Oregon Symphony Association

U.S. State Privacy Rights

Last Reviewed: July , 2025

This Privacy Notice for U.S. Residents (this “Notice”) supplements the information contained in the Oregon Symphony Association (“we,” or “us”) Privacy Policy and applies solely to residents of certain U.S. states with data privacy laws that may extend rights to individuals interacting with nonprofit organizations. As a nonprofit, the Oregon Symphony is not subject to many state consumer privacy laws. However, if you have questions or requests regarding your data, you may contact us by email at dataprivacy@orsymphony.org , telephone at 503-228-4294, or mail at 851 SW 6th Avenue, Suite 385, Portland, OR 97204-1339. Please read this Notice in conjunction with our Privacy Policy.

Colorado
Delaware
Minnesota
New Jersey
Nevada
Oregon

COLORADO

We adopt this section of this Notice to give Colorado residents (“you”) additional information required by the Colorado Privacy Act and its implementing regulations (the “CPA”). This section applies to you when you are acting in an individual or household context, but not when you are acting in a commercial or employment context, including as a job applicant. Any terms defined in the CPA have the same meaning when used in this section of this Notice.

Collection, Use, and Sharing of Your Personal Data

We do not rent or sell the personal data we collect. We may disclose your personal data to our third-party service providers for a business purpose as described in the How We Share Your Information section in our Privacy Policy. We do not knowingly process personal data from children under the age of 13. We also do not engage in targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning consumers, as defined in the CPA.

Your Colorado Privacy Rights

If you are a Colorado resident, you can make certain requests regarding your personal data. Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the data applies. If we are unable to comply with your request in whole or in part, we will notify you with reasons for the denial. Your rights include:

Right to Know: You have the right to know whether we control the collection of your personal data.
Right to Access: You have the right see what personal data we have collected about you in a usable format.
Right to Delete: You have the right to request that we delete personal data that we collect from you, subject to applicable legal exceptions.
Right to Correct: You have the right to request that we correct inaccurate personal data.
Right to Opt-Out of Sale of Personal Data and Targeted Advertising: You have the right to opt out of “targeted advertising,” certain types of profiling, and the “sale” of your “personal data” (as defined in the CPA).

Exercising Your Colorado Privacy Rights

Making Requests to Know, Access, Delete, or Correct Your Personal Information. To exercise your opt-out rights or your rights to know, access, delete, correct your personal information, please submit a request by email at dataprivacy@orsymphony.org, telephone at 503-228-4294, or mail at 851 SW 6th Avenue, Suite 385, Portland, OR 97204-1339. Only you, or someone legally authorized to act on your behalf, may make a request related to your personal information. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. We will only use personal information provided in a request to review and comply with the request. You do not need to create an account with us to submit a request to know or delete. We endeavor to substantively respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. We will delete or de-identify personal information not subject to a legal exception from our records and will direct our service providers to take similar action. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
Instructions for Using an Authorized Agent to Make Requests: You may use an authorized agent to submit a request to know or an access, deletion, correction, or opt-out request on your behalf. An authorized agent must have your signed permission to submit a request on your behalf or provide proof that they have power of attorney in accordance with applicable law. Before completing requests from authorized agents, we may contact you directly to confirm you’ve given your permission and/or to verify your identity. Authorized agents may submit requests by email at dataprivacy@orsymphony.org, telephone at 503-228-4294, or mail at 851 SW 6th Avenue, Suite 385, Portland, OR 97204-1339.

How to Submit an Appeal

To appeal our decision regarding a request to these rights, you may contact us by email at dataprivacy@orsymphony.org , telephone at 503-228-4294, or mail at 851 SW 6th Avenue, Suite 385, Portland, OR 97204-1339. We will respond to your appeal within 45 days of receipt, as required by the CPA.

Contact Information

If you have any questions or comments about this Notice, the ways in which we collect and use your data, our Privacy Policy, your choices and rights regarding such use, or wish to exercise your Colorado privacy rights, please do not hesitate to connect us by email at, telephone at 503-228-4294, or mail at 851 SW 6th Avenue, Suite 385, Portland, OR 97204-1339.

DELAWARE

We adopt this section of this Notice to give Delaware residents (“you”) additional information required by the Delaware Personal Data Privacy Act (the “DPDPA”). This section applies to you when you are acting in an individual or household context, but not when you are acting in a commercial or employment context, including as a job applicant. Any terms defined in the DPDPA have the same meaning when used in this section of this Notice.

Collection, Use, and Sharing of Your Personal Data

We do not rent or sell the personal information we collect. We may disclose your personal information to our third-party service providers for a business purpose as described in the How We Share Your Information section in our Privacy Policy. We do not knowingly process personal data from children under the age of 13. We do not use personal information for targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning consumers, as defined in the DPDPA.

Your Delaware Privacy Rights

If you are a Delaware resident, you can make certain requests regarding your personal data. Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the data applies. If we are unable to comply with your request in whole or in part, we will notify you with reasons for the denial. Your rights include:

Right to Know: You have the right to know whether we control the collection of your personal data.
Right to Access: You have the right see what personal data we have collected about you in a usable format.
Right to Delete: You have the right to request that we delete personal data that we collect from you, subject to applicable legal exceptions.
Right to Correct: You have the right to request that we correct inaccurate personal data.
Right to Opt-Out of Sale of Personal Data and Targeted Advertising: You have the right to opt out of “targeted advertising,” certain types of “profiling”, and the “sale” of your “personal data” (as defined in the DPDPA).

Exercising Your Delaware Privacy Rights

Making Requests to Know, Access, Delete, or Correct Your Personal Information. To exercise your opt-out rights or your rights to know, access, delete, or correct your personal data, please submit a request by email at dataprivacy@orsymphony.org, telephone at 503-228-4294, or mail at 851 SW 6th Avenue, Suite 385, Portland, OR 97204-1339. Only you, or someone legally authorized to act on your behalf, may make a request related to your personal data. We cannot respond to your request or provide you with personal data if we cannot verify your identity or authority to make the request and confirm the personal data relates to you. We will only use personal data provided in a request to review and comply with the request. You do not need to create an account with us to submit a request to know or delete. We endeavor to substantively respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. We will delete or de-identify personal data not subject to a legal exception from our records and will direct our service providers to take similar action. For data portability requests, we will select a format to provide your personal data that is readily useable and should allow you to transmit the data from one entity to another entity without hindrance.
Instructions for Using an Authorized Agent to Make Requests: You may use an authorized agent to submit a request to know or an access, deletion, correction, or opt-out request on your behalf. An authorized agent must have your signed permission to submit a request on your behalf or provide proof that they have power of attorney in accordance with applicable law. Before completing requests from authorized agents, we may contact you directly to confirm you’ve given your permission and/or to verify your identity. Authorized agents may submit requests by email at dataprivacy@orsymphony.org, telephone at 503-228-4294, or mail at 851 SW 6th Avenue, Suite 385, Portland, OR 97204-1339.

How to Submit an Appeal

To appeal our decision regarding a request to these rights, you may contact us by email at dataprivacy@orsymphony.org, telephone at 503-228-4294, or mail at 851 SW 6th Avenue, Suite 385, Portland, OR 97204-1339. We will respond to your appeal within 60 days of receipt, as required by the DPDPA.

Contact Information

If you have any questions or comments about this Notice, the ways in which we collect and use your data, our Privacy Policy, your choices and rights regarding such use, or wish to exercise your Delaware Privacy Rights, please do not hesitate to contact by email at dataprivacy@orsymphony.org , telephone at 503-228-4294, or mail at 851 SW 6th Avenue, Suite 385, Portland, OR 97204-1339.

MINNESOTA

We adopt this section of this Notice to give Minnesota residents (“you”) additional information required by the Minnesota Consumer Data Privacy Act (the “MCDPA”). This section applies to you when you are acting in an individual or household context, but not when you are acting in a commercial or employment context, including as a job applicant. Any terms defined in the MCDPA have the same meaning when used in this section of this Notice.

Collection, Use, and Sharing of Your Personal Data

Your Minnesota Privacy Rights

If you are a Minnesota resident, you can make certain requests regarding your personal data. Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the data applies. If we are unable to comply with your request in whole or in part, we will notify you with reasons for the denial. Your rights include:

Right to Know: You have the right to know whether we control the collection of your personal data.
Right to Access: You have the right see what personal data we have collected about you in a usable format.
Right to Delete: You have the right to request that we delete personal data that we collect from you, subject to applicable legal exceptions.
Right to Correct: You have the right to request that we correct inaccurate personal data.
Right to Opt-Out of Sale of Personal Data and Targeted Advertising: You have the right to opt out of “targeted advertising,” certain types of “profiling”, and the “sale” of your “personal data” (as defined in the MCDPA).

Exercising Your Montana Privacy Rights

Making Requests to Know, Access, Delete, or Correct Your Personal Information. To exercise your opt-out rights or your rights to know, access, delete, or correct your personal information, please submit a request by email at dataprivacy@orsymphony.org, telephone at 503-228-4294, or mail at 851 SW 6th Avenue, Suite 385, Portland, OR 97204-1339. Only you, or someone legally authorized to act on your behalf, may make a request related to your personal information. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. We will only use personal information provided in a request to review and comply with the request. You do not need to create an account with us to submit a request to know or delete. We endeavor to substantively respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, technically infeasible, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. We will delete or de-identify personal information not subject to a legal exception from our records and will direct our service providers to take similar action. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
Instructions for Using an Authorized Agent to Make Requests: You may use an authorized agent to submit a request to know or an access, deletion, correction, or opt-out request on your behalf. An authorized agent must have your signed permission to submit a request on your behalf or provide proof that they have power of attorney in accordance with applicable law. Before completing requests from authorized agents, we may contact you directly to confirm you’ve given your permission and/or to verify your identity. Authorized agents may submit requests by contacting us by email at dataprivacy@orsymphony.org, telephone at 503-228-4294, or mail at 851 SW 6th Avenue, Suite 385, Portland, OR 97204-1339.

How to Submit an Appeal

Contact Information

If you have any questions or comments about this Notice, the ways in which we collect and use your data, our Privacy Policy, your choices and rights regarding such use, or wish to exercise your Minnesota Privacy Rights, please do not hesitate to contact us by email at dataprivacy@orsymphony.org , telephone at 503-228-4294, or mail at 851 SW 6th Avenue, Suite 385, Portland, OR 97204-1339.

NEW JERSEY

We adopt this section of this Notice to give New Jersey residents (“you”) additional information required by New Jersey Data Protection Act (“NJDPA”). This section applies to you when you are acting in an individual or household context, but not when you are acting in a commercial or employment context, including as a job applicant. Any terms defined in NJDPA have the same meaning when used in this section of this Notice.

Collection, Use, and Sharing of Your Personal Data

We do not rent, sell, or use for targeted advertising, the personal information we collect. We may disclose your personal information to our third-party service providers for a business purpose as described in the How We Share Your Information section in our Privacy Policy. We do not use personal information for targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning consumers, as defined in the NJDPA.

Your New Jersey Privacy Rights

If you are a New Jersey resident, you can make certain requests regarding your personal data. Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the data applies. If we are unable to comply with your request in whole or in part, we will notify you with reasons for the denial. Your rights include:

Right to Know: You have the right to know whether we control the collection of your personal data.
Right to Access: You have the right see what personal data we have collected about you in a usable format.
Right to Delete: You have the right to request that we delete personal data that we collect from you, subject to applicable legal exceptions.
Right to Correct: You have the right to request that we correct inaccurate personal data.
Right to Opt-Out of Sale of Personal Data and Targeted Advertising: You have the right to opt out of “targeted advertising,” certain types of “profiling”, and the “sale” of your “personal data” (as defined in the NJDPA).

Exercising Your New Jersey Privacy Rights

Making Requests to Know, Access, Delete, or Correct Your Personal Information. To exercise your opt-out rights or your rights to know, access, delete, or correct your personal data, please submit a request by email at dataprivacy@orsymphony.org, telephone at 503-228-4294, or mail at 851 SW 6th Avenue, Suite 385, Portland, OR 97204-1339. Only you, or someone legally authorized to act on your behalf, may make a request related to your personal data. We cannot respond to your request or provide you with personal data if we cannot verify your identity or authority to make the request and confirm the personal data relates to you. We will only use personal data provided in a request to review and comply with the request. You do not need to create an account with us to submit a request to know or delete. We endeavor to substantively respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. We will delete or de-identify personal data not subject to a legal exception from our records and will direct our service providers to take similar action. For data portability requests, we will select a format to provide your personal data that is readily useable and should allow you to transmit the data from one entity to another entity without hindrance.
Instructions for Using an Authorized Agent to Make Requests: You may use an authorized agent to submit a request to know or an access, deletion, correction, or opt-out request on your behalf. An authorized agent must have your signed permission to submit a request on your behalf or provide proof that they have power of attorney in accordance with applicable law. Before completing requests from authorized agents, we may contact you directly to confirm you’ve given your permission and/or to verify your identity. Authorized agents may submit requests by email at dataprivacy@orsymphony.org, telephone at 503-228-4294, or mail at 851 SW 6th Avenue, Suite 385, Portland, OR 97204-1339.

How to Submit an Appeal

Contact Information

If you have any questions or comments about this Notice, the ways in which we collect and use your data, our Privacy Policy, your choices and rights regarding such use, or wish to exercise your New Jersey Privacy Rights, please do not hesitate to contact us by email at dataprivacy@orsymphony.org , telephone at 503-228-4294, or mail at 851 SW 6th Avenue, Suite 385, Portland, OR 97204-1339.

NEVADA

Nevada’s privacy law, known as Senate Bill 220, provides Nevada residents with a limited right to opt-out of certain personal information sales. However, please know we do not currently sell data triggering that statute’s opt-out requirements.

OREGON

We adopt this section of this Notice to give Oregon residents (“you”) additional information required by the Oregon Consumer Privacy Act (the “OCPA”). This section applies to you when you are acting in an individual or household context, but not when you are acting in a commercial or employment context, including as a job applicant. Any terms defined in the OCPA have the same meaning when used in this section of this Notice.

Categories of Personal Information We Collect

We may collect or receive (and may have collected or received during the 12-month period prior to the Last Updated date of this Notice) the categories of personal information listed below. Not all categories will be collected or received for every individual. For more information on the categories of personal data we collect, please see the “Types of Information We Collect” section of our Privacy Policy.

Identifiers, such as name, telephone number, physical address, and email address.
Device Information and Online Activity, such as keystroke patterns indicative of human or bot website/app usage, mobile and web network activity, and related information (such as Mac address, IP address, cookie IDs, browser activity, other information associated with your browsing history), and social media information.
Commercial Information, such as purchase and transaction history information, health and safety-related information, product testimonials, and competition entries.
Communications, such as the content of emails, text messages, call logs or other communications, and calendar information where we are a party to the exchange.
Demographic Information, if voluntarily provided, such as age, gender, citizenship, ethnicity, date of birth, family, or marital status,
Financial Information, such as credit or debit card numbers, and claims information.
Approximate Geolocation Information.
Sensitive Personal Data, if voluntarily provided (for example, in a communication to us or for discount purposes), such as data that reveals a racial or ethnic background, national origin, religious beliefs, mental or physical condition or diagnosis, sexual orientation, status as transgender or nonbinary, status as a victim of crime, or citizenship or immigration status.

Collection, Use, and Sharing of Your Personal Data

We do not rent or sell the personal information we collect. We may disclose your personal information to our third-party service providers for a business purpose as described in the How We Share Your Information section in our Privacy Policy. We do not use personal information for targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning consumers, as defined in the OCPA.

If you voluntarily provide sensitive personal data, such as racial or ethnic origin, religious or philosophical beliefs, health information, and sex life or sexual orientation information, we do not use such information except, in limited circumstances to:

Offer discounts and other promotional opportunities.
Conduct internal audits and investigate complaints, grievances, and suspected violations of our policies.
Respond to law enforcement requests as required by applicable law, court order, or government regulations.
Exercise or defend our legal rights and the rights of our employees, customers, contractors, and agents.

To the extent we process deidentified information, we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

Your Oregon Privacy Rights

If you are an Oregon resident, you can make certain requests regarding your personal data. Once we receive your request and confirm your identity, we will review your request to see if an exception allowing us to retain the data applies. If we are unable to comply with your request in whole or in part, we will notify you with reasons for the denial. Your rights include:

Right to Know: You have the right to know whether we control the collection of your personal data.
Right to Access: You have the right see what personal data we have collected about you in a usable format.
Right to Delete: You have the right to request that we delete personal data that we collect from you, subject to applicable legal exceptions.
Right to Correct: You have the right to request that we correct inaccurate personal data.
Right to Opt-Out of Sale of Personal Data and Targeted Advertising: You have the right to opt out of “targeted advertising,” certain types of “profiling”, and the “sale” of your “personal data” (as defined in the OCPA).

Exercising Your Oregon Privacy Rights

Making Requests to Know, Access, Delete, or Correct Your Personal Information. To exercise your opt-out rights or your rights to know, access, delete, or correct your personal information, please submit a request by email at dataprivacy@orsymphony.org, telephone at 503-228-4294, or mail at 851 SW 6th Avenue, Suite 385, Portland, OR 97204-1339. Only you, or someone legally authorized to act on your behalf, may make a request related to your personal information. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. We will only use personal information provided in a request to review and comply with the request. You do not need to create an account with us to submit a request to know or delete. We endeavor to substantively respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. We will delete or de-identify personal information not subject to a legal exception from our records and will direct our service providers to take similar action. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.
Instructions for Using an Authorized Agent to Make Requests: You may use an authorized agent to submit a request to know or an access, deletion, correction, or opt-out request on your behalf. An authorized agent must have your signed permission to submit a request on your behalf or provide proof that they have power of attorney in accordance with applicable law. Before completing requests from authorized agents, we may contact you directly to confirm you’ve given your permission and/or to verify your identity. Authorized agents may submit requests by email at dataprivacy@orsymphony.org, telephone at 503-228-4294, or mail at 851 SW 6th Avenue, Suite 385, Portland, OR 97204-1339.

How to Submit an Appeal

Contact Information

If you have any questions or comments about this Notice, the ways in which we collect and use your data, our Privacy Policy, your choices and rights regarding such use, or wish to exercise your Oregon Privacy Rights, please do not hesitate to contact us by email at dataprivacy@orsymphony.org , telephone at 503-228-4294, or mail at 851 SW 6th Avenue, Suite 385, Portland, OR 97204-1339.