PRIVACY NOTICE.

(a) A controller shall provide consumers with a reasonably accessible and clear privacy notice that includes:

(1) the categories of personal data processed by the controller, including, if applicable, any sensitive data processed by the controller;

(2) the purpose for processing personal data;

(3) how consumers may exercise their consumer rights under Subchapter B, including the process by which a consumer may appeal a controller's decision with regard to the consumer's request;

(4) if applicable, the categories of personal data that the controller shares with third parties;

(5) if applicable, the categories of third parties with whom the controller shares personal data; and

(6) a description of the methods required under Section 541.055 through which consumers can submit requests to exercise their consumer rights under this chapter.

(b) If a controller engages in the sale of personal data that is sensitive data, the controller shall include the following notice:

"NOTICE: We may sell your sensitive personal data." The notice must be posted in the same location and in the same manner as the privacy notice described by Subsection (a).

(c) If a controller engages in the sale of personal data that is biometric data, the controller shall include the following notice:

"NOTICE: We may sell your biometric personal data." The notice must be posted in the same location and in the same manner as the privacy notice described by Subsection (a).