Privacy Policy

Updated: March 16, 2026

This Privacy Policy describes how Ooma, Inc., together with its wholly owned subsidiaries (collectively, “Ooma,” “we,” “our,” or “us”), collects, uses, discloses, and otherwise processes your Personal Information, and your choices and legal rights with respect to such information. Ooma provides Voice over IP services for businesses and consumers, as well as home security products and services, including cameras and motion sensors; UCaaS and API services; and internet access and managed Wi-Fi® (together, “Equipment” and “Services”).

Please review this Privacy Policy carefully, as it applies to the websites and mobile applications (collectively, “Sites”), as well as the services owned, operated, and/or provided by Ooma that display or link to this Privacy Policy. This Privacy Policy also applies to Personal Information collected in connection with the Equipment and Services, unless stated otherwise.

For purposes of this Privacy Policy, “Personal Information” refers to information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to you, and includes “personal data” or similar terms, as defined by applicable law.

To Whom Does this Privacy Policy Apply

We interact with individuals in different capacities:

• As consumers who purchase and use our products (“Consumers”) or
• As commercial representatives of businesses with whom we engage (“B2B Contacts”).

This Privacy Policy applies to both Consumers and B2B Contacts. For MyPhone, the collection and use of Personal Information from child users under the age of 13 is governed by our Children’s Privacy Policy, linked here.

To Whom Does this Privacy Policy Not Apply

Employees, applicants and contractors. This Privacy Policy does not apply to the collection, disclosure and use of Personal Information of job applicants, employees and contractors. The processing of such information is governed by separate policies.

Business Customers’ End Users. Additionally, this Privacy Policy does not apply when Ooma acts as a data processor (or service provider) on behalf of business customers. To the extent Ooma collects and processes any Personal Information as a service provider, Ooma processes such information in accordance with the instructions of the business customer. If you are an end user of a business using Ooma services, please contact such business customer directly for information about how it processes your Personal Information and to exercise your privacy rights, as applicable.

By using our Services, you agree to the collection, use, and disclosure of your Personal Information as described in this Privacy Policy. If you do not agree, please do not use our Services.

Notice at Collection of Personal Information

This Notice at Collection applies to both Consumers and B2B Contacts.

We collect the categories of Personal Information identified in the following chart. We generally disclose these categories of Personal Information for business purposes to our service providers, including payment processors and account management providers to facilitate our Services and access to the Sites. Some of these categories we “sell” or “share” for “targeted advertising” (as such terms are defined by applicable law) with business partners and third parties, such as data analytics providers, advertising technology vendors, third-party advertising networks, and social media platforms.

We do not knowingly sell or share Personal Information about persons under the age of 18. To opt out of sales and sharing, please click here. You may also choose to enable online, where available, a universal tool that automatically communicates your opt-out preferences, such as the Global Privacy Control (“GPC”). We will process the GPC signal as a request to opt-out.

1. CATEGORIES OF PERSONAL INFORMATION WE COLLECT

2. Business and Commercial Purposes for Which We Collect and Use Your Personal Information

We may collect and use each of the categories of Personal Information listed above for one or more of the business purposes described in our Privacy Policy, or for another purpose that we describe to you when or before collecting your Personal Information to:

• Provide you with our Sites, Equipment and Services
• Create, maintain, customize, and secure your account with us – this includes processing your payments and fulfilling your orders
• Communicate with you, including through bots, to respond to your inquiries/requests and request feedback from you, and to send you important updates and messages about changes to our Equipment and Services, this Privacy Policy, and/or other applicable terms and conditions
• Review the usage and maintain the operation of our Sites, Equipment and Services
• Conduct analysis and develop and/or improve our Sites, Equipment and Services – this includes processing your Personal Information to understand and analyze usage trends and preferences, to improve the Equipment and Services, and to develop new products, services, features, and functionalities
• Engage in data driven targeted advertising, including to show you advertisements for products and/or services tailored to your interests on social media and other websites; and to administer our sweepstakes, contests, and other similar promotions
• Provide you with customized content or targeted offers, including to send you information, newsletters, and marketing/promotional material from us and, or on behalf of, our marketing partners and affiliates
• Provide you with surveys to improve the types of Equipment and Services we offer and how we provide them to you. For example, we may combine this information with Personal Information provided by other Customers to understand trends in our user base and improve our Equipment and Services accordingly
• Optimize our services through the use of artificial intelligence (AI), including through third-party AI tools, to provide, optimize, and improve our services. For example, we may use AI tools to provide and analyze transcriptions, optimize our marketing, and/or improve our customer support
• Monitor, protect, and maintain the security and integrity of our Sites, Equipment and Services and our business, such as protecting against and preventing fraud, unauthorized transactions, claims and other liabilities
• Comply with applicable laws and regulations and respond to lawful requests and communications from law enforcement and other government officials
• Carry out sales and business transactions in which information held by us is among the assets transferred or is otherwise relevant to the evaluation, negotiation, or completion of the transaction
• Protect our rights, privacy, safety, property and/or those of others
• Fulfill any other purpose for which you provide your Personal Information or as explained to you at the point of information collection.

3. Retention

We will retain your Personal Information for as long as reasonably necessary to provide you with Equipment and Services that you request, for marketing purposes unless you opt out as described in our Privacy Policy, or otherwise where permitted or required in accordance with applicable law.

We will retain and use your Personal Information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. What this means in practice will depend on the type of information and purposes of collection, taking into account ongoing business or legal needs for the information, for example in relation to tax, health and safety, and potential or actual disputes or investigations.

Personal Information We Collect

There are several ways we may collect your Personal Information, including through (a) information you provide to us, (b) information we collect automatically, (c) information we receive from third parties, and (d) combining information from different sources. This includes data that identifies you personally whether directly or indirectly.

1. Information You Provide

We collect Personal Information as listed in the above Notice at Collection section from you as follows:

• When You Purchase Equipment and Services. We collect your Personal Information if you purchase Equipment and Services, including, but not limited to, name, physical address, email address, telephone number, account information, certain billing information, and other information you provide. If you purchase Equipment of Services from us, our third-party payment processors collect a payment card number or other payment information.
• When You Use our Equipment and Services. We may also collect Personal Information that you upload, save, send, or receive on or through the Equipment or Services (including mobile applications) depending on how you use the Equipment and Services.
• When You Provide Information About a Third Party. If you provide information about someone else, such as sending a promotion to a friend or upload someone’s contact information, the Personal Information you provide may be used to facilitate communication with such person or to provide the Services, depending on the circumstances.
• When You Communicate with Us. If you complete our surveys, contact us directly, inquire about our Equipment and Services, or provide information on our Site, we may collect your name, email address, phone, company, job title, physical address, Equipment and Services of your interest, date and time of your communication, any attachments you include, and other content or information you may directly provide to us.
• When You Transmit Information Through Public Forums. You should be aware that any Personal Information you voluntarily include and transmit through publicly accessible forums may be viewed and used by anyone with access to such forums. We are not responsible for other users’ use of available information, so you should carefully consider whether and what to post or how you identify yourself on such forums.

2. Information We Collect Automatically

We and our third-party partners and service providers use a variety of technologies to automatically collect certain information from you when engaging with our Sites and Services. We may collect your Personal Information using different data collection technologies, such as cookies, pixels, and tags on our Sites, and in email messages and certain online advertisements. For information on the choices you may have with respect to these data collection technologies, see the Your Privacy Choices and Rights section below.

The specific types of Personal Information that we, our partners, and service providers may automatically collect when you visit our Sites and interact with our Services include:

• Device and Browser Information. We and third parties on our behalf collect information related to the types of Equipment and Services you purchase. If you use our Managed Wi-Fi® Service, we may also automatically collect data regarding the devices that connect to your network and how your network is being used. Such information may include an end user’s unique personal identifier, online identifier, Internet Protocol address, operating system, browser type, username, location-based data, and interactions with an Internet website, application, or advertisement. If you use our mobile applications, we and third parties on our behalf may also automatically collect device ID or diagnostic data for analytics purposes or to troubleshoot issues.
• Usage Information. When you interact with or use our Sites, Equipment and Services, certain information may be collected by us or our third party vendors, including the date and time of your visit, the pages you view immediately before and after you access our Services, the areas or pages of our Services that you visit, the amount of time you spend viewing or using our Services, items placed or left in your shopping cart on the Sites, keystrokes, mouse movements, form field entries, recordings of chat sessions or your use of and inputs to other AI-supported tools, and other use and overall engagement with our Sites and Services.
• Marketing Information. If you receive an email from us, information may be collected about your interactions with the message (e.g., whether you opened, forwarded, or clicked through to our Sites).
• Third-party analytics technologies. We may use third-party analytics tools to better understand who is using our Sites and Services, how people are using them, and how to improve their effectiveness as well as the effectiveness of any related content.

Cookies and Other Similar Technologies: “Cookies” are text files that are placed on your browser by the websites that you visit. Cookies are used for various purposes, including to distinguish you from other users, make your site navigation more efficient, help remember your preferences, enhance your browsing experience, and improve the use and functionality of our Sites and related content. They can also enable the delivery of relevant and personalized advertisements to you across the Internet.

We (and our partners and service providers) use the following types of cookies:

• Strictly Necessary Cookies. These cookies are essential to enable you to move around the Sites and use its features. These cookies allow us to provide some of the basic functionalities of the Sites.
• Performance Cookies. These cookies generally collect information about how visitors use the Sites so that we can improve our Services. These cookies do not collect identifiable information.
• Functionality Cookies. These cookies allow the Sites to remember the choices you make as you browse the Sites. They provide more enhanced and personal features. The information collected is anonymized, and they cannot track your browsing activity on other sites once you leave the Sites.
• Targeting/Advertising Cookies. These cookies may be set by our advertising partners, including social media platforms. They may be used by our partners to build a profile of your interests and show you relevant advertisements on other online services, which is known as “interest-based advertising.” These cookies uniquely identify your browser and device and observe your behaviors and browsing activities over time across multiple websites or platforms.

Please note that cookies and other similar technologies provided by third parties may be placed on our Sites. The providers of these technologies may create one or more identifiers associated with you or your device(s) both on and off our Sites and combine this information with other sources and use the combined information for analytics and/or advertising purposes.

The third parties listed below, among others, use cookies or other similar technologies on our Site or Services for the purposes set forth below:

Our use of Google Analytics and Advertising technologies: Our Sites use technology provided by Google to facilitate analytics, advertising and reporting. We implement Google Analytics cookies to collect Personal Information about you when you visit our Sites for purposes of remarketing, impression reporting, and demographic and interest reporting. This information includes browsing and Sites usage data and can be combined with other data related to you collected through Google’s advertising cookie or other third-party technology. You can opt out of the use of this technology through the Google Analytics opt-out browser add on, Google Ad Settings, and/or Ad Settings for mobile apps.

3. Information We Receive from Third Parties

We may receive Personal Information from other sources. Our third-party sources may include:

• Our Affiliates.
• Our Business Partners, including companies that co-sponsor our promotions.
• Our Marketing/Advertising and Analytics Partners, including online advertising networks and analytics providers that assist us in engaging in targeted advertising.
• Social Media Platforms, when you link a social media account through our Sites or Services. We may automatically receive certain information about you based on your registration and privacy settings on those third-party services. This may include, but may not be limited to, name, username, demographic information, updated address or contact information, location, interests, social media, and online activity. For more information about the privacy practices of those social media platforms, please review the privacy policies and settings of the social media platforms that you use.

4. Combination of Information

We may combine Personal Information that we receive from various sources. For example, we may combine Personal Information that we collect from you offline with Personal Information we collect from you through our Sites, Equipment and Services. Similarly, we may combine Personal Information that we receive from third parties with Personal Information we already have about you. We use, disclose, and protect combined Personal Information as described in this Privacy Policy.

How We Disclose Your Personal Information

We may disclose each category of your Personal Information that we collect in a number of ways. The specific Personal Information we may share with the categories of recipients listed below depends on how you interact with our Sites, Equipment and Services. For instance, browsing our Sites without an account results in different information collection and disclosure practices from activities like creating an account, using the Equipment and Services, or seeking customer support.

We disclose your Personal Information for business purposes to the following categories of recipients:

• Our Service Providers. We disclose your Personal Information to our service providers that provide business, professional, or technical support services to us, help us operate our business and the Sites and Services, or administer activities on our behalf. We require our service providers to only use your Personal Information in connection with providing services to Ooma.
• Corporate Affiliates. We may disclose your Personal Information with our affiliated companies or brands for purposes consistent with this Privacy Policy and other business and operational purposes.

We may also disclose your Personal Information to the following categories of third parties:

• Advertising Partners. We may disclose your Personal Information to third parties for targeted advertising, including social media platforms, third-party advertising networks, and other parties that assist us in serving and optimizing our advertisements. Some of our Sites have features such as, plugins, widgets, and/or other tools made available by social media platforms and networks that may result in information being collected or disclosed between us and such parties. Their use of your information is not governed by this Privacy Policy.
• Co-branding Partners. We may disclose certain Personal Information to third parties with whom we partner to offer co-branded Ooma Equipment and Services or with whom we work to jointly create and/or offer products, services, or joint promotions.
• Relevant Third Parties as Part of a Corporate Transaction. In the event of a reorganization, merger, sale, joint venture, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with a bankruptcy or similar proceeding), we may disclose or transfer your Personal Information to certain third parties, such as the acquiring entity and its advisers.
• Public Forums. Any Personal Information that you voluntarily choose to post to a publicly accessible area of the services will be available to anyone who has access to that content, including other users.
• Competent Governmental, Regulatory, and Public Authorities. We may disclose your Personal Information to government and law enforcement authorities, in each case to comply with legal or regulatory obligations or requests.
• Other Third Parties. We may disclose your Personal Information to other parties at your direction or with your consent, where required by law, or as we believe necessary or appropriate either to: (i) comply with applicable law; (ii) protect our operations and those of any of our affiliates; (iii) investigate and prevent against fraud; (iv) protect our rights, privacy, safety, or property and/or those of others; or (v) allow us to pursue available remedies or limit damages that we may sustain.

We may also disclose your Personal Information for other reasons that we will describe at the time of information collection or prior to disclosing your information.

Please note that we may de-identify or aggregate Personal Information so that it will no longer be considered Personal Information and disclose such information to other parties for purposes consistent with those described in this Privacy Policy. We will protect de-identified information in accordance with applicable law, will never attempt to “re-identify” the information, and require others not to do so.

Customer Specific Network Information

In the course of providing Equipment and Services to you, Ooma will collect and maintain certain customer-specific network information, as such term is defined under 47 U.S.C. § 222(h) (“Customer Specific Network Information”). Customer Specific Network Information includes the types of Equipment and Services you currently purchase, related usage, and billing information for such Equipment and Services. Your telephone number, name, and address are not Customer Specific Network Information.

We value our relationships with our Customers and are committed to respecting and protecting your Customer Specific Network Information. Accordingly, we will not sell, trade, or share your Customer Specific Network Information outside of Ooma or with anyone not authorized to offer or provide our Equipment and Services, or to perform functions on our behalf, except as authorized by you or as provided below. Generally, we can use your Customer Specific Network Information to offer additional services to you, and for billing and collections purposes. We can also disclose your Customer Specific Network Information for legal or regulatory reasons or in the event of emergencies, including in response to subpoenas and court orders.

We can also use Customer Specific Network Information to investigate fraud and to prevent violation of our agreements or Terms and Conditions and monitor potentially unlawful use of our network, Equipment and Services, and abuse of other Customers.

Your Privacy Choices And Rights

Ooma provides you several choices with respect to how we collect and process your Personal Information.

1. U.S. State Privacy Rights

Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Texas, Tennessee, Utah, Virginia, or any other state with an applicable privacy law have certain rights relating to the collection, use, disclosure, and other processing of their Personal Information.

The exact scope of these rights depends upon whether you are a Consumer or a B2B Contact and may vary by state. In addition, certain exceptions may apply.

• Right to Know. You may have the right to know what Personal Information we have collected about you, including the categories of sources from which the Personal Information is collected, the business or commercial purpose for collecting, selling, or sharing Personal Information, the categories of third parties to whom we disclose Personal Information, the categories of Personal Information disclosed to third parties, and the specific pieces of Personal Information we have collected about you. You may also have the right to access this Personal Information in a portable format.
• Right to Request Categories of Third Parties. You may have the right to request a list of the categories of third parties with which we disclose your Personal Information.
• Right to Request Specific List of Third Parties. You may have the right to request a list of the specific third parties with which we disclose your Personal Information.
• Right to Access a List of Specific Third Parties. RI residents can access a list of all third parties with which we have sold or may sell Personal Information by following the instructions linked here.
• Right to Delete. You may have the right to request that we delete Personal Information that we have collected from or about you, subject to certain exceptions.
• Right to Correct. You may have the right to correct inaccurate Personal Information that we may maintain about you, subject to appropriate verification. Where appropriate, we may comply with a right to correct by deleting your Personal Information.
• Right to Opt Out of Sale and Targeted Advertising. We use and disclose to third parties Personal Information for analytics and advertising purposes which may be considered a “sale” under applicable state laws. Accordingly, you may have the right to opt out of the sale or “sharing” of your Personal Information, or the use and disclosure of your Personal Information for “targeted advertising” (as these terms are defined in applicable laws).
• Right to Limit Use or Disclosure of Sensitive Personal Information: You may have the right to request that we limit the use or disclosure of your Sensitive Personal Information, subject to certain exceptions.
• Right to Opt Out of Profiling: You may have the right to opt out of certain automated processing that results in decisions that have legal or similarly significant effects on you.
• Right to Opt Out of ADMT. We do not use “automated decision-making technology” (ADMT) to make “significant decisions” about you, as those terms are defined in applicable law.

To exercise your right to opt out of sale and targeted advertising, please click here or the “Your Privacy Choices” link in the footer of the Site. In some jurisdictions, you may choose to enable a tool that automatically communicates your opt-out preferences to all businesses that you interact with online. If you enable a browser-based opt-out preference signal, such as the GPC, upon receipt or detection, we will treat the signal as a valid request to opt out of sale, sharing, or targeted advertising linked to that browser and, where we can do so, consumer profiles that we have associated with that browser. Please note that if you use different browsers or browser profiles, you will have to enable the signal on each one that you use. We will never ask you to verify your identity to exercise your right to opt out of the sale of your Personal Information.

To exercise all other privacy rights, please contact us by phone at 1 (888) 711-6662 or email us at privacy@ooma.com. Please include the statement “Your Privacy Rights” in the subject field of your email.

To protect the confidentiality of yours and others’ Personal Information, we will only complete your request when your identity has been verified (other than for requests to opt out). We will seek to match the information in your request to the Personal Information we maintain about you. As part of our verification process, we may ask you to: submit additional information, use identity verification services to assist, or, if you have set up an account on our website, to sign into your account as part of our identity verification process. Where permitted under applicable law, we may decline a request if we are unable to verify your identity (or an agent’s authority to make the request) and confirm the Personal Information we maintain relates to you.

Authorized agents. In certain states, consumers may designate an authorized agent to exercise their privacy rights. You may designate an authorized agent to submit requests on your behalf using the methods described in this section. However, we may require written proof of the agent’s permission to do so and verify your identity directly with you.

Right to appeal. Depending on your U.S. state residency, you may have the right to appeal a decision we have made in connection with your privacy rights request. To appeal a refusal to take action on your request, please contact privacy@ooma.com or 1 (888) 711-6662. If you are unsatisfied with the way that we have handled your appeal, you may have the right to complain to your state’s attorney general.

Right to non-discrimination. You will not receive retaliatory or discriminatory treatment in connection with a request to exercise your privacy rights described in this section. However, the exercising of the rights described above may result in a different price, rate, or quality/level of product or service where that difference is reasonably related to the impact the right has on our relationship with you or is otherwise permitted by law.

You are not required to create an account to exercise your state privacy rights.

Response Timing and Format. We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 45 days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

2. Interest-Based Advertising

Self-regulatory industry organizations such as the Digital Advertising Alliance (DAA) offer browser-based opt-out tools for the companies that participate in them. Please visit the DAA’s AdChoices site for more information: https://youradchoices.com/control.

3. Marketing and Promotional Communications

From time to time, we may send you marketing and promotional communications, including special offers from us or our partners. If you no longer wish to receive promotional and marketing emails from us, you may opt out of such communications at any time by following the opt-out instructions included in any promotional or marketing email you receive from us. Even after you opt out from receiving commercial messages from us, you will continue to receive administrative messages from us regarding our Services.

4. California Shine the Light Disclosures

If we disclose information subject to California’s “Shine the Light” law to third parties for their own direct marketing purposes, California residents may opt out here.

Notice of Financial Incentive

We offer various financial incentives. For example, we may provide discounts, coupons and other benefits for customers who sign up to receive our marketing emails.

We may ask you to provide Personal Information in connection with these financial incentives, including the following Personal Information: email, name, and phone number. Because these promotions involve the collection of Personal Information, they may be interpreted as “financial incentive” programs or “bona fide loyalty programs.” We use this information for the purposes described above under Notice at Collection including for targeted advertising. We may share your Personal Information with third parties as described in Notice at Collection, including data analytics providers, advertising technology vendors, and social media platforms.

Participation in any financial incentive is optional. You can opt into a financial incentive by following the sign-up or participation instructions provided, and you have the ability to withdraw from the program at any time by emailing privacy@ooma.com. To stop receiving our coupons or discounts in your email, you may unsubscribe from our emails by clicking the “unsubscribe” button at the bottom of any such email. If you ask us to delete your Personal Information, we will not be able to provide you with access to these programs. We may stand up new incentive programs from time to time – information on how to sign up and opt out of these programs will be provided as applicable.

The value of any financial incentive we offer is reasonably related to the value of any Personal Information you provide to us. We estimate the value of your Personal Information by considering, without limitation, the expenses we incur from collecting your Personal Information and/or providing the financial incentive to you, the revenue generated by your use of the financial incentive, and any improvements we can make to our products and services based on aggregating information obtained through the financial incentive program.

Please note that we may provide additional terms that apply to a particular financial incentive. If applicable, those terms will be presented to you at sign up.

External Links

Our Services may have links to third-party services, which may have privacy policies that differ from our own. We are not responsible for the practices of such sites.

Children’s Privacy

Our Sites are designed for B2B Contacts and adult residential Consumers. Our Sites are not directed to children under the age of 18, and we do not knowingly sell Personal Information from children under 18 through our Sites.

If you are a parent or guardian and believe that your child has provided Personal Information to us through our general website without your consent, please contact us at privacy@ooma.com and we will take steps to delete such information from our systems.

Note Regarding MyPhone. We offer a separate phone service, named MyPhone, designed for multiple audiences, including families with children, millennials, and adults seeking an alternative to smartphones. Because MyPhone is used by both adults and children, we collect age information from all users before collecting other Personal Information to comply with applicable laws.

Where parents and legal guardians purchase Equipment and Services for use by their minor children, we collect age information from all users before collecting other Personal Information. If a user is identified as under 13 years of age, the collection and use of that user’s Personal Information is governed by our Children’s Privacy Policy, linked here. We require the parent or legal guardian to create and manage the account, provide any necessary information, and provide parental consent on behalf of their child prior to any collection of Personal Information in connection with the child’s use of MyPhone. If your child uses MyPhone, please review the Children’s Privacy Policy for information about our practices and your rights under applicable laws.

MyPhone users who are 13 years of age and over are subject to this main Privacy Policy.

Data Security

We have implemented physical, administrative, and technical safeguards to maintain the security, confidentiality, and integrity of your information. However, as no transmission of information over the internet is absolutely secure, we cannot guarantee the safety of your information.

Revisions to this Privacy Policy

We reserve the right to update or modify this Privacy Policy at any time without prior notice by posting a revised version of the policy on the Sites. If we make material changes to this Privacy Policy, we will notify you by temporarily noting “UPDATED” near the Privacy Policy link in the footer of our Sites or directly communicating with you via email or other means. Your use of the Sites or any Ooma Services following revision to this Privacy Policy constitutes your agreement that all information collected from or about you after the revised policy is posted will be subject to the terms and conditions of the revised policy. The date listed above indicates the most recent change or update to this Privacy Policy.

International Transfers

Ooma is a global business, and we use vendors located around the world to help us run our business. Accordingly, the disclosures described above may result in the transfer of your Personal Information outside of the country or region in which you reside. For example, the Personal Information of individuals located in the European Economic Area (“EEA”), the United Kingdom (“UK”) or Canada may be transferred outside of such countries, including to the United States. In some of these locations, data protection laws may be less stringent than in your jurisdiction.

Please note that while outside of the jurisdiction in which you reside, some of your Personal Information will be subject to applicable local laws, which may permit government and national security authorities in those jurisdictions to access your Personal Information in certain circumstances.

To find out more about how we safeguard your information, please contact us via the details in the How to Contact Us section below.

Individuals in the European Union (“EU”), the UK and Switzerland may read more about certain Ooma affiliates’ participation in the Data Privacy Framework here.

How to Contact Us

If you have any questions or concerns about this Privacy Policy or the practices described herein, you may contact us at privacy@ooma.com or by mail to 525 Almanor Avenue, Suite 200, Sunnyvale, CA 94085 or by phone at 1 (888) 711-6662.

Supplemental Notice for Individuals in the EEA, the UK and Switzerland

For residents of the European Economic Area (“EEA”), United Kingdom (“U.K.”), and Switzerland, Ooma is the controller responsible for processing your Personal Information.

1. Lawful Basis For Processing

Applicable law in certain jurisdictions requires us to set out the “lawful basis” that we rely on to collect and use your Personal Information. Where applicable, the lawful bases upon which we rely on in order to collect and use your Personal Information are as follows:

• Consent. We may collect, use, and disclose your Personal Information on the basis of the consent that you provide us at the point of information collection or disclosure. You have the right to revoke your consent at any time.
• Contractual Necessity. We may collect and use certain Personal Information where it is either necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract. This may include Personal Information used to provide you with our products and related services and related transaction information.
• Compliance With Legal Obligation. We are subject to various legal requirements in the jurisdictions in which we operate, and we may use, disclose, and retain your Personal Information if necessary for us to comply with a legal obligation arising under an applicable law to which we are subject.
• Legitimate Interests. We may collect and use your Personal Information to the extent necessary to carry out our legitimate interests (or those of a third party), provided that such interests do not outweigh your interests or fundamental rights and freedoms. For example, we may collect and use your Personal Information in reliance on a legitimate interest in managing our relationship with you; conducting and managing our business; providing you with customer support; conducting market research; developing and enhancing our Services; detecting and preventing fraud and other harmful activities; and monitoring and maintaining the security of our data, systems, and networks.

2. Privacy Rights and Requests

Under applicable law, you may have certain rights in relation to your Personal Information, including:

• Right to Access. You have the right to request access to, or copies (and transmission) of, the Personal Information we hold about you and the purposes for which we are using it.
• Right to Rectify. You have the right to correct inaccurate Personal Information that we have collected from and maintain about you, subject to appropriate verification.
• Right to Erase. You have the right to erase Personal Information pertaining to you, under certain conditions. We will assess any deletion request after verifying your identity and work to respond within one calendar month, and let you know if we need additional time.
• Right to Object. You have the right to object to our processing your Personal Information, under certain conditions.
• Right to Restrict. You have the right to restrict the processing of your Personal Information, under certain conditions.
• Right to Data Portability. You have the right to receive the Personal Information we have collected from you. Under certain conditions, you may request that we transfer your Personal Information to another organization, or directly to you.
• Right to Lodge a Complaint. You have the right to file a complaint with the supervisory authority in your jurisdiction.

At any time, you may request or assert any of the rights above by emailing us at privacy@ooma.com. We will You may have the right to lodge a complaint about our data collection and processing actions with the supervisory authority concerned. Contact details for data protection authorities are available here: http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.

3. Data Privacy Framework: EU, UK and Switzerland

Participation and Commitment. Ooma, Inc. and wholly-owned subsidiaries Broadsmart Global, Inc., Junction Networks Inc., 2600hz, Inc., and Talkatone, LLC (“Certified Parties“) comply with the EU-U.S. Data Privacy Framework (“EU U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Information transferred from the European Union, the UK, and Switzerland to the United States. The Certified Parties adhere to the DPF Principles of Notice; Choice; Accountability for Onward Transfer; Security; Data Integrity and Purpose Limitation; Access; and Recourse, Enforcement, and Liability (“DPF Principles”) to ensure your Personal Information remains protected. If there is any conflict between the terms in this Privacy Policy and the DPF Principles, the Principles shall govern.

To learn more about the Data Privacy Framework (“DPF”) program and to view the Certified Party’s certification, please visit www.dataprivacyframework.gov/.

Data Practices, Onward Transfer and Individual Rights. The Certified Parties collect the Personal Information described in this Privacy Policy. The purposes for collection and disclosures to external parties are also described in this Privacy Policy. The Certified Parties remain liable under the DPF Principles if a third-party agent processes Personal Information on its behalf in a manner inconsistent with the DPF Principles, unless they prove they are not responsible for the event giving rise to the damage.

You have the rights set forth above and the additional rights as described here.

Public Authority Requests. The Certified Parties may be required to disclose Personal Information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Enforcement and Recourse. In compliance with the applicable DPF Principles, the Certified Parties commit to resolve complaints about their collection or use of your Personal Information. The Certified Parties have further committed to cooperate with the panel established by the EU data protection authorities (DPAs) with regard to unresolved complaints concerning data transferred from the EU, with the UK Information Commissioner’s Office with regard to unresolved DPF complaints concerning data transferred from the UK, and with the Swiss Federal Data Protection and Information Commission with regard to unresolved DPF complaints concerning data transferred from Switzerland.

EEA, UK or Swiss individuals with inquiries or complaints regarding the Certified Parties’ DPF policy should first contact the Certified Parties at: privacy@ooma.com.

The U.S. Federal Trade Commission has DPF investigatory and enforcement powers over the Certified Parties.

Binding Arbitration. Under certain conditions, you may invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms.

Supplemental Notice for Residents of Canada

If you are a resident of Canada, you may submit an access or deletion request by contacting us at privacy@ooma.com and including the statement “Canada Privacy Rights” in the subject field of your email. Requests may also be submitted by authorized agents, subject to the requirements of applicable law such as PIPEDA and its substantially similar provincial legislations.

For information about the transfer and storage of your Personal Information outside of Canada, or if you are a resident of Quebec, outside of your province of residence, please see the International Transfers section above.

For any questions or concerns regarding this Privacy Policy, please contact Ooma’s Privacy Officer at privacy@ooma.com, Suite 200, 1250 Homer Street, Vancouver, BC, V6B 1C6. If we do not answer your concern to your satisfaction, you can contact the Office of the Privacy Commissioner of Canada, 30 Victoria Street, Gatineau, Quebec, K1A1H3.