This Privacy Policy describes how the Colorado Bar Association (“CBA”) and CBA-CLE collects, uses, shares, stores, and protects Personal Data on www.cobar.organd any other social media, mobile websites, microsites, applications, or other services and platforms operated or used by CBA and collected by phone, paper, or other means. CBA and CBA-CLE share data and CBA-CLE honors the CBA Privacy Policy.

1. Types of Data We Collect and How We Collect It

CBA is a voluntary membership organization and collects information, including online, by phone, paper, and by other means, to help us better identify and contact you, our members, customers, and potential customers. CBA collects this information for a variety of business purposes, including but not limited to, applying for and renewing CBA membership, registering for a CBA-CLE event or program, purchasing CBA-CLE products, publications, or services, or otherwise interacting with CBA.

“Personal Data” means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. This information may include but is not limited to:

• • General data (e.g., names, dates of birth, home and business addresses, email addresses, Internet protocol addresses and mobile/landline business/personal telephone numbers that are provided by our members/customers)

• • Professional data (e.g., bar pass date and state(s))

• • Government-issued identification numbers (e.g., social security numbers, national identification numbers, passport information in limited circumstances, and tax identification numbers), for example from employees and independent contractors, but not from members unless the CBA makes payments to members, such as honoraria, awards, or royalties for publishing rights

• • Other identification information (e.g., photographs)

• • Financial information (e.g., credit and debit card numbers) for product sales

• • Demographic data (e.g., racial or ethnic origin, sexual orientation, dietary restrictions, and disability data) from voluntary membership surveys or event registration forms for diversity or accessibility purposes

CBA receives information on attorney registrations from the Office of Attorney Regulation Counsel of the Colorado Supreme Court. This information is publicly available at www.coloradosupremecourt.com.

2. How Your Data Is Used and Stored

In addition to the uses described above, we use your Personal Data in a variety of ways including, but not limited to the below, in order to:

• • Identify you when you visit our Sites

• • Provide service communications such as bill reminders, order confirmations, program registrations and customer service messages

• • Provide products, information and services you request or that we think you may be interested in

• • Respond to your emails or online requests for products, services, or information

• • Deliver and process surveys

• • Personalize and improve the usability of the Sites

• • Fulfill and/or deliver CBA products and services

• • Tailor content, advertising and marketing to you

• • Publish select membership directories, membership lists and registration lists on the Sites and in print and digital media (e.g. Board, Committee, and Section rosters and online communities); such directories and lists will not include credit card information or personal identification numbers such as social security numbers..

3. How Your Data is Shared

We share your Personal Data, sometimes combined with Non-Personal Data, in a variety of ways including, but not limited to, the below:

Share data with third parties to fulfill service requests and to perform business functions (e.g., CBA contracts with third parties to provide services on our behalf such as data

hosting services; packaging, mailing and delivery services; customer support and consulting services; and event registration services). If you require additional information, please contact us as set forth in the “Contact Us” information below.

Share data with third parties as required by law or to protect CBA in the good-faith belief that such action is necessary to: (a) conform to legal requirements or comply with legal process served on CBA; (b) protect and defend CBA’s rights or property; or (c) protect the personal safety of CBA personnel or members of the public in appropriate circumstances.

Share data with third parties if CBA and/or its assets (or a portion of its assets) are sold, assigned, transferred, or merged, or if CBA undergoes some other change including a change to its corporate form as part of a bankruptcy proceeding or otherwise; information may be transferred as part of that transaction or change.

Share data with third parties to offer you products and services that may be of interest to you professionally or personally as an attorney (e.g., business software solutions or member product discounts). Users can request their information to be removed from such lists by contacting us, as set forth in the “Contact Us” information section below.

4. How We Protect Your Data

CBA implements commercially reasonable security measures to help protect against unauthorized access to or unauthorized alteration, disclosure, or destruction of data. Except for membership directories, membership lists and registration lists, and the sharing of information as set forth in this Privacy Policy, we restrict access to Personal Data to certain companies who need the data to operate, develop, or improve our services or benefits. In some cases, limited data may be made available to volunteer leaders on behalf of CBA for purposes such as membership recruitment and retention.

5. How to Manage the Processing of Your Data

You can manage your profile and email preferences, including opting out of email by contacting us using the “Contact Us” information at the bottom of this webpage. If you prefer to receive hard copy mailings only from the CBA, you can contact us and request to have your name and address removed from the list we provide to third parties. For California residents, please consult the “California Privacy Rights” section for additional considerations.

Our processing of your data is based upon your consent, contract performance (e.g., your purchase of products or membership sign-up/renewal), or compliance with

law. Your consent can be withdrawn at any time. We retain Personal Information that you provide to us where we have an ongoing legitimate business need to do so (for example, as needed to comply with our legal obligations, resolve disputes and enforce our agreements).

You have the right to object to our processing of your data or to restrict our processing of your data. In addition, if you have consented to the processing of your Personal Data, you have the right to withdraw your consent at any time.

Your Personal Data is your own – we rely on you to update and correct your Personal Data. If you are a user of our Sites, subscriber to CBA publications, purchaser of CBA products and services, or a CBA member, you can review, update and correct your information directly on CBA’s website or by contacting us via the “Contact Us” information at the bottom of this webpage.

6. Data Retention

Typically, we retain your Personal Data for the period necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. This may include retaining your Personal Data indefinitely, even after you are no longer a CBA member, in order to provide you with future marketing opportunities and other purposes such as tracking trends, as well as to comply with our legal obligations, resolve disputes, or enforce any of our agreements. Please note that you can request, at any time, that we delete your Personal Data. All requests must be directed to the “Contact Us” information at the bottom of this webpage. We can decide to delete your Personal Data if we believe that the data is incomplete, inaccurate, or that our continued use and storage are contrary to our obligations to other members, individuals, or third parties.

7. Transmission of Data to Other Countries

Your Personal Data is processed in the United States, where privacy laws may be less stringent than the laws in your country and where the government, courts, or law enforcement may be able to access your data. By submitting your Personal Data to us, you agree to the transfer, storage and processing of your Personal Data in the United States.

8. Breach Notification

The CBA will notify you by email, US mail, telephone, or other means as permitted by law if it is determined that a data security incident occurred.

9. CBA Email Policy

The CBA Email Policy is as follows:

Your email address will be used only by CBA, CBA-CLE, its entities and CBA vendors and volunteer leaders performing member services or offering products on CBA’s

behalf. Please understand, however, that in such cases, your email address may be visible to other attorneys, others who have interest in the legal profession and CBA events, as well as the public through CBA membership directories, membership lists

and registration lists. CBA also shares your email address with third parties to enable CBA to take security measures to help protect against unauthorized access to or unauthorized alteration, disclosure, or destruction of data. Finally, CBA shares email addresses with third parties as necessary for CBA to perform certain services on our behalf, such as packaging, mailing and delivering products and processing event registrations and to respond to your service requests. If you require additional information, please contact us as set forth in the “Contact Us” information below.

10. Cookies

CBA uses cookies. A cookie is a small text file that reports user and page activity (e.g., what banner ad appeared and whether you clicked on it).

Information gathered using cookies is not sold or provided to vendors, direct mail concerns, email list services, etc.

CBA cannot control the use of cookies by sites linked to our site or to vendor(s) sites that have purchased banner advertisements. CBA is not responsible for the privacy practices or the content of such sites. It is recommended that you review the privacy policies of other linked websites as the privacy policies of these websites, and their use of cookies, may differ from CBA Privacy Policy.

Cookie settings, including whether to reject cookies, can be controlled in your Internet browser (e.g. Google Chrome, Edge, Mozilla, Firefox). Certain features on our website may not function if cookies are disabled.

11. User ID and Password

You may be required to use a User ID and Password to access certain parts of CBA’s website and associated accounts. The use of a User ID and Password helps protect your Personal Data. Please create a unique password, for example using uppercase letters, lowercase letters, numbers, and special characters. Please contact us via the “Contact Us” information below if you need assistance in using or resetting your User ID and/or Password.

12. Linking to Other Websites

CBA’s website contains links to other websites not operated by CBA. CBA Privacy Policy only applies to CBA’s website. It is recommended that you review the privacy policies of other linked websites as the privacy policies of these websites may differ from CBA’s Privacy Policy.

13. California Privacy Rights

In addition to the rights as explained in this Privacy Policy, under California’s “Shine the Light” law, California residents who provide personal information (as defined in the