U.S. State Privacy Notice

1. Scope and how this notice works

This notice is provided by Next Basket Platform B.V. (trading as NEXT BASKET AI) and applies to personal information collected through the nextbasket.com marketing website, as described in our Privacy Policy. The Privacy Policy describes what we collect, why, who we share it with, and how long we keep it; this notice adds the state-specific rights and processes. This notice is provided for general information and is not legal advice.

Our current offering is business-to-business, and our U.S. launch is not yet established as a separate operation. We have no separate U.S. operating company, no U.S. registered agent, and no U.S. privacy address yet; those are future U.S.-launch items, and this notice does not imply that any U.S. entity, state registration, tax nexus, or agent already exists. We have not completed a state-by-state threshold or nexus analysis, and we do not represent that every — or any particular — state privacy law applies to us. Publishing this notice is not an admission that any statute applies.

As a voluntary and precautionary baseline, we extend the core privacy rights described in the annexes below — at least access, correction, and deletion — to residents of the states covered here wherever this is practical, whether or not the relevant law strictly applies to us. Because we have not confirmed that we meet any given law’s thresholds, each annex is written as a voluntary extension of core rights rather than as an admission of coverage; where a law would not strictly apply, the same core rights are still offered wherever practical. Residents of other US states whose comprehensive privacy laws take effect are extended these core rights on the same voluntary, precautionary basis.

Our B2B focus is not treated as a blanket exemption: business-contact data can still be personal information — particularly in California, whose B2B exemptions expired on January 1, 2023. Employment and job-applicant data is outside this marketing-site notice unless we separately collect it.

Through this website we do not sell personal information, do not share it or process it for targeted or cross-context behavioral advertising, and do not use it for consequential automated decision-making — that is, decisions that produce legal or similarly significant effects about you. We also do not use personal information collected through this website to train large language models or other AI models. These statements underpin the opt-out, universal-opt-out, and automated-decision sections below and are restated per state.

2. How to submit a privacy request (all states)

• Email privacy@nextbasket.com with the subject line "Privacy Request" and tell us your state of residence and the right you want to exercise.
• We will verify your identity by matching the information you provide against our records and may ask for additional information where reasonably necessary. For requests we handle voluntarily, we target an initial response within 45 days and use one legally permitted extension where a request is complex; where a specific state law sets a different deadline, that statutory deadline controls.
• Exercising your rights is free of charge (subject to statutory limits on repetitive requests), and we will not discriminate or retaliate against you for exercising them.
• Authorized agents: where your state law provides for them (for example, California), you may use an authorized agent — we may require proof of your written permission and may still verify your identity directly. We do not currently designate a U.S. toll-free privacy number or a U.S. authorized agent; those would be established as part of a future U.S. launch.

Email is the request method we offer today. We may add a webform before a material U.S. consumer launch, but a webform is not required to make a request. We do not currently detect or process browser-based opt-out preference signals, and we make no claim that any such signal (for example, Global Privacy Control) is honored today; because we do not sell or share personal information or conduct targeted advertising through this website, no signal-dependent opt-out is currently needed. If our practices ever change, we will implement, test, and document recognized opt-out signals before the change takes effect (see the Colorado annex).

3. California (CCPA, as amended by the CPRA)

Applicability. The California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the "CCPA"), applies to businesses that meet at least one of its thresholds — annual gross revenues above the inflation-adjusted threshold, buying/selling/sharing the personal information of 100,000+ California consumers or households, or deriving 50%+ of annual revenue from selling or sharing personal information. We have not established that we meet these thresholds, and this notice is not an admission that the CCPA applies to us; we extend the core California rights below voluntarily, as a precaution, where practical. Unlike the other state laws in this notice, the CCPA can also protect individuals acting in a business (B2B) capacity — its B2B exemptions expired on January 1, 2023 — so we do not treat our B2B focus as a blanket exemption for the work-contact data our forms collect.

Your California rights. Subject to the CCPA’s conditions, you have the right to:

• Know / access — the categories and specific pieces of personal information we collected about you, the sources, the purposes, and the categories of recipients.
• Delete — the personal information we collected from you, subject to statutory exceptions.
• Correct — inaccurate personal information we hold about you.
• Opt out of sale or sharing — we do not sell personal information for money and do not share it for cross-context behavioral advertising; you may still submit an opt-out request and we will honor it if our practices ever change.
• Limit use of sensitive personal information — we do not collect sensitive personal information through this website to infer characteristics.
• Non-discrimination — we will not discriminate or retaliate against you for exercising your rights.

How to exercise. Email privacy@nextbasket.com with the subject "California Privacy Request". Email is our request channel; because we operate online and B2B, we do not designate a U.S. toll-free privacy line. We will verify your identity proportionately and respond within the timeframes described in Section 2. You may use an authorized agent as described in Section 2.

Lookback (last 12 months). Consistent with our Privacy Policy, in the 12 months preceding the effective date we collected identifiers and contact details; professional and company details; limited commercial enquiry data; and internet/network activity with approximate, IP-derived location when analytics is enabled. We did not intentionally collect biometric, education, precise-geolocation, or sensitive data. We disclosed personal information to our service providers for business purposes; we did not sell it, and we did not share it for cross-context behavioral advertising.

Automated decision-making technology (ADMT). We do not use ADMT to make decisions with legal or similarly significant effects about you through this website. No website data is used for consequential automated decisions such as eligibility, credit, employment, housing, insurance, healthcare, or personalized pricing. AI may assist our content and operations, but marketing-site leads are not subject to consequential automated decisions.

4. Virginia (VCDPA)

Applicability. The Virginia Consumer Data Protection Act (VCDPA) applies to businesses that control or process the personal data of at least 100,000 Virginia consumers in a calendar year, or at least 25,000 consumers while deriving over 50% of gross revenue from the sale of personal data. We have not established that we meet these thresholds, and we offer the rights below voluntarily as a precaution rather than as an admission that the VCDPA applies. The VCDPA defines a "consumer" as a Virginia resident acting only in an individual or household context — it does not cover individuals acting in a commercial or employment (B2B) context, which is the primary way this website is used; even so, we extend these core rights where practical.

• Confirm whether we process your personal data, and access it.
• Correct inaccuracies in your personal data.
• Delete personal data provided by or obtained about you.
• Obtain a copy of personal data you provided to us, in a portable format.
• Opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects — noting that we do none of these through this website.

How to exercise and appeal. Email privacy@nextbasket.com with the subject "Virginia Privacy Request". If we decline to act on your request, we will tell you why. You may appeal by replying to our decision; we will respond to your appeal within the appeal-response period set out in the VCDPA and, if the appeal is denied, we will give you a way to contact the Virginia Attorney General to submit a complaint.

5. Colorado (CPA)

Applicability. The Colorado Privacy Act (CPA) applies to controllers that process the personal data of at least 100,000 Colorado consumers in a calendar year, or at least 25,000 consumers while deriving revenue (or receiving a discount) from the sale of personal data. We have not established that we meet these thresholds, and we offer the rights below voluntarily as a precaution rather than as an admission that the CPA applies. Like Virginia, Colorado defines a "consumer" as an individual acting only in an individual or household context — not in a commercial or employment context; even so, we extend these core rights where practical.

• Access, correct, and delete your personal data, and obtain a portable copy of it.
• Opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects — noting that we do none of these through this website.

Universal opt-out mechanisms. Colorado law requires controllers that sell personal data or process it for targeted advertising to honor recognized universal opt-out mechanisms (such as the Global Privacy Control). We do not sell personal data or process it for targeted advertising through this website, so that obligation is not triggered by our current practices, and we make no claim that we detect such a signal today; the request route in Section 2 remains available to everyone. If our practices ever change (for example, a sale or targeted advertising), we will implement, test, and document recognized universal opt-out signals before the change takes effect.

How to exercise and appeal. Email privacy@nextbasket.com with the subject "Colorado Privacy Request". If we decline your request, you may appeal by replying to our decision; we will respond within the appeal-response period set out in the CPA and, if the appeal is denied, we will tell you how to contact the Colorado Attorney General.

6. Connecticut (CTDPA)

Applicability. The Connecticut Data Privacy Act (CTDPA) applies to businesses that process the personal data of at least 100,000 Connecticut consumers in a calendar year (excluding data processed solely for payment transactions), or at least 25,000 consumers while deriving over 25% of gross revenue from the sale of personal data. We have not established that we meet these thresholds, and we offer the rights below voluntarily as a precaution rather than as an admission that the CTDPA applies. The CTDPA covers individuals acting in an individual or household context, not a commercial or employment context; even so, we extend these core rights where practical.

• Access, correct, and delete your personal data, and obtain a portable copy of it.
• Opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects — noting that we do none of these through this website.

Large language model (LLM) training disclosure. Connecticut law requires disclosure of whether personal data is used to train large language models. We do not use personal data collected through this website to train large language models, and we do not use it to train or fine-tune such models through our CRM or AI integrations, unless we obtain a separate, explicit written opt-in.

How to exercise and appeal. Email privacy@nextbasket.com with the subject "Connecticut Privacy Request". If we decline your request, you may appeal by replying to our decision; we will respond within the appeal-response period set out in the CTDPA and, if the appeal is denied, we will tell you how to contact the Connecticut Attorney General.

7. Utah (UCPA)

Applicability. The Utah Consumer Privacy Act (UCPA) applies to businesses with annual revenue of $25 million or more that also process the personal data of at least 100,000 Utah consumers in a calendar year, or at least 25,000 consumers while deriving over 50% of gross revenue from the sale of personal data. We have not established that we meet these thresholds, and we offer the rights below voluntarily as a precaution rather than as an admission that the UCPA applies. The UCPA covers individuals acting in an individual or household context, not a commercial or employment context; even so, we extend these core rights where practical.

• Confirm whether we process your personal data, and access it.
• Delete personal data you provided to us.
• Obtain a copy of personal data you provided to us, in a portable format.
• Opt out of targeted advertising and the sale of personal data — noting that we do neither through this website.

How to exercise. Email privacy@nextbasket.com with the subject "Utah Privacy Request". The UCPA does not provide a formal appeal process; if you are unhappy with our decision, you can still reply to us and we will review it, and you may contact the Utah Attorney General with a complaint.

8. Texas (TDPSA)

Applicability. The Texas Data Privacy and Security Act (TDPSA) applies to businesses that conduct business in Texas or target Texas residents and process or sell personal data — it has no minimum volume thresholds, but it exempts "small businesses" as defined by the US Small Business Administration (except for the sale of sensitive data, which requires consent even for small businesses). We have not completed a Texas nexus or small-business analysis, and we offer the rights below voluntarily as a precaution rather than as an admission that the TDPSA applies. The TDPSA covers individuals acting in an individual or household context, not a commercial or employment context; even so, we extend these core rights where practical.

• Confirm whether we process your personal data, and access it.
• Correct inaccuracies in your personal data.
• Delete personal data provided by or obtained about you.
• Obtain a portable copy of your personal data.
• Opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects — noting that we do none of these through this website. We do not sell sensitive personal data or biometric data, so the TDPSA’s specific notices for those practices are not required.

How to exercise and appeal. Email privacy@nextbasket.com with the subject "Texas Privacy Request". If we decline your request, you may appeal by replying to our decision; we will respond within the appeal-response period set out in the TDPSA and, if the appeal is denied, we will tell you how to contact the Texas Attorney General.

9. Changes and contact

We will update this notice as state privacy laws take effect or change and when our practices change; material changes will move the effective date above. As our U.S. launch develops, we will add any U.S.-specific contacts — such as a U.S. privacy address or an authorized agent — once they exist; none exists yet.

Questions about this notice or our privacy practices: Next Basket Platform B.V., Fascinatio Boulevard 216, 3065 WB Rotterdam, Netherlands, or email privacy@nextbasket.com. See our Privacy Policy (/privacy-policy/) for the full description of our data practices and our Your Privacy Choices (/privacy-choices/) page for a summary of the choices available to you.