Privacy Policy

Scope of Policy; Verito Business Data vs. Hosted and Managed Client Data

• Cloud Hosting: Data that you store on our servers as part of our cloud hosting services is governed by our Cloud Hosting Terms of Service located at https://verito.com/cloud-terms-of-service.
• Managed IT: Data accessed or processed via our Managed IT services (including local device management) is governed by our Managed IT Service Provider Agreement located at https://verito.com/MIT-terms-of-service.
• WISP and Professional Services: Data provided in connection with our VeritShield WISP services and other professional services is governed by the applicable services agreement.

Except as otherwise stated, this Privacy Policy principally describes personal information that Verito collects or uses for its own business purposes ("Verito Business Data"). For purposes of the California Consumer Privacy Act (CCPA) and similar state privacy laws, regarding data that a Client stores in our hosted environments and data we access or process through our Managed IT services (collectively, "Client Data"), Verito acts as a "Service Provider" (or "Processor"), and you, the customer or other party that has entered into a service agreement with Verito (the "Client"), act as the "Business" (or "Controller"), as applicable, or, where the Client acts as a processor on behalf of another controller, Verito acts as a sub-processor. Verito's processing of Client Data is also governed by our Data Processing Addendum located at https://verito.com/data-processing-agreement/. We do not access, use, or disclose Client Data except as described herein and in the applicable service terms and Data Processing Addendum, as necessary to provide our services to you, or as required by law.

Client Data Not Used to Train AI: Verito does not use Client Data to train artificial intelligence (AI) models, and service providers acting on Verito's behalf are contractually prohibited from doing so. Artificial intelligence tools that a Client procures and uses for itself are addressed in our AI Tools Addendum.

Authorized Access and Use: To provide these services effectively, you acknowledge and agree that our "authorized use" includes:

• International Technical Support: Remote infrastructure maintenance and software troubleshooting performed by affiliates and subsidiaries.
• Anonymized Benchmarking: The creation of aggregated and de-identified industry studies regarding security controls and compliance, excluding tax return information, provided such data cannot identify you, your business, or your individual data subjects and provided we do not attempt to re-identify it.
• Infrastructure Management: Use of infrastructure providers who may have physical access to hardware but lack access to your Client Data.

Client Responsibilities

You represent and warrant that you have obtained all necessary consents and provided all necessary notices to data subjects (including your own clients and employees) regarding the processing of their data by Verito. You are solely responsible for ensuring that your use of our services to store or process personal data complies with applicable laws, including but not limited to the GLBA and COPPA.

This policy applies to information we collect:

• on the Site;
• in email, text, and other electronic messages between you and the Site;
• when you interact with our advertising and applications on third party websites and services, if those applications or advertising include links to the Site;
• by any third party (including our affiliates and subsidiaries), including through any application or content (including advertising) that may link to or be accessible from or on the Site.

If you apply for or are employed by Company, we may also use your information for the following purposes:

• To develop and improve your experience including to generate analytics.
• To process your application, assess your qualifications or to communicate with you about employment.
• To administer pay and other benefits that are a part of your employment package.
• To provide general business management and operation.
• For accounting, financial reporting and business planning.
• To ensure your safety and the security of Company-held information.
• To perform pre-employment background checks where permitted by law.
• To comply with legal and regulatory obligations under applicable law or any other purpose that we disclose to you in the course of providing employment.
• For any purpose as reasonably required by Company in connection with your application for and during the course of your employment.

We may also merge or otherwise combine your information in furtherance of the purposes above.

Purpose of this Privacy Policy

This Privacy Policy aims to give you information on how we collect and process your personal information through your use of the Site, including any data you may provide through the Site when you purchase, access or use any of our products/services.

It is important that you read this Privacy Policy together with any other privacy policy or fair processing policy we may provide on specific occasions when we are collecting or processing personal information about you so that you are fully aware of how and why we are using your data.

Controller

Verito Inc. is the controller, business, or other analogous responsible party for personal information Verito collects or uses for its own business purposes, including Visitor and Account Data and other Verito Business Data. Where it is necessary or appropriate for the purposes for which we hold your information, we may share your relevant information across our affiliated companies. All our affiliated companies covered by this notice manage your personal information in the manner and to the standards set out in this Privacy Policy.

If you have any questions about this Privacy Policy, including any requests to exercise your legal rights, please contact the Data Privacy Manager at the email address below: [email protected]; https://verito.com

Collection of Information

Personal information means any information about an individual from which that person can be identified. It does not include information where the identity has been removed (anonymous data).

We may collect, use, store, and transfer different kinds of personal information about you which we have grouped together as follows:

• Identity Data includes first name, maiden name, last name, username or similar identifier, marital status, title, date of birth and gender.
• Contact Data includes billing address, delivery address, email address and telephone numbers.
• Financial Data includes bank account and payment card details.
• Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us.
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, cookie identifiers, device or similar online identifiers, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access the Site.
• Profile Data includes your username and password, purchases, or orders made by you, your interests, preferences, feedback, and survey responses.
• Usage Data includes information about how you use our Site, products and services, including pages viewed, links clicked, referral sources, browsing activity, and interactions with the Site.
• Marketing and Communications Data includes your preferences in receiving marketing from us, your communication preferences, and information used to identify or communicate with business contacts for sales and marketing purposes.
• Business Operations and Compliance Data includes information you provide during the setup of services such as the Written Information Security Plan (WISP), including details about your business practices, security protocols, and operational structure.
• Managed IT & RMM Data: For clients using our Managed IT services, we may collect technical data via Remote Monitoring and Management (RMM) tools, including device specifications, software installation status, patch levels, and system performance metrics, together with other diagnostic, technical, usage, and related information that our remote access and monitoring software is designed to collect and transmit to us. All or portions of that software may remain installed on a Client's systems after a support incident is resolved.

Note: We access devices and data as reasonably necessary to provide the Services, maintain system health, or as requested by the Client.

We also may collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data could be derived from your personal information but is not considered personal information by law as this data will not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific Site feature. However, if we combine or connect Aggregated Data with your personal information so that it can directly or indirectly identify you, we treat the combined data as personal information which will be used in accordance with this Privacy Policy.

Except as described below in connection with applicants and employees and except for data that a Client stores in or transmits through our hosted or managed environments, we do not collect any Special Categories of Personal Information (Higher Risk Data) about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, genetic and biometric data). We also do not collect information about criminal convictions and offenses except as described below in connection with employment or background screening.

We use different methods to collect data from and about you including through:

Direct Interactions

You may give us your Identity, Contact, Financial, and Business Operations Data by filling in forms or by corresponding with us by postal mail, phone, email or Other Channels. This includes personal information you may provide when you:

• subscribe to our publications;
• request marketing to be sent to you;
• create an account on our Site;
• inquire about or place an order for our products or services (including WISP setup);
• apply for a job on our Site; or
• give us feedback or contact us.

Automated Technologies or Interactions

As you interact with our Site, we will automatically collect Technical and Usage Data about your equipment, browsing actions and patterns. We collect this personal information by using cookies, pixels, web beacons, tags, scripts, server logs, tracking code and other similar technologies. We may also receive Technical, Usage, Contact, or Profile Data from third-party technologies or data providers that associate Site activity with other information they or others maintain about you. See our section on Cookies.

Third Parties or Publicly Available Sources

We may receive personal information about you from various third parties as set out below:

• Technical Data about you from analytics providers or search information providers;
• Contact, Financial, and Transaction Data from providers of technical, payment, and delivery services;
• Data Enrichment Providers: We may verify, supplement, or enrich Contact, Profile, Marketing and Communications, or other business contact information using third-party data providers. Those providers may associate Site activity with business or contact information they or others maintain about you, including an email address or company information that you did not submit directly to us through a form or other direct interaction with the Site.
• Analytics Providers. We may use third-party analytics services, which may include Google Analytics and Microsoft Clarity, to better understand use of our Site and improve it. These services may collect information such as IP address, online identifiers, pages viewed, referral information, and interactions with the Site. We may use or combine information from these services with other information in accordance with this Privacy Policy. The providers may process information as described in their applicable terms and privacy notices.
• To more fully understand how Google may use the data it collects on the Site please review "How Google uses information from sites or apps that use our services" (located here https://policies.google.com/technologies/partner-sites?hl=en-US or any successor URL).
• For more information on Microsoft Clarity's privacy practices, please review the Microsoft Privacy Statement (https://privacy.microsoft.com/en-us/privacystatement).

We collect personal information that you provide directly to us, that we collect automatically, and that we receive from third-party or publicly available sources as described in this Privacy Policy. It is the intent of the Company to use personal information only for the purpose for which it was requested and any additional uses specifically provided on the Site and in accordance with the terms of our Privacy Policy and Website Terms of Use.

It is highly recommended and suggested that you review the privacy policies and statements of any website you choose to use or frequent as a means to better understand the way in which other websites garner, make use of, and share information collected.

Use of Information Collected

We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:

• To process payments for products and services you have purchased from us.
• Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.
• To review applications for employment and requests to set up accounts.
• Performing services including maintaining or servicing accounts, providing customer service, verifying customer information, processing payments, providing advertising or marketing services, or providing analytic services.
• Internal Account-Based Marketing: We may use Business Operations and Compliance Data, Identity, Contact, Technical, Usage, Profile, and Marketing and Communications Data, including information obtained through website visitor identification and data enrichment technologies, to market similar or relevant goods and services offered by Verito and its strategic partners to you. This data may be processed by Verito and service providers acting on our behalf for Verito's own sales and marketing purposes (including by creating or updating records in our customer relationship management (CRM) systems and using those records for sales outreach) and is not sold to third parties for their independent marketing purposes.
• Benchmarking and Industry Studies: We may aggregate and anonymize Business Operations and Compliance Data, excluding tax return information, to create industry benchmarks and studies regarding security controls and compliance. This aggregated data will not identify you or your business, and we do not attempt to re-identify it.
• Debugging to identify and repair errors that impair existing intended functionality.
• Internal research for technological development and demonstration.

Where applicable under data protection laws, we may process your personal information on one or more lawful bases depending on the specific purpose for which we use the data. Please contact us if you need details about the specific lawful basis on which we rely for particular processing. Where consent is required or is the basis for processing, you may withdraw consent as provided by applicable law.

GLBA Safeguards

As a service provider to tax and accounting professionals, we understand the importance of data security. We maintain administrative, technical, and physical safeguards designed to assist you in meeting your obligations under the GLBA Safeguards Rule (16 CFR Part 314). References in this Privacy Policy to frameworks, standards, guidance, or compliance support describe the nature of our services and are not an independent warranty or guarantee of legal or regulatory compliance. Unless the applicable service agreement expressly states otherwise, Verito does not act as your Qualified Individual, compliance certifier, or legal advisor, and you remain responsible for your own written information security program and overall legal compliance.

Promotional Offers from Us

At times, we may find it necessary to use personal information as a means to keep you informed of other possible products and/or services that may be available to you from the Site. We may also be in contact with you with regard to completing surveys and/or research questionnaires related to your opinion of current or potential future products and/or services that may be offered. You may receive marketing communications from us if you have requested information from us or purchased products and/or services from us and you have not opted out of receiving that marketing, if you have opted in to our marketing program, or if we otherwise lawfully obtain your business contact information and are permitted to contact you under applicable law. See our section on Unsubscribe or Opt-Out for more details.

Sweepstakes, Contests, Giveaways, Raffles or Similar Promotions

We may operate sweepstakes, contests, giveaways, raffles and similar promotions through the Site or our affiliates' sites, including with respect to any links or landing pages related thereto that may require online registration by and among us, our affiliates, third parties, or vendors. We typically ask you for certain personal information when you enter and, if applicable, win a sweepstake, contest, giveaway, raffle or similar promotion. We may share this personal information with our affiliates, or other third parties, including, but not limited to, sponsors, co-sponsors, marketing parties, or prize providers of such sweepstakes, contests, giveaways, raffles and promotions (irrespective of whether it is hosted by us), or otherwise in accordance with the rules applicable to such sweepstakes, contests, giveaways, raffles or promotions. You should carefully review the rules of each sweepstake, contest, giveaway, raffle and promotion in which you participate through the Site or our affiliates' sites, as they may contain additional important information about us, or other third parties', including, but not limited to, sponsors', co-sponsors', marketing parties', or prize providers' use of your personal information. Insofar as the terms and conditions of such rules concerning the treatment of your personal information conflict with this Privacy Policy, the terms and conditions of such rules shall control. We are not responsible for the terms and conditions of a third party, including, but not limited to, a sponsor's, co-sponsor's, marketing party's, or prize provider participant's, privacy policy.

Promotional Emails During Sweepstakes, Contests, Giveaways, Raffles or Similar Promotions Registration Process

Through the Company, you can request to receive promotional emails from us. We may also ask if you want to receive such promotional emails from us during sweepstakes, contests, giveaways, raffles or similar promotional registration processes. If you want to receive our promotional emails, you will be asked to provide certain personal information and areas of interest so that we can fulfill your request. If you would like to stop receiving such promotional emails, please see the Unsubscribe or Opt-Out section of this Privacy Policy and the unsubscribe link in any marketing email you receive.

Third Party Marketing

The Company does not sell, rent, or lease customer lists or contact information to third parties for their independent marketing purposes. For purposes of state privacy laws, terms such as "sale" or "sharing" may be defined more broadly than a monetary sale; where applicable, we provide the opt-out rights described below.

Disclosures of Your Personal Information

We may find it beneficial to share specific data with our company group and trusted partners, or our payment processing vendors, in an effort to conduct statistical analysis, provide you with email, text messages and/or postal mail, deliver support, fill orders and/or arrange for deliveries to be made, or otherwise for the purposes set out in the table above. Service providers that process personal information on our behalf are required to process it for specified purposes, subject to applicable contractual and legal requirements. We may share your personal information with Internal Third Parties (as set out in the Glossary) or External Third Parties (as set out in the Glossary).

We may disclose your personal information, without prior notice to you, if we are required to do so under applicable law or if we believe in good faith that disclosure is necessary to:

• Remain in conformance with any decrees, laws, and/or statutes or in an effort to comply with any process which may be served upon us and/or our Site;
• Maintain, safeguard and/or preserve all the rights and/or property of the Company; and
• Act under exigent circumstances to safeguard the personal safety of users of the Site or the general public.

This paragraph does not apply to Client Data, for which the notice and cooperation provisions of our Data Processing Addendum and the applicable service agreement govern.

Infrastructure Providers: We utilize Deft, LLC as a colocation provider for the data center facilities that house our servers. Deft has physical access to the hardware but does not have logical access to your data. We manage these servers remotely.

Sub-processors: We maintain a current list of the sub-processors that process Client Data on our behalf at https://verito.com/trust/. That list is incorporated into our Data Processing Addendum, and we update it before a new sub-processor begins processing Client Data. Providers that process Verito Business Data for website, analytics, CRM, enrichment, or marketing purposes are not necessarily sub-processors for purposes of the Data Processing Addendum.

International Support: We utilize our affiliates and subsidiaries which may be based in the United States or abroad to provide remote infrastructure support and software troubleshooting. Access is limited to what is reasonably necessary to provide the applicable support and services, and technical and administrative controls are in place to prevent unauthorized access to Client Data.

We may also disclose your personal information to third parties to evaluate or conduct a merger, acquisition, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of a bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our Site users/consumers is among the assets transferred. If a change happens to our business, then the new owners may use your personal information in the same way as set out in this Privacy Policy.

We require all third parties to respect the security of your personal information and to treat it in accordance with applicable law. Where a third party acts as our service provider or processor, we require it to process personal information for specified purposes in accordance with our instructions, contractual requirements, and applicable law. Certain third parties may process information for their own purposes as permitted by applicable law and as described in their privacy notices.

Change of Purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

United States Data Residency

We are a business headquartered in the United States that provides services primarily to customers located within the United States. Our primary data storage facilities are located in the United States. Client Data is stored on U.S.-hosted infrastructure; however, authorized personnel, affiliates, or service providers may remotely access or process Client Data from outside the United States as described in this Privacy Policy, the applicable service terms, and our Data Processing Addendum.

If you are visiting our Site from outside the United States, please be aware that your information may be transferred to, stored, and processed in the United States where our servers are located and our central database is operated. By using our services, you understand that your information may be transferred to our facilities and those third parties with whom we share it as described in this Policy.

If You Fail to Provide Personal Information

Where we need to collect personal information by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with products or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

Cookies

Please note that certain information about your computer hardware and software and browsing actions and patterns may be collected by the Company through automatic data collection technologies as you navigate through and interact with our Site. This information is used by us for operation of our Site and our business, analytics, visitor identification, sales and marketing, to maintain quality of the Site and our business, and to provide general statistics regarding use of the Site. The technologies we use for this automatic data collection may include:

• Cookies (or browser cookies). Unless you have adjusted your browser settings so that it will refuse cookies, our systems or our service providers may issue cookies when you direct your browser to our Site. Please review the "Cookies" section and specifically the "Use of Cookies" subsection below for more information on cookies and how you can manage your cookies settings.
• Pixels, Web Beacons, and Similar Technologies. Pages of the Site and our e-mails may contain small electronic files, pixels, tags, scripts, web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs), or similar technologies that permit us or our service providers, for example, to recognize or associate Site activity with a browser or visitor, count users who have visited pages or opened an email, and generate related Site statistics.

Use of Cookies

The Site uses "cookies" to help personalize your online experience. A cookie is a text file that is placed on your hard disk by a web page server. Cookies cannot be used to run programs or deliver viruses to your computer. Cookies are uniquely assigned to you, and can only be read by a web server in the domain that issued the cookie to you.

One of the primary purposes of cookies is to provide a convenience feature to save you time. The purpose of a cookie is to tell the web server that you have returned to a specific page. For example, if you visit certain Site pages, a cookie helps us to recall your specific information on subsequent visits. When you return to the Site, the information you previously provided can be retrieved.

Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. Please see the "Choices About How We Use and Disclose Your Information" section below for more information about managing your computer's settings for cookies.

Third Party Use of Cookies and Other Tracking Technologies

Some content or applications on the Site are served by third parties, including servers, content providers, and application providers. These third parties may use cookies alone or in conjunction with web beacons or other tracking technologies to collect information about you when you use our Site. The information they collect may be associated with your personal information or they may collect information, including personal information, about your online activities over time and across different websites and other online services. When you visit or log in to our Site, cookies and similar technologies may be used by our online data partners or vendors to associate your Site activity with other personal information they or others maintain about you, including by association with your email address. We or service providers on our behalf may then send communications and marketing to those email addresses, subject to applicable law and your opt-out rights. We or service providers on our behalf may use this information for analytics, visitor identification, sales, marketing communications, or other purposes described in this Policy.

Third-party tracking technologies may be governed by the responsible provider's terms and privacy notice. For information about provider-specific privacy choices or opt-out tools, please review the applicable provider's materials and the choices described below. If RB2B is enabled on the Site, you may opt out of receiving this advertising by visiting https://app.retention.com/optout. This provider-specific option is in addition to the other choices described below.

Choices About How We Use and Disclose Your Information

We strive to provide you with choices regarding the personal information we collect, use, or receive. Depending on your browser, device, applicable law, and the technology involved, mechanisms may be available to you that provide control over your information:

• Tracking Technologies and Advertising. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of the Site may become inaccessible or not function properly. For more information about the cookies we use, please see our section on "Cookies."
• Cookie and Consent Preferences. If the Site displays a cookie banner or other consent or preference-management tool, you may use that tool to manage the cookie or tracking choices made available through it. The available choices may vary based on your location and the technologies then in use.
• Promotional Offers from Us. If we have sent you a promotional email, you may click on the unsubscribe link at the bottom of the email to be omitted from future email distributions.
• Do Not Track and Opt-Out Preference Signals: Our Site may not recognize or respond to general browser "Do Not Track" instructions. Certain laws may require recognition of legally recognized opt-out preference signals, such as Global Privacy Control (GPC), for particular processing. Where applicable, we will honor such signals as required by law.

We do not control third parties' collection or use of your information to serve interest-based advertising (the collection of data across web domains owned or operated by different entities, or the use of such data, for the purpose of tailoring advertising based on preferences or interest known or inferred from the data collected). However, these third parties may provide you with ways to choose not to have your information collected or used in this way. You can opt out of receiving targeted ads from members of the Network Advertising Initiative ("NAI") or who follow the Digital Advertising Alliance's Self-Regulatory Principles for Online Behavioral Advertising at the following websites:

• NAI Website (US): https://optout.networkadvertising.org/?c=1
• DAA Website (US): https://optout.aboutads.info/?c=2&lang=EN

Accessing and Correcting Your Information

You may send us an email at [email protected] to request access to, correct, or delete any personal information that you have provided to us. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

Residents of certain states may have additional personal information rights and choices under applicable state privacy laws.

Please see Your State Privacy Rights below for more information.

Your State Privacy Rights

State consumer privacy laws may provide their residents with additional rights regarding our use of their personal information. These rights apply only to the extent provided by applicable law and may be subject to exceptions, verification requirements, and other limitations.

Depending on applicable law, state residents may have rights to:

• Confirm whether we process their personal information.
• Access and delete certain personal information, subject to applicable exceptions.
• Obtain a copy of certain personal information in a portable and, where technically feasible, readily usable format.
• Opt-out of personal information processing for targeted advertising, sale, or sharing.

Depending on applicable law, additional rights may include:

• Correct inaccuracies in their personal information, taking into account the information's natural processing purpose.
• Opt-out of profiling in furtherance of decisions that produce legal or similarly significant effects.
• Limit certain uses or disclosures of sensitive personal information, where applicable.
• Not receive unlawful discriminatory treatment or retaliation for exercising applicable privacy rights.

These rights vary by jurisdiction and may be subject to exceptions and limitations under applicable law. Verification requirements may also apply.

California Privacy Rights

If you are a California resident and the California Consumer Privacy Act (CCPA) applies to the relevant processing, you may have rights to know and access the categories and specific pieces of personal information we collect about you; request correction or deletion; opt out of the sale or sharing of personal information; limit certain uses and disclosures of sensitive personal information; where applicable, exercise certain rights concerning automated decisionmaking technology; and exercise applicable privacy rights without discriminatory treatment. These rights are subject to applicable statutory exceptions and limitations.

For CCPA purposes, "sale" and "sharing" have specific statutory meanings and do not necessarily require a monetary payment. Verito does not sell customer lists or contact information to third parties for their independent marketing purposes, but where our processing constitutes a "sale" or "sharing" under applicable law, we will provide the applicable opt-out rights.

How to Exercise Your Rights

To exercise any of these rights please send an email to [email protected] or to the following mailing address:

Verito Inc.
3524 Silverside rd. Suite 35B, Wilmington, Delaware 19810

If a privacy-preference or cookie-consent tool is active on the Site, you may also use that tool to exercise any privacy choices made available through it.

We may request information reasonably necessary to verify your identity, residency, or authority to make the request. Where permitted by law, an authorized agent may submit a request on your behalf, subject to verification of the agent's authority and your identity as applicable. We may deny or limit a request where permitted by law and will provide any explanation required by applicable law.

Opt-Out Preference Signals

Where applicable law recognizes a universal opt-out preference signal, such as Global Privacy Control (GPC), we will process a valid signal in accordance with applicable law. See "Choices About How We Use and Disclose Your Information" above.

Requests Relating to Client Data

If your request concerns Client Data that Verito processes on behalf of one of our customers as a service provider or processor, the applicable customer is generally responsible for responding to your request as the business or controller. We may direct you to that customer and will assist the customer with the request as required by applicable law and our contractual obligations.

Appeals

Where applicable law provides a right to appeal, you may appeal a decision regarding a consumer rights request by sending an email to [email protected] and stating the reasons with reasonable detail for the appeal. We will respond within the period required by applicable law and provide any additional information required by applicable law.

Children Under the Age of 18

Our Site is not intended for children under eighteen (18) years of age. No one under age eighteen (18) may provide any personal information to or on the Site. The Company does not knowingly collect personal information from children under the age of eighteen (18) without verifiable parental consent. If it is determined that such information has been inadvertently collected on anyone under the age of eighteen (18), we will promptly take the necessary steps to ensure that such information is deleted from our system's database.

Hosted and Managed Client Data: While Verito does not collect data from children, we acknowledge that our Clients (such as Tax and Accounting Professionals) may use our hosting or managed IT services to store data regarding minors (e.g., dependent information on tax returns). In such cases, Verito acts as a Service Provider/Processor. The Client is the responsible Controller for ensuring compliance with applicable laws, including the Children's Online Privacy Protection Act (COPPA), regarding such data.

Unsubscribe or Opt-Out

All users and/or visitors to our Site have the option to discontinue receiving communications from us and/or reserve the right to discontinue receiving communications by way of email, text messages, or newsletters. You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you. If you wish to unsubscribe or opt-out from any third party websites, you must go to that specific website to unsubscribe and/or opt-out.

Where you opt out of receiving these marketing messages, this will not apply to personal information provided to us as a result of a product/service purchase or other transactions.

Links to Other Web Sites

Our Site may contain links to affiliate and other third party websites. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. The Company does not control, claim, nor accept responsibility for any privacy policies, practices, and/or procedures of such other websites. Therefore, we encourage all users and visitors to be aware when they leave our Site to read the privacy statements/policy of each and every website you visit.

Data Security

The Company has put in place appropriate security measures and shall take reasonable precautions to maintain adequate physical, procedural, and technical security with respect to our offices and information storage facilities so as to prevent any loss, misuse, unauthorized access, disclosure, or modification of the user's personal information under our control. In addition, we limit access to your personal information to those employees, agents, contractors, service providers, and other third parties who have a business need to know. Employees, agents, contractors, and service providers that process personal information on our behalf are subject to appropriate confidentiality and data-protection obligations and process it in accordance with their role, our instructions where applicable, and applicable law. Additional information about our security and privacy program, current security controls, and relevant service providers is available at https://verito.com/trust/.

We may use payment processing companies based in the United States who provide credit card processing services.

Data Breach Notification: We have put in place procedures to deal with any suspected personal information breach. In the event of a confirmed Security Incident involving Client Data, Verito will notify the affected Customer without undue delay after confirmation, subject to applicable law and any more specific obligation in the Data Processing Addendum or applicable service agreement. For other personal information, we will provide notifications as required by applicable law. We will also notify any applicable regulator of a breach where we are legally required to do so.

The safety and security of your information also depends on you. If, when and where we may give you (or where you have chosen) a password for access to certain parts of our Site, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. We urge you to be careful about giving out information, to the extent possible, in public areas of the Site. The information you share in public areas may be viewed by any user of the Site.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your personal information, we cannot guarantee the security of your personal information transmitted to our Site. Any transmission of personal information is at your own risk. We are not responsible for circumvention of any privacy settings or security measures contained on the Site.

Data Retention

We will only retain your personal information for as long as reasonably necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting, or other requirements. We may retain your personal information for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

Retention of Inquiry Data: We generally retain data regarding inquiries and prospective clients for a period of twenty-four (24) months of inactivity. After this period, if no business relationship has been established, the data is deleted or anonymized.

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting, or other requirements.

Your Legal Rights

Under certain circumstances and where provided by applicable data protection laws, you may have rights in relation to your personal information. Those rights may include:

• Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal information to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
• Object to processing of your personal information in cases where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal information for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information, which override your rights and freedoms.
• Request restriction of processing of your personal information. This enables you to ask us to suspend the processing of your personal information in the following scenarios: if you want us to establish the data's accuracy; where our use of the data is unlawful but you do not want us to erase it; where you need us to hold the data even if we no longer require it as you need it to establish, exercise, or defend legal claims; you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
• Request the transfer of your personal information to you or to a third party. We will provide to you, or a third party you have chosen, your personal information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information that you initially provided consent for us to use or where we used the information to perform a contract with you.
• Withdraw consent at any time where we are relying on consent to process your personal information. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you wish to exercise any of the rights set out above, please contact us as set forth below in "How to Contact Us."

No Fee Usually Required

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

What We May Need from You

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time Limit to Respond

We try to respond to all legitimate requests within forty-five (45) days. Occasionally it could take us longer than forty-five (45) days if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

Dispute Resolution

Website Terms: Except to the extent an applicable service agreement governs a particular dispute, disputes arising out of or relating to this Privacy Policy are governed by the governing-law, dispute-resolution, arbitration, venue, class-action, and jury-waiver provisions of our Website Terms of Use, which are incorporated by reference.

Changes to this Privacy Policy

We reserve the right to update and/or change the terms of our Privacy Policy, and as such we will post those changes to our Website https://verito.com/privacy-policy, so that our users and/or visitors are always aware of the type of information we collect, how it will be used, and under what circumstances, if any, we may disclose such information. We keep our Privacy Policy under regular review.

Your Duty to Inform Us of Changes

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your relationship with us.

Relationship to Website Terms

Your use of the Site is subject to our Website Terms of Use, which govern contractual assent to use of the Site. This Privacy Policy describes our privacy practices. In the event of a conflict between this Privacy Policy and the Website Terms of Use, the Website Terms of Use control.

How to Contact Us

If you have any questions or concerns regarding this Privacy Policy or our privacy practices, please feel free to contact our Data Privacy Manager at the following email or mailing address:

Email address: [email protected]

Verito Inc.
3524 Silverside rd. Suite 35B, Wilmington, Delaware 19810
Attn: Data Privacy Manager

Glossary

• Legitimate Interest means the interest of our business in conducting and managing our business to enable us to offer and give you the best service/product and the best and most secure experience. We consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal information for our legitimate interests. We do not use your personal information for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.
• Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.
• Comply with a legal obligation means processing your personal information where it is necessary for compliance with a legal obligation that we are subject to.
• Internal Third Parties mean other companies in our company group acting as joint controllers or processors.
• External Third Parties mean:
  • Service providers acting as processors who provide IT and system administration services.
  • Professional advisers including lawyers, bankers, auditors, and insurers based in the United States who provide consultancy, banking, legal, insurance, and accounting services.
  • Marketing, analytics, CRM, data enrichment, and website-technology providers, including public relations specialists, advertisers, and sales-support providers.
  • Payment processing companies based in the United States who provide credit card processing services.