United States Regional Privacy Notice

Effective: June 2026 | Last revised: June 2026

Scope & applicability

This United States Regional Privacy Notice (Notice) applies to individuals residing in the United States whose personal data is processed by Granicus LLC and its affiliates (collectively, Granicus, we, us, or our). It supplements the Granicus Global Privacy Policy available at granicus.com/privacy-policy.

Processor / Service Provider Clarification. Granicus provides technology platforms to government agencies and other public-sector entities (Agency Customers). In those contexts, the Agency Customer is the data controller and Granicus acts solely as a data processor or service provider operating under a Data Processing Agreement (DPA). Personal data processed under a DPA is governed by the DPA and applicable law, and individuals should direct rights requests relating to Agency Customer data to the relevant Agency Customer. This Notice applies to personal data for which Granicus independently determines the purposes and means of processing (e.g., Granicus’s own marketing, website analytics, and account management).

Federal Agency Context. When Granicus processes data on behalf of federal agency customers, those agencies retain obligations under the Privacy Act of 1974 (5 U.S.C. § 552a) and the E-Government Act of 2002 (44 U.S.C. § 3501 et seq.). Granicus supports Agency Customers in meeting those obligations, including with respect to System of Records Notices, Privacy Impact Assessments, and records-management requirements, as specified in applicable government contracts and DPAs.

For clarity, Sections relating to analytics, profiling, automated decision-making, and marketing apply solely to processing activities where Granicus acts as a controller, and not to processing performed on behalf of Agency Customers under a Data Processing Agreement.

Key definitions

Personal Data means any information that identifies, relates to, describes, or is reasonably capable of being associated with a particular individual or household.

Sensitive Personal Data means a subset of personal data including racial or ethnic origin; religious beliefs; mental or physical health data; sexual orientation; transgender or nonbinary status; genetic or biometric data; geolocation (precise); immigration status; and financial account data.

Sale means the disclosure of personal data for monetary or other valuable consideration, as defined in applicable state law (including under the CCPA/CPRA, TDPSA, and equivalent statutes).

Automated Decision-Making Technology (ADMT) means any system, algorithm, or machine-learning model that substantially replaces human decision-making to produce outputs such as predictions, recommendations, scores, or classifications that inform decisions about individuals.

Profiling means any automated processing of personal data to evaluate, analyse, or predict aspects concerning an individual’s characteristics, behaviour, interests, or preferences.

Personal data we collect, how we use it, and legal basis

The table below describes the categories of personal data Granicus collects as a controller, the specific examples within each category, and the purposes for which we use it. The sources of this data are: directly from you; from Agency Customers and their platforms; from cookies and tracking technologies on our Services; and from third-party analytics and data-enrichment providers.

Data Minimisation. Consistent with applicable law, including the Maryland Online Data Privacy Act (MODPA) where applicable, Granicus collects only personal data that is reasonably necessary and proportionate to the disclosed purpose. We do not collect personal data for its own sake or beyond what is needed to deliver the relevant Service or function.

Disclosure of personal data to third parties

We disclose personal data to third parties only as described in this Notice or as permitted by applicable law. The following table summarises categories of data disclosed, recipient categories, and purposes.

Third-party websites and social media

Our Services may contain links to third-party websites and social media platforms. Those platforms operate under their own privacy policies. We are not responsible for their data practices. Social media plugins (including Facebook, LinkedIn, and X/Twitter) may collect your IP address and usage data independently of Granicus. We recommend reviewing the privacy policies of any third-party platform before submitting personal data to it.

Selling and sharing

Granicus does not sell personal data in the traditional sense of an exchange for money. However, certain disclosures to advertising and analytics partners, and the sending of marketing communications on behalf of Agency Customers, may constitute a sale or sharing under the CCPA/CPRA and equivalent state laws. You have the right to opt out of such activities. To exercise your opt-out right, contact us using the methods in Section 10.

In the preceding 12 months, Granicus has shared or sold personal data (in the form of identifiers and professional/employment information) with Agency Customers at their discretion and with advertising/analytics partners for marketing and campaign-improvement purposes. We have not sold sensitive personal data, and we do not do so consistent with our obligations under MODPA and as a matter of policy.

Data retention

Retention periods vary depending on the nature of the data, applicable contractual obligations, and legal requirements. Where specific retention periods are not mandated, Granicus applies reasonable retention criteria, including the duration of the customer relationship, operational needs, and legal or regulatory requirements.

The table below sets out our standard retention periods (or the criteria used to determine them) for each category of personal data.

Where a government contract or applicable law requires a longer or shorter retention period, that requirement will govern. Data that is no longer required will be securely deleted or de-identified. Granicus periodically reviews retention schedules to ensure compliance with evolving legal requirements.

Cookies, tracking technologies, and opt-out signals

Types of tracking technologies

We use cookies and similar technologies (pixel tags, web beacons, device fingerprinting) to operate, secure, and improve our Services, and for analytics and advertising purposes. See our Cookie Policy at granicus.com/trust-center/cookie-policy/ for full details.

Global Privacy Control and Universal Opt-Out Mechanism (UOOM)

Granicus honors Global Privacy Control (GPC) and Universal Opt-Out Mechanism (UOOM) signals where required by applicable state law, including California and Oregon. When our Services detect a valid GPC or UOOM signal from your browser or device, we will treat that signal as a request to opt out of the sale and sharing of your personal data for cross-contextual behavioural advertising. You can configure GPC via browser extensions or privacy-first browsers. The opt-out will apply to the browser or device from which the signal is sent.

Certain third-party analytics and advertising technologies operate independently. Disabling cookies in your browser settings or using an ad blocker may limit some tracking. For third-party social media tracking, we recommend the opt-out steps described in Section 4.1 above.

Insights, profiling, and analytics

Granicus may, in limited circumstances and where acting as a controller, use personal data to generate aggregated analytics and marketing insights. Such insights generally relate to engagement metrics, interests, or market segment classifications and do not typically include inferred sensitive characteristics. Where Granicus processes personal data on behalf of Agency Customers, any profiling or analytics is performed solely at the direction of the Agency Customer and is governed by the applicable DPA.

Automated Decision-Making Technology (ADMT)

Disclosure of ADMT use

Consistent with California CPPA ADMT Regulations effective January 1, 2026, and equivalent provisions in other state laws, Granicus discloses the following regarding its use of ADMT:

To the extent Granicus uses automated tools when acting as a controller, such tools are limited to marketing analytics, segmentation, and communication optimization. Granicus does not use automated decision-making technology to make decisions that produce legal or similarly significant effects on individuals.

Use of automated decision-making within Granicus products is governed by customer contractual terms and customer-facing disclosures.

Risk assessments and cybersecurity audits

Granicus evaluates high-risk processing activities, including the use of sensitive personal data and targeted advertising, in accordance with applicable law. Where required, Granicus will conduct and maintain risk assessments and make them available to regulators as required. Granicus also maintains a security program that includes periodic assessments and reviews designed to evaluate the effectiveness of our controls.

Your privacy rights

Subject to applicable law and available exceptions, you may have the following rights with respect to personal data for which Granicus is the controller. Rights exercisable against Agency Customer-controlled data must be directed to the relevant Agency Customer.

Not Applicable to All States. The availability of specific rights varies by state. Consult Section 11 (State-Specific Notices) for the rights applicable to your state of residence.

How to exercise your rights, submit requests, and appeal

Submitting a Request

To exercise any right described in this Notice, you may contact us by:

• Telephone: 800-314-0147
• Email: customercare@granicus.com
• Online: via the rights-request portal linked at granicus.com/trust-center/us-privacy-notices/

Your request must include sufficient information for us to verify your identity and understand the nature of your request. Granicus will respond within the timeframe required under applicable law (generally 45 days, with a permissible 45-day extension). Requests relating to opt-out of sale or sharing do not require identity verification beyond what is necessary to process the request.

Authorised Agents

You may designate an authorised agent to submit a request on your behalf. We will require: (a) written, signed authorisation from you specifying the agent’s authority; or (b) a power of attorney under applicable law. We may verify your identity independently and confirm your authorisation directly with you.

Appeal

If we deny your rights request, you have the right to appeal our decision in all states that provide an appeal right (including Virginia, Colorado, Connecticut, Texas, Oregon, New Jersey, Minnesota, Montana, Delaware, Iowa, New Hampshire, Nebraska, Maryland, Indiana, Kentucky, and Rhode Island). To appeal, email customercare@granicus.com with: (a) your full name; (b) a description of the original request and our decision; and (c) the basis for your appeal. We will respond within the time period required by applicable law.

Non-Discrimination

Granicus will not discriminate against you for exercising any rights under this Notice or applicable law. We will not deny Services, charge different prices, or provide a degraded level of service as a result of a rights request.

Children’s data

Granicus’s own commercial website and direct marketing services are not directed at children under the age of 16, and we do not knowingly collect or sell the personal data of children under 16. If we discover that we have inadvertently collected personal data from a child under 16, we will promptly delete it. This limitation applies only to Granicus’s consumer-facing websites and marketing activities. Granicus may process personal data of children when acting as a service provider to Agency Customers, in which case the Agency Customer is responsible for obtaining any required consents.

COPPA. Some Agency Customers operate platforms that may be directed at or knowingly collect data from children under 13 (e.g., government youth services). In those cases, the Agency Customer, as controller, is responsible for compliance with the Children’s Online Privacy Protection Act (COPPA, 15 U.S.C. §§ 6501–6506) and for obtaining required parental consent. Granicus, in its processor capacity, supports Agency Customers’ COPPA compliance obligations as specified in the applicable DPA.

State Children’s Privacy Laws. Granicus monitors developments under California’s Age-Appropriate Design Code and equivalent state children’s data laws and will update this Notice and our practices as those laws take effect.

State-specific privacy notices

The following table provides jurisdiction-specific information for residents of states with comprehensive privacy laws. All rights described herein are subject to applicable legal exceptions and exemptions.

Security

Granicus implements technical, administrative, and physical safeguards designed to protect personal data from unauthorised access, disclosure, alteration, or destruction, including encryption in transit and at rest, access controls, and regular security assessments. No transmission or storage system can be guaranteed to be 100% secure. In the event of a personal data breach, Granicus will notify affected individuals and regulators as required by applicable law.

Changes to this Notice

We may update this Notice from time to time to reflect changes in applicable law, our practices, or our Services. Material changes will be communicated via email or a prominent notice on our website at least 30 days before taking effect, where practicable. The effective date at the top of this Notice indicates when it was last revised. Continued use of our Services after the effective date constitutes acceptance of the revised Notice.

Contact us

For questions, concerns, or requests relating to this Notice or our privacy practices, please contact us at:

Granicus Privacy Team

Email: customercare@granicus.com
Telephone: 800-314-0147
Website: granicus.com/trust-center/us-privacy-notices/

For privacy matters relating to data processed by Granicus on behalf of a specific government agency, please contact the relevant agency directly.