I. INTRODUCTION II. THE RUS OPERATING AFFILIATES’ INTERIM CAPI DISCLOSURES III. DISCLOSURE OF RIGHTS OF CA RESIDENTS UNDER THE CCPA IV. “DO NOT SELL MY PERSONAL INFROMATION” – REQUESTS THAT THE RUS OPERATING AFFILIATES NOT SELL YOUR PERSONAL INFORMATION V. DISCLOSURE OF AVAILABLE METHODS TO SUBMIT VERIFIABLE CONSUMER REQUESTS TO THE RUS OPERATING AFFILIATES VI. NOTICE OF INFORMATION COLLECTED ONLINE IF YOU NEED OR WANT TO RECEIVE A REPRODUCTION OF THE BELOW IN AN ALTERNATE FORMAT, PLEASE CONTACT FRANCESCO SUGLIA AT fsuglia@ramboll.com. DISCLOSURE/NOTICE REGARDING INFORMATION COLLECTED ONLINE WHEN ONE USES/VISITS CERTAIN OF OUR AFFILIATED WEBSITES (E.G., USING COOKIES) IS ADDRESSED AT THE BOTTOM OF THIS DISCLOSURE/NOTICE UNDER THE HEADING “VI. NOTICE OF INFORMATION COLLECTED ONLINE.” YOU SHOULD READ THE BELOW DISCLOSURE/NOTICE ENTIRELY – AND NOT JUST THE REFERENCED SECTION. BUT, FOR YOUR CONVENIENCE, SHOULD YOU WANT TO SKIP DIRECTLY TO THE REFERENCED SECTION, YOU CAN DO SO BY CLICKING HERE.

I. INTRODUCTION

The California Consumer Privacy Act (“CCPA”), effective January 1, 2020, imposes obligations upon certain businesses regarding how those businesses act with respect to certain personal information that they obtain/process about natural persons who are California residents (each a “Resident”). The CCPA defines “personal information” broadly as “information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular [Resident] or household [of a Resident].” (Cal. Civ. Code § 1798.140(o)). Among other things, the act requires businesses that are subject to the CCPA (each a “Covered Business”) to make certain disclosures/notices to Residents (like those made below) and affords to Residents certain rights intended to provide them with greater transparency and control regarding their personal information. The CCPA expressly excludes from many (or, in some cases, all) of its requirements certain types of personal information, such as, for example: (1) information that is available from certain government records; (2) certain anonymized/deidentified information; (3) certain information about/related to the job applicants, employees, independent contractors and other representatives of a business; and (4) certain information about employees, independent contractors and other representatives of parties to business-to-business dealings. (See, e.g., Cal. Civ. Code §§ 1798.140(o), 1798.145(h), (o)).

301 Bell Isle Road LLC, Foubu Environmental Services, LLC, O’Brien & Gere Engineers, Inc., O’Brien & Gere, Inc. of North America, O’Brien & Gere Engineers, P.C., O’Brien & Gere Operations, LLC, O’Brien & Gere Property Development, Inc., Ramboll US Corporation, REUS Engineers, P.C., and REUS Geologists, P.C., (referred to herein collectively and interchangeably as the “RUS Operating Affiliates”) are US-based operating indirect subsidiaries of the Demark-based Ramboll Group A/S (“Ramboll Group”), a holding company, and closely related operating affiliates thereof. Ramboll Group also has (1) foreign-based operating direct and indirect subsidiaries/related affiliates (the “Foreign Operating Affiliates”) and (2) domestic-and-foreign-based direct and indirect intermediary holding companies and other non-operating indirect subsidiaries/related affiliates (the “Other Ramboll Affiliates”).

The RUS Operating Affiliates and the Foreign Operating Affiliates provide (primarily) engineering, design and consultancy services across one or more of the following (and related) markets: Buildings, Transport, Planning & Urban Design, Water, Environment & Health, Energy, Telecom and Management Consulting. Their business is not direct-to-consumer, and, as a function of the nature of their business, the vast majority of personal information that the RUS Operating Affiliates obtain/process is information that falls within with the exclusions generally referenced in the first paragraph of this Introduction section (“Excluded Information”).

The current version of the CCPA was finalized in late 2018, and it is unclear the extent to which the CCPA applies to the respective RUS Operating Affiliates (and/or to Ramboll Group, its Foreign Operating Affiliates and/or the Other Ramboll Affiliates). In addition, it is anticipated that the California Attorney General will adopt clarifying and implementing regulations to, among other things, clarify certain of the act’s ambiguities and fill certain of its gaps, but, as of the date this disclosure/notice was last updated, the anticipated regulations were not yet finalized and adopted. Nonetheless, pending further guidance and analysis (including regarding the extent to which the CCPA applies to Ramboll Group, its Foreign Operating Affiliates and/or the Other Ramboll Affiliates), the RUS Operating Affiliates have begun reasonable and good faith efforts towards compliance with what they understand to be the act’s mandates.

To that end, the RUS Operating Affiliates have endeavored to identify: (1) all categories (as enumerated in the CCPA) of Residents’ personal information that is not Excluded Information (“CAPI”) that the RUS Operating Affiliates are likely to have obtained over the last twelve months; (2) all categories of sources from which they are likely to have received CAPI over the last twelve months; (3) all business/commercial purposes (as enumerated in the CCPA) for which they are likely to have collected or sold CAPI over the last twelve months; (4) all categories of third parties (as defined in the CPPA) with whom/which they likely shared CAPI over the last twelve months; (5) all categories of CAPI that they are likely to have sold over the last twelve months, and the categories of third parties to whom/which that information likely was sold; and (6) all categories of CAPI that they are likely to otherwise have disclosed for a business purpose over the last twelve months, and the categories of third parties to whom/which that information likely was so disclosed. Below, the RUS Operating Affiliates disclose the results of those efforts to date and describe certain of the rights that the CCPA provides to Residents, available methods to submit requests to the RUS Operating Affiliates to exercise certain of those rights and other related information.

II. THE RUS OPERATING AFFILIATES’ INTERIM CAPI DISCLOSURES

A. Categories of CAPI the RUS Operating Affiliates Likely Obtained/Likely Did Not Obtain During the Last Twelve Months

The CCPA requires that a Covered Business disclose the categories of CAPI that the business obtained during the preceding twelve months (by reference to the below-enumerated categories that most closely describe the subject CAPI). The disclosure is required to be made online and in any California-specific description that the Covered Business employs regarding consumer privacy rights.

B. Categories of Sources from Which the RUS Operating Affiliates Likely Obtained CAPI During the Last Twelve Months

The CCPA requires that a Covered Business disclose (also online and in any California-specific description that it employs regarding consumer privacy rights) the categories sources from which the business obtained CAPI during the preceding twelve months. The likely sources from which the RUS Operating Affiliates obtained CAPI during that period are:

C. Business or Commercial Purposes for which the RUS Operating Affiliates Likely Obtained or Sold CAPI During the Last Twelve Months

The CCPA requires that a Covered Business disclose (also online and in any California-specific description that it employs regarding consumer privacy rights) the business or commercial purposes for which it obtained or sold CAPI during the preceding twelve months. Based on the RUS Operating Affiliates’ related diligence to date, it appears highly unlikely that they have sold CAPI for any business or commercial purpose – or otherwise. The following are the likely business or commercial purposes (as enumerated in the CCPA) for which the RUS Operating Affiliates obtained (and used) CAPI during that period:

D. Categories of Third Parties with Whom/Which the RUS Operating Affiliates Likely Shared CAPI During the Last Twelve Months

The CCPA requires that a Covered Business disclose (also online and in any California-specific description that it employs regarding consumer privacy rights) the categories of third parties with whom/which that business shared CAPI during the last twelve months. The likely persons/entities (who/that may constitute third parties under the CCPA) with whom/which the RUS Operating Affiliates shared CAPI during that period are:

E. Categories of CAPI the RUS Operating Affiliates Likely Sold During the Last Twelve Months and Categories of Third Parties to Whom/Which that Information Likely Was Sold

The CCPA requires that a Covered Business disclose (also online and in any California-specific description that it employs regarding consumer privacy rights) the categories of CAPI (by reference to the enumerated category(ies) that most closely describe(s) the subject CAPI) that the business sold during the preceding twelve months and the categories of third parties to whom/which that information likely was sold – or the fact that it has not sold CAPI during that period. Based on the RUS Operating Affiliates’ related diligence to date, it appears highly unlikely that they have sold CAPI during the preceding twelve months.

F. Categories of CAPI the RUS Operating Affiliates Likely Disclosed For a Business Purpose During the Last Twelve Months and Categories of Third Parties to Whom/Which that Information Likely Was So Disclosed

The CCPA requires that a Covered Business disclose (also online and in any California-specific description that it employs regarding consumer privacy rights) the categories of CAPI that the business disclosed for a business purpose during the preceding twelve months (by reference to the below category(ies) that most closely describe(s) the subject CAPI), and may also require disclosure of the categories of third parties to whom/which that information likely was so disclosed – or the fact that it has not disclosed CAPI for a business purpose during that period. During the preceding twelve-month period, the RUS Operating Affiliates likely disclosed the following categories of CAPI to the following categories of persons/entities (who/that may constitute third parties under the CCPA):

1. Categories of CAPI:

a. Identifiers;

b. Section 1798.90 Information;

c. Protected Classification Characteristics;

d. Commercial Information;

e. Sensory Data; and

f. Professional or Employment Related Information;

2. Categories of third parties:

a. the RUS Operating Affiliates’ respective clients (or authorized agents/representatives thereof);

b. the RUS Operating Affiliates’ respective employees (or authorized agents/representatives thereof);

c. government agencies/bodies (or authorized agents/representatives thereof);

d. the RUS Operating Affiliates’ corporate affiliates, including each other;

e. parties (or authorized agents/representatives thereof) to a merger or divestiture, restructuring, reorganization, dissolution, or other similar sale or transfer of assets involving one or more of the RUS Operating Affiliates, in which the subject personal information was among the assets to be transferred;

f. operating systems and platforms (or authorized agents/representatives thereof);

g. internet service providers (or authorized agents/representatives thereof);

h. data analytics providers (or authorized agents/representatives thereof);

i. the RUS Operating Affiliates’ respective insurers (or authorized agents/representatives thereof);

j. the RUS Operating Affiliates’ respective auditors (or authorized agents/representatives thereof);

k. the RUS Operating Affiliates’ respective accountants/tax professionals (or authorized agents/representatives thereof);

l. the RUS Operating Affiliates’ respective attorneys/legal professionals (or authorized agents/representatives thereof);

m. third parties to whom/which disclosure is legally required (such as, for example, but without limitation, to respond to law enforcement requests or as required by applicable law, court order, or governmental regulations);

n. other third parties described when collecting personal information;

and

o. contractors and/or vendors (or authorized agents/representatives thereof) of the RUS Operating Affiliates, respectively (who/that are not covered by one of the preceding categories).

III. DISCLOSURE OF RIGHTS OF CA RESIDENTS UNDER THE CCPA

The CCPA requires certain disclosures regarding certain of the rights that it provides to Residents. As noted above, however, the CCPA is ambiguous in certain respects, including as relates to some of those rights. The following disclosure of rights reflects the current understanding of the RUS Operating Affiliates and, in turn, is subject to such ambiguities, as well as future modification.

Subject to certain exclusions/limitations, a Resident has the right to be informed, at or before the point of collection of that Resident’s personal information by a Covered Business, about the categories of personal information to be collected and the purposes for which those categories of personal information will be used. This right commonly is referred to as the “right to notice at collection.” Notably, while certain Excluded Information is excluded from the right to notice at collection, the exclusion covering certain information about/related to job applicants, employees, independent contractors and other business representatives does not apply to this particular right.

A Resident also has the right to request that a Covered Business:

A Resident may make one of the above-enumerated requests (enumerated requests 1-7 commonly referred to as a “request to know,” enumerated request 8 commonly referred to as a “request to access” and enumerated request 9 commonly referred to as a “request to delete”) by submitting to a Covered Business what is defined in the CCPA as a “verifiable consumer request” (as described under the below heading “DISCLOSURE OF AVAILABLE METHODS TO SUBMIT VERIFIABLE CONSUMER REQUESTS TO THE RUS OPERATING AFFILIATES”). Generally, a Covered Business need not address Excluded Information in response to a request to know, request to access or request to delete, and, under certain circumstances, it also may invoke other exclusions to/limitations on the CCPA’s requirements.

A Resident also has the right to direct a covered business to refrain from selling personal information about that Resident to third parties – and, absent affirmative authority otherwise (from Residents ages thirteen and over or the parent or guardian of those under thirteen), Covered Businesses may not sell the personal information of Residents known to be are under age sixteen (and a Covered Business shall be deemed to have such knowledge if/when it willfully disregards a Resident’s age). This right commonly is referred to as the “right to opt-out” – or, as relates to Residents under age sixteen, the “right to opt-in.” The right to opt-out/opt-in is not exercised via a verifiable consumer request. Rather, a Covered Businesses that sells personal information (other than Excluded Information), must, among other things, provide a clear and conspicuous link on its internet homepage, titled “Do Not Sell My Personal Information,” to an internet web page that enables a Resident, or someone authorized to act for the Resident, to opt-out of the sale of the Resident’s personal information. When a Resident or the Resident’s authorized agent exercises the right to opt-out, the Covered Business must (1) refrain from selling personal information obtained by it about that Resident and (2) respect the opt-out for at least twelve months before making any request that the Resident authorize the sale of the Resident’s personal information.

A Resident also has the right not to be discriminated against for exercising any right provided to the Resident under the CCPA.

IV. “DO NOT SELL MY PERSONAL INFORMATION” – REQUESTS THAT THE RUS OPERATING AFFILIATES NOT SELL YOUR PERSONAL INFORMATION

As noted above, based on the RUS Operating Affiliates’ related diligence to date, it appears highly unlikely that they have sold CAPI during the preceding twelve months. Based on that same diligence, it also appears highly unlikely that the RUS Affiliates will sell CAPI in the foreseeable future (without first notifying affected Residents in accordance with the CCPA). As also noted above, however, the RUS Operating Affiliates’ interim CAPI disclosures represent the product of reasonable and good faith efforts by the RUS Operating Affiliates to provide reasonably accurate and reasonably complete disclosures covering CAPI obtained and/or processed, while the RUS Operating Affiliates continue to make efforts to enable them to provide more accurate, more complete, and more definitive disclosures. Thus, in an abundance of caution, the RUS Affiliates invite Residents, respectively, to exercise their right to opt-out, if they so choose. While additional mechanism’s for doing so are put in place, Resident’s may do so by:

When submitting a right to opt-out request, please provide only your first and last name, a telephone number or email address at which you may be contacted regarding the request (or, if neither, an alternate method by which you may be contacted) and clear indication that you wish to exercise your right to opt-out of the sale of your personal information.

Upon receipt of such requests, the RUS Operating Affiliates will make reasonable efforts to prioritize such requests over their general continuing efforts to confirm that they will not sell CAPI regardless (without first notifying affected Residents in accordance with the CCPA).

V. DISCLOSURE OF AVAILABLE METHODS TO SUBMIT VERIFIABLE CONSUMER REQUESTS TO THE RUS OPERATING AFFILIATES

A verifiable consumer request is a request made by (1) a Resident (on the Resident’s own behalf or on behalf of the Resident’s minor child) or (2) a natural person or an entity registered with the California Secretary of State who/that the Resident has authorized to act on the Resident’s behalf (an “Authorized Agent”); and that the Covered Business to which the request is directed can reasonably verify as having been made by a particular Resident about whom it has collected personal information or by that Resident’s Authorized Agent. The CCPA requires that Covered Businesses verify such requests pursuant to regulations to be adopted by the California Attorney General, and Covered Businesses are not obligated to provide information in response to a request that cannot be so verified. As noted above, the Attorney General’s anticipated regulations have not yet been adopted and, so, the RUS Operating Affiliates lack regulatory guidance for verifying Residents’ requests to know, requests to access and requests to delete. In turn, requests to know, requests to access and requests to delete made to the RUS Operating Affiliates before such regulations are adopted may be held until such regulations are adopted by the Attorney General and implemented by the RUS Operating Affiliates. Thereafter, the RUS Operating Affiliates will address such requests accordingly.

Requests to know, requests to access and requests to delete, and, for the time being, any other requests related to the CCPA, may be made to the RUS Operating Affiliates by:

When submitting a request, please provide only your first and last name, a telephone number or email address at which you may be contacted regarding the request (or, if neither, an alternate method by which you may be contacted) and a brief description of your request and of any current or former dealings between you and any of the RUS Operating Affiliates.

Upon receipt of a request to know, request to access or request to delete, and subject to the foregoing, the RUS Operating Affiliates will use the information provided to begin efforts to verify the identity(ies) of the requestor and of the Resident on behalf of whom the request is submitted, and, if different, to confirm that the requestor is authorized to act on behalf of the Resident. Thereafter, the RUS Operating Affiliates will use the information provided to begin efforts to associate the information provided to, and otherwise identify, any personal information of the subject Resident that is not Excluded Information and that it obtained or processed within the preceding twelve months or otherwise currently possesses. To the extent the RUS Operating Affiliates require additional information regarding the requestor, the subject Resident, or the personal information that is the subject of the request, they may endeavor to contact the requestor and/or the subject Resident. In certain circumstances, the RUS Operating Affiliates may provide a request and information provided to them in connection with a request to a third-party identity verification service and rely upon such service for guidance. Given the nature of the RUS Operating Affiliates’ business, in many instances they may not reasonably or readily be able to sufficiently verify the identity(ies) of the requestor and/or of the Resident, confirm authorization (if necessary) and/or associate the information provided to, or otherwise identify, any personal information of the subject Resident, or even confirm whether they indeed obtained, processed or otherwise possess such information. In such cases, the RUS Operating Affiliates will so notify the requestor and/or subject Resident.

The RUS Operating Affiliates will retain a record of each CCPA-related request made to them in accordance with the foregoing (and may retain records of CCPA-related requests not made in accordance with the foregoing) and the information contained in such request for at least twenty-four months after the request is made, including all or some of the following information: the date, manner and nature/substance of the request; the date(s), manner(s) and nature/substance of the response(s); and the basis/bases supporting the response and/or any denial of the request (in whole or in part).

CCPA-related requests made by one of the above-enumerated methods, but that reasonably appear to be directed not to any of the RUS Operating Affiliates, but, rather, to Ramboll Group, its Foreign Operating Affiliates and/or the Other Ramboll Affiliates, will be forwarded to a representative of the entity(ies) to which they reasonably appear to be directed.

VI. NOTICE OF INFORMATION COLLECTED ONLINE

The RUS Operating Affiliates (as well as Ramboll Group and its Foreign Operating Affiliates) maintain certain internet websites/applications. Personal information of those who access the internet websites/applications of the RUS Operating Affiliates may be collected through those internet websites/applications. Notices under the CCPA describing the categories of personal information collected and of the purposes for which those categories of personal information are collected/may be used can be found for the respective internet websites/applications as set forth below, respectively: