I am trying to be sure we are not "over disclosing". From everything I am reading, it is not necessary to give an initial or annual (we have to do an opt-out) privacy notice to business customers. Am I correct on this and if not, is it any different if the business is a dba?