Additional Privacy Notice for California Residents under the California Consumer Privacy Act (CCPA)

Your Rights under the CCPA

1. The CCPA requires us to disclose in this notice that California residents have the following rights regarding their personal data:
   1. the right to request that you be disclosed:
      1. the categories of personal information collected about you in the preceding 12 months;
      2. the categories of sources used to collect the personal information;
      3. the business or commercial purposes for collecting, selling and/or sharing your personal information;
      4. the categories of third parties to whom your personal information was disclosed, including for advertising purposes; and
      5. the specific pieces of personal information collected about you.
   2. the right to request that personal information collected about you be deleted (unless that personal information is necessary to provide the services you asked for);
   3. where applicable, the right to opt out of the sharing of your personal information for the purpose of cross contextual behavioural advertising;
   4. the right to correct inaccurate personal information collected about you; and
   5. the right not to be discriminated against for exercising any of these rights.
2. Also, we must provide in this online disclosure certain details about our collection and handling of categories of personal information.

Categories of Personal Information collected

3. As set out in clauses 8 and 9 of our Privacy and Data Policy, we have collected the following categories of personal information in the last 12 months:
   1. Personal identifiers: the details required in our registration form, including your email address;
   2. Financial details: payment account details;
   3. Internet or other electronic network activity information:
      1. as set out at clause 8.3 of our Privacy and Data Policy: browser type and operating system of the devices from which you have logged in to MEGA; IP address and port information for logins, API usage, file uploads, folder creations and link exports; the country that we expect you are accessing our services from (inferred by matching your IP address to a public IP address database); file sizes, versioning order, timestamps and parent-child file relationships; deletion timestamps; the email address of anyone you have specifically made a contact using MEGA’s systems; contact email addresses of chat participants, chat commencement time and chat duration, and moderation activity; takedowns and account suspensions; our communications with you; and your personal account settings, including any avatar picture; and
      2. as set out in our Cookie Policy: usage information essential to provide our services and usage statistics to improve our services.

Categories of Sources of Personal Information

4. As also set out in our Privacy and Data Policy, we have only collected personal information about California residents from the following categories of sources in the past 12 months:
   1. Directly from you: when you provide it to us upon registration or when you contact us via email or by any other means; and
   2. From your visits to and use of our website and any of our apps.

Business and Commercial Purposes for the Collection, Disclosure, and Use of Personal Information

5. As also set out at clauses 8.6 and 9.2 of our Privacy and Data Policy, we collect personal information about California residents for the following business purposes:
   1. So that we can provide the services you have contracted to obtain from us under our Terms; and
   2. for market and product research and to be able to give you promotional material and special offers on our services.

Disclosure of Personal Information

6. In accordance with our Privacy and Data Policy, in the past 12 months we have disclosed only to the extent necessary to provide our services:
   1. Personal identifiers and Internet or other electronic network activity information to our related and affiliated entities
   2. Personal identifiers and Internet or other electronic network activity information in response to law enforcement requests and as required by applicable law, court order, or governmental regulations; and
   3. Financial details to our payment processors.

Sale of Personal Information

7. As set out at clause 17 of our Privacy and Data Policy, we do not sell your personal information to any third party. We therefore do not offer to opt-out from the sale of personal information as provided by section 1798.110 of the CCPA

Use and Disclosure of Sensitive Personal Information

8. Likewise, we do not offer a right to limit our use and disclosure of sensitive personal information because we do not use or disclose sensitive personal information.

Non-Discrimination Statement

9. We do not discriminate against any consumer for exercising and of their rights under the CCPA.

How to Exercise One or More of Your Rights under the CCPA

10. To exercise one or more of your rights, you or someone you authorize to make a request on your behalf may contact MEGA’s Privacy Office at privacy@mega.nz.

Changes to this Notice

11. We may make changes to this Notice in the future. Any changes will be notified to all users residing in California and become effective when notified (unless indicated otherwise).