Amperity Privacy Notice

3. Legal Basis for processing Personal Data (EEA and UK only)

If you are a resident of the EEA or the UK, we are required to explain the legal basis for processing your personal data. Our legal basis for collecting and using the personal data described above will depend on the personal data concerned and the specific context in which we collect it and may include the following:

4. Sharing and Disclosing Personal Data

Service Providers

Like many businesses, we engage other companies to provide certain business-related services to us (“Service Providers”). We may disclose personal data to our Service Providers but only to the extent needed to enable them to provide such services.

Examples of Service Providers that may receive and process personal data on our behalf include companies providing the following services mail services (hard copy and email); hosting services; database management/back-up services; monitoring services; training service provider; customer support and customer relationship management services; accounting services; marketing services; and payment processors.

Service Providers are limited to performing services on our behalf pursuant to contracts which impose restrictions on their use of personal data, including prohibiting them from selling, sharing, using, or disclosing any personal data we share with them for their own marketing purposes or for any other purpose.

Behavioral Advertising

We use identifiers derived from your personal data (i.e., a pseudonymized representation of your email address) for cross-device tracking and cross-contextual advertising purposes. This identifier is disclosed to our advertising providers who use it to serve targeted advertising to devices connected to you via cross-device tracking.

Depending on where you live, this sharing of personal data could be considered a sale. You may opt-out from receiving cross-device advertising by visiting and employing the controls described on NAI’s Consumer Opt Out page (or, if located in the European Union or United Kingdom, clicking here) or by opting-out of any non-essential cookies by managing your Cookie Preferences. You will need to opt-out on each device and browser separately.

Corporate Affiliates

We may share data with our corporate affiliates, that will only use the information as described in this Notice. In particular, we may transfer your personal data to corporate affiliates in a country where adequacy decisions have been issued, or where we have implemented appropriate and suitable safeguards such as the European Commission’s Standard Contractual Clauses for the transfer of your personal data to our U.S. headquarters. In other cases, we will ask you for your prior consent.

Merger, Sale, or Other Asset Transfers

Subject to possible restrictions under applicable local laws and regulations, Amperity may disclose your personal data to a potential or actual acquirer, successor, or assignee as part of any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in bankruptcy or similar proceedings).

In the event of a merger, dissolution or similar corporate event, or the sale of all or substantially all of our assets, we expect that the information that we have collected, including personal data, would be transferred to the surviving entity in a merger or the acquiring entity, including at the negotiation stage. All such transfers shall be subject to our commitments with respect to the privacy and confidentiality of such personal data as set forth in this Notice.

As Required by Law

We may be required to disclose personal data in response to lawful requests by public authorities, including for the purpose of meeting national security or law enforcement requirements. We may also disclose personal data to other third parties when compelled to do so by government authorities or required by law or regulation including, but not limited to, in response to court orders and subpoenas.

Aggregated / De-Identified

We might also share data about our Customers with third parties if the data has been de-identified or aggregated in a way so it cannot be used to identify you.

5. International Transfers of Data

The Services are provided from the United States and other locations, and we may transfer your personal data to multiple countries throughout the world where we or our service providers maintain facilities, including the United States, in accordance with applicable local laws and regulations. We maintain primary data centers in the United States, Canada, and Ireland.

These countries may not have the same level of data protection as the data protection laws in the country where you are located. We take steps designed to ensure that the data we collect under this Notice is processed as described in this Notice and according to applicable law wherever the data is collected.

If you are located in the EEA, UK, Switzerland or other countries which restrict the transfer of personal data, we comply with applicable data protection laws when transferring your personal data outside of these areas. In particular, we may transfer your personal data to countries for which adequacy decisions have been issued; implement appropriate and suitable safeguards such as the European Commission’s Standard Contractual Clauses or the Addendum B.1.0 issued by the Information Commissioner of the UK for the transfer of personal data to our U.S. headquarters, other offices or third parties, where applicable, or where required, we will ask you for your prior consent.

You may contact us in the “How to Contact Us“ section below to obtain a copy of the clauses, relevant data transfer agreements or safeguards we use to transfer personal data outside of these countries/regions.

6. How We Protect Your Personal Data

Amperity implements reasonable and appropriate security measures to protect your personal data from loss, misuse and unauthorized access, disclosure, alteration and destruction, taking into account the risks involved in processing and the nature of such data, and comply with applicable laws and regulations.

Please understand, however, that no security system is impenetrable. We cannot guarantee the security of our databases, nor can we guarantee that the information you supply will not be intercepted while being transmitted to and from us over the Internet. In particular, e-mails sent to or from the Site may not be secure, and you should therefore take special care in deciding what information you send to us via e-mail. In the event that we are required by law to inform you of a breach of your personal data we may notify you electronically, in writing, or by telephone, if permitted to do so by law.

7. Data Retention

We retain your personal data for as long as is necessary to fulfill the purpose(s) for which it was collected, as set forth in this Notice, and to comply with applicable laws. We will erase your personal data when it is no longer necessary for the purpose(s) for which it was collected or otherwise processed; when you withdraw your consent (where lawfulness of processing was based on your consent) and there is no other legal ground for the processing; when you object to the processing and there are no overriding legitimate grounds for the processing; when your personal data has been unlawfully processed; and when it is no longer necessary to comply with legal obligations.

When determining the retention period, we also take into account criteria such as the type of services requested by or provided to you, the nature and length of our relationship with you, possible re-enrollment to use our Site or Services, and the impact on the Site or Services functionality if we delete your personal data. For example, we may retain information for as long as we need it for:

• A legal request or obligation, including obligations of Amperity or to comply with applicable law

• A governmental investigation

• A legal claim, complaint, litigation or regulatory proceedings

8. Your Rights and Choices

Depending on where you live, you may have certain rights regarding the personal data that we collect about you. Please refer to the location in which you reside to learn more about additional terms and rights that may apply to you. Please note that your exercise of rights also depends on your relationship with us. Platform End Users, for example, should exercise their rights through our Customers since our Customers act as the data controller in such instance.

a) EEA and UK residents

If you are an individual residing in the EEA or the UK, you may have the following data protection rights regarding your personal data that we collect as a data controller:

• Right to Know/Access. You have the right to obtain confirmation from us as to whether we are processing your personal data and the right to access and receive a copy of such personal data.

• Right to Delete/Erasure. You have the right to request that we delete or erase your personal data. Please note that if we are processing your personal data on behalf of one of our clients, we will forward your request to that client and await instructions from them on whether your personal data should be deleted.

• Right to Rectify/Correct Inaccurate Information. If we process inaccurate, incomplete, or outdated personal data, you have the right to request that we correct it.

• Right to Data Portability. You have the right to receive the personal data concerning you in a structured, commonly used and machine-readable format, and the right to transmit that data to another company where feasible.

• Right to Object to Processing. You have the right to object to the processing of your personal data in certain situations. For example, where we engage in direct marketing activities such as sending you marketing emails (after obtaining your consent), you may object to receiving further marketing communications from us by clicking on the “unsubscribe” link in the marketing emails we send you. If we process your personal data on the basis of legitimate interests, you may object to our processing based on grounds relating to your particular situation, unless we are able to demonstrate overriding compelling legitimate grounds.

• Right to Restrict Processing. You have the right to restrict our processing of your personal data under certain circumstances (for example, you contest the accuracy of your personal data or when you believe that we are processing your personal data beyond the original purpose).

• Right to Withdraw Consent. If the collection and processing of your personal data is based on your consent, you have the right to withdraw your consent at any time for future processing. Please note that withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal.

• Right to Lodge a Complaint. You have the right to complain to a data protection authority about our collection and use of your personal data. For more information, please contact your local supervisory authority. Contact details for supervisory authorities in Europe, including the UK, can be found here.

Please note that the rights described above are not absolute, and where an exception under applicable law applies, we may be entitled to refuse requests in whole or in part.

b) U.S. residents

If you reside in a U.S. state which has a data privacy law currently in effect, then this U.S. section applies to you. Please refer to the state in which you reside to learn more about additional terms and rights that may apply to you.

California

The California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"), requires us to provide California consumers with some additional information regarding how we collect, use, and disclose your personal information, and the rights available to California consumers under the CCPA. The terms used in this section have the same meaning as in the CCPA.

Additional Disclosures for California residents - Information Collection, Purpose, and Disclosure

In the preceding twelve (12) months, we have collected categories of personal data from the sources as discussed in Section 1 “Personal Data We Collect and How We Collect It.” The business or commercial purpose for collecting that information is disclosed in Section 2 “How We Use Your Information.”

In the preceding twelve (12) months, we have disclosed your personal data for a business or commercial purpose described in Section 2 “How We Use Your Information” to the following categories of third parties:

In the preceding twelve (12) months, we have sold or shared your personal data for a business or commercial purpose to the following categories of third parties:

California Privacy Rights

If you are a California resident, you may have the following rights under the CCPA, subject to certain limitations and exceptions under applicable law:

Know and Access. You have the right to request to know and access the following information covering the 12 months preceding your request:

the categories of personal information we have collected about you;

the categories of sources from which your personal information was collected;

the business or commercial purposes for collecting, "selling" and/or "sharing" your personal information;

the categories of third parties to whom we have disclosed, "sold" or "shared" personal information about you; and

the specific pieces of personal information we have collected about you.

Data Portability. You have the right to receive your personal information in a portable and commonly used format.

Correct. You have the right to request that we correct any of your personal information that we have collected from you that is inaccurate.

Delete. You have the right to request that we delete certain personal information we have collected from you.

Opt-Out of the Sale or Sharing of your Personal Information. We do not sell personal information as the term "sell" is traditionally understood (i.e. for money). However, we do share your personal information with third parties through cookies and other similar technologies for the purpose of displaying more relevant advertisements to you if you instruct us to do so, which could be considered a "sale" or "share" of your personal information under the CCPA. You can exercise your right to opt-out of such "selling" or "sharing" of your personal information by adjusting your cookie choices in our cookie banner or via our Cookie Declaration. Alternatively, if you enable an opt-out preference signal in your browser or extension (e.g., Global Privacy Control), you will automatically be opted out of the "sale" or "sharing" of your personal information. However, please note that you may be asked to confirm your opt-out preference if you have previously consented to the "sale" or "sharing" of your personal information.

Limit the Use and Disclosure of Your Sensitive Personal Information. We do not collect, use or disclose any sensitive personal information for the purpose of inferring characteristics about you. As such, we do not offer an ability to limit the use and disclosure of sensitive personal information.

Non-Discrimination. You have the right to not be discriminated against for exercising any of your CCPA rights.

Please note that the rights described above are not absolute, and where an exception under applicable law applies, we may be entitled to refuse requests in whole or in part.

Identify Verification

As required by California law, we may require you to prove your identity in order to exercise any of the above rights. We may verify your identity by phone call or email. Depending on your request, we will ask for personal information such as your name, your telephone number, email address, and/or date of last communication with Amperity. We may also ask you to provide a signed declaration confirming your identity.

Authorized agent

In California, an authorized agent may submit a rights request on your behalf. We will require verification that you provided the authorized agent permission to make a request on your behalf. You must provide us with a copy of the signed permission you have given to the authorized agent to submit the request on your behalf and verify your own identity directly with us. We will only use the information provided for verification to confirm the requestor’s identity or authority to make the request, and for our compliance records. If you are an authorized agent submitting a request on behalf of an individual, you must attach a copy of the following information to the request:

A completed Authorized Agent Designation Form indicating that you have authorization to act on the consumer’s behalf.

If you are a business, proof that you are registered with the Secretary of State to conduct business in California.

If we do not receive both pieces of information, the request will be denied.

To exercise your privacy rights, please refer to our contact details in the "How to Contact Us" section below. We endeavor to respond to a verifiable request within forty-five (45) days of its receipt. If we require more time, we will inform you of the reason and extension period (up to a total of 90 days) in writing.

Additional U.S. States

This section applies to residents of certain U.S. states which also have an applicable data privacy law currently in effect, including but not limited to: Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia. Depending on your U.S. state of residency, you may have the following privacy rights (as and to the extent applicable):

Know and Access. You have the right to request to know and access the personal data that we have collected about you.

Data Portability. You have the right to obtain your personal data in a portable and readily usable format.

Correct. You have the right to request that we correct inaccuracies in the personal data we have collected about you.

Delete. You have the right to request that we delete personal data provided by you or obtained about you.

Opt-out of Data Processing for purposes of Targeted Advertising; Sales to Third Parties; and Profiling. As described in the California section above, we do not sell personal information to third parties for money, nor for the purpose of profiling in connection with decisions that produce legal or similarly significant effects. However, we do process personal data for the purpose of displaying targeted or interest-based advertisements that are more relevant to you, if you instruct us to do so. You have the right to opt out of the processing of personal data for targeted advertising purposes at any time by adjusting your cookie choices in our cookie banner or via our Cookie Declaration. Alternatively, if you enable an opt-out preference signal in your browser or extension (e.g., Global Privacy Control), you will automatically be opted out of the "sale" of your personal data. However, please note that you may be asked to confirm your opt-out preference if you have previously consented to the "sale" of your personal data.

Appeal. In instances where we are not able to honor your privacy rights request, you have the right to appeal our decision to not take action on your request. You may appeal our decision to not take action on your request by emailing us at privacy@amperity.com. In the email subject line please include (a) your state of residence and (b) the words “Appealing Rights Decision”. In the email body please provide an explanation of the basis of your appeal. You must send your request to appeal within 45 days after we send you our original decision. We will endeavor to respond to your appeal within 60 days of such an appeal, including a written explanation of the reasons for the decision, and any action taken or not taken in response to the appeal.

Non-Discrimination. You have the right to not be discriminated against for exercising any of your privacy rights.

Please note that the rights listed above only apply to residents of U.S. states which have an applicable data privacy law currently in effect and who are acting in an individual or household context only. They do not apply to residents acting in a commercial or employment context.

If you reside in a U.S. state which has an applicable data privacy law currently in effect, and wish to submit a rights request, please refer to the "How to Contact Us" section below, and please also note the information provided in the "Identity Verification" section above. If your state allows an authorized agent to submit a rights request on your behalf, please also note the information provided in the "Authorized agent" section above. We will respond to verifiable requests received as required by applicable law.

9. Children

This Site is not directed towards children. We do not knowingly collect personal data from children under the age of 16 through the Site and/or the Services. If you are under 16, please do not give us any personal data. We encourage parents and legal guardians to monitor their children’s Internet usage and to help enforce our Privacy Notice by instructing their children to never provide personal data through the Site without their permission. If you have reason to believe that a child under the age of 16 has provided personal data to us, please contact us, and we will endeavor to delete that information from our databases.