Data Subject Rights

Individuals residing in the European Economic Area (“EEA”) and the United Kingdom have a number of rights in relation to their personal data processed by Avalara. These are summarized below. Please note that exercising these rights is subject to certain requirements and conditions as set forth in applicable laws. These rights may also be limited in certain circumstances, for example if fulfilling a request would reveal personal information about another person, where they would infringe the rights of another (including Avalara), or if an individual asks us to delete information which we are required by law or have compelling legitimate interests to keep. Relevant exemptions are included, as applicable, in Regulation (EU) 2016/679 (the General Data Protection Regulation, or “GDPR”), the United Kingdom’s retained version of the GDPR as implemented by the Data Protection Act 2018, and applicable local laws. We will inform individuals of any relevant exemptions it on which we rely upon when responding to any request received.

1. Right of access: You have the right to obtain from Avalara confirmation as to whether your personal data is being processed, and, where that is the case, to request access to your personal data. The access information includes – inter alia – the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed.

You have the right to obtain a copy of the personal data undergoing processing. Subject to applicable law, we may charge a reasonable fee for copies, based on administrative costs.

2. Right to rectification: You have the right to obtain from Avalara the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you may have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

3. Right to erasure (to be forgotten): You have the right to ask Avalara to erase your personal data.

4. Right to restriction of processing: You have the right to request restriction of processing of your personal data, in which case, it would be marked and processed by Avalara only for certain purposes.

5. Right to data portability: You have the right to receive the personal data that you have provided to Avalara in a structured, commonly used and machine-readable format and you have the right to transmit the personal data to another entity without hindrance from us.

6. Right to object: You may have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by Avalara, and we can be required to no longer process your personal data. If you have a right to object and you exercise this right, your personal data will no longer be processed for such purposes by Avalara. Exercising this right will not incur any cost. Such a right to object may not exist, in particular, if the processing of your personal data is necessary to take steps prior to entering into a contract or to perform a contract already concluded.

If you wish to exercise these rights, or if you have questions or complaints regarding this notice, please email us at dataprivacy@avalara.com.

You also have the right to lodge a complaint with the competent supervisory authority for data protection issues.

Avalara and our service providers store the personal data of EEA and UK users for the time necessary to achieve the purposes for which the information is collected, in accordance with applicable data protection laws. When we no longer need to store or use your personal data to comply with contractual, statutory or regulatory obligations to which we are subject (for example, statutory retention periods or if we need it to preserve evidence within legal statutes of limitation) or for other purposes in accordance with applicable law, we will remove it from our systems and records or take steps to properly anonymize it so that you can no longer be identified from it.