California Consumer Privacy Act

YOUR CALIFORNIA PRIVACY RIGHTS

This document supplements the information contained in our Privacy Notice and applies solely to California Consumers, as defined by the California Consumer Privacy Act of 2018 (“CCPA”).

To protect you, your fellow visitors, and our employees and their families, Iron Mountain may collect limited health information to grant or deny access to our facilities, and/or to inform stakeholders of exposure to or positive testing for Covid-19. Information collected will be handled, as applicable, in accordance with this document and the Privacy Notice referenced above.

Information We Collect, Use, and Disclose.

Iron Mountain collects, uses, and discloses Personal Information about California Consumers for business purposes only, and which are consistent with applicable laws. Where Iron Mountain discloses Personal Information to third parties, it requires that they only use the personal information for the business purposes described below. It also requires that such parties maintain the personal information’s confidentiality, and that appropriate systems and processes are in place to ensure its security. Iron Mountain does not and will not sell your Personal Information.

We collect, use, and where indicated, disclose the following categories of Personal Information:

Note that under the CCPA, Personal Information does not include:

• Publicly available information from government records.
• De-identified or aggregated consumer information.
• Information excluded from the CCPA’s scope, like:
  • Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA);
  • Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), Gramm-Leach-Bliley Act (GLBA), California Financial Information Privacy Act (FIPA), and Driver’s Privacy Protection Act of 1994.

Additional Purposes for Using Personal Information.

In addition to the uses set forth above, Iron Mountain may use and share the categories of Personal Information identified:

• To comply with applicable legal and regulatory requests and obligations (including investigations).
• To establish or defend legal claims and allegations.
• For security or the prevention, detection, or investigation of fraud, suspected or actual illegal activity, or other misconduct.
• To seek advice from lawyers, auditors and other professional advisers.

Your Rights and Choices.

In certain circumstances, in addition to the information provided above about the collection, use, and disclosure of Personal Information, the CCPA provides California Consumers with the following rights regarding their Personal Information:

Access to Specific Pieces of Personal Information

You have the right to request the specific pieces of personal information we (and any third parties which are Service Providers to Iron Mountain) have collected about you over the past 12 months.

Request for Deletion of Personal Information

You have the right to request that we (and any third parties which are Service Providers to Iron Mountain) delete your Personal Information, subject to certain exceptions.  These exceptions include:

• Completing the transaction for which we collected the personal information, providing a good or service that you requested, taking actions reasonably anticipated within the  context of our ongoing business relationship with you, or otherwise performing our contract with you;
• Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, or prosecuting those responsible for such activities;
• Debugging products to identify and repair errors that impair existing intended functionality;
• Exercising free speech, ensuring the right of another consumer to exercise their free speech rights, or exercising another right provided for by law;
• Complying with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.);
• Engaging in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent;
• Enabling solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;
• Complying with a legal obligation;
• Making other internal or lawful uses of that information that are compatible with the context in which you provided it.