U.S. State Privacy Supplement

1. Relationship to the Privacy Policy

This supplement adds to the Privacy Policy. Which legal rights apply depends on your residence, the processing, the operator’s activities and statutory coverage, and any applicable exemption. YSUITS is a service brand; this notice is not a statement of incorporation, a financial-services license, or a certification of compliance with every state law.

Some laws distinguish a business’s own activities from its processing for an organization customer. If an organization controls the records concerned, its notice and instructions also matter. You may contact support@ysuits.com for assistance identifying the appropriate request recipient; that referral does not limit an obligation that applies directly to YSUITS.

2. Rights that may apply

Depending on the applicable law, you may have rights to learn whether your information is processed, obtain access or a portable copy, correct inaccuracies, request deletion, and opt out of sale, certain targeted advertising, or specified profiling that produces legal or similarly significant effects. Some laws provide additional rights concerning sensitive personal information, authorized agents, and appeal of a denied request.

These rights have conditions and exceptions. For example, retaining a record may be necessary to complete a requested transaction, meet a legal obligation, protect security, or establish or defend a claim. We assess the particular information and purpose instead of treating an entire account or all audit records as automatically exempt. Exercising a legal right will not result in unlawful discrimination.

Information categories and current practices

The account notice describes identifiers and contact information, account and organization associations, authentication records, technical and session activity, and support or privacy correspondence. The Product Privacy Addendum describes commercial and financial records, source documents, personnel information and other records supplied by an organization for an enabled function. Sources include you, your authorized organization, your use of the service and a connection you choose to authorize. The notices explain the relevant purposes, recipients and retention criteria.

We do not sell customer personal information or share it for cross-context behavioral advertising. The current public website does not deploy advertising or third-party analytics scripts. Sensitive information in an authorized workspace is handled for the requested service and lawful instructions, rather than as permission for unrelated advertising or general-purpose model training. Required opt-out and sensitive-information rights remain available where the relevant law applies.

3. Texas

The Texas Data Privacy and Security Act applies only where its coverage requirements are satisfied. Small businesses as defined by the federal Small Business Administration are generally outside its main requirements, but the separate restriction on selling a consumer’s sensitive data without prior consent can still apply. A small-business description is not permission to disregard other privacy or security laws.

Where the Act applies, a request generally receives a substantive response within 45 days, with a permitted additional 45 days where reasonably necessary and timely explained. A denial includes reasons and appeal instructions. You may appeal by emailing support@ysuits.com and identifying the earlier decision. An appeal receives a written response within the applicable 60-day period; a denied appeal includes information about complaining to the Texas Attorney General.

4. California

Where the CCPA applies, California residents may have rights to know and access, delete, correct, opt out of sale or sharing for cross-context behavioral advertising, limit certain uses or disclosures of sensitive personal information, and receive equal treatment. CCPA coverage is not assumed solely because someone visits from California. The applicable law also imposes duties on some service providers and contractors that do not depend on treating them as the customer-facing business.

For a covered request to know, delete, or correct, the CCPA generally requires acknowledgment within 10 business days and a substantive response within 45 calendar days, subject to a permitted extension explained within the applicable period. Covered sale/sharing opt-outs and sensitive-information limitations follow their different, shorter time limits, generally no later than 15 business days. We will identify an applicable exception or verification issue rather than represent receipt as completion.

5. Opt-out signals and separate choices

Where applicable law requires recognition of an opt-out preference signal, such as Global Privacy Control, the signal is treated according to that law for the relevant sale, sharing, or targeted-advertising activity and context. A general “Do Not Track” setting is not automatically the same instruction. Browser-based signals do not necessarily identify all records held under a different account or by an independent organization.

A service-provider disclosure under a properly restricted contract is not automatically a sale or advertising-related sharing. The applicable Privacy Policy describes the relevant practices. An opt-out does not prohibit processing that is necessary and lawful for account security or the service you requested, and ordinary service use is not consent to a new unrelated purpose.

6. How to request, verify, and appeal

Email support@ysuits.com with the right you wish to exercise, the service or organization involved, and enough information to locate the relevant records. You do not need to create a new account to send a request. Do not include passwords, full payment-card details, Social Security numbers, or identity documents in an initial ordinary email.

We may ask for proportionate additional information where needed to verify identity or an agent’s authority, using a suitable channel. Verification requirements depend on the request; an opt-out is not automatically subject to the same proof as disclosure of private account records. We do not use verification information for unrelated marketing.

Where a law provides an appeal, you can use the same email and state that you are appealing. If a requested action is denied or limited, the response explains the reason and any available appeal or regulator route. Different state deadlines apply; the Texas and California examples above are not a promise that every state uses the same timetable.

7. Scope of completion and retained records

Acknowledgment, authentication, administrative review, and completion are distinct steps. A notice that a request was received or is under review does not mean data has been exported or erased. A completed outcome should describe the action actually taken and any lawful limitation, retained category, or outstanding step.

Where information must be retained, its continued use remains limited to the lawful purpose. Information needed to document a request or keep an opt-out effective should be minimized. An account closure does not automatically erase independent organization records, legally required transaction records, or information already lawfully held by another controller.

8. Other laws and complaints

State privacy supplements do not displace applicable federal financial, tax-return, children’s, student-record, health, communications, or breach-notification rules. Nor does a general account consent supply a special consent required by one of those laws.

You may contact the privacy regulator or attorney general with jurisdiction over your concern. California residents may complain to the California Privacy Protection Agency or California Attorney General; Texas consumers may use the Texas Attorney General’s consumer-privacy complaint route. Contacting support@ysuits.com does not waive your right to approach a regulator.