATIONS); OR
• ANY INFORMATION COVERED BY CERTAIN OTHER INDUSTRY SECTOR-SPECIFIC PRIVACY LAWS, INCLUDING THE U.S. FAIR CREDIT REPORTING ACT (FRCA), THE U.S. GRAMM-LEACH-BLILEY ACT (GLBA), IN THE CASE OF CALIFORNIA RESIDENTS THE CALIFORNIA FINANCIAL INFORMATION PRIVACY ACT (FIPA), AND THE U.S. DRIVER’S PRIVACY PROTECTION ACT OF 1994.

How to Contact Us

Our Data Protection Manager can be contacted at dpm@componentsource.com. Please direct any queries about this policy or about the way we process your personal information to our Data Protection Manager.

CSPrivacy 10/2025