Privacy Policy
EightPay Inc.

Our services provide financial infrastructure for the internet, allowing individuals to enable their purchases and businesses of all sizes to accept payments, send payouts, and manage their businesses online. EightPay Inc. values the trust placed in us by our users and wants to be transparent about our use of the Personal Data that is entrusted to us.

To that end, this Privacy Policy (“Policy”) outlines the “Personal Data” that we collect about you, how we use it, how we share it, your rights and choices, and how to contact us about our privacy practices. This Policy also explains your data subject rights, including the right to object to certain uses of your Personal Data by us.

For the purposes of this Policy, “EightPay Inc.”, “we”, “our” or “us” refers to the EightPay Inc. entity responsible for the collection and use of Personal Data.

“Personal Data” refers to any information that relates to an identified or identifiable individual, including information that you provide to us or that we collect about you when you engage with our Services (e.g. device information, IP address).

“Services” encompass the products and services that EightPay Inc. identifies as being covered by this Policy, including EightPay Inc.-provided devices and apps. “Business Services” refer to the Services provided by EightPay Inc. to entities (“Business Users”) who provide us with “End Customer” Personal Data in connection with their own business activities. “End User Services” refer to the Services that EightPay Inc. provides directly to individuals for their personal use.

“Sites” refer to EightPay Inc..cash and the other websites, apps, and online services covered by this Policy. Collectively, Sites, Business Services, and End User Services are referred to as “Services”.

Depending on the context, “you” may refer to the End Customer, End User, Representative, or Visitor:

When you directly use an End User Service for personal use (e.g. when you sign up for Link, or make a payment to EightPay Inc. Climate), we refer to you as an “End User”.
When you do business with or transact with a Business User (e.g. when you buy a product from a merchant that uses EightPay Inc. Checkout for payment processing), but are not directly doing business with EightPay Inc., we refer to you as an “End Customer”.
When you act on behalf of an existing or potential Business User (e.g. if you are a founder of a company, administer an account for a merchant who is a Business User, or receive an employee credit card from a Business User using EightPay Inc. Issuing), we refer to you as a “Representative”.
When you visit a Site without being logged into a EightPay Inc. account or otherwise communicate with EightPay Inc., we refer to you as a “Visitor” (e.g. you send EightPay Inc. a message asking for more information because you are considering being a user of our products).

Depending on whether you are an End User, End Customer, Representative, or Visitor, our collection and use of Personal Data varies. For instance, if you are the sole proprietor of a business, we may collect Personal Data to onboard your business. However, you may also be an End Customer who purchased goods from another Business User that uses EightPay Inc.’s Services for payment processing, or an End User who uses Link to make those purchases.

In this Privacy Policy, "Transaction Data" includes Personal Data, such as your name, email address, billing address, shipping address, payment method information (such as credit or debit card number, bank account information, or payment card image selected by you), merchant and location, purchase amount, date of purchase, and in some cases, information about what you have purchased and your phone number and past purchases.

1.1 End Users
We offer End User Services directly to you for personal use (e.g., Link). When you use Link or connect your bank account, you allow us to store your payment methods so that you can easily use them across merchants who are our Business Users. We collect Personal Data, such as your name, contact information, payment method details (e.g., card number, CVC, and expiration date), and Transaction Data related to your transactions when you choose to pay with Link.

If you share bank account information with us, we periodically collect and process your account information, such as bank account owner information, account balances, account number and details, account transactions, and credentials. We share this Personal Data with Business Users that you choose only with your separate permission. You may ask us to stop collecting and sharing this information. We also share contact information, such as shipping address, billing address, and phone number, with Business Users that you do business with, but only with your separate permission.

When you buy goods or services directly from EightPay Inc., we receive Transaction Data, such as contact information, payment method information, and information about that transaction. We also provide an identity verification service that compares an identity document with your image (e.g., selfie). You may choose to opt-in to store that verification for future use across other merchants, and separately consent to letting us use your biometric data to improve our verification technology. You can also ask us to stop providing you these services.

We use your Personal Data to provide the End User Service to you, including security, sanctions screening, delivery, support, personalization (e.g., language preferences and settings choices), and messages related to the End User Service (e.g., communicating Policy updates and information about our Services). We also use your Personal Data to assess whether your use of Link to make a payment with a merchant is authorized by you (and not a bad actor) and likely to be successfully authorized by the payment method you choose to use when you choose to make purchases with Link.

When you choose to connect your financial account with EightPay Inc., you may choose to share account information with Business Users that you do business with. These Business Users will have their own privacy policies that describe how they use that information. For payment transactions with Link, we share your End User Personal Data with others to enable or "process" the transaction. We use your Personal Data collected across our Services (e.g., EightPay Inc. Radar) to detect fraud and prevent financial losses for you, us, and our Business Users and financial partners, including to detect unauthorized purchases. We may use your Personal Data to assess your eligibility for, and offer you, other End User Services or promote existing End User Services. We do not sell or share End User Personal Data with third parties for marketing or advertising their products without your separate consent.

1.2 End Customers

EightPay Inc. provides Business Services to our Business Clients. (e.g. payment processing through in-person or online checkout, or processing pay-outs for those Business Users). When we act as a Business User's service provider (also known as a data processor), we will process Personal Data in accordance with our agreement with the Business User and the Business User's lawful instructions (for example, when we process a payment for a Business User because you purchased a product from them) or they instruct us to send funds to you.

a. Collection of Personal Data from End Customers by EightPay Inc.
When End Customers engage in payment transactions or other activities with Business Users who utilize EightPay Inc.'s payment processing services, EightPay Inc. collects Transaction Data. This may include information such as payment amounts, refunds, purchases, donations, and transaction histories with the Business User. EightPay Inc. may also obtain incomplete checkout form information even if the transaction is not completed.

EightPay Inc. provides verification and fraud prevention services to Business Users, which involves collecting Identity/Verification Information from End Customers. This may include Personal Data such as government IDs, selfies, and payment method information for age verification or authorization purposes. To prevent fraudulent activities, EightPay Inc. may compare this information with data collected from Business Users, financial and identity verification partners, publicly available sources, and third-party service providers. This helps EightPay Inc. to evaluate whether the person engaging in the transaction is the actual End Customer or someone impersonating them.

b. Our use and sharing of Personal Data of End Customers

To provide our Business Services to Business Users, we require Personal Data from End Customers, and we share such data with the Business User. We also use End Customers’ Personal Data for EightPay Inc.’s own purposes, where allowed by law, to enhance, secure and provide our Business Services and to prevent fraud, loss, and other harms as explained below.

Payments and Accounting. We use your Transaction Data to facilitate our Payments related Business Services to Business Users. This includes processing online payment transactions, computing sales tax, invoicing and billing, helping them calculate their revenue, pay their bills, and perform accounting tasks. Moreover, we may also use Personal Data to enhance and improve our Business Services.

When you make a payment transaction, your Personal Data is shared with various parties as part of the transaction. We act as a service provider or processor, and we share Personal Data with other parties to enable the transaction. For instance, if you opt to use a payment method for the transaction (such as credit card, debit card, buy now pay later, or direct debit), the payment method will receive the Transaction Data that contains your Personal Data. Please refer to your payment method’s privacy policy to learn more about how they handle and share your data.

The merchant you do business with will also obtain Transaction Data that includes your Personal Data, and the merchant may share that data with others. Please consult your merchant’s privacy policy to learn more.

To allow our Business Users to offer financial services, we may receive and use your Personal Data when you use cards provided by EightPay Inc. or its financial partners. These cards may bear the EightPay Inc. brand or the brand of our Business Users or bank partners. We will also use your Personal Data to verify your identity, reduce fraud, and enhance security. If you provide a "selfie" and an image of your identity document, we will use technology to verify your identity. We use the Personal Data we collect across our Services to detect and prevent losses for you, us, our Business Users, and financial partners. We may provide our Business Users with Personal Data about you, including your attempted transactions, to help them assess the fraud or loss risk associated with a transaction.

We share Personal Data of End Customers with their respective Business Users and parties authorized by those Business Users to receive Personal Data. This includes when a Business User authorizes a third party application provider to access their EightPay Inc. account using EightPay Inc. Connect. For instance, when Identity Services are used to verify an End Customer's identity, EightPay Inc. shares the information provided by the End Customer with the Business User. The Business Users may further share your Personal Data with third parties they authorize. Please refer to their privacy policy to learn more.

If you begin a purchase, we share your Personal Data with the Business User and they may use it for marketing and advertising purposes, subject to their privacy policy. You can refer to their privacy policy to know about your rights to stop the use of your Personal Data for marketing purposes. We do not use, sell or share End Customer Personal Data for our marketing or advertising, or for marketing and advertising by third parties who are not the Business User you have transacted or attempted to transact with.

1.3 Representatives

To provide Business Services, we collect, use and share Personal Information from Representatives of Business Users (e.g. a business owner).
a. Personal Data that we collect about Representatives

Registration and Contact Information. When you create a EightPay Inc. account for a Business User, we gather your name and login credentials. If you register for a EightPay Inc. event or sign up for EightPay Inc. communications, we collect your registration and profile information. If you are a Representative or Representative of a potential Business User, we receive your Personal Data from third parties to advertise, market and communicate with you, and we may associate your location with you to determine which Services or information would be relevant. For more details, please refer to Section 2.

Identification Information. If you own a Business User or are expected to hold shares, an officer or director position in a Business User, we will need your contact details such as your name, postal address, telephone number, and email address to comply with our financial partner and regulatory requirements. We collect Personal Data about you such as your ownership interest in the Business User, your birth date, and government identifiers related to you and the Business User, like your social security number, tax number, or Employer Identification Number. Additionally, you may opt to provide your bank account information.

b. How we use and share Personal Data of Representatives

Business Services: In order to provide the Services requested by you or the Business User you are associated with, we may use and share your Personal Data with the Business User. For instance, for tax Business Services, we may use your Personal Data to file taxes on behalf of the Business User. Similarly, for our Atlas business incorporation services, we may use your Personal Data to file documents with government authorities on your behalf.

We may also share your Personal Data with parties authorized by the Business User to receive such information. For example, payment method providers such as Visa and WeChat Pay require merchant onboarding information for Business Users that accept their payment methods. EightPay Inc. will provide the necessary information, including the Personal Data of Representatives, to such financial partners. These payment method providers may be located outside your home country, such as WCP, AliPay, Block, Klarna Bank AB. The use of your Personal Data by authorized third parties is governed by their own privacy policies.

If you have chosen a company name that includes Personal Data, such as a sole proprietorship or a family name, we will use and share that information as any company name would be used in connection with the provision of our Services.

Advertising: We may use and share your Personal Data with others to advertise and market our Services to you, where allowed by applicable law. We may use interest-based advertising and emails and measure the effectiveness of our ads. However, we do not sell or share your Personal Data with others for their advertising purposes. Please see our Cookie Policy for more information.


1.4 Visitors

We collect, use and share Personal Data of Visitors (who are not End Users, End Customers or Representatives).

a. Visitor Personal Data that we collect

Upon visiting our Sites, your Personal Data may be obtained through your submission or our use of cookies and related technologies.

If you complete a form found on the Site or on third-party websites featuring our advertising (such as LinkedIn or Facebook), we collect the information provided in the form, such as your contact information and any details related to your inquiries regarding our Services. We may also assign a location to your visit.

b. How we use and share visitor Personal Data

Personalization: The information we collect from cookies and similar technologies is used to personalize your experience on our Sites, improve navigation, and make content about EightPay Inc. and our Services more relevant to you. This includes tailoring our responses to your region, as some of our Services may not be available in all areas.

Advertising: We may use and share Visitor Personal Data with others to advertise and market our Services to you, in accordance with applicable law and consent requirements. This includes interest-based advertising and email campaigns, with the aim of measuring the effectiveness of our ads. Please see our Cookie Policy for more information. We do not sell or share Visitor Personal Data to others for their advertising purposes.

Engagement: When visitors interact with our EightPay Inc..com site, we may use the information we collect from your devices to provide opportunities for you to engage in conversations or chat with chatbots, in order to address your questions.

In addition to the ways we collect, use and share Personal Data that are described above, we also process your Personal Data as follows:

a. Personal Data Collection

The information we gather depends on the Service you use and how Business Users implement our Business Services. We may collect information about devices and browsers used on our Sites and Third-Party Sites, as well as usage data associated with those devices and browsers, such as IP address, language, time spent on the Sites and Third-Party Sites, pages visited, links clicked, payment methods used, and referral sources. We may also use activity indicators, such as mouse activity, to detect fraud. Please refer to our Cookie Policy for more information. We may also collect information you provide to us through various channels, such as support tickets, emails, or social media. When you respond to our emails or surveys, we collect your name, email address, and any other information you choose to include. If you call us, we collect your phone number and any other information you provide during the call. We also collect engagement data, such as your attendance or registration for EightPay Inc. events and any interaction with EightPay Inc. personnel. Finally, if you post content on our Sites, we will collect any Personal Data that you provide.

b. Personal Data Usage

In addition to the Personal Data usage described above, we use Personal Data in the following ways:

Enhancing and Developing Services: We utilize analytics on our Sites to examine your usage of our Sites and Services, as well as troubleshoot any technical problems. If you want to know more about cookies that may be served through our Sites and how you can control our use of cookies and third-party analytics, please refer to our Cookie Policy. We also gather and process Personal Data via our different Services to enhance our Services, create new Services, and support our initiatives to make our Services more relevant and valuable to you. For additional information, see our resources.

Communication: We will use the contact information we have about you to provide the Services, which may entail sending codes via SMS to authenticate you. If you are an End User, Representative, or Visitor, we may communicate with you via the contact information we have about you (e.g. using email, phone, text message, or videoconference) to offer details about our Services and our affiliates' services, invite you to participate in our events or surveys, or otherwise interact with you for our marketing objectives, as long as we do so in compliance with relevant laws, including any consent or opt-out conditions. For instance, we may use the information you submit to us when you provide your contact information or when we collect your business contact information at trade shows or other events to follow up with you regarding an event, send you information you requested about our products and services, and include you in our marketing campaigns.

Social Media and Promotions: If you decide to provide us with Personal Data to participate in an offer, program, or promotion, we will utilize the Personal Data you provide to administer the offer, program, or promotion. We will also use that Personal Data and the Personal Data you make available on social media to market to you unless we are prohibited from doing so.

Preventing Fraud and Ensuring Security: Our Services collect and utilize Personal Data to help us detect and manage fraudulent and malicious activity across our platform, enabling our fraud detection Business Services and securing our Services and transactions against unauthorized access, use, modification, or misappropriation of Personal Data, information, and funds. To prevent and monitor fraud and security compliance, we receive information from service providers, third parties, and our own Services. In some cases, we collect Personal Data from Business Users, financial parties, and third parties. For instance, we may receive information from third parties about compromised IP addresses to protect our Services. This Personal Data helps us confirm identities, perform credit checks in accordance with applicable laws, and prevent fraudulent activity. We may also employ technology to assess the risk of fraud associated with attempted transactions by End Customers or End Users with Business Users or financial partners.

Compliance with Legal Obligations: We utilize Personal Data to meet our contractual and legal obligations related to anti-money laundering, KYC laws, anti-terrorism, export control, and other legal requirements. Our goal is to provide secure and compliant Services, and the collection and use of Personal Data is crucial to this effort. For example, we monitor payment transaction patterns and other online signals to minimize the risk of fraud, money laundering, and other harmful activity to EightPay Inc., our End Users, and their End Customers.

Protection of Minors: Our Services are not intended for minors, including children under the age of 13, and we request that they do not provide Personal Data through our platform. In certain countries, we may impose higher age limits as required by applicable laws.

c. Personal Data Sharing.

In addition to the ways described above, we share Personal Data in the following ways:

We may share your Personal Data with other EightPay Inc. affiliated entities for purposes outlined in this Policy.

To provide the Services to our Business Users and End Users, as well as to communicate, market, and advertise to Visitors, Representatives, and End Users regarding our Services, we rely on service providers or processors. These service providers offer critical services such as hosting, analytics, customer service, and auditing. We authorize these service providers to access and use the Personal Data we make available to them for providing the services we require, and to comply with applicable legal requirements. We require our service providers to contractually commit to protect the security and confidentiality of the Personal Data they process on our behalf. Most of our service providers are located in the European Union, the United States of America, and India.

We also share Personal Data with Financial Partners, which are financial institutions we partner with to offer the Services. We share certain Personal Data of Representatives with institutional investors who purchase or provide credit secured by the Capital loans that we have made to the associated Business Users.

In some cases, we may refer you to third parties to obtain services. In such cases, we will disclose the identity of the third party and the information that will be shared with them and seek your consent to share the information.

If we undergo a transaction that alters the structure of our business, such as a reorganization, merger, sale, joint venture, assignment, transfer, change of control, or other disposition of all or any portion of our business, assets, or stock, we may share Personal Data with third parties in connection with such transaction. Any other entity that acquires us or part of our business will have the right to continue using your Personal Data, but subject to the terms of this Policy.

Finally, we may share your Personal Data as we believe necessary to comply with applicable law, to enforce our contractual rights, to secure or protect the Services, rights, privacy, safety, and property of EightPay Inc., you or others, and to respond to valid legal process requests from courts, law enforcement agencies, regulatory agencies, and other public and government authorities, which may include authorities outside your country of residence.

For the purposes of the General Data Protection Regulation, we rely upon a number of legal bases to enable our processing of your Personal Data.

a. Contractual and Pre-Contractual Business Relationships.

We process Personal Data for the purpose of entering into business relationships with prospective Business Users and End Users and to perform the respective contractual obligations with them. Activities include:

• Creation and management of EightPay Inc. accounts and EightPay Inc. account credentials, including the evaluation of applications to commence or expand the use of our Services;
• Creation and management of EightPay Inc. Checkout accounts;
• Accounting, auditing, and billing activities;
• Processing of payments, including fraud detection, loss prevention, optimizing valid transactions, communications regarding such payments, and related customer service.

b. Legal Compliance.

We process Personal Data in order to comply with fraud monitoring, prevention, and detection obligations, laws related to the identification and reporting of illegal and illicit activity, such as "Anti-Money Laundering ("AML") and Know-Your-Customer ("KYC")" obligations, and financial reporting obligations. For example, we may be compelled to record and verify a User's identification in order to comply with regulations aimed at preventing money laundering and other financial crimes. These requirements are imposed by law and may compel us to disclose our compliance to third parties and submit to third-party verification audits.

c. Legitimate Interests.

We process Personal Data based on our legitimate business interests, where allowed under applicable law. The following is a list of business purposes for which we have a legitimate interest in processing your data:

• Detect, monitor, and prevent fraudulent and unauthorized payment transactions.
• Reduce financial loss, claims, liabilities, or other harm to our customers, users, and EightPay Inc..
• Determine eligibility for and offer new EightPay Inc. products and services.
• Respond to inquiries, send service notices, and provide customer support.
• Promote, analyze, modify, and improve our Services, systems, and tools, and develop new products and services.
• Manage, operate, and improve the performance of our Sites and Services by understanding their effectiveness and optimizing our digital assets.
• Analyze and advertise our Services, and related improvements.
• Conduct aggregate analysis and develop business intelligence that enable us to operate, protect, make informed decisions, and report on the performance of our business.
• Share Personal Data with third-party service providers and business partners that help us operate and improve our business.
• Enable network and information security throughout EightPay Inc. and our Services.
• Share Personal Data among our affiliates.

d. Consent.

We may rely on consent to collect and use Personal Data in order to communicate with you and provide our Services such as Link, Financial Connections, Atlas, and Identity. When we process data with your consent, you have the right to withdraw your consent at any time without impacting the lawfulness of the processing prior to the withdrawal.

You may have choices regarding our collection, use and disclosure of your Personal Data:

a. Opting out of receiving electronic communications from us

If you no longer wish to receive marketing communications from us, you may unsubscribe using the unsubscribe link included in such emails. We will endeavor to accommodate your request(s) as quickly as possible. Please keep in mind that even if you choose not to receive marketing-related emails from us, (i) we retain the right to communicate with you about the services you receive (e.g., support and important legal notices), and (ii) our Business Users may still send you messages and/or direct us to send you messages on their behalf.

b. Your data protection rights

In accordance with applicable law, depending on your location, you may have certain rights related to the Personal Data that EightPay Inc. holds about you. These rights are as follows:

• The right to request confirmation of whether EightPay Inc. processes your Personal Data and obtain a copy of that data if it is being processed;
• The right to request that EightPay Inc. correct any inaccurate, incomplete, or outdated Personal Data;
• The right to request that EightPay Inc. delete your Personal Data in certain circumstances as provided by law;
• The right to request that EightPay Inc. limit the use of your Personal Data in certain circumstances while EightPay Inc. considers another request that you have submitted;
• The right to request that EightPay Inc. transfer your Personal Data to another company where technically feasible;
• If your Personal Data is processed based on your consent, the right to withdraw your consent at any time;
• If EightPay Inc. processes your Personal Data based on legitimate interests, the right to object to the processing of your data. EightPay Inc. will stop processing your data unless there are compelling legitimate grounds or legal reasons for the processing;
• The right not to be discriminated against for exercising these rights; and/or
• The right to appeal any decision by EightPay Inc. relating to these rights.

Please note that you may have additional rights regarding your Personal Data under applicable law, and you can refer to the jurisdiction-specific provisions section below for more information, especially if you are in California.

We take reasonable measures to safeguard the security of your Personal Data, appropriate to the level of risk associated with its processing. We maintain administrative, technical, and organizational controls to prevent unauthorized access, destruction, loss, alteration, or misuse of the Personal Data governed by this Policy. However, please note that no data transmission or storage system can be completely secure.

To assist us in protecting your Personal Data, we recommend that you use a strong password, secure it against unauthorized use, and avoid using the same login credentials (such as password) for EightPay Inc. accounts and other services or accounts. If you suspect that your interactions with us are no longer secure (for example, if you believe that the security of your EightPay Inc. account has been compromised), please contact us immediately. You can find more information here.

We retain your Personal Data as long as we are providing Services to you or our Business Users (as applicable), or as long as we reasonably anticipate providing the Services. Even after we stop directly providing Services to you or a Business User you transacted with, or even if you close your EightPay Inc. account or complete a transaction with a Business User, we may keep your Personal Data for:

• compliance with our legal and regulatory obligations,
• conducting fraud monitoring, detection, and loss prevention activities,
• fulfillment of our tax, accounting, and financial reporting obligations,
• meeting our contractual commitments to our financial partners (and where data retention is required by the payment methods you used), and
• compliance with any limitation periods and records retention obligations under applicable law. You can find more information here.

As a global company, we may transfer your Personal Data to countries other than your own, including to the United States, where data protection regulations may differ from those in your country. To ensure compliance with relevant data protection laws, we take steps when transferring data across borders. In some situations, we may be obligated to disclose Personal Data in response to lawful requests from officials, such as law enforcement or security authorities.

• If applicable law requires a data transfer mechanism, we utilize one of the following: transfers to specific countries or recipients that have been recognized as providing an adequate level of protection for Personal Data under applicable law, EU Standard Contractual Clauses approved by the European Commission and the UK International Data Transfer Addendum issued by the Information Commissioner’s Office, or other legal methods available to us under applicable law. While EightPay Inc., Inc. previously relied on the E.U.-U.S. Privacy Shield and the Swiss-U.S. Privacy Shield frameworks for the transfer of Personal Data to the United States, we are currently not relying on these frameworks.

We reserve the right to modify this Policy at any time to reflect new services, changes in our privacy practices, or changes in applicable legislation. The notation "Last updated" at the top of this Policy shows when it was last altered. Any modifications become effective when we post the amended Policy on the Services or provide notice of the update as required by law.

• We may send you disclosures and notifications about the Policy or Personal Data gathered by posting them on our website and, if you are an End User or Representative, by contacting you via your EightPay Inc. Dashboard, email address, and/or physical address provided in your EightPay Inc. account.

If you are an Australian resident and are dissatisfied with our handling of any complaints related to this Policy, you may want to reach out to the Office of the Australian Information Commissioner. For Brazilian residents, who are subject to Lei Geral de Proteção de Dados Pessoais (LGPD), you have rights under Article 18 of LGPD, and you can contact our DPO to exercise those rights. For Canada, the term "applicable law" in this Policy includes the Federal Personal Information Protection and Electronic Documents Act (PIPEDA), and "Personal Data" includes "personal information" as defined under PIPEDA. If you are a resident of the EEA or UK, you can contact our DPO to exercise your rights. In addition, if you believe that our processing of your information is not in line with GDPR, you can direct your questions or complaints to the Irish Data Protection Commission if EightPay Inc. Payments Europe Limited is your data controller. Alternatively, if you are a resident of the UK, you can direct your concerns to the UK Information Commissioner's Office. For Indian residents, if you have any questions or complaints regarding the processing of your Personal Data in India, please contact our Nodal and Grievance Officer. In Indonesia, "applicable law" in this Policy includes Law No. 11 of 2008 as amended by Law No. 19 of 2016 on Electronic Information and Transactions, Government Regulation No. 71 of 2019 on the Implementation of Electronic Systems and Transactions, and Minister of Communication and Informatics Regulation No. 20 of 2016 on Personal Data Protection in Electronic Systems, and "Personal Data" includes "personal data" as defined under those laws.

When we transfer Personal Data of data subjects in Japan to jurisdictions that are not recognized as "adequate" by the Personal Information Protection Commission, we enter into written agreements with any third parties located outside of Japan, providing equivalent rights and obligations as those provided under the Japanese Act on the Protection of Personal Information. For residents of Malaysia, if you have any questions or complaints about this Policy, please contact our DPO. "Applicable law" in this Policy for Switzerland includes the Swiss Federal Act on Data Protection (FADP), and to exercise your rights under the FADP, please contact our DPO.

• If you are a California consumer, we process your personal information in accordance with California law, such as the CCPA. You have choices regarding our use and disclosure of your personal information, subject to certain limitations under the CCPA. In addition to the rights listed above, California consumers have other California-specific rights, including the right to know more about personal information collection and sharing, the right to opt-out of a sale, the right to limit the use of Sensitive Personal Information, and the right to opt-out of sharing cross-context behavioral advertising. To submit a request to exercise any of these rights, you can contact us using the methods described in the Contact Us section below. If you want to appoint an authorized agent to make requests on your behalf to exercise your rights under the CCPA, you can do so in writing or through a power of attorney. Your agent may submit a request on your behalf, but we may require you to directly verify your identity and confirm that you provided the authorized agent permission to submit the request.