This California Privacy Notice (the “Notice”) sets forth VMware, Inc. and its group of companies ("VMware", "we", "us" and "our") disclosure obligations under California law, including the California Consumer Privacy Act of 2018 as amended (“CCPA”) and California Civil Code section 1798.83. This Notice provides the additional details regarding the information defined as ‘personal information’ under applicable California law and related to a California resident or household (“Consumers” and “you”) further referred to as “Personal Information.” This Notice describes the categories of Personal Information we have collected, the categories of Personal Information we have disclosed, the categories of Personal Information we have sold or shared, and a description of the Consumer’s rights.

This Notice supplements our Privacy Notices posted at www.vmware.com/help/privacy.html including the VMware Global Privacy Notice and the VMware Products & Services Notice.

This Notice does not cover the Personal Information we process as a ‘service provider’ in connection with your use of our products and services that have been deployed by one of our business customers, such as your organization. Our commitments as a service provider are set forth in the applicable agreement between VMware and your organization.

Categories of Personal Information Collected
We have collected the following categories of Personal Information in the preceding 12 months:

Personal Information Sources
See the VMware Global Privacy Notice, Part I: What Information We Collect & How We Collect It, and the VMware Products & Services Notice, Part I: What Information We Collect & How We Collect It, listing the sources of Personal Information.

Purposes for Which Personal Information is Collected and Used 
See the VMware Global Privacy Notice, Part II: How We Use Your Information, and the VMware Products & Services Notice, Part II: How We Use the Information, setting forth the purposes for which we use Personal Information.

Retention of Personal Information
See the VMware Global Privacy Notice, Part VII: Deletion and Retention, setting forth the retention periods for Personal Information.

Disclosure of Personal Information for Business Purposes 
We have disclosed in the preceding 12 months the above categories of Personal Information for a business purpose such as to enable service providers to perform services on our behalf, to coordinate efforts among VMware entities, or to facilitate marketing and sales through our channel partners. We have made such disclosures to our subsidiaries and affiliates, service providers (such as CRM SaaS providers), our business partners (such as resellers).

Personal Information “Sold” or “Shared”
We do not sell or share Personal Information for monetary consideration. However, under California law, some uses of cookies and similar tracking technologies may be characterized as “selling” or “sharing” Personal Information. Because we use such tracking technologies, in the preceding 12 months we may have “sold” or “shared” the following categories of Personal Information for commercial purposes such as to serve advertisements, to analyze the success of marketing campaigns, or to understand the use of our websites, and such receiving entities may use the Personal Information for their own purposes, such as to improve their ability to target advertisements. The following Personal Information is “sold” or “shared” to advertising networks, social media networks and analytics partners.

Our online Properties are not directed to individuals under the age of 16, nor do we have actual knowledge that we sell or share the Personal Information of consumers under the age of 16.

Your Consumer Rights under the CCPA
Under the CCPA, you may have the following consumer rights. Please note that these rights are not absolute and are subject to conditions or limitations:

Right to Know (Collection). You have the right to request, at no charge, that we disclose to you the categories and specific pieces of Personal
Information we have collected.

Right to Know (Collection and Disclosure). You have the right to request that we disclose certain information about how we have handled your Personal Information, including the:

• categories of Personal Information collected about you (see above);
• categories of sources from which we collected your Personal Information (see above);
• businessand/or commercial purposes for collecting, selling, sharing and/or disclosing your Personal Information (see above);
• categories of third parties to/with whom your Personal Information has been disclosed for a business purpose (see above);
• categories of third parties to/with whom your Personal Information has been sold or shared (see above); and
• the specific pieces of Personal Information collected about you.
  

Access and Portability. You have the right to obtain a list of categories and a copy of the Personal Information, in a portable and (if technically feasible) readily usable format, collected on you.

Deletion. You have the right to request the deletion of your Personal Information we have collected from you. This right may be subject to certain conditions and limitations under the law.

Correction. You have the right to request the correction of your Personal Information that we maintain.

Right to Opt-Out of Selling or Sharing. We do not sell or share Personal Information for monetary consideration. However, under California law, some uses of cookies and similar tracking technologies may be characterized as “selling” or “sharing” Personal Information. You have the right to opt-out of such “selling” or “sharing” of your Personal Information. To exercise this right, when you visit our online Properties, go to the cookie settings (accessible via a “Do Not Sell or Share My Personal Info” button or link) and turn off cookies per your preferences. Alternatively, you may employ the Global Privacy Control (“GPC”) signal, as further described in the VMware Global Privacy Notice, Part IX: Other Information; Global Privacy Control. Because your cookie preference and GPC settings are tied to your device and browser, if you visit our website from a different device or browser, or clear cookies or settings on your browser, you will need to re-select your preferences or GPC settings.

Right to Limit the Use of Sensitive Personal Information. Such right is not applicable as we do not collect or process ‘Sensitive Personal Information’ (as defined by applicable California law) for the purpose of inferring characteristics about consumers. We do not, as a matter of course, use or disclose Sensitive Personal Information for purposes other than those specified in Section 7027(m) of the California Consumer Privacy Act Regulations. Such permitted purposes include the performance of services reasonably expected by an average consumer who requests those services; to prevent, detect and investigate security incidents; to resist malicious, deceptive, fraudulent or illegal actions directed at us; to ensure the physical safety of natural persons; short-term, transient uses such as nonpersonalized context-based advertising; to verify, maintain or improve the quality of a service; and purposes that do not infer characteristics about the consumer.

Right to be Free from Discrimination. We will not unlawfully discriminate against you for exercising your rights under the CCPA.

Additional Rights under California Law
Under California Civil Code section 1798.83, California residents who provide Personal Information in obtaining products or services for personal, family, or household use may request information about the Personal Information shared by us, if any, with other third parties for their own direct marketing purposes. If applicable, this information will include the identity and addresses of those third parties and the type of Personal Information.

In addition, a business subject to California Business and Professions Code Section 22581 must allow California residents under age 18 who are registered users of online sites, services or applications to request and obtain removal of content or information they have publicly posted. Your request should include a detailed description of the specific content or information to be removed. Please be aware that your request does not guarantee complete or comprehensive removal of content or information posted online and that the law may not permit or require removal in certain circumstances.

Exercising Your Rights
To exercise your rights as set out above, please contact us by:

• calling 1-877-486-9273, option 0, or
• by submitting a request here.

Depending on the sensitivity of your request, you may be required to provide additional information to verify your identity and request before further action is taken. If your request is for access to your personal data, we will confirm your email and one or more additional pieces of information provided in your request to verify against information already in our possession, such as name and state or country of residence. If we are unable to confirm that the data provided in your request matches our records, we will ask for additional information to verify your identity.

Your authorized agent may make a request on your behalf. We will consider any evidence the agent submits to demonstrate that you gave the agent signed permission to submit the request. We may email you to confirm that the agent is indeed acting on your behalf.