Date Last Updated: February 12, 2020

I. INTRODUCTION II. THE RUS OPERATING AFFILIATES’ INTERIM CAPI DISCLOSURES III. DISCLOSURE OF RIGHTS OF CA RESIDENTS UNDER THE CCPA IV. “DO NOT SELL MY PERSONAL INFROMATION” – REQUESTS THAT THE RUS OPERATING AFFILIATES NOT SELL YOUR PERSONAL INFORMATION V. DISCLOSURE OF AVAILABLE METHODS TO SUBMIT VERIFIABLE CONSUMER REQUESTS TO THE RUS OPERATING AFFILIATES VI. NOTICE OF INFORMATION COLLECTED ONLINE IF YOU NEED OR WANT TO RECEIVE A REPRODUCTION OF THE BELOW IN AN ALTERNATE FORMAT, PLEASE CONTACT FRANCESCO SUGLIA AT fsuglia@ramboll.com. DISCLOSURE/NOTICE REGARDING INFORMATION COLLECTED ONLINE WHEN ONE USES/VISITS CERTAIN OF OUR AFFILIATED WEBSITES (E.G., USING COOKIES) IS ADDRESSED AT THE BOTTOM OF THIS DISCLOSURE/NOTICE UNDER THE HEADING “VI. NOTICE OF INFORMATION COLLECTED ONLINE.” YOU SHOULD READ THE BELOW DISCLOSURE/NOTICE ENTIRELY – AND NOT JUST THE REFERENCED SECTION. BUT, FOR YOUR CONVENIENCE, SHOULD YOU WANT TO SKIP DIRECTLY TO THE REFERENCED SECTION, YOU CAN DO SO BY CLICKING HERE.

The California Consumer Privacy Act (“CCPA”), effective January 1, 2020, imposes obligations upon certain businesses regarding how those businesses act with respect to certain personal information that they obtain/process about natural persons who are California residents (each a “Resident”). The CCPA defines “personal information” broadly as “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular [Resident] or household [of a Resident].” (Cal. Civ. Code § 1798.140(o)). Among other things, the act requires businesses that are subject to the CCPA (each a “Covered Business”) to make certain disclosures/notices to Residents (like those made below) and affords to Residents certain rights intended to provide them with greater transparency and control regarding their personal information. The CCPA expressly excludes from many (or, in some cases, all) of its requirements certain types of personal information, such as, for example: (1) information that is available from certain government records; (2) certain anonymized/deidentified information; (3) certain information about/related to the job applicants, employees, independent contractors and other representatives of a business; and (4) certain information about employees, independent contractors and other representatives of parties to business-to-business dealings. (See, e.g., Cal. Civ. Code §§ 1798.140(o), 1798.145(h), (o)).

301 Bell Isle Road LLC, Foubu Environmental Services, LLC, O’Brien & Gere Engineers, Inc., O’Brien & Gere, Inc. of North America, O’Brien & Gere Engineers, P.C., O’Brien & Gere Operations, LLC, O’Brien & Gere Property Development, Inc., Ramboll US Corporation, REUS Engineers, P.C., and REUS Geologists, P.C., (referred to herein collectively and interchangeably as the “RUS Operating Affiliates”) are US-based operating indirect subsidiaries of the Demark-based Ramboll Group A/S (“Ramboll Group”), a holding company, and closely related operating affiliates thereof. Ramboll Group also has (1) foreign-based operating direct and indirect subsidiaries/related affiliates (the “Foreign Operating Affiliates”) and (2) domestic-and-foreign-based direct and indirect intermediary holding companies and other non-operating indirect subsidiaries/related affiliates (the “Other Ramboll Affiliates”).

The RUS Operating Affiliates and the Foreign Operating Affiliates provide (primarily) engineering, design and consultancy services across one or more of the following (and related) markets: Buildings, Transport, Planning & Urban Design, Water, Environment & Health, Energy, Telecom and Management Consulting. Their business is not direct-to-consumer, and, as a function of the nature of their business, the vast majority of personal information that the RUS Operating Affiliates obtain/process is information that falls within with the exclusions generally referenced in the first paragraph of this Introduction section (“Excluded Information”).

The current version of the CCPA was finalized in late 2018, and it is unclear the extent to which the CCPA applies to the respective RUS Operating Affiliates (and/or to Ramboll Group, its Foreign Operating Affiliates and/or the Other Ramboll Affiliates). In addition, it is anticipated that the California Attorney General will adopt clarifying and implementing regulations to, among other things, clarify certain of the act’s ambiguities and fill certain of its gaps, but, as of the date this disclosure/notice was last updated, the anticipated regulations were not yet finalized and adopted. Nonetheless, pending further guidance and analysis (including regarding the extent to which the CCPA applies to Ramboll Group, its Foreign Operating Affiliates and/or the Other Ramboll Affiliates), the RUS Operating Affiliates have begun reasonable and good faith efforts towards compliance with what they understand to be the act’s mandates.

To that end, the RUS Operating Affiliates have endeavored to identify: (1) all categories (as enumerated in the CCPA) of Residents’ personal information that is not Excluded Information (“CAPI”) that the RUS Operating Affiliates are likely to have obtained over the last twelve months; (2) all categories of sources from which they are likely to have received CAPI over the last twelve months; (3) all business/commercial purposes (as enumerated in the CCPA) for which they are likely to have collected or sold CAPI over the last twelve months; (4) all categories of third parties (as defined in the CPPA) with whom/which they likely shared CAPI over the last twelve months; (5) all categories of CAPI that they are likely to have sold over the last twelve months, and the categories of third parties to whom/which that information likely was sold; and (6) all categories of CAPI that they are likely to otherwise have disclosed for a business purpose over the last twelve months, and the categories of third parties to whom/which that information likely was so disclosed. Below, the RUS Operating Affiliates disclose the results of those efforts to date and describe certain of the rights that the CCPA provides to Residents, available methods to submit requests to the RUS Operating Affiliates to exercise certain of those rights and other related information.

The CCPA requires that a Covered Business disclose the categories of CAPI that the business obtained during the preceding twelve months (by reference to the below-enumerated categories that most closely describe the subject CAPI). The disclosure is required to be made online and in any California-specific description that the Covered Business employs regarding consumer privacy rights.

1. “Identifiers” – such as, by way of example and not limitation, a real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers. The RUS Operating Affiliates have obtained Identifiers of Residents during the preceding twelve months.
2. “Section 1798.90 Information” – a Resident’s name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. The RUS Operating Affiliates have obtained Section 1798.90 Information of Residents during the preceding twelve months.
3. “Protected Classification Characteristics” – characteristics of protected classifications under California or federal law, such as, for example, but without limitation: age (if 40 years or older); race; color; ancestry; national origin; citizenship; religion or creed; marital status; medical condition; physical or mental disability; sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions); sexual orientation; veteran or military status; and genetic information (including familial genetic information). The RUS Operating Affiliates very likely have obtained Protected Classification Characteristics of Residents during the preceding twelve months.
4. “Commercial Information” – including, by way of example and not limitation, records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. The RUS Operating Affiliates very likely have obtained Commercial Information of Residents during the preceding twelve months.
5. “Biometric Information” – an individual’s physiological, biological, or behavioral characteristics that can be used, singly or in combination with each other or with other identifying data, to establish individual identity, including, by way of example and not limitation: (a) an individual’s deoxyribonucleic acid (DNA); (b) imagery of the iris, retina, fingerprint, face, hand, palm, vein patterns, and voice recordings, from which an identifier template, such as a faceprint, a minutiae template, or a voiceprint, can be extracted; (c) keystroke patterns or rhythms; (d) gait patterns or rhythms; and (e) sleep, health, or exercise data that contains identifying information. The RUS Operating Affiliates very likely have obtained Biometric Information of Residents during the preceding twelve months.
6. “Internet/Network Activity Information” – including, but not limited to, browsing history, search history, and information regarding a Resident’s interaction with an internet web site, application, or advertisement. The RUS Operating Affiliates have obtained Internet/Network Activity Information of Residents during the preceding twelve months.
7. “Geolocational Data”. Excluding, perhaps, Excluded Information, the RUS Operating Affiliates likely have not obtained Geolocational Data of Residents during the preceding twelve months.
8. “Sensory Data” – such as, for example, audio, electronic, visual, thermal, olfactory, or similar information. The RUS Operating Affiliates very likely have obtained Sensory Data of Residents during the preceding twelve months.
9. “Professional or Employment Related Information”. The RUS Operating Affiliates very likely have obtained Professional or Employment Related Information of Residents during the preceding twelve months.
10. “Non-Public Education Information” – information directly related to a student that is maintained by or on behalf of an educational agency or institution. The RUS Operating Affiliates likely have obtained Non-Public Education Information of Residents during the preceding twelve months.
11. “Profile Inferences” – inferences drawn from other personal information to create a profile about a person reflecting the preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. Excluding, perhaps, Excluded Information, the RUS Operating Affiliates likely have not obtained Profile Inferences of Residents during the preceding twelve months.

The CCPA requires that a Covered Business disclose (also online and in any California-specific description that it employs regarding consumer privacy rights) the categories sources from which the business obtained CAPI during the preceding twelve months. The likely sources from which the RUS Operating Affiliates obtained CAPI during that period are:

1. directly from the Residents who are the subject of the CAPI (each commonly referred to as a “data subject”), whether affirmatively and expressly provided by the data subject or observed from the data subject’s conduct (including, but not limited to, online activities);
2. indirectly from data subjects, such as through a data subject’s employer, agent, representative, or other person or entity (likely also covered within one of the other categories of sources stated below) who/that is authorized (expressly, implicitly, or apparently) by the data subject to disclose the subject information;
3. the RUS Operating Affiliates’ respective clients (or authorized agents/representatives thereof);
4. the RUS Operating Affiliates’ respective employees (or authorized agents/representatives thereof);
5. government agencies/bodies (or authorized agents/representatives thereof);
6. the RUS Operating Affiliates’ corporate affiliates, including each other;
7. parties (or authorized agents/representatives thereof) to a merger or divestiture, restructuring, reorganization, dissolution, or other similar sale or transfer of assets involving one or more of the RUS Operating Affiliates, in which the subject personal information was among the assets to be transferred; and
8. contractors and/or vendors (or authorized agents/representatives thereof) of the RUS Operating Affiliates, respectively (who/that are not covered by one of the preceding categories).

The CCPA requires that a Covered Business disclose (also online and in any California-specific description that it employs regarding consumer privacy rights) the business or commercial purposes for which it obtained or sold CAPI during the preceding twelve months. Based on the RUS Operating Affiliates’ related diligence to date, it appears highly unlikely that they have sold CAPI for any business or commercial purpose – or otherwise. The following are the likely business or commercial purposes (as enumerated in the CCPA) for which the RUS Operating Affiliates obtained (and used) CAPI during that period:

1. auditing related to a current interaction with the subject Resident and concurrent transactions, including, for example, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with that specification and other standards;
2. detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity;
3. debugging to identify and repair errors that impair existing intended functionality;
4. short-term, transient use that does not involve disclosure to a third party or creating a profile about a person or otherwise altering a person’s experience outside of the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction;
5. performing services on behalf of the business, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services;
6. undertaking internal research for technological development and demonstration; and
7. undertaking activities to verify or maintain the quality or safety of, and/or to improve, upgrade, or enhance, a service or device that is owned, manufactured, manufactured for, or controlled by the business.

The CCPA requires that a Covered Business disclose (also online and in any California-specific description that it employs regarding consumer privacy rights) the categories of third parties with whom/which that business shared CAPI during the last twelve months. The likely persons/entities (who/that may constitute third parties under the CCPA) with whom/which the RUS Operating Affiliates shared CAPI during that period are:

1. the RUS Operating Affiliates’ respective clients (or authorized agents/representatives thereof);
2. the RUS Operating Affiliates’ respective employees (or authorized agents/representatives thereof);
3. government agencies/bodies (or authorized agents/representatives thereof);
4. the RUS Operating Affiliates’ corporate affiliates, including each other;
5. parties (or authorized agents/representatives thereof) to a merger or divestiture, restructuring, reorganization, dissolution, or other similar sale or transfer of assets involving one or more of the RUS Operating Affiliates, in which the subject personal information was among the assets to be transferred;
6. operating systems and platforms (or authorized agents/representatives thereof);
7. internet service providers (or authorized agents/representatives thereof);
8. data analytics providers (or authorized agents/representatives thereof);
9. the RUS Operating Affiliates’ respective insurers (or authorized agents/representatives thereof);
10. the RUS Operating Affiliates’ respective auditors (or authorized agents/representatives thereof);
11. the RUS Operating Affiliates’ respective accountants/tax professionals (or authorized agents/representatives thereof);
12. the RUS Operating Affiliates’ respective attorneys/legal professionals (or authorized agents/representatives thereof);
13. third parties to whom/which disclosure is legally required (such as, for example, but without limitation, to respond to law enforcement requests or as required by applicable law, court order, or governmental regulations);
14. other third parties described when collecting personal information; and
15. contractors and/or vendors (or authorized agents/representatives thereof) of the RUS Operating Affiliates, respectively (who/that are not covered by one of the preceding categories).

The CCPA requires that a Covered Business disclose (also online and in any California-specific description that it employs regarding consumer privacy rights) the categories of CAPI (by reference to the enumerated category(ies) that most closely describe(s) the subject CAPI) that the business sold during the preceding twelve months and the categories of third parties to whom/which that information likely was sold – or the fact that it has not sold CAPI during that period. Based on the RUS Operating Affiliates’ related diligence to date, it appears highly unlikely that they have sold CAPI during the preceding twelve months.

The CCPA requires that a Covered Business disclose (also online and in any California-specific description that it employs regarding consumer privacy rights) the categories of CAPI that the business disclosed for a business purpose during the preceding twelve months (by reference to the below category(ies) that most closely describe(s) the subject CAPI), and may also require disclosure of the categories of third parties to whom/which that information likely was so disclosed – or the fact that it has not disclosed CAPI for a business purpose during that period. During the preceding twelve-month period, the RUS Operating Affiliates likely disclosed the following categories of CAPI to the following categories of persons/entities (who/that may constitute third parties under the CCPA):

1. Categories of CAPI:

a. Identifiers;

b. Section 1798.90 Information;

c. Protected Classification Characteristics;

d. Commercial Information;

e. Sensory Data; and

f. Professional or Employment Related Information;

2. Categories of third parties:

a. the RUS Operating Affiliates’ respective clients (or authorized agents/representatives thereof);

b. the RUS Operating Affiliates’ respective employees (or authorized agents/representatives thereof);

c. government agencies/bodies (or authorized agents/representatives thereof);

d. the RUS Operating Affiliates’ corporate affiliates, including each other;

e. parties (or authorized agents/representatives thereof) to a merger or divestiture, restructuring, reorganization, dissolution, or other similar sale or transfer of assets involving one or more of the RUS Operating Affiliates, in which the subject personal information was among the assets to be transferred;

f. operating systems and platforms (or authorized agents/representatives thereof);

g. internet service providers (or authorized agents/representatives thereof);

h. data analytics providers (or authorized agents/representatives thereof);

i. the RUS Operating Affiliates’ respective insurers (or authorized agents/representatives thereof);

j. the RUS Operating Affiliates’ respective auditors (or authorized agents/representatives thereof);

k. the RUS Operating Affiliates’ respective accountants/tax professionals (or authorized agents/representatives thereof);

l. the RUS Operating Affiliates’ respective attorneys/legal professionals (or authorized agents/representatives thereof);

m. third parties to whom/which disclosure is legally required (such as, for example, but without limitation, to respond to law enforcement requests or as required by applicable law, court order, or governmental regulations);

n. other third parties described when collecting personal information;

and

o. contractors and/or vendors (or authorized agents/representatives thereof) of the RUS Operating Affiliates, respectively (who/that are not covered by one of the preceding categories).

As noted above, the foregoing RUS Operating Affiliates’ interim CAPI disclosures represent the product of reasonable and good faith efforts by the RUS Operating Affiliates to provide reasonably accurate and reasonably complete interim disclosures covering CAPI obtained and/or processed, while the RUS Operating Affiliates continue to make efforts to enable them to provide more accurate, more complete and more definitive disclosures. The RUS Operating Affiliates intend to update the foregoing RUS Operating Affiliates’ interim CAPI disclosures as their continuing efforts produce information that is materially more accurate, more complete and more definitive.

The CCPA requires certain disclosures regarding certain of the rights that it provides to Residents. As noted above, however, the CCPA is ambiguous in certain respects, including as relates to some of those rights. The following disclosure of rights reflects the current understanding of the RUS Operating Affiliates and, in turn, is subject to such ambiguities, as well as future modification.

Subject to certain exclusions/limitations, a Resident has the right to be informed, at or before the point of collection of that Resident’s personal information by a Covered Business, about the categories of personal information to be collected and the purposes for which those categories of personal information will be used. This right commonly is referred to as the “right to notice at collection.” Notably, while certain Excluded Information is excluded from the right to notice at collection, the exclusion covering certain information about/related to job applicants, employees, independent contractors and other business representatives does not apply to this particular right.

A Resident also has the right to request that a Covered Business:

1. describe/disclose to that Resident or that Resident’s authorized agent the categories of personal information that the business obtained about that Resident during the preceding twelve months;
2. describe/disclose to that Resident or that Resident’s authorized agent the categories of sources from which it obtained the categories of personal information obtained about that Resident during the preceding twelve months;
3. describe/disclose to that Resident or that Resident’s authorized agent the business or commercial purposes for which it collected or sold (as applicable) the categories of personal information obtained about that Resident during the preceding twelve months;
4. describe/disclose to that Resident or that Resident’s authorized agent the categories of third parties with whom it shared the categories of personal information obtained about that Resident during the preceding twelve months;
5. describe/disclose to that Resident or that Resident’s authorized agent the specific pieces of personal information obtained about that Resident during the preceding twelve-months;
6. describe/disclose to that Resident or that Resident’s authorized agent the categories of personal information about that Resident that it sold during the preceding twelve months and the categories of third parties to which that information was sold;
7. describe/disclose to that Resident or that Resident’s authorized agent the categories of personal information about that Resident that it disclosed for a business purpose during the preceding twelve months, and may also require disclosure of the categories of third parties to whom/which that information was so disclosed;
8. deliver free of charge to that Resident or that Resident’s authorized agent the specific pieces of personal information obtained about that Resident during the preceding twelve months; and, regarding personal information obtained electronically by the Covered Business, such information must be delivered in a portable and, to the extent technically feasible, readily useable format that allows the Resident to transmit the information to another entity without hindrance; and
9. delete any personal information about that Resident which the business has collected from that Resident and direct any service provider (as defined in the act) with which the Covered Business shared such information also to delete it from its records.

A Resident may make one of the above-enumerated requests (enumerated requests 1-7 commonly referred to as a “request to know,” enumerated request 8 commonly referred to as a “request to access” and enumerated request 9 commonly referred to as a “request to delete”) by submitting to a Covered Business what is defined in the CCPA as a “verifiable consumer request” (as described under the below heading “DISCLOSURE OF AVAILABLE METHODS TO SUBMIT VERIFIABLE CONSUMER REQUESTS TO THE RUS OPERATING AFFILIATES”). Generally, a Covered Business need not address Excluded Information in response to a request to know, request to access or request to delete, and, under certain circumstances, it also may invoke other exclusions to/limitations on the CCPA’s requirements.

A Resident also has the right to direct a covered business to refrain from selling personal information about that Resident to third parties – and, absent affirmative authority otherwise (from Residents ages thirteen and over or the parent or guardian of those under thirteen), Covered Businesses may not sell the personal information of Residents known to be are under age sixteen (and a Covered Business shall be deemed to have such knowledge if/when it willfully disregards a Resident’s age). This right commonly is referred to as the “right to opt-out” – or, as relates to Residents under age sixteen, the “right to opt-in.” The right to opt-out/opt-in is not exercised via a verifiable consumer request. Rather, a Covered Businesses that sells personal information (other than Excluded Information), must, among other things, provide a clear and conspicuous link on its internet homepage, titled “Do Not Sell My Personal Information,” to an internet web page that enables a Resident, or someone authorized to act for the Resident, to opt-out of the sale of the Resident’s personal information. When a Resident or the Resident’s authorized agent exercises the right to opt-out, the Covered Business must (1) refrain from selling personal information obtained by it about that Resident and (2) respect the opt-out for at least twelve months before making any request that the Resident authorize the sale of the Resident’s personal information.

A Resident also has the right not to be discriminated against for exercising any right provided to the Resident under the CCPA.

As noted above, based on the RUS Operating Affiliates’ related diligence to date, it appears highly unlikely that they have sold CAPI during the preceding twelve months. Based on that same diligence, it also appears highly unlikely that the RUS Affiliates will sell CAPI in the foreseeable future (without first notifying affected Residents in accordance with the CCPA). As also noted above, however, the RUS Operating Affiliates’ interim CAPI disclosures represent the product of reasonable and good faith efforts by the RUS Operating Affiliates to provide reasonably accurate and reasonably complete disclosures covering CAPI obtained and/or processed, while the RUS Operating Affiliates continue to make efforts to enable them to provide more accurate, more complete, and more definitive disclosures. Thus, in an abundance of caution, the RUS Affiliates invite Residents, respectively, to exercise their right to opt-out, if they so choose. While additional mechanism’s for doing so are put in place, Resident’s may do so by:

1. Calling 833-691-0203;
2. Emailing fsuglia@ramboll.com; or
3. Clicking HERE (the information you submit via the destination form will be used by the RUS Operating Affiliates to address your request).

When submitting a right to opt-out request, please provide only your first and last name, a telephone number or email address at which you may be contacted regarding the request (or, if neither, an alternate method by which you may be contacted) and clear indication that you wish to exercise your right to opt-out of the sale of your personal information.

Upon receipt of such requests, the RUS Operating Affiliates will make reasonable efforts to prioritize such requests over their general continuing efforts to confirm that they will not sell CAPI regardless (without first notifying affected Residents in accordance with the CCPA).

A verifiable consumer request is a request made by (1) a Resident (on the Resident’s own behalf or on behalf of the Resident’s minor child) or (2) a natural person or an entity registered with the California Secretary of State who/that the Resident has authorized to act on the Resident’s behalf (an “Authorized Agent”); and that the Covered Business to which the request is directed can reasonably verify as having been made by a particular Resident about whom it has collected personal information or by that Resident’s Authorized Agent. The CCPA requires that Covered Businesses verify such requests pursuant to regulations to be adopted by the California Attorney General, and Covered Businesses are not obligated to provide information in response to a request that cannot be so verified. As noted above, the Attorney General’s anticipated regulations have not yet been adopted and, so, the RUS Operating Affiliates lack regulatory guidance for verifying Residents’ requests to know, requests to access and requests to delete. In turn, requests to know, requests to access and requests to delete made to the RUS Operating Affiliates before such regulations are adopted may be held until such regulations are adopted by the Attorney General and implemented by the RUS Operating Affiliates. Thereafter, the RUS Operating Affiliates will address such requests accordingly.

Requests to know, requests to access and requests to delete, and, for the time being, any other requests related to the CCPA, may be made to the RUS Operating Affiliates by:

1. Calling 833-691-0203;
2. Emailing fsuglia@ramboll.com; or
3. Clicking HERE (the information you submit via the destination form will be used by the RUS Operating Affiliates to address your request).

When submitting a request, please provide only your first and last name, a telephone number or email address at which you may be contacted regarding the request (or, if neither, an alternate method by which you may be contacted) and a brief description of your request and of any current or former dealings between you and any of the RUS Operating Affiliates.

Upon receipt of a request to know, request to access or request to delete, and subject to the foregoing, the RUS Operating Affiliates will use the information provided to begin efforts to verify the identity(ies) of the requestor and of the Resident on behalf of whom the request is submitted, and, if different, to confirm that the requestor is authorized to act on behalf of the Resident. Thereafter, the RUS Operating Affiliates will use the information provided to begin efforts to associate the information provided to, and otherwise identify, any personal information of the subject Resident that is not Excluded Information and that it obtained or processed within the preceding twelve months or otherwise currently possesses. To the extent the RUS Operating Affiliates require additional information regarding the requestor, the subject Resident, or the personal information that is the subject of the request, they may endeavor to contact the requestor and/or the subject Resident. In certain circumstances, the RUS Operating Affiliates may provide a request and information provided to them in connection with a request to a third-party identity verification service and rely upon such service for guidance. Given the nature of the RUS Operating Affiliates’ business, in many instances they may not reasonably or readily be able to sufficiently verify the identity(ies) of the requestor and/or of the Resident, confirm authorization (if necessary) and/or associate the information provided to, or otherwise identify, any personal information of the subject Resident, or even confirm whether they indeed obtained, processed or otherwise possess such information. In such cases, the RUS Operating Affiliates will so notify the requestor and/or subject Resident.

The RUS Operating Affiliates will retain a record of each CCPA-related request made to them in accordance with the foregoing (and may retain records of CCPA-related requests not made in accordance with the foregoing) and the information contained in such request for at least twenty-four months after the request is made, including all or some of the following information: the date, manner and nature/substance of the request; the date(s), manner(s) and nature/substance of the response(s); and the basis/bases supporting the response and/or any denial of the request (in whole or in part).

CCPA-related requests made by one of the above-enumerated methods, but that reasonably appear to be directed not to any of the RUS Operating Affiliates, but, rather, to Ramboll Group, its Foreign Operating Affiliates and/or the Other Ramboll Affiliates, will be forwarded to a representative of the entity(ies) to which they reasonably appear to be directed.

The RUS Operating Affiliates (as well as Ramboll Group and its Foreign Operating Affiliates) maintain certain internet websites/applications. Personal information of those who access the internet websites/applications of the RUS Operating Affiliates may be collected through those internet websites/applications. Notices under the CCPA describing the categories of personal information collected and of the purposes for which those categories of personal information are collected/may be used can be found for the respective internet websites/applications as set forth below, respectively:

1. For the https://ramboll.com homepage and its subpages/applications, notice can be found at https://ramboll.com/legal-information
2. For the https://www.galago.ai/ homepage and its subpages/applications, notice can be found at https://www.galago.ai/galago-privacy-policy/#section6;
3. For the https://ramboll-shair.com, https://events.ramboll-shair.com, and https://app.ramboll-shair.com homepages and their respective subpages/applications, notice can be found at https://ramboll-shair.com/privacy-policy/ and;
4. For the https://www.opseyes.com/ homepage and its subpages/applications, notice can be found at https://www.opseyes.com/privacy-policy/#section6.