U.S. States Privacy Notice
Last Updated: December 2023

If you reside in California, Colorado, Connecticut, Utah, or Virginia, this U.S. state data privacy notice
applies to you and supplements the rest of our Privacy Policy. Please refer to the state in which you
reside to learn more about additional terms and rights that may apply to you.
California
The California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"),requires us to provide California consumers with some additional information regarding how we collect,use, and disclose your personal information, and the rights available to California consumers under theCCPA. The terms used in this section have the same meaning as in the CCPA.
As described in detail in section 2 of our Privacy Policy, we may collect the following categories ofinformation about you through the Confluent Product or when you visit our sites:•Identifiers, such as your name and email address;•Personal information categories listed in the California Customer Records statute (Cal. Civ. Code§ 1798.80(e)), such as your contact information;•Device identifiers, such as your IP address;•Internet or other network activity information, such as your browsing history or app usage;•Geolocation data; such as your approximate location based on your IP address and otherinformation that identifies or can be reasonably associated with your device;•Commercial information, such as transaction data;•Your account log-in information i.e. username and password to access your account (if you havean account with us);•

Professional or other employment related information, such as where you work and your title;
and•Financial information, such as credit card and payment data.

The sources from which we collect personal information are described in Section 2 ("PersonalInformation We Collect") of this Privacy Policy. The business and commercial purposes for which wecollect this information are described in section 4 ("Our Use of Personal Information") of this Privacy
Policy. The categories of third parties to whom we "disclose" this information for a business purpose aredescribed in section 5 ("Sharing of Personal Information") of this Privacy Policy.
Sales and Sharing of Personal Information
Confluent does not sell personal information as the term “sell” is traditionally understood (i.e. formoney). However, the CCPA defines "sale" very broadly. It includes the disclosure of a California
1resident's personal information in exchange for anything of value. Like many websites and apps, ourSites and related online services use cookies and similar technologies to enable certain functionality,
help collect information about your visit, and, if you choose to enable such cookies, show you relevant
advertising about products and services from and on behalf of us and others, as described in Section 3("Our Use of Cookies and Similar Tracking Technologies"). The use of such cookies which disclose or
make available a California resident’s personal information (including IP addresses, cookie IDs, andmobile IDs) to third parties including advertising partners may be considered a “sale” of personal
information under the CCPA (given its broad definition of "sale"), or a "share" of personal information
under the CPRA amendments (which is defined as the disclosure of personal information for thepurposes of cross-context behavioral advertising).
According to how the terms "sale" and "share" are defined under the CCPA, in the year before thissection was last updated, we may have "sold" or "shared" the following categories of personal
information to third parties: identifiers (like your IP Address) and other electronic network activity (suchas browsing history). We may have "sold" or "shared" these categories of personal information to thethird parties listed in section 5 ("Sharing of Personal Information") of this Privacy Policy.
We do not knowingly sell or share personal information of California residents who are under 16 yearsof age.
California Privacy Rights
If you are a California resident, you may have the following rights under the CCPA, subject to certain
limitations and exceptions under applicable law:
•Know and Access: You have the right to request to know and access the following information
covering the 12 months preceding your request:- the categories of personal information we have collected about you;- the categories of sources from which your personal information was collected;- the business or commercial purposes for collecting, "selling" and/or "sharing" your personal
information;- the categories of third parties to whom we have disclosed, "sold" or "shared" personal
information about you; and- the specific pieces of personal information we have collected about you.
You have the right to receive your personal information in a portable and commonly usedformat.

•Correct: You have the right to request that we correct any of your personal information that wehave collected from you that is inaccurate.

•Delete: You may have the right to request that we delete certain personal information we havecollected from you.

•Opt out of the Sale and Sharing of your personal information. You have the right to requestthat a business not "sell" or "share" your personal information with a third party, as those terms
are defined under the CCPA. As described above, Confluent uses cookies and similar
technologies to make available certain personal information (including IP addresses, cookie IDs,2and mobile IDs) to third party service providers and advertising partners to display personalized
advertisements to you, or to provide similar advertising or analytics services to their othercustomers. To the extent that such practice constitutes a “sale” or “share” of personal
information under the CCPA, you may opt-out of such “sale” or “share” of your Personal
Information at any time by visiting our Cookie Notice and following its instructions.
•Limit the use and disclosure of sensitive personal information: Although Confluent may use"personal information", as defined by the CCPA, for the purposes described in section 4 ("OurUse of Personal Information"), including for the purpose of inferring characteristics about you,
we do not use or disclose "sensitive personal information,” as defined by the CCPA, for thepurpose of inferring characteristics about you, or in any way that would require a right to limit
under the CCPA. As a result, we do not offer an ability to limit the use or disclosure of sensitive
personal information.

•Non-Discrimination: You have the right to not be discriminated against for exercising any ofyour CCPA rights.

Colorado Privacy Rights
The Colorado Privacy Act ("CPA") and its implementing regulations define "consumer" as a Colorado
resident who is acting in an individual or household context only and does not include residents acting in
a commercial or employment context. If you are a Colorado "consumer", you may have the following
rights concerning your personal data, subject to certain limitations and exceptions under applicable law:•

Access: You have the right to request to confirm whether we are processing personal data about
you and to access such personal data.

•Data Portability: You have the right to obtain your personal data in a portable and readily
usable format.

•Correction: You have the right to request that we correct inaccuracies in the personal data wehave collected about you, taking into account the nature of the personal data and the purposesof processing your personal data.

•Deletion: You have the right to request to delete certain of your personal data.

•Opt-out of Data Processing for purposes of Targeted Advertising; Sales to Third Parties; andProfiling: As described in the section "Sales and Sharing of Personal Information" above, we donot sell personal data to third parties for money, nor for the purpose of profiling in connection
with decisions that produce legal or similarly significant effects. However, we do process
personal data for the purpose of displaying personalized advertisements to you, if you instruct
us to do so. You have the right to opt out of the processing of personal data for personalized
advertising purposes at any time by changing your cookies choices via our Cookie Notice andfollowing its instructions.

•Appeal: You have the right to appeal a refusal to take action on your request. You must ask us toreconsider our decision within 45 days after we send you our decision. We will endeavor to3

respond to your appeal within 60 days of such an appeal, including a written explanation of thereasons for the decision, and any action taken or not taken in response to the appeal.
Connecticut Privacy Rights
The Connecticut Data Privacy Act ("CtDPA") defines "consumer" as an individual who is a resident ofConnecticut. If you are a Connecticut "consumer", you may have the following rights concerning yourPersonal Information, subject to certain limitations and exceptions under applicable law:•

Access: You have the right to request to confirm whether we are processing personal data about
you, and to access such personal data.

•Data Portability: You have the right to obtain your personal data in a portable and readily
usable format.

•Correction: You have the right to request that we correct inaccuracies in your personal data.

•Deletion: You have the right to request to delete the personal data provided by you or obtained
about you.

•Opt-out of Data Processing for purposes of Targeted Advertising; Sales to Third Parties; andProfiling: We do not sell personal data to third parties, or process personal data for the purposeof profiling in connection with decisions that produce legal or similarly significant effects. As
described in the section "Sales and Sharing of Personal Information" above, we do process
personal data for the purpose of displaying personalized advertisements, if you instruct us to doso. You have the right to opt out of the processing of personal data for personalized advertising
purposes at any time by changing your cookies choices via our Cookie Notice and following its
instructions.

•Appeal: You have the right to appeal a refusal to take action on your request. You must ask us toreconsider our decision within 45 days after we send you our decision. We will endeavor to
respond to your appeal within 60 days of such an appeal, including a written explanation of thereasons for the decision, and any action taken or not taken in response to the appeal.

Utah Privacy Rights
The Utah Consumer Privacy Act ("UCPA") defines “consumer” as an individual who is a resident of Utah
acting in an individual or household context only and does not include residents acting in a commercial
or employment context. If you are a Utah "consumer", you may have the following rights concerning
your personal data, subject to certain limitations and exceptions under applicable law:
•Access: You have the right to request to confirm whether we are processing personal data about
you, and to access such personal data.

•Data Portability: You have the right to obtain your personal data in a portable and readily
usable format.

•Deletion: You have the right to request to delete the personal data provided by you or obtained
about you.

4•

Opt-out of Data Processing for purposes of Targeted Advertising and Sales to Third Parties: We
do not sell Personal Information to third parties. As described in the section "Sales and Sharingof Personal Information" above, we do process Personal Information for the purpose ofdisplaying personalized advertisements, if you instruct us to do so. You have the right to opt outof the processing of personal data for personalized advertising purposes at any time by changing
your cookies choices via our Cookie Notice and following its instructions.

Virginia Privacy Rights
The Virginia Consumer Data Protection Act ("VCDPA") defines "consumer" as a Virginia resident who isacting in an individual or household context only and does not include residents acting in a commercial
or employment context. If you are a Virginia "consumer", you may have the following rights concerning
your personal data, subject to certain limitations and exceptions under applicable law:
•Access: You have the right to request to confirm whether we are processing personal data about
you, and to access such personal data.

•Data Portability: You have the right to obtain your personal data in a portable and readily
usable format.

•Correction: You have the right to request that we correct inaccuracies in your personal data.

•Deletion: You have the right to request to delete the personal data provided by you or obtained
about you.

•Opt-out of Data Processing for purposes of Targeted Advertising; Sales to Third Parties; andProfiling: As described in the section "Sales and Sharing of Personal Information" above, we donot sell personal data to third parties for money, nor for the purpose of profiling in connection
with decisions that produce legal or similarly significant effects. However, we do process
personal data for the purpose of displaying personalized advertisements, if you instruct us to doso. You have the right to opt out of the processing of personal data for personalized advertising
purposes at any time by changing your cookies choices via our Cookie Notice and following itsinstructions.

•Appeal: You have the right to appeal a refusal to take action on your request. You must ask us toreconsider our decision within 45 days after we send you our decision. We will endeavor torespond to your appeal within 60 days of such an appeal, including a written explanation of thereasons for the decision, and any action taken or not taken in response to the appeal.

Making Rights Requests
If you are a resident of one of the above U.S. states and would like to exercise any of your rights
described above, please submit your rights request by using this form or by e-mailing us at
privacy@confluent.io. To protect the personal data that we maintain, we may verify your identity when
you make a request.

5Please note that the rights described above are not absolute, and where an exception under applicablelaw applies, we may be entitled to refuse requests in whole or in part. For example, where responding
to your request involves disproportionate effort, when we are unable to verify your identity or if therights and freedoms of another individual would be negatively affected.
In certain states (such as California), an authorized agent may submit a rights request on yourbehalf. We may require an authorized agent to verify their authority to submit a request on your behalf,or we may require you to verify your own identity or confirm with us that you provided the agent withpermission to submit the request. We will only use the information provided for verification to confirm
the requestor’s identity or authority to make the request, and for our compliance records.
We endeavor to respond to a verifiable request within forty-five (45) days of its receipt. If we require
more time, we will inform you of the reason and extension period (up to a total of 90 days) in writing.

6