Privacy Policy

1. Scope, Applicability, and Connecticut Notice

This privacy policy (this Policy) explains how [Pool Business Legal Name], LLC, a Connecticut-organized limited liability company with its principal place of business at [full business address], Connecticut [ZIP code] (the Company, we, us, or our), collects, uses, discloses, and otherwise processes personal data in connection with our design, sale, installation, and servicing of swimming pools and related products and services for residential homes and commercial properties.

This Policy is intended to comply with the Connecticut Data Privacy Act, Conn. Gen. Stat. §§ 42515 through 42526, as amended (the CTDPA), including the January 1, 2025 requirements relating to universal opt-out preference signals.

1.1 Who This Policy Covers

This Policy applies to Connecticut residents in their capacity as consumers as defined under the CTDPA, meaning natural persons acting in an individual or household context. It does not apply to:

• Individuals acting in a commercial or employment context, such as:
• Property managers acting on behalf of building owners
• Representatives of homeowner associations or condominium associations acting in an official capacity
• Employees or agents of businesses procuring commercial pool installations or services
• Deidentified or aggregated data that cannot reasonably be linked to an identified or identifiable natural person or household
• Information expressly exempted under the CTDPA or other applicable laws (for example, certain financial, health, or credit information covered by sector-specific laws)

If you are interacting with us in a commercial or employment context, some or all of the consumer rights described in Section 5 may not apply to you. However, we still handle your information in accordance with contractual, common law, and any other applicable statutory obligations.

1.2 Children’s Data

Our services are not directed to children under 13 years of age, and we do not knowingly collect personal data from children under 13. If we become aware that we have collected personal data from a child under 13, we will take steps to delete such data as required by law.

2. Key Terms and Definitions

For purposes of this Policy, the following terms have the meanings set forth below. To the extent these terms are defined differently in the CTDPA, the statutory meanings shall control where applicable.

2.1 Biometric Data

Biometric data means data generated by automatic measurements or technical processing of an individuals biological, physiological, or behavioral characteristics that is used or intended to be used to identify a specific individual, including fingerprints, voiceprints, facial geometry, retina or iris scans, or other unique biological patterns. Biometric data does not include photographs or audio/video recordings themselves, unless such data is used for identification or authentication.

2.2 Commercial Context

Commercial context means activities reflecting an individual acting in a business or employment capacity rather than in an individual or household context. Personal data collected solely in a commercial context is generally outside the CTDPAs consumer-rights provisions.

2.3 Controller

Controller means the person or entity that determines the purposes and means of processing personal data. For the personal data described in this Policy, the Company acts as a controller.

2.4 Data Protection Assessment or DPA

Data protection assessment or DPA means a documented riskbenefit analysis of our data processing activities that present a heightened risk of harm to consumers, as required by Conn. Gen. Stat. § 42522.

2.5 Personal Data or Personal Information

Personal data or personal information means any information that is linked or reasonably linkable to an identified or identifiable natural person. Personal data may include information associated with a household. It may include some or all of the following and such additional information as further described in Section 3 below:

*Your e-mail Address

*Your First and Last Name

*Your Phone Number

*Your Address; and

*Your Usage Data

Personal data does not include:

• Deidentified data
• Aggregated data
• Publicly available information as defined under the CTDPA

2.6 Processor

Processor means a person or entity that processes personal data on behalf of a controller pursuant to a contract or other legal obligation and that does not determine the purposes and means of the processing.

2.7 Profiling

Profiling means any form of automated processing of personal data to evaluate, analyze, or predict personal aspects relating to a consumer, including performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements.

2.8 Sensitive Personal Data or Sensitive Data

Sensitive personal data or sensitive data means a category of personal data that includes, without limitation:

• Data revealing racial or ethnic origin
• Data revealing religious beliefs, religious affiliations, or religious practices
• Data concerning health conditions or diagnoses
• Data concerning sex life or sexual orientation
• Genetic data or biometric data processed for the purpose of uniquely identifying an individual
• Social Security number or other government-issued identifiers
• Financial account numbers (with or without access codes), payment card numbers, or similar
• Precise geolocation data
• Any other category of sensitive personal data identified under Conn. Gen. Stat. § 42516(b) or subsequent guidance

2.9 Targeted Advertising

Targeted advertising means displaying advertisements to you based on personal data obtained from your activities over time and across nonaffiliated websites, applications, or online services to predict your preferences or interests. It does not include:

• Advertising based solely on activities within our own website or app
• Contextual advertising based on the content you are viewing at the time
• Processing solely for measurement and frequency capping, if not combined with cross-context behavioral data

2.10 Third Party

Third party means a person or entity other than:

• The Company; or
• A processor engaged by the Company to process personal data on the Companys behalf.

2.11 Consumer, You, or Your

Consumer, you, or your means a Connecticut resident acting in an individual or household context, and not acting in a commercial or employment context, as defined in the CTDPA.

3. Personal Data We Collect

We collect various categories of personal data about you, depending on how you interact with us. The categories include, but are not limited to, the following.

3.1 Identifiers and Contact Information

• Full name and any aliases
• Residential or commercial property address
• Mailing address
• Email address
• Telephone numbers (home, mobile, and business)
• Unique identifiers we assign (customer or account numbers)
• Online identifiers (IP address, device IDs, cookies, pixels, and similar)
• Social media usernames and profile information, if you contact us or connect with us via social media

3.2 Financial and Payment Information

• Payment card information (credit or debit card number, expiration date) collected via our payment processors
• Bank account numbers and routing numbers if used for ACH payments
• Financing application information, including income, employment, and other credit-related data (with your authorization)
• Credit history, credit scores, and credit reports (with your authorization)
• Payment history, invoices, and transaction records
• Loan origination and payoff information related to financing of our products and services

3.3 Commercial and Transactional Information

• Records of products and services purchased, obtained, or considered
• Pool design specifications (dimensions, materials, features, options)
• Transaction history and order details
• Quotes, estimates, and proposals
• Warranty registrations, service contracts, and service history
• Communications regarding repairs, maintenance, and customer support

3.4 Property and Real Property Information

• Property type (residential, multifamily, commercial, recreational, etc.)
• Property size, lot size, and general characteristics
• Existing structures, utilities, drainage, soil conditions, and site constraints
• Permit, zoning, and code information related to the project
• Homeowner association or similar covenants and restrictions
• Property ownership and public record information
• Site plans, surveys, photographs, diagrams, and installation notes

3.5 Precise Geolocation Data

• Exact property locations and installation addresses
• GPS or similar precise location information (where enabled or provided) for installation or service visits
• Geographic coordinates associated with service calls or on-site inspections

3.6 Biometric Data (If Applicable)

If you use any features of our services that rely on biometric data (such as certain mobile app authentication or advanced remote consultation features), we may collect:

• Facial geometry or facial recognition data in connection with identity verification or personalized visualizations
• Voiceprints or voice data used for authentication or analysis
• Other biometric identifiers used for security, verification, or access control

We do not use biometric data for profiling or marketing and treat such data as sensitive personal data.

3.7 Internet or Other Electronic Network Activity Information

• Browsing history on our website or app
• Search queries performed on our website or app
• Pages visited, links clicked, and time spent
• Device and browser information (device type, operating system, browser type and version)
• Referral URLs and the website that directed you to us
• Log files with IP address, timestamps, and request information
• Application usage data, error logs, and performance data

3.8 Demographic and Profile Information

• Age or date of birth (where provided)
• Gender (where provided)
• Language preferences
• Household size or composition (for project planning, if voluntarily provided)
• Occupation and employer (if relevant to credit applications or project eligibility)
• Inferences drawn from the above to create a profile reflecting your preferences and likely interests in our products and services

We do not require you to provide sensitive demographic characteristics such as race, ethnicity, or religious beliefs for the provision of our core services, and we will not use such information for discriminatory purposes.

3.9 Sensory Information

• Audio recordings of customer support calls, where permitted by law and disclosed to you
• Photographs and videos taken of your property for site assessment, design, installation progress, or quality assurance
• Video or audio recordings from in-person or virtual consultations, where we obtain appropriate notice and consent

3.10 Professional or Employment-Related Information

For business or commercial projects, we may collect:

• Business title or role
• Business contact information
• Employer name and business address
• Professional licenses or credentials relevant to project authorization

3.11 Other Information You Provide Directly

• Information you submit in forms, emails, text messages, online chat, or surveys
• Feedback, reviews, testimonials, and responses to questionnaires
• Special requests, accessibility needs, or safety instructions
• Communication and marketing preferences

3.12 Information Obtained from Third Parties

We may obtain personal data about you from other sources, including:

• Credit reporting agencies and financial institutions (with your authorization)
• Public records (property, tax, or permit databases)
• Data brokers and marketing partners, to the extent permitted by law
• Referral sources, such as friends, family, real estate agents, or contractors who refer you to us
• Our contractors, subcontractors, and service providers, who may provide information about project progress or interactions with you
• Social media platforms, if you link, connect, or interact with us through those services

4. How We Collect Personal Data

We collect personal data through various methods and sources, including:

4.1 Directly from You

• When you request a quote, schedule a consultation, or place an order
• When you sign contracts or financing documents
• When you communicate with us via phone, email, text, chat, mail, or in person
• When you create an account on our website or app (if any)
• When you participate in surveys, promotions, or events
• When you submit reviews or testimonials

4.2 Automatically Through Technology

• Through cookies, pixels, web beacons, tags, scripts, and similar technologies placed on your browser or device when you visit our website or use our app
• Through server logs and analytics tools that record usage patterns, device details, and technical events
• Through our mobile app (if applicable), including device identifiers, usage analytics, and location information where you have granted permission

For details on our use of cookies and tracking technologies, and how you can manage them, see Section 9 below.

4.3 From Third Parties

• From contractors and subcontractors engaged to perform design, installation, service, or permitting functions on our behalf
• From payment processors and financial institutions that process your payments or financing
• From credit bureaus and credit reporting agencies in connection with financing or extended payment terms (with your authorization)
• From marketing partners and lead generation services that you have interacted with and authorized to share your information
• From public agencies or records related to permits, property records, and zoning compliance

4.4 Inferred or Derived Information

We may create new data about you by analyzing the personal data described above, for example:

• Estimating your likelihood of being interested in certain pool models or accessories
• Estimating service needs based on installation date and usage patterns
• Segmenting consumers into groups for marketing or service optimization

5. Purposes for Which We Process Personal Data

We process personal data only for lawful and disclosed purposes. These purposes include:

5.1 Providing Our Products and Services

• Evaluating your property and project requirements
• Preparing designs, plans, specifications, and cost estimates
• Installing, constructing, or delivering pools and related equipment
• Providing maintenance, warranty, and repair services
• Scheduling and managing site visits and service calls
• Communicating with you about project status and service appointments

5.2 Managing Customer Accounts and Relationships

• Creating and managing customer records and user accounts
• Providing customer support and responding to your inquiries or complaints
• Managing warranties, service plans, and service history
• Personalizing your experience based on your preferences and history

5.3 Payment, Financing, and Business Operations

• Processing payments and issuing invoices, receipts, and account statements
• Evaluating and administering financing options (with your authorization)
• Managing billing, collections, and accounts receivable
• Maintaining business records and accounting systems

5.4 Marketing, Advertising, and Promotions

• Sending promotional communications, newsletters, and offers
• Providing information about new products, features, and services
• Conducting contests, sweepstakes, or promotional events
• Performing audience segmentation and interest-based marketing
• Conducting targeted advertising (as defined in Section 2.9), subject to your opt-out rights under Sections 6 and 7

5.5 Analytics, Research, and Service Improvement

• Analyzing usage patterns and customer feedback to improve our products and services
• Enhancing the design and usability of our website and app
• Developing new offerings and service enhancements
• Conducting internal research and reporting

5.6 Security, Fraud Prevention, and Integrity of Services

• Monitoring and protecting our systems, networks, and data from security incidents
• Detecting, investigating, and preventing fraud, misuse, or unauthorized access
• Ensuring the safety of our personnel, contractors, and consumers during on-site work
• Authenticating users, including through security features or biometric verification where expressly authorized

5.7 Legal, Regulatory, and Contractual Obligations

• Obtaining required permits, inspections, and approvals from governmental authorities
• Complying with building codes, zoning ordinances, and environmental or safety regulations
• Maintaining tax and accounting records required by law
• Responding to lawful requests, subpoenas, court orders, or legal process
• Protecting our legal rights, pursuing remedies, and defending claims

5.8 Business Transfers and Corporate Transactions

• In connection with evaluating, negotiating, or completing a merger, acquisition, reorganization, asset sale, or other corporate transaction
• Transferring personal data as part of such transaction, subject to the terms of this Policy and applicable law

5.9 Any Other Purpose With Your Consent

• For any additional purposes that we expressly disclose to you at the time of collection and for which you provide consent, where required by law

6.   How We Share Personal Data

We may share your personal data with the following categories of recipients, for the purposes set forth above.

6.1 Processors (Service Providers Working on Our Behalf)

We share personal data with our processors, who process personal data on our behalf and under our instructions, including:

• Payment processors and financial service providers
• Cloud hosting and data storage providers
• Customer relationship management and communication platforms
• Analytics and website hosting providers
• IT support, cybersecurity, and system maintenance vendors
• Marketing, email, and advertising service providers

We enter into contracts with processors that require them to:

• Process personal data only for the documented purposes and instructions we provide
• Implement appropriate technical and organizational security measures
• Not sell personal data or use it for their own marketing purposes
• Assist us in meeting our obligations under the CTDPA, where applicable

6.2 Contractors and Subcontractors

We work with independent contractors and licensed subcontractors to perform design, installation, construction, inspections, and service work. These contractors may have access to certain personal data, including:

• Your name and contact details
• Property address and site access instructions
• Project and installation details
• Relevant safety or accessibility information

We treat these contractors as processors acting on our behalf when they process personal data solely to perform contracted services for you. We require them, through written agreements, to:

• Use your personal data only to provide contracted services
• Keep your personal data confidential and secure
• Comply with applicable data protection and privacy laws
• Not use your personal data for their own independent marketing or unrelated business purposes without your consent

If you believe a contractor has used your personal data improperly, you should promptly notify us using the contact information in Section 13.

6.3 Third Parties for Legal, Compliance, and Safety Reasons

We may disclose personal data to third parties (including law enforcement, regulators, or courts) when we believe, in good faith, that such disclosure is necessary to:

• Comply with legal obligations, laws, or regulations
• Respond to subpoenas, court orders, or other lawful requests for information
• Protect the rights, property, or safety of you, us, our personnel, our contractors, or others
• Investigate or prevent fraud, security incidents, or other wrongdoing

6.4 Financing Partners and Credit Providers

If you choose to apply for financing or extended payment terms, we may share personal data with:

• Lenders, financial institutions, and credit providers
• Credit reporting agencies, as allowed by law and with your authorization

These entities may act as independent controllers of your data, and their use of your data will be governed by their own privacy policies and applicable laws.

6.5 Marketing and Advertising Partners

We may share limited personal data (such as online identifiers and browsing information) with:

• Advertising networks
• Social media platforms
• Marketing and analytics providers

for the purpose of targeted advertising or measuring campaign performance, subject to your opt-out rights and applicable law.

6.6 Business Transfers

In the event of a merger, acquisition, reorganization, sale of assets, or bankruptcy, personal data may be transferred as part of the business assets. Any successor entity will be bound by this Policy or a substantially similar privacy policy, and your rights under the CTDPA will continue to apply.

6.7 With Your Direction or Consent

We may disclose personal data to any third party when you direct us to do so or when you have otherwise provided your consent.

7.     Sale of Personal Data and Targeted Advertising

7.1 Sale of Personal Data Under Connecticut Law

Under the CTDPA, a sale of personal data occurs when we exchange personal data with a third party for monetary or other valuable consideration, subject to certain exceptions (for example, disclosures to processors).

As of the effective date of this Policy:

• We do not sell personal data to data brokersor similar entities whose primary business is the commercial resale of personal data.
• We may share certain personal data with marketing and advertising partnersthat help us deliver or measure advertising. Some of this sharing may be considered a sale of personal data under the CTDPA, even if no money is exchanged directly for the data itself.

If and to the extent our sharing with third parties for marketing or analytics purposes constitutes a sale of personal data, you have the right to opt out of such sale, as described in Section 8.

7.2 Targeted Advertising

We may engage in targeted advertising by using or allowing third-party advertising partners to collect or receive information about your interactions with our website or app over time and across nonaffiliated websites or online services, in order to predict or infer your preferences and display relevant ads.

You have the right to opt out of targeted advertising at any time, as described in Section 8.

7.3 Profiling

We may use limited profiling for:

• Marketing segmentation and customer relationship management
• Fraud detection and security monitoring
• Service customization and recommendations

We do not engage in profiling that produces legal or similarly significant effects (such as decisions regarding employment, credit approval, housing, or insurance) solely by automated means without human involvement, except where required or expressly permitted by law and with appropriate safeguards.

You have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you, as described in Section 8, to the extent we engage in such profiling.

8.     Your Privacy Rights Under the Connecticut Data Privacy Act

If you are a Connecticut resident acting in an individual or household context, you have the following rights with respect to your personal data, subject to certain exceptions and limitations set forth in the CTDPA.

These rights do not apply to data processed solely in a commercial or employment context, or to data exempted by law.

8.1 Right of Access

You have the right to confirm whether we are processing your personal data and to access such personal data, including:

• The categories of personal data processed
• The specific pieces of personal data we have collected about you
• The categories of sources from which personal data is collected
• The purposes for which we process your personal data
• The categories of third parties to whom personal data is disclosed

8.2 Right to Correct

You have the right to request that we correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing. We may request documentation or clarification when necessary to verify the accuracy of requested corrections.

8.3 Right to Delete

You have the right to request that we delete personal data that we have collected from or about you, subject to certain exceptions, such as when the data is needed:

• To complete a transaction or fulfill a contract with you
• To provide requested goods or services
• To detect security incidents or protect against fraudulent activity
• To comply with legal obligations (e.g., tax, accounting, or regulatory records)
• For internal uses reasonably aligned with your expectations, including certain warranty and service records

If an exception applies, we will explain it in our response.

8.4 Right to Data Portability

You have the right to obtain a portable copy of your personal data that you previously provided to us in a structured, commonly used, and machine-readable format, to the extent technically feasible, and where the processing is carried out by automated means.

8.5  Right to Opt Out of Certain Processing

You have the right to opt out of the following types of processing of your personal data:

1. Targeted advertising
2. Sale of personal data, as that term is defined by the CTDPA.
3. Profilingin furtherance of decisions that produce legal or similarly significant effects concerning you.

We describe how you can exercise these opt-out rights in Section 10 (Methods for Exercising Your Rights) and how we honor opt-out preference signals in Section 9.

8.6 Right to Non-Discrimination

We will not discriminate against you for exercising any rights under the CTDPA, including by:

• Denying goods or services to you
• Charging different prices or rates
• Providing a different level or quality of goods or services

except to the extent that the difference is reasonably related to the value provided by your data or as expressly permitted by law (for example, bona fide loyalty, rewards, or discount programs that involve data processing with appropriate notice and consent).

8.7 Right to Appeal

If we decline to take action on your request to exercise a right under this Policy, you have the right to appeal our decision within a reasonable period (no less than 60 days from the date of our decision, unless a shorter period is required by law).

• We will provide you with clear instructions on how to appeal in our response to your initial request.
• We will respond to your appeal within 45 daysof receipt, including a written explanation of the reasons for our decision.
• If your appeal is denied, we will inform you of any available methods for contacting the Connecticut Attorney General to submit a complaint.

9.  Opt-Out Preference Signals (Effective January 1, 2025)

Beginning January 1, 2025, the CTDPA requires controllers to recognize and honor opt-out preference signals for certain types of processing (targeted advertising, sale of personal data, and certain profiling). We are committed to complying with this requirement.

9.1 What Is an Opt-Out Preference Signal?

An opt-out preference signal is a technical mechanism that allows you (or an agent acting on your behalf) to communicate your choice to opt out of:

• Targeted advertising
• Sale of personal data
• Profiling in furtherance of decisions that produce legal or similarly significant effects

Opt-out preference signals are typically sent through:

• Web browsers or browser extensions
• Device-level privacy settings
• Authorized third-party tools that implement universal opt-out technologies

9.2 Signals We Honor

As of January 1, 2025, we will recognize and honor:

1. Global Privacy Control (GPC)signals transmitted via your browser or extension, to the extent technically feasible and consistent with any standards or guidance adopted or recognized by the State of Connecticut.
2. Any other universal opt-out mechanismsthat may be subsequently designated, recognized, or recommended by Connecticut law, regulations, or official guidance.

We will periodically review applicable legal and technical standards and may update this Policy to reflect additional recognized mechanisms.

9.3 How We Process Opt-Out Preference Signals

When we receive a valid opt-out preference signal from your browser, device, or authorized agent:

1. We will treat the signal as a request to opt outof:
   • Targeted advertising
   • Sale of your personal data
   • Profiling in furtherance of decisions that produce legal or similarly significant effects concerning you (to the extent such profiling occurs)

2.We will apply the opt-out signal to:

• The specific browser or device from which the signal is sent
• Your account with us, if we can reasonably associatethe signal with an existing account (for example, when you are logged in)

3. We will not require you to create an accountto exercise your opt-out rights via an opt-out preference signal.
   
   4. We will process the opt-out preference signal within a commercially reasonable time, not to exceed the statutory timelines for processing opt-out requests (generally 45 daysfrom receipt, subject to one extension of an additional 45 days when reasonably necessary and where permitted by law).

9.4 Scope and Limitations of Opt-Out Preference Signals

• Opt-out preference signals do notaffect processing of your personal data that is necessary for:
• Providing goods or services you requested or ordered
• Performing a contract with you
• Detecting and preventing fraud or security incidents
• Complying with legal obligations
• Certain internal operations reasonably aligned with your expectations and the context in which you provided the data
• Opt-out preference signals limitour use of your personal data for:
• Targeted advertising
• Sale of personal data
• Certain profiling activities with legal or similarly significant effects
• If you subsequently grant consentfor a specific purpose that conflicts with the opt-out preference signal (for example, by enrolling in a marketing program that clearly requires data sharing), we will honor your more specific consent to the extent permitted by law and clearly documented, unless and until you withdraw that consent.

9.5 Confirmation and Recordkeeping

• When technically feasible and where we can associate an opt-out signal with a user account, we will recordyour opt-out preference in your account settings.
• We may maintain reasonable recordsof your opt-out status and any subsequent changes or withdrawals, solely for compliance and recordkeeping purposes.

10. Cookies, Tracking Technologies, and Do-Not-Track

10.1 Use of Cookies and Similar Technologies

We use cookies and similar technologies (including web beacons, pixels, tags, scripts, and SDKs) on our website and app for various purposes, including:

• Authenticating users and enabling secure login
• Remembering your preferences and settings
• Improving website performance and functionality
• Conducting analytics and measuring traffic and usage patterns
• Supporting targeted advertising and marketing campaigns

10.2 Types of Cookies We Use

1. Strictly Necessary Cookies
   • Required for the operation of our website or app
   • Enable core features such as page navigation, secure access, and load balancing
   • Cannot be disabled through our cookie settings interface
     
     2. Functional (Preference) Cookies
   • Remember choices you make, such as language or region
   • Provide enhanced, more personalized features

3.    Analytics and Performance Cookies
4. Collect information about how visitors use our site
5. Help us understand which pages or features are most popular
6. Assist us in troubleshooting errors and improving performance

4. Advertising and Targeting Cookies
   • Used by us or third-party partners to:
5. Deliver relevant advertisements
6. Measure the effectiveness of advertising campaigns
   • May track your browsing activities across nonaffiliated sites
   • These cookies are directly related to targeted advertising, and you may opt out as described in Sections 8 and 9.

10.3 Managing Cookies and Local Device Settings

You can manage cookies and similar technologies in several ways:

• Browser Settings: Most web browsers allow you to:
• Block or delete cookies
• Limit cookies to trusted sites
• Receive notifications when a cookie is set
• Our Cookie Controls(if available on our site): We may provide an on-site cookie banner or preferences center that allows you to:
• Accept or decline non-essential cookies (e.g., advertising or analytics cookies)
• Review and adjust your cookie settings

Please note that disabling certain cookies may impair the functionality of our website or app and may limit your ability to use some features.

10.4 Do-Not-Track Signals

Do-Not-Track (DNT) is a setting in some web browsers that signals to websites that you do not wish to be tracked. Currently, there is no universally accepted standard for how websites should respond to DNT signals, and the CTDPA instead focuses on opt-out preference signals as described in Section 9.

At this time:

• We do notrespond to browser-based DNT signals in a uniform manner.
• We dohonor opt-out preference signals, such as Global Privacy Control (GPC), as described in Section 9.

11. Methods for Exercising Your CTDPA Rights

If you are a Connecticut resident acting in an individual or household context, you can exercise your rights under Section 8 using any of the methods below.

11.1 How to Submit a Request

You may submit a request to access, correct, delete, or obtain a copy of your personal data, or to opt out of targeted advertising, sale, or certain profiling, by using one of the following methods:

1. Online Web Form
   • Visit: [URL of privacy request or Do Not Sell/Share/Opt-Out page]
   • Complete and submit the form with the required information.
   2. Email
2. Send an email to: [privacy email address]
3. Include:
   • Your full name
   • Contact information
   • The nature of your request (access, correction, deletion, portability, or opt-out)
   • Any relevant account or project number, if applicable

3.  Telephone

• Call our toll-free number: [telephone number]
• Provide the requested information so that we can verify your identity and process your request.

4. Postal Mail

• Send a written request to:
  Aquatic Pool and SPA Services, Inc.
  Attn: Privacy Officer

1437 Middletown Avenue
Northford, CT 06472

We may add or update methods for submitting requests and will update this Policy accordingly.

11.2 Verification of Your Identity

To protect your privacy and the security of your data, we must reasonably verify your identity before processing certain requests. Verification steps may vary depending on:

• The type and sensitivity of the data involved
• The nature of your request
• Our relationship with you

We may:

• Ask you to confirm specific pieces of information we already hold (e.g., recent transaction details, property address, or contact information)
• Request additional documentation where necessary (e.g., copies of invoices or identification documents, subject to applicable law)
• Require you to log into your existing account (if applicable)

If we cannot reasonably verify your identity, we may be unable to fulfill your request and will inform you of this in writing.

11.3 Authorized Agents

You may authorize another person (an authorized agent) to submit a rights request on your behalf. To protect your data:

• We may require the authorized agent to provide proof of authority, such as:
• A valid, signed power of attorney
• Written authorization signed by you and reasonably sufficient to verify your identity and the agents identity
• We may contact you directly to confirmthat you have authorized the request.

11.4 Response Timeframes

We will respond to your verifiable request without undue delay, and in any event within:

• 45 daysof receipt of your request; and
• We may extend this period once by an additional 45 days(for a total of up to 90 days), where reasonably necessary due to the complexity or number of requests, and we will notify you of the extension and the reasons for the delay.

11.5 Fees

We generally do not charge a fee to process or respond to your verifiable consumer requests. However, we may charge a reasonable fee or refuse to act on a request if:

• The request is manifestly unfounded, excessive, or repetitive; or
• A fee is expressly permitted by the CTDPA or other applicable law.

If we decide to charge a fee, we will provide you with an estimate in advance and allow you to decide whether you wish to proceed.

11.6 How to Appeal Our Decision

If we decline to act on your request, in whole or in part, you have the right to appeal our decision.

• To appeal, you may use any of the methods in Section 11.1, clearly indicating that your submission is an Appeal of Privacy Rights Decision.
• We will respond to your appeal within 45 daysof receipt with a written explanation of our decision.
• If we deny your appeal, we will provide you with information on how you can contact the Connecticut Attorney Generalto file a complaint or obtain further guidance.

12. Data Protection Assessments and High-Risk Processing

Because we collect and process certain categories of personal data that may present a heightened risk of harm to consumer privacy or security such as:

• Sensitive financial information
• Precise geolocation data
• Biometric data (if used)
• Inferences for targeted advertising or certain profiling activities

we conduct Data Protection Assessments (DPAs) as required by Conn. Gen. Stat. § 42522.

12.1 Scope of Our Data Protection Assessments

Our DPAs are designed to:

• Identify and evaluate the benefitsof processing activities to you, us, and other stakeholders
• Assess the risksto your privacy, security, and other rights
• Evaluate the safeguardswe have implemented to mitigate these risks
• Determine whether the benefits of processing outweigh the potential risks, taking into account any mitigation measures

Examples of processing activities for which we may conduct DPAs include:

• Use of precise geolocation data for on-site services or emergency access
• Use of sensitive financial data for credit evaluation and financing programs
• Use of profiling for targeted advertising or marketing segmentation
• Collection or use of biometric data for authentication or identity verification

12.2 Safeguards Implemented

As a result of our DPAs, we may implement specific technical, organizational, and administrative measures, such as:

• Encryption of sensitive personal data in transit and at rest, where appropriate
• Access controls and role-based permissions
• Regular security testing and monitoring
• Data minimization and strict retention schedules
• Additional consent mechanisms for certain sensitive processing activities
• Enhanced training for employees and contractors who access sensitive data

12.3 Availability of DPA Information

While DPAs themselves may contain confidential and proprietary information, we are committed to transparency. You may request more information about:

• Whether a specific processing activity affecting your personal data is subject to a DPA
• The key privacy risks identifiedin that DPA; and
• The general types of safeguards we have implemented in response to those risks.

To request this information, please contact us using the methods described in Section 13. We may provide only a summary of the DPA findings in order to protect security, confidentiality, and proprietary information, as permitted by law.

13. Data Security, Retention, and International Data Transfers

13.1 Data Security

We implement and maintain reasonable administrative, technical, and physical safeguards designed to protect personal data against:

• Accidental or unlawful destruction
• Loss, alteration, unauthorized disclosure, or access
• Misuse or other unauthorized processing

Security measures we may use include, without limitation:

• Encryption of data in transit and, where appropriate, at rest
• Firewalls, intrusion detection systems, and secure network configurations
• Role-based access controls and authentication measures
• Regular security assessments, vulnerability scanning, and patch management
• Logging and monitoring of access and system activity
• Employee and contractor training on data security and privacy

No system or method of transmission over the internet is 100% secure. While we strive to protect your personal data, we cannot guarantee absolute security. If we become aware of a data breach involving your personal data, we will notify you and any applicable authorities in accordance with Connecticut data breach notification laws and other applicable regulations.

13.2 Data Retention

We retain your personal data only for as long as is reasonably necessary to:

• Fulfill the purposes described in this Policy
• Provide the products and services you have requested
• Comply with our legal, tax, accounting, and regulatory obligations
• Resolve disputes and enforce our agreements

While specific retention periods may vary based on the category of data and applicable law, we generally apply the following guidelines:

1. Installation, Project, and Service Records
   • Retained for up to 10 yearsfrom completion of the project or last service visit, to:
     • Support warranties, service obligations, and maintenance history
     • Manage potential claims, disputes, and statutory limitation periods
     • Comply with contractor licensing and building code requirements

2. Financial and Transaction Records
   • Retained for at least 7 yearsfrom the date of the transaction, to:
     • Satisfy tax, accounting, and audit requirements
     • Comply with applicable financial regulations
   • Payment card data is notstored by us beyond what is necessary to complete the transaction and is primarily handled by our payment processors.
     1. Marketing and Communications Data
   • Retained for as long as you remain subscribed or do not opt out of marketing communications, and for a reasonable time thereafter for recordkeeping purposes.
   • We will promptly honor unsubscribe or opt-out requests and will cease sending marketing communications to you within a commercially reasonable period.
     
     4. Customer Support and Inquiry Records
   • Retained for as long as necessary to address your inquiries, provide follow-up services, and maintain a record of communications, typically 25 years, unless longer retention is required or justified.
     1. Biometric Data (If Collected)
   • Retained only for the minimum period necessary to accomplish the purpose (such as authentication or verification) and then deleted or irreversibly deidentified, unless a longer retention period is:
     • Required by law; or
     • Specifically authorized by you in a separate, clear, and informed consent.
       1. Website and Analytics Data
     • Retained for a period consistent with our analytics and security practices, typically 1336 months, unless a shorter or longer period is justified for security, legal, or business continuity reasons.

When personal data is no longer needed for any lawful business purpose, we will either:

• Securely deleteor destroy the data; or
• Deidentify or aggregatethe data so that it is no longer reasonably linkable to an identifiable individual or household.

13.3 International Data Transfers

Our primary operations and data centers are located in the United States. If you access our website or services from outside the United States, your personal data will be transferred to and processed in the United States, which may have different data protection laws than those in your jurisdiction.

Where required by law, we will implement appropriate safeguards for cross-border data transfers, which may include:

• Contractual protections with our processors and service providers
• Technical and organizational measures to protect personal data during transfer and subsequent processing

By using our services or providing personal data to us, you acknowledge that your data may be processed in the United States in accordance with this Policy and applicable law.

14. Additional Information for Commercial Customers and Business Contacts

As noted in Section 1.1, the CTDPA applies to consumers acting in an individual or household context. Many of our relationshipsparticularly those involving commercial properties, homeowner associations, property management companies, or business entitiesinvolve individuals acting in a commercial or employment capacity.

14.1 Business Contacts and Commercial Context Data

When we interact with you as a representative, employee, owner, or agent of a business or organization (for example, a property management firm or commercial property owner):

• We may collect your business contact informationand professional details.
• We process this information primarily for:
• Managing business relationships
• Providing quotations, contracts, and services to your organization
• Communicating about projects, billing, and accounts
• Some of the consumer rightsdescribed in Section 8 (such as access, deletion, and opt-out of sale for personal data in a purely commercial context) may not apply under the CTDPA.

Nevertheless, we handle business contact information in accordance with:

• This Policy (to the extent applicable)
• Our contractual commitments
• Other applicable data protection and privacy laws

If you are unsure whether your interactions with us fall within an individual/household or commercial context, you may contact us for clarification using the methods described in Section 15.

15. Changes to This Policy

We may update or modify this Policy from time to time to reflect:

• Changes in our business practices, products, or services
• Changes in applicable laws or regulatory requirements
• Developments in technology or security practices

15.1 Notification of Changes

When we make material changes to this Policy, we will:

• Update the Last Updateddate at the top of the Policy
• Provide additional notice as appropriate, which may include:
• Posting a prominent notice on our website
• Sending you an email or other direct communication
• Obtaining your consent if required by law for certain changes

Your continued use of our services after the effective date of any updated Policy constitutes your acknowledgment of the updated Policy, to the extent permitted by law.

16. Contact Information

If you have any questions, concerns, or requests regarding this Policy or our privacy practices, or if you wish to exercise any of your rights under the CTDPA, you may contact us using any of the methods below:

By Mail:
Aquatic Pool and Spa Services, Inc.
Attn: Privacy Officer
1437 Middletown Avenue
Northford, Connecticut 06472

By Email:
info@aquaticpool.com

By Telephone:
(203) 239-7949

If you are a Connecticut resident and you believe that we have not adequately addressed your privacy concerns after you have contacted us and, if applicable, completed our appeal process as described in Section 11.6, you may contact the:

Office of the Attorney General of the State of Connecticut
165 Capitol Avenue
Hartford, Connecticut 06106
Website: https://portal.ct.gov/AG
Telephone: (860) 808-5318 (Consumer Assistance)

We encourage you to contact us first so that we have an opportunity to address your concerns directly