Atreides Data Services and Website Privacy Policy

Effective date: 5 September, 2024

Last updated: 18 August, 2026

Atreides Caseri Inc. together with its subsidiaries and affiliates (“we,” “our,” “Atreides”) provides mobile intelligence products and services (the “Services”) designed to assist a range of organizations (both commercial and non-commercial) in performing analysis regarding movement patterns across and near mapped locations. The more specific purposes and nature of our Services are described below. Atreides Caseri Inc. is the parent company of the group, but your information may be processed by an affiliate or subsidiary depending on how and where you interact with Atreides.

We take seriously the privacy objectives of the individuals whose information we handle and maintain in our database. We in turn provide this Privacy Policy (“Privacy Policy”) to explain how we use and manage personal information, and what choices consumers have to control how we use and share their information.

We provide certain disclosures required under the California Consumer Privacy Act in our “CCPA PRIVACY NOTICE” located below. We use the term “Personal Information” (whether or not capitalized), also called “personal data” under some states’, provinces’ or countries’ laws, to refer to the various types of information and identifiers that are generally included in statutory definitions of these terms. We use the term “Consumer” (whether or not capitalized) to refer to persons and individuals defined as “consumers” or “data subjects” under various privacy laws; we also use the term “you” to refer to anyone whose Personal Information we hold or who may be reading this.

In addition to using personal information to create and provide our Services, we operate this website (along with any other websites we may operate), designed for our own customers and prospective customers and others who want to learn about our Services. We address the information we collect and use for those and other business purposes (such as information we use to communicate with our corporate customers, and potential customers) in Section 5 of this Privacy Policy.

1. Information That We Collect and Use in Our Services & How We Collect Such Information

• Atreides does not use personal information it has collected directly from consumers in the Services that it offers. Rather, the personal information Atreides uses in its Services are provided by third parties, generally, third party data aggregation companies (“Data Partners”). These Data Partners provide Atreides with a license to use their data to develop, improve and provide the Atreides Services, which sometimes includes the further license of personal information to third parties.
• The Personal Information that Atreides collects from Data Partners includes the following data elements, which may be associated with each other:
  • Mobile advertising IDs or “MAIDs”
  • Precise Location Information
  • Wifi connection information
  • Time-stamps (which may be used to estimate length of time a device may have spent at a particular location)
  • Network Information
    • VPN status
    • Network protocols employed
    • Device connectivity information (e.g., how a device connects to a network) and signal strength
    • Network information such as mobile network code and mobile country code

We may combine any of the points of Information we collect or receive with other Information.

2. How We Use the Information Collected Through and For Our Services

Atreides uses the information it collects from Data Partners to provide and improve its Services. This generally consists of creating databases correlated to devices that can be matched to physical places. We then may use these databases to make available datasets for our clients (“Clients”) regarding:

• which devices went to or from certain locations, or the size, or increase or decrease of devices in this dataset;
• more general traffic patterns, such as the directional source of traffic to or from a location;
• potential security, infrastructure or public safety threats, and make available device information underlying such threats.

We also use the information described above for our own internal purposes – such as to improve, test, update and verify our own database; develop new products and services; operate, analyze, improve and secure our Services and our databases and servers.

We use information collected purely in a corporate capacity as described in Section 5.

3. How We Share Information with Third Parties, including Service Providers

Atreides discloses Personal Information to Clients, including their service providers, as part of providing the Services we’ve described above (or other services we may add in the future). We also share Personal Information for other reasons, as follows:

• With Our Customers: As described above, we disclose or otherwise make available Personal Information in various ways to our Clients when we provide our Services. These clients may be for-profit companies, non-profits, or government agencies involved in a range of projects for public planning, defence/national security, safety and infrastructure protection.
• With Our Service Providers: We share Personal Information with a variety of service providers in order to operate, protect and advertise our Services and maintain our website(s). For instance, we may share information with our tech, hosting and customer support providers, and other companies that help us deliver, secure or develop our Services.
• Corporate transfers: If Atreides, its stock or its significant assets are acquired by or merged into another entity, Personal Information we hold in connection with our business will be transferred to that entity, and may be disclosed during due diligence in anticipation of any such transaction, in accordance with any applicable requirements and restrictions under relevant law(s).
• Affiliates, parent companies and subsidiaries: We may share some or all of the Personal Information we process among the Atreides’ corporate group (i.e., among parent, affiliates and subsidiaries within Atreides) for each of the purposes outlined above.
• As required by law or to protect any person or entity: To the greatest extent permitted by applicable law, Atreides may disclose Personal Information if we believe that such disclosure is necessary to (a) comply in good faith with relevant laws or to respond to subpoenas, orders or search warrants served on us; or (b) to protect or otherwise defend the rights, property or safety of Atreides, our customers, or any other person or entity.

We may otherwise disclose Personal Information as permitted by applicable law, for example (without limitation) in certain emergency circumstances where there is a serious risk of death or serious bodily injury.

4. Your Opt-Out Choices

There are multiple ways that you can opt-out of our use of Personal Information, either for the Services or for our own corporate purposes:

• First, you may opt out of having your personal information sold by submitting your mobile Ad ID to us here, to have your Personal Information removed from our Services database. We will then in most cases remove your personal information within 15 business days, from the time we received the opt-out request. In our discretion, we may in certain cases (and where legally permissible) require that you verify any of the information that you submit, such as by providing us a screen shot of your device.

You can find your mobile device’s Advertising ID on iOS by use of apps like e.g. My Device ID, and on Android by going to Settings, then selecting “Ads”.

The Advertising ID should look something like this: 3f097372-f01e-4b64-984c-395ae5828ee6.

Please see Section 6 for information about the broader range of rights you may have under state privacy laws, Section 13 for information about rights you may have if you are located in Canada, and the California Privacy Addendum for information about your rights under California’s privacy laws.

5. Data Collected in our Corporate Capacity & How We Collect Such Data

How Atreides Collects & Uses the Personal Information We Collect In Our Corporate Capacity

We use the Personal Information we collect to do the following:

• Create and manage your Client account, if you have one.
• Provide Services you or our Client have requested.
• Respond to and communicate with you.
• Perform data analysis.
• We may combine the information with other Personal Information we obtain from third parties, publicly available sources, and any other product or service we provide to further improve the relevance and effectiveness of products, including (but not limited to), those provided on or through our Services.
• We may use IP addresses to help diagnose problems with our servers and to administer our website(s). We also use this Information for compliance with our legal obligations, policies and procedures, including the enforcement of our legal agreements.
• If we collect Personal Information from “offline” sources – such as if you provide us your business card at a trade show or if we license or receive information about potential Clients – we will maintain that Information and use it for marketing and business purposes, as well.

How Atreides Shares the Personal Information We Collect Through Our Websites and Our Corporate Capacity

We may sometimes share or otherwise disclose the Personal Information we collect about you, which is collected in our corporate capacity, as described in this Section, as follows:

• We may share the Personal Information with service providers who help us deliver the Services you request or we provide. For instance, we share information with tech providers, and other companies that may help us deliver or develop Services.
• To the greatest extent permitted by applicable law, we will disclose your Personal Information (or other information) to law enforcement and other governmental and regulatory authorities if we believe in good faith that we are required to do so by law, regulation or other government authority or to protect the rights, safety or property of ourselves or any person or entity. We may also cooperate with law enforcement agencies in any official investigation and we may disclose any information in our possession to the requesting agency in doing so.
• If Atreides or all or substantially all of our assets, are purchased by another company (such as in a merger, consolidation, restructuring, the sale of stock and/or assets, or other corporate change or financing transaction), the Personal Information in our possession will likely be transferred to the successor entity, in accordance with any applicable requirements and restrictions under relevant law(s). We also may share the information during the course of any due diligence process leading up to any such transaction, to the extent permitted by applicable laws.

We may otherwise disclose Personal Information as permitted by applicable law, for example (without limitation) in certain emergency circumstances where there is a serious risk of death or serious bodily injury.

6. Privacy Rights You May Have in Specific US States

Note: If you are located in Canada, please see Section 13 for information on your rights.

Certain states in the USA have passed state-specific privacy laws that grant residents of their respective state’s particular privacy rights. These states include California (as to which a separate “Addendum” is provided below), as well as Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia. A useful privacy “tracker” as to what these states are, and when each privacy law becomes effective, is provided by the “IAPP,” an industry association devoted to privacy issues, at https://iapp.org/resources/article/us-state-privacy-legislation-tracker/.

If you live in one of these states, you may have the following rights with respect to your “personal information” or “personal data” (which we’ve collectively referred to in this Privacy Policy as “Personal Information”).

Namely, you may have the right to ask that we:

• Provide you access to and/or a copy of certain Personal Information we hold about you.
• Correct or update Personal Information we hold about you. (We may process a “correction” as a “deletion” if we cannot sufficiently verify your identity.)
• Delete certain Personal Information we have about you, which may also be referred to as the right of “erasure” under some laws.
• Opt you out of the sale or sharing of Personal Information, or processing of your personal information for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects, if applicable. This includes opting you out of the use of your Personal Information for cross-contextual behavioral advertising.
• You also generally have the right to not be discriminated against for exercising your rights.

You also may have the right to disclosures, as we provide in this Privacy Policy, about the types of Personal Information we collect and disclose, and from and to whom:

• How to Exercise your Privacy Rights. You may submit requests to exercise your right to information/know, access, correction, or deletion by going here or calling us toll free at (855) 800-9353.
• You can submit requests to opt-out of sale of personal information by going here or by calling us toll free at (855) 800-9353. You may also use the settings on your mobile phone to cease the transmission of your mobile ad identifiers for certain purposes, on a going forward basis.

We may in our discretion verify your identity where legally permitted – in part by requesting certain information from you — when you request to exercise certain privacy rights. However we often are unable to adequately verify access requests for certain information we have collected. Specifically, we often cannot fully satisfy requests for precise location data of a device over time, due to the fact that we are not able to verify to a reasonably high degree of certainty that the location data we have collected pertains to the Consumer making such a request, or whether either a Consumer with custody of a device — or the person making the request — is the rightful owner of the device to which the information we hold pertains. We take this general approach in order to avoid a scenario where such a person in temporary possession of a phone might obtain potentially detailed historic information pertaining to the phone’s owner through a request for access.

Further, certain Information or purposes may be exempt from the above requests under applicable law. For example, if you are a Client, we need to retain certain information in order to provide our Services to you, or for our own record-keeping. Under certain laws, we may be permitted to retain Personal Information where necessary to protect the security or integrity of networks, systems or locations.

Authorized Agents. Under certain states’ privacy laws, you may designate an authorized agent to make requests on your behalf. In order for an authorized agent to be verified, you must provide the authorized agent with signed, written permission to make such requests and in some cases a power of attorney. We may also follow up with you to verify your identity before processing the authorized agent’s request.

Right to Appeal. In certain states, residents have the right to appeal our decision to deny your request, if applicable. If you wish to do this, please send an email to [email protected] with the word “Privacy Appeal” in the subject line.

7. Data Retention

To the extent permitted by applicable law, we retain personal information in our commercial database for as long as it is useful or being used. We generally retain personal information to fulfill the purposes for which we collected it, including to provide Services, such as to create datasets and perform analytics for our Clients, but also for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes. To the extent permitted by applicable law, when determining the appropriate retention period for personal information, we may consider factors such as the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

When we no longer require the personal information we have collected about you, we may either delete it, anonymize it, or isolate it from further processing, in each case where permitted by applicable law.

Additional information regarding our retention and destruction of Quebec Personal Information is provided in Section 13.2.

8. Security and Data Integrity

Atreides takes steps designed to protect Personal Information within our possession at rest and in transit. This may include various types of physical and electronic security, including firewall protections, encryption, hashing or truncation of data, and access controls to personal information. However, you should be aware that neither we nor any platform can guarantee 100 percent safety from hacks or illegal intrusion.

9. Changes to this Privacy Policy

From time to time, we may update this Privacy Policy. Any changes to it will become effective when it is posted to our website (or within another reasonable time frame that we specify). Please check back to learn of any changes to this Privacy Policy. Alternatively, where required by applicable law, we will notify you of changes directly and/or obtain your consent.

10. Storage of Information

You should be aware that in accessing this website or otherwise communicating with us, the information we collect or receive from you may be subject to laws with lesser or different privacy standards than those in your own country (such as if you are in a country located in the European Union).

11. Your California Privacy Rights

If you are a resident of California, the California Consumer Protection Act, as amended by the California Privacy Rights Act (together the “CCPA”) provides certain rights of disclosure, access and deletion of your Information as described below in the “CCPA PRIVACY NOTICE” at the end of this Privacy Policy.

12. Additional Information for European Data Subjects

This section of the Privacy Policy applies to our processing of personal information subject to the UK and/or EU data protection laws. It explains how and why we process your personal information, how we transfer your personal information internationally and your rights.

Purposes and lawful basis

Data transfers

Some of the third party service providers we use (for example, IT, communications) may store or access personal data outside the EU from time to time. Similarly, some Atreides affiliates are also based outside the EU, for example, in the United States of America and Canada.

Where we transfer your personal information outside the UK and/or EU, we will take steps required by applicable law to ensure your personal information is appropriately protected. This may include relying on adequacy regulations (where applicable) and/or putting in place approved contractual safeguards such as the International Data Transfer Agreement (IDTA) and/or the UK Addendum to the EU Standard Contractual Clauses, together with any required risk assessments and additional measures. Please contact us if you would like more information about these safeguards (including how to obtain a copy where relevant).

Your rights

You have the right to request access to, rectification or erasure of, the personal data Atreides holds about you. You may also have the right to object to or restrict certain types of processing of your personal data (in particular where we rely on legitimate interests) and, in some circumstances, you can request to receive a machine-readable copy of the personal data you have provided to us. Where we rely on your consent, you have the right to withdraw that consent at any time.

You also have the right to complain to us if you consider that there has been an infringement of your rights in relation to your personal data. You can submit a complaint to us by email at [email protected].

If you are not happy with our processing of personal data, you have the right to lodge a complaint with your relevant supervisory authority.

13. Additional Information for Persons In Canada

For persons located in Canada, the term “Consumer”, as used in this Privacy Policy, means an identified or identifiable individual, including where there is a serious possibility that the individual could be identified through the use of that information, alone or in combination with other information.

Consumers in Canada generally have the right to access, update and rectify their Personal Information, and to withdraw consent to the continued collection, use, communication and/or disclosure of such information, subject to certain conditions, restrictions and limitations under applicable laws. Canadian Consumers may also have the right to ask questions about our collection of their Personal Information, obtain information regarding the Personal Information we hold about them and with whom we have (or may have) shared such information, and/or to submit a complaint about our handling of their Personal Information, our compliance with applicable privacy and data protection laws, or our privacy practices. However, your specific rights may depend on the jurisdiction where you are located. Nothing in this Privacy Policy is intended to change your rights or create any rights that do not exist under the laws in the jurisdiction where you are located.

Consumers in Canada should be aware that we or our service providers may transfer and/or store your Personal Information outside Canada. Such Personal Information may be accessible to courts, law enforcement and national authorities in other countries. Consumers in Canada should also be aware that the Personal Information that we collect and share in connection with our Services may be used by nation states and government authorities to track their movements for public safety purposes.

13.1. Alberta

Consumers in Alberta may contact our Privacy Officer as set out under the “Contact Us” section below, if they have questions about the collection, use, disclosure or storage of Personal Information by Atreides’s service providers and affiliates outside Canada, or to obtain access to written information about Atreides’s policies and practices with respect to service providers and affiliates outside Canada.

13.2. Quebec

For persons in Quebec, the term “Consumer”, as used in this Privacy Policy, includes a natural person to whom Personal Information relates, including where such information directly or indirectly allows that person to be identified.

Consumers located in Quebec should be aware that:

• We or our affiliates and service providers may communicate their Personal Information outside Quebec.
• Their Personal Information will be accessible to engineering and mission systems employees who need to access such information to perform their duties or functions.

Consumers in Quebec may also have certain rights with respect to their Personal Information, in addition to those referenced above for all of Canada, including rights related to data portability, de-indexation and re-indexation, dissemination of their information, and/or automated decision making. You may contact us, as set out under the “Contact Us” section below, with requests to exercise such rights, and we will respond in accordance with applicable law.

Roles and Responsibilities of Personnel

Atreides’s CEO has overall responsibility for our compliance with applicable Quebec privacy and data protection legislation. However, certain functions have been assigned to the following Atreides personnel:

• The Privacy Officer has responsibility for the day-to-day administration and implementation of Atreides’s privacy program, such as developing and delivering privacy training to relevant personnel, establishing and publishing relevant policies and procedures, investigating and responding to complaints and alleged violations of Atreides’s privacy policies or relevant laws, responding to requests from Consumers to exercise their rights under applicable privacy laws, and regularly reviewing and identifying opportunities to improve Atreides’s privacy program.
• The Director of Cyber Security is responsible for preparing a written information security program, assisting with breach prevention, response and containment, and evaluating and implementing information security controls.
• IT & System Administrators are responsible for the management of our systems where Personal Information may be stored, processed, or transmitted.

In addition, all Atreides personnel are responsible for:

• protecting the confidentiality and security of any Personal Information they handle in connection with their employment;
• following Atreides’s security measures and its policies and procedures for handling Personal Information;
• refraining from any unauthorized access, use or disclosure of Personal Information;
• facilitating data subject requests; and
• reporting security or confidentiality incidents.

Retention and Destruction of Personal Information

Once the purpose for collecting and using such Personal Information is achieved, we may destroy the information, unless we are permitted or required to retain, de-identify or anonymize the information under applicable law.

We use appropriate and secure methods to dispose of personal information.

Complaint Process

Persons in Quebec may contact us with any privacy questions, complaints or concerns, as set out under the “Contact Us” section below.

Atreides’s process for dealing with complaints related to the protection of Personal Information generally includes:

1. Acknowledgement of receipt without undue delay.
2. Taking steps to confirm the identity of the complainant (where appropriate), and to obtain the details of the complaint as well as any relevant documentation.
3. Consideration of applicable laws.
4. An appropriate, fair and impartial investigation.
5. Communicating the outcome of the investigation to the complainant, including any remediation measures taken by Atreides (where justified).

14. Contact Us

In addition to the above-referenced communication methods, Atreides has a designated privacy contact. If you have questions related to this Privacy Policy, or regarding our Services, please contact the Privacy Officer at [email protected].

CCPA Privacy Notice: Addendum for California Residents

CALIFORNIA PRIVACY RIGHTS

Last Modified: 18 August 2026
Date posted: 18 August 2026

The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (together, the “CCPA”) provides certain rights to residents of California. This section of the Privacy Policy applies if you are a natural person who is a resident of California (“California Consumer”) and uses our Services. This Addendum supplements the information in the Privacy Policy. However, this Addendum is intended solely for, and is applicable only as to, California Consumers: if you are not a California Consumer (or a resident of California), this does not apply to you and you should not rely on it.

In the below tables and sections, we describe (as required by the CCPA):

1. Our Collection of Personal Information – the types of Personal Information (which the CCPA defines broadly) that we collect, the types of sources we collect it from.
2. Our Disclosure, Share and Sale of Personal Information – the types of recipients to whom we disclose, share or sell Personal Information.
3. Our Business Purposes – our business purposes for (a) collecting and (b) sharing Personal Information, which are generally the same.
4. Your California Privacy Rights and Choices – what rights you have under the CCPA, for instance, to request that we “opt out” or delete or correct your Information from or in our marketing database (also called “do not sell” rights), or to request categories and personal information that we may have collected about you.

The following sets forth the categories of Information we collect and purposes for which we may use California residents’ personal information:

1. Our Collection of Personal Information

Depending on how you interact with us, we may collect about you the categories of Information summarized below. The following table also describes how we collect and use such categories of Information for purposes of our Services. The data types listed below each category are provided solely for purposes of example: we do not necessarily collect or use each such data type.

2. Our Disclosure, Share, and Sale of Personal Information

We will disclose the Personal Information collected from and about you as discussed above for various business purposes, including with service providers and third parties such as our customers. The chart below sets out how and with whom we sell, share or disclose personal information, and whether (based on the CCPA’s definition of “sell”) we believe we have “sold” or “shared” a particular category of information. (“Sharing” under the CCPA includes disclosure for purposes of cross contextual behavioral advertising, sometimes called targeted advertising or interest-based advertising.) Note that the examples we provide under the column “Category” simply reflect statutory, exemplary language: we do not necessarily collect all types of information reflected within each category.

We also may disclose any of the personal information we collect as follows:

Sharing for Legal Purposes: In addition, we may disclose personal information with third parties in order to: (a) comply with legal process or a regulatory investigation (e.g. a subpoena or court order); (b) enforce our Terms of Service, this Privacy Policy, or other contracts with you, including investigation of potential violations thereof; (c) respond to claims that any content violates the rights of third parties; and/or (d) protect the rights, property or personal safety of us, our platform, our customers, our agents and affiliates, its users and/or the public. We likewise may provide information to other companies and organizations (including law enforcement) for fraud protection, and spam/malware prevention, and similar purposes.

Disclosure In Event of a Corporate Transaction: We may also disclose personal information in the event of a major corporate transaction, including for example a merger, investment, acquisition, reorganization, consolidation, bankruptcy, liquidation, or sale of some or all of our assets, or for purposes of due diligence connected with any such transaction.

Disclosure to Service Providers: We disclose any personal information we collect with our service providers, which may include (for instance) providers involved in tech or customer support, operations, web or data hosting, billing, accounting, security, marketing, data management, validation, enhancement or hygiene, or otherwise assisting us to provide, develop, maintain and improve our Services.

Aggregate or Deidentified Information: We may aggregate and/or de-identify any Information collected so that such Information can no longer be linked to you or your device (“Aggregate/De-Identified Information”). We may use Aggregate/De-Identified Information for any purpose, including without limitation for research, and may also disclose such data to any third parties.

3. Our Business Purposes for Collecting and Disclosing Personal Information

Generally speaking, we collect and disclose the Personal Information that we collect for the following purposes, as we also have described in our Privacy Policy.

In particular, we use Personal Information we collect from Data Partners to provide and improve its Services. This generally consists of creating databases correlated to devices that can be matched to physical places. We then may use these databases to make available datasets for our clients (“Clients”) regarding:

• which devices went to or from certain locations, or the size, or increase or decrease of devices in this dataset;
• more general traffic patterns, such as the directional source of traffic to or from a location;
• potential security, infrastructure or public safety threats, and make available device information underlying such threats.

In doing the above, we (or our Data Partners) remove sensitive location data (as that term is defined by the U.S. FTC), which is precise location data potentially correlated to sensitive U.S. locations such as health providers and houses of worship. We may also create deidentified, partially deidentified or carefully segregated and siloed datasets in order to preserve and enhance Consumers’ privacy.

We also use this Personal Information to operate our Services, including:

• Improving, testing, updating and verifying our own database.
• Developing new products.
• Operating, analyzing, improving, and securing our Services.

Other internal purposes, for example:

• For internal research, internal operations, auditing, detecting security incidents, debugging, short-term and transient use, quality control, and legal compliance. We sometimes use the Information collected from other “business to business” interaction (such as at trade shows) or from data compilers for the above.

4. Your California Rights and Choices

Without being discriminated against for exercising these rights, California residents have the right to request that we disclose what personal information we collect from you, to delete that information, and to opt-out of the sale of your personal information, subject to certain restrictions. You also have the right to designate an agent to exercise these rights on your behalf. This section describes how to exercise those rights and our process for handling those requests. (To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.) Please note that sometimes we act as a “service provider” for our clients, in which case we receive and act on instructions from the client(s) as to the client data provided: any requests to exercise rights with respect to data we handle on behalf of a client should be directed to the particular client.

a. Right to request access to your personal information

California residents have the right to request that we disclose what categories of your personal information that we collect, use, or sell. You may also request the specific pieces of personal information that we have collected from you. However, we may withhold some personal information where the risk to you or our business is too great to disclose the Information.

b. Right to request deletion or correction of your personal information

California residents may also request that we delete or correct any personal information that we collected from you, such as if you have been a customer of ours. (Note that this is different from your right to “opt out” of us selling your personal information, which is described below; also note that we do not generally collect personal information directly from consumers.) However, we may retain personal information for certain important purposes, such as (a) to protect our business, systems, and users from fraudulent activity, (b) to address technical issues that impair existing functionality (such as de-bugging purposes), (c) as necessary for us, or others, to exercise their free speech or other rights, (d) to comply with law enforcement requests pursuant to lawful process, (e) for scientific or historical research, (f) for our own internal purposes reasonably related to your relationship with us, or to comply with legal obligations. Additionally, we need certain types of information so that we can provide our Services to you. If you ask us to delete it, you may no longer be able to access or use our Services.

c. Right to “opt-out” of the sale or “sharing” of your personal information

California residents may opt out of the “sale” of their personal information. California law broadly defines what constitutes a “sale” – including making available a wide variety of information in exchange for “valuable consideration.”

Depending what Information we have about you, and whether we have included any of it in our marketing products and services, we may have sold (as defined by California law) certain categories of Information about you in the last 12 months, as described in the above table in Section 2 of this Addendum.

d. How to exercise your opt-out (do not sell), access, correction and (if applicable) deletion rights

• You may submit requests to exercise your right to information/know, access, correction, or deletion by going here or calling us toll free at (855) 800-9353.
• You can submit requests to opt-out of sale of personal information by going here or by calling us toll free at (855) 800-9353. You may also use the settings on your mobile phone to cease the transmission of your mobile ad identifiers for certain purposes, on a going forward basis.

For security purposes (and as required under California law), we will verify your identity – in part by requesting certain information from you — when you request to exercise certain California privacy rights. For instance, if you request specific pieces of personal information we have received about you, you may need to confirm your possession of an identifier (such as your possession of an email address or your residence at a home address) in order to confirm you are the person you claim to be. However we often are unable to adequately verify access requests for certain information we have collected. Specifically, we often cannot fully satisfy requests for precise location data of a device over time, due to the fact that we are not able to verify to a reasonably high degree of certainty that the location data we have collected pertains to the individual making such a request, or whether either an individual with custody of a device — or the person making the request — is the rightful owner of the device to which the information we hold pertains. We take this general approach in order to avoid a scenario where such a person in temporary possession of a phone might obtain potentially detailed historic information pertaining to the phone’s owner through a request for access.

Once we have verified your identity (if we can do so sufficiently), we will respond to your request as appropriate:

• Where you have requested the categories of Personal Information that we have collected about you, we will provide a list of those categories.
• Where you have requested specific pieces of Personal Information, we will provide the information you have requested, subject to the above conditions, i.e., to the extent required under the CCPA and provided we do not believe there is an overriding privacy or security concern to doing so.
• Where you have requested that we delete Personal Information that we have collected from you, we will seek to confirm whether your request is for an “opt out” or a “deletion”: because “opt out” or “do not sell” rights enable us to maintain your Information for “suppression” purposes – i.e., to prevent us from selling Personal Information about you in the future (which is what many consumers requesting “deletion” actually desire to occur) — we try to explain this in order to ensure we are meeting consumers’ preferences. (In addition, “deletion” rights only apply to Information that we have collected “from” consumers – which does not apply to much of the Information in our databases.)
• Upon completion of the above process, we will send you a notice that explains the categories of Personal Information we were able to locate about you, whether we (1) deleted or suppressed, (2) deidentified, or (3) retained the Information we collected from you. Certain information may be exempt from such requests under applicable law.

If we are unable to complete your requests fully for any of the reasons above, we will provide you additional information about the reasons that we could not comply with your request.

e. Right to nondiscrimination

We will not deny, charge different prices for, or provide a different level of quality of goods or services if you choose to exercise these rights.

f. Information about persons under 16 years of age

We do not knowingly collect personal information from minors under 16 years of age in California unless we have received legal consent to do so. If we learn that personal information from such California residents has been collected, we will take reasonable steps to remove their Information from our database (or to obtain legally required consent).

g. Authorized agents

You may designate an agent to make requests to exercise your rights under the CCPA as described above. When we receive such a request, we may (as appropriate) take steps both to verify the identity of the person seeking to exercise their rights as listed above, and to verify that your agent has been authorized to make a request on your behalf through providing us with a signed written authorization or a copy of a power of attorney.

h. Data retention

We retain personal information in our commercial database for as long as it is useful or being used. We generally retain personal information to fulfill the purposes for which we collected it, including to provide Services, such as to create datasets and perform analytics for our Clients, but also for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes. To determine the appropriate retention period for personal information, we may consider factors such as the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

When we no longer require the personal information we have collected about you, we may either delete it, anonymize it, or isolate it from further processing.