Privacy and Data Security Statement

Thank you for visiting SureCircle, and for viewing this Privacy and Data Security Statement ("Statement"). This Statement applies to SureCircle Limited (the "Company") for users outside the United States. For users residing in the United States, this Statement applies to SureCircle LLC, and SureCircle LLC shall be the operating entity. This Statement covers all SureCircle's products and services (collectively, the "Services"), which include our website www.surecircle.net and related subdomains, and all other online and offline offerings. This Statement serves to notify you about the types of personal information we collect, how we use it, who we share it with, what we do to store and protect it, and how you can exercise your privacy rights and choices. For residents of California and other US states with special privacy rights, additional disclosures are available. If you would like to exercise any of the rights below, please contact us as set forth at privacy@surecircle.net. We will process such requests in accordance with applicable laws. If we deny your request, you may appeal by emailing privacy@surecircle.net with the subject line "Privacy Rights Appeal"; we will provide a written decision with reasons and instructions for contacting the applicable attorney general, where required.

As used in this Statement, "personal information" has the meaning given to it under the law where you live, but typically refers to information that can be used to identify you as an individual; meanwhile our activities taken with respect to your personal information are referred to as "processing."

For your convenience, we have provided a quick summary of our processing activities below.

Summary of How We Handle Personal Information

We have two main types of users: Merchants and End Users. We offer the SureCircle Services directly to End Users, for example when they use the SureCircle system to track and protect their packages. We also work directly with Merchants to offer our Services on their respective storefronts. Our sites and apps also collect information from both End Users and Merchants automatically, which we use to analyze and advertise our Services and promote third-party products and services to End Users.

From Merchants, we collect your business contact and financial information, as well as the orders you ship. Meanwhile, from End Users, we collect your account and shipping information, as well as the details surrounding the packages you wish to track and protect, and any claims you make (which are then shared with Merchants). If you expressly authorize us to connect to your email account, we will access only shipment-related emails from designated senders or folders to extract order and tracking data for your requested Services. We use read-only, least-privilege access, do not retain email content beyond the data elements necessary to provide the Services, and do not use such content for advertising. You may revoke access at any time through your account or by contacting privacy@surecircle.net. Upon revocation we will cease new access and delete any tokens within a commercially reasonable period. If applicable, we may also allow End Users to sync other third-party online marketplaces, to more efficiently track the status of their packages.

Fictitious Business Name (DBA) Disclosure – California

SureCircle LLC discloses that, in the State of California, it conducts business under the fictitious business name "SURECIRCLE INSURANCE SOLUTIONS." Pursuant to Section 17910 of the California Business and Professions Code, SureCircle LLC will file, publish (as applicable), and maintain a current fictitious business name statement in the county or counties where it transacts business in California, and will renew or refile such statement in accordance with statutory requirements. This disclosure is for notice and compliance purposes only and does not alter the legal identity of SureCircle LLC as the contracting entity.

Contact for legal notices:

• For users outside the United States: SureCircle Limited, Attention: Legal Department, RM A5, 7/F, ASTORIA BUILDING, NO.34 ASHLEY ROAD, TSIM SHA TSUI, HONG KONG; privacy@surecircle.net.
• For users residing in the United States: SureCircle LLC, Attention: Legal Department, 17350 State Hwy 249, Ste 220 #30038, Houston, TX 77064, United States; privacy@surecircle.net.

Contacting Our Privacy Office

If you have any questions or concerns about our privacy and data security policies, procedures, and practices, including anything we say in this privacy statement, or would like to exercise your privacy rights, we encourage you to contact our Privacy Office.

Attention: Privacy Officer, Legal

• For users outside the United States:
  Mail: SureCircle Limited, Attention: Legal Department, RM A5, 7/F, ASTORIA BUILDING, NO.34 ASHLEY ROAD, TSIM SHA TSUI, HONG KONG
  Email: privacy@surecircle.net
• For users residing in the United States:
  Mail: SureCircle LLC, Attention: Legal Department, 17350 State Hwy 249, Ste 220 #30038, Houston, TX 77064, United States
  Email: privacy@surecircle.net

Changes to our Privacy Statement. We may revise this Privacy Statement from time to time. Where changes are material, we will provide notice as required by applicable law (e.g., prominent in-product notice, email, or website banner) and, where required, obtain your affirmative consent before applying the change to newly collected or newly processed personal information. Continued use is not deemed consent where applicable law requires opt-in.

What Personal Information Do We Collect?

The categories of personal information we collect depend on how you interact with us, our Services, and the requirements of applicable law. We collect information that you provide to us directly, information we obtain automatically when you use our Services, and information from other sources such as third-party services and organizations, as described below.

Personal Information Collected from You Directly

If you choose to participate in or make use of certain activities and features available via our online and mobile resources, you will need to provide us with certain personal information about yourself. The categories of information we collect vary based on whether you are a Merchant, End User, or both.

• Merchant Accounts. To enter into a contract with us, Merchants share their full name, phone number, store URL, and annual sales volume. Merchants also provide us with their billing and payment information, and details regarding their orders, which may include Merchants' residence(s) as part of shipping information.
• End User Accounts. When an End User activate our protection services, whether through the SureCircle website, on a merchant website or shopping cart, or by having a Merchant provide them automatically as part of the benefits they offer, the End User shall access claim and shipment information or submitting supplemental materials using a one-time protected code sent to your email address, without creating a persistent account.
• Insurance Information Collection. In order to process your insurance application, we will collect the following personal information, which may be retained for up to 7 years or longer, in accordance with the requirements set by the insurance company. The information we collect includes: Basic Information (e.g., Full Name, Email Address, Shipping Address); Order Information (e.g., Order Number; Order Date, Order Amount, Order Content, Logistics Tracking Number); and Insurance Coverage Information (Underwriting Company, Insurance Recorded ID, Underwriting Time). This information is essential for completing the insurance process and ensuring that all required records are maintained as per regulatory and contractual obligations.
• Shipment information. To track and protect your shipments, we collect your order number and related tracking information, which may include your shipping address, the contents of your package and its value, and the status of your delivery (including comments, delivery instructions, and photos of your package when delivered).
• End User claims: you may file a claim for a package that is protected by us regardless of if you have created an End User account. To file a claim, we will require at a minimum your full name, your email address, the protection or order ID associated with your package, and any other information required to process your claim (such as photo evidence of damage to your package). During the claims process, the insurance company may require a sworn statement or police report, which may be forwarded to the insurance company by SureCircle. We may also connect with your third-party payment processor account to send you payments for successful claims.

Below are some other ways you voluntarily give us your personal information as an End User, Merchant, or both:

• Purchases. We may collect personal information and details associated with your purchases and claims, including payment information. Any payments made via our Services are processed by third-party payment processors. We do not directly collect or store any payment card information entered through our Services, but we may receive information associated with your payment card information (e.g., your billing details).
• Your Communications with Us. We may collect personal information, such as email address, phone number, or mailing address when you request information about our Services, register for our newsletter or loyalty program, request customer or technical support, or otherwise communicate with us.
• Surveys. We may contact you to participate in surveys. If you decide to participate, we may collect personal information from you in connection with the survey.
• Sweepstakes or Contests. We may collect personal information you provide for any sweepstakes or contests that we offer. In some jurisdictions, we are required to publicly share information of sweepstakes and contest winners.
• Conferences, Trade Shows, and Other Events. We may collect personal information from individuals when we attend or host conferences, trade shows, and other events.
• Business Development and Strategic Partnerships. We may collect personal information from individuals and third parties to assess and pursue potential business opportunities.
• Job Applications. We may post job openings and opportunities on our Services. If you respond to one of these postings, we may collect your personal information, such as your application, CV, cover letter, and/or any other information you provide to us.

Automatically Collected Information

Data collection methods differ based on whether you are an End User or a Merchant accessing our backend management system.

• For End User. When you visit or use our websites or plugins, SureCircle does not automatically collect personally sensitive information identifiers about you, except in the following circumstances: When you purchase insurance from us or file a claim, SureCircle will collect: Basic Information (e.g., full name, phone number, email address, shipping address); Order Information (e.g., order number, order date, order amount, purchase contents, carrier tracking number); Insurance Coverage Information (e.g., underwriting company, insurance recorded ID, underwriting time); and Claim Information (e.g., full name, email address, protection/order ID, shipping address, carrier tracking number, delivery status, proof photos). During claims processing, insurers may require sworn statements or police reports (forwarded by SureCircle); personal payment information will be used for disbursing approved claim payments.
• For Merchant. If you log in to our backend management system, we may automatically collect limited information for security protection purposes, including: Your Internet Protocol (IP) address; Basic details about the device and browser used to access the system (e.g., browser type, operating system); Login timestamp and duration of the session.
• The automatically collected information is used to safeguard the security of the management system, prevent unauthorized access, and comply with relevant security protocols. Such information will be retained for a period in accordance with regulatory and audit requirements, and SureCircle will not actively associate automatically collected information with personal identifiers.

We also utilize technologies and other third-party tools to process analytical information, with our analytics providers including:

• Cloudflare. It is used by us for security protection to defend our systems against cyber attacks. For more information about how Cloudflare uses your personal information (including for its own purposes, e.g., for profiling or linking it to other data), please visit Cloudflare's Privacy Policy.

Information Collected from Third Parties

Third-Party Services and Sources. We may obtain personal information about you from other sources, including through third-party services and organizations. For example, if you access our Services through a third-party application, such as an app store, a third-party login service like Shopify, we may collect personal information about you from that third-party application that you have made available via your privacy settings.

Note: External Sites, Apps, Links and Social Media

We maintain a presence on external social media platforms such as Twitter, Facebook, YouTube, and LinkedIn. We may further allow the community features of our online and mobile resources to connect with, or be viewable from, that external social media presence. Similarly, our online and mobile resources may contain links to other websites or apps controlled by third parties.

We are not responsible for either the content on, or the privacy practices of, social media platforms, or any third-party sites or apps to which we link. Those apps, sites, and platforms are not controlled by us and therefore have their own privacy policies and terms of use. If you have questions about how those apps, sites and platforms collect and use personal information, you should carefully read their privacy policies and contact them using the information they provide.

How and Why Do We Use the Personal Information We Collect?

We use your personal information for a variety of business purposes, including to provide our Services, for administrative purposes, and to market our products and Services, as described below.

To Provide Our Services

We use your information to fulfill our contract with you and provide you with our Services, such as:

• Managing your information and accounts;
• Providing access to certain areas, functionalities, and features of our Services;
• Answering requests for customer or technical support;
• Communicating with you about your account, activities on our Services, and policy changes;
• Processing your financial information and other payment methods for products or Services purchased;
• Processing applications if you apply for a job we post on our Services; and
• Allowing you to register for events.

For Administrative Purposes

We use your information for various administrative purposes, such as:

• Pursuing our legitimate interests such as direct marketing, research and development (including marketing research), network and information security, and fraud prevention;
• Detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activity, and prosecuting those responsible for that activity;
• Measuring interest and engagement in our Services;
• Short-term, transient use, such as contextual customization of ads;
• Improving, upgrading, or enhancing our Services;
• Developing new products and services;
• Ensuring internal quality control and safety;
• Authenticating and verifying individual identities, including requests to exercise your rights under this Privacy Statement;
• Debugging to identify and repair errors with our Services;
• Auditing relating to interactions, transactions, and other compliance activities;
• Sharing personal information with third parties as needed to provide the Services;
• Enforcing our agreements and policies; and
• Carrying out activities that are required to comply with our legal obligations.

To Market and Advertise our Services

We may use personal information to tailor and provide you with content and advertisements. We may provide you with these materials as permitted by applicable law. Some of the ways we market to you include email campaigns, text messages, custom audiences advertising, and "interest-based" or "personalized advertising," including through cross-device tracking.

If you have any questions about our marketing practices, or if you would like to opt out of the use of your personal information for marketing purposes, you may contact us at privacy@surecircle.net.

With Your Consent

We may use personal information for other purposes that are clearly disclosed to you at the time you provide personal information or with your consent.

Other Purposes

We also use your personal information for other purposes as requested by you or as permitted by applicable law.

• Automated Decision Making. We may engage in automated decision making, including profiling. For example, we may engage in automated decision making for example to provide you with personalized recommendations for products. SureCircle's processing of your personal information will not result in a decision based solely on automated processing that significantly affects you unless such a decision is necessary as part of a contract we have with you, we have your consent, or we are permitted by law to engage in such automated decision making. If you have questions about our automated decision making, you may contact us at privacy@surecircle.net.
• De-identified and Aggregated Information. We may use personal information to create de-identified and/or aggregated information, such as demographic information, information about the device from which you access our Services, or other analyses we create.

When / With Whom Do We Share Personal Information?

We may share your personal information with third parties as described below.

Disclosures to Provide our Services

• To other Merchants or End Users. We will communicate with Merchants regarding the details and status of claims initiated by End Users on that Merchant's site, and likewise alert End Users when Merchants have taken action with respect to a claim filed by the End Users.
• Service Providers. We may share your personal information with our third-party service providers and vendors that assist us with the provision of our Services. This includes service providers and vendors that provide us with IT support, hosting, payment processing, customer service, and related services. This category also includes insurance brokers and carriers who are involved in the issuance of the policies used in our shipping protection services.
• Affiliates. We may share personal information with our other corporate affiliates who for our administrative purposes, IT management, or for them to provide services to you or support and supplement the Services we provide.
• Advertising Partners. Through our Services, we may share your personal information with third-party advertising partners. These third-party advertising partners may set Technologies and other tracking tools on our Services to collect information regarding your activities and your device (e.g., your IP address, cookie identifiers, page(s) visited, location, time of day). These advertising partners may use this information (and similar information collected from other services) for purposes of delivering personalized advertisements to you when you visit digital properties within their networks. This practice is commonly referred to as "interest-based advertising," "cross-context behavioral advertising," or "personalized advertising.

The privacy choices you may have about your personal information are determined by applicable law and are described in "Your Privacy Choices and Rights" below.

Disclosures to Protect Us or Others

We may disclose personal information to government authorities and to other third parties when compelled to do so by such government authorities, or otherwise as required or permitted by applicable law, including responding to court orders and subpoenas. We may also disclose personal information when we have reason to believe that someone is causing injury to or interference with our rights or property or harming or potentially harming other persons or property.

Disclosures in Connection with a Business Sale/Purchase

We may disclose your personal information in connection with an actual or proposed sale of substantially all of our assets, equity interests, or securities, or are acquired by one or more third parties as a result of an acquisition, merger, sale, reorganization, divestiture, consolidation, or liquidation, personal information may be one of the transferred assets. If such a business transfer occurs or is proposed, we will provide you with notice and give you the choice to opt out of having your personal information disclosed or transferred to the acquiring party. You may exercise this opt-out right by contacting us. Please note that if you opt out, you may not be able to continue using our services if the business transfer is completed.

How Do We Store and Protect Collected Personal Information?

We store information in paper-based files or other electronic record keeping methods in secure databases (including trusted third-party storage providers). All critical data is stored within the United States (for users residing in the United States) and/or other jurisdictions that meet applicable data protection standards, and hosted by Amazon Web Services (AWS) or other trusted third-party storage providers that comply with relevant data security requirements. Data Isolation: Customer data is stored in logical partitions to ensure complete isolation between merchants. Least Privilege: Access controls are implemented based on the principle of least privilege, strictly limiting access to sensitive data. Comprehensive Auditing: All internal access records are fully traceable, supporting real-time monitoring and compliance auditing. Data Transparency: We do not sell or rent any personal information to third-party data brokers or marketing companies. We take reasonable steps to protect your personal information from misuse, interference and loss and from unauthorized access, modification or disclosure. We store the personal information we collect as described in this Privacy Statement for as long as you use our Services, or as necessary to fulfill the purpose(s) for which it was collected, provide our Services, resolve disputes, establish legal defenses, conduct audits, enforce our agreements, and comply with applicable laws. We endeavor to retain all such personal information in accordance with legal requirements.

Despite the significant investment we've made in the Security Program to protect your personal information, we cannot guarantee that your personal information will be free from attempts at unauthorized access, or that loss or accidental destruction will never occur. To the fullest extent permitted by applicable law, we do not accept liability for unauthorized access, use, disclosure, or loss of your personal information.

By using our Services or providing personal information to us, you agree that we may communicate with you electronically regarding security, privacy, and administrative issues relating to your use of our Services. If we learn of a security system's breach, we may attempt to notify you electronically, for example by posting a notice on our Services, by mail, or by sending an email to you.

Your Privacy Choices and Rights

Your Privacy Choices. The privacy choices you may have about your personal information are determined by applicable law and are described below.

• Email Communications. If you receive an unwanted email from us, you can use the unsubscribe link found at the bottom of the email to opt out of receiving future emails. Note that you will continue to receive transaction-related emails regarding products or Services you have requested. We may also send you certain non-promotional communications regarding us and our Services, and you will not be able to opt out of those communications (e.g., communications regarding our Services or updates to our Terms or this Privacy Statement).
• Text Messages. If you receive an unwanted text message from us, you may opt out of receiving future text messages from us by following the instructions in the text message you have received from us or by otherwise contacting us at privacy@surecircle.net.
• Cookies and Personalized Advertising. You may stop or restrict the placement of Technologies on your device or remove them by using the controls we make available in our cookie banner, or adjusting your preferences as your browser or device permits. However, if you adjust your preferences, our Services may not work properly.

Children's Privacy

United States Federal law imposes special restrictions and obligations on commercial website operators who direct their operations toward and collect and use information from children under the age of 13. We comply with the Children's Online Privacy Protection Act (COPPA) and do not target users under 13 years old. For users subject to other applicable jurisdictions' children's privacy laws, we comply with such laws. We will immediately delete any accidentally collected personal information of children under the applicable age threshold (unless legally required to retain). We take those age-related requirements very seriously and do not intend for our online and mobile resources to be used by children under the age of 18. We do not knowingly collect personal information from minors under the age of 18. If we become aware that anyone under the age of 18 has submitted personal information to us via our online and mobile resources, we will delete that information, unless we are required to keep it to protect our rights or the rights of others and will not use it for any other purpose. We encourage parents and legal guardians to talk with their children about the potential risks of providing personal information over the Internet.

NOTICE AT COLLECTION AND SUPPLEMENTAL NOTICE FOR RESIDENTS OF CERTAIN U.S. STATES

This Notice at Collection and Supplemental Notice is for residents of states that have adopted comprehensive privacy legislation and others that may come into effect from time to time, including, but not limited to, California, Connecticut, Colorado, Utah and Virginia (collectively, "Applicable State Laws"), and applies only to users residing in the United States (with SureCircle LLC as the operating entity).

PERSONAL INFORMATION WE COLLECT AND SHARE

As more fully described in the section titled What Personal Information Do We Collect, the sources from which we collect personal information include directly from you when you interact with us, automatically from you when you use our sites and Services (for example through cookies and other Technologies), and from third parties (for example, from third-party shipping providers).

Depending on how you use our Services, the information we may have collected about you, as well as the categories of third parties with whom we have disclosed and/or shared this information, are described in the table below.

Depending on how you use our Services, we may collect various types of personal information about you. In the 12 months prior to the "last updated" date of this notice, we have collected the following categories of personal information:

• Identifiers such as your real name, postal address, email address
• Personal information as defined in California Customer Records law such as name, signature, address, telephone number, insurance recorded id, (for refund purpose if a claim is filed) bank account number, credit or debit card number
• Commercial information such as transaction information, purchase history, financial details, and payment information
• Audio, electronic, sensory, or similar information, such as Images and audio, video or call recordings created in connection with our business activities
• Sensitive personal Information, such as Account login information and (for refund purpose if a claim is filed) debit or credit card numbers.

We only collect personal information, as defined by applicable privacy laws or the purposes allowed by law or with your consent. Personal information may be used, or disclosed to a service provider or contractor, for additional, specified purposes. You may have the right to limit the use or disclosure of your personal information. However, it is important to note that personal information does not include publicly available information that is lawfully made available to the general public from federal, state, or local government records. Some of this financial information may overlap with other categories of personal data. This type of financial and personal information may be shared with service providers, advertising networks, merchants, end users, and data analytics providers for business purposes, and it may also be sold and/or shared with advertising networks and data analytics providers.

USE OF PERSONAL INFORMATION

We may use or disclose the personal information we collect for the purposes outlined in How and Why Do We Use the Personal Information above. These purposes include:

• To provide our Services to you;
• For our administrative purposes (including security, fraud detection and protection, and improve our Services);
• To process your requests, orders, and transactions (including provide customer service to you);
• To Advertise and market our products and Services to you;
• With your consent; and,
• To comply with law and enforce our rights and the rights of others.

Where required under applicable law, we will not collect additional categories of personal information or use the personal information we have collected for materially different, unrelated, or incompatible purposes without first providing you notice.

SALES/SHARING OF PERSONAL INFORMATION

For purposes of certain state law, SureCircle LLC does not "sell" personal information, nor do we have actual knowledge of any "sale" of personal information of minors under 18 years of age as the term "sell" is commonly understood. That said, for users over 18 years of age, we may share information with third-party advertising partners for the purpose of promoting our Services as described above, such as for cross-context behavioral advertising. Notwithstanding the foregoing and subject to applicable laws of your jurisdiction or state law, for users over 18 years of age, in the event of a corporate transaction (e.g., merger or asset transfer), your personal information may be transferred to the successor entity for substantially similar purposes, subject to applicable law and your existing privacy choices. You may limit such sales or sharing by utilizing the controls available in our cookie banner, adjusting your browser settings to send a Global Privacy Control signal, or by contacting us at privacy@surecircle.net.

RETENTION OF PERSONAL INFORMATION

We store the personal information we collect as described in our Privacy Statement for as long as you use our Services, or as necessary to fulfill the purpose(s) for which it was collected, provide our Services, resolve disputes, establish legal defenses, conduct audits, enforce our agreements, and comply with applicable laws, or based upon other criteria, including, but not limited to, the sensitivity and volume of such data. Additionally, we endeavor to retain all such personal information in accordance with legal requirements. The specific retention period for your personal information will depend on your relationship with us and the reasons we hold your personal information. The criteria used to determine our retention periods may include, for example: (i) the nature and duration of our service relationship with you; (ii) the length of any applicable statutory, regulatory or contractual retention requirement; and (iii) the need to retain personal information to defend or pursue legal claims before the expiration of any applicable statute of limitations.

ADDITIONAL PRIVACY RIGHTS FOR RESIDENTS OF CERTAIN STATES

• Authorized Agent. Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. To authorize an agent, provide written authorization signed by you and your designated agent and contact us at privacy@surecircle.net for additional instructions.
• Verification. To protect your privacy, we will take steps to reasonably verify your identity before fulfilling your request. These steps may involve asking you to provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative, or to answer questions regarding your account and use of our Services.
• De-Identified Information. If we create or receive de-identified information, we will not attempt to reidentify such information, except to comply with applicable law.
• California Shine the Light. The California "Shine the Light" law permits users who are California residents to request and obtain from us once a year, free of charge, a list of the third parties to whom we have disclosed their personal information (if any) for their direct marketing purposes in the prior calendar year, as well as the type of personal information disclosed to those parties.
• Right for minors to remove posted content. Where required by law, California residents under the age of 18 may request to have their posted content or information removed from the publicly-viewable portions of the Services by contacting us at privacy@surecircle.net.
• Your Rights under State Data Protection Laws. You may have rights under certain US state data protection laws. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights include:
  • Right to know whether or not we are processing your personal data
  • Right to access your personal data
  • Right to correct inaccuracies in your personal data
  • Right to request the deletion of your personal data
  • Right to obtain a copy of the personal data you previously shared with us
  • Right to non-discrimination for exercising your rights
  • Right to opt out of the processing of your personal data if it is used for targeted advertising (or sharing as defined under California's privacy law), the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling")
• Exercise Your Rights. If you would like to exercise any of the rights below, please contact us as set forth at privacy@surecircle.net. We will process such requests in accordance with applicable laws.

GLBA Compliance

This section applies only to users residing in the United States (with SureCircle LLC as the operating entity).

• SureCircle LLC maintains a comprehensive written information security program designed to protect the confidentiality and integrity of nonpublic personal information (NPI) as required by the Gramm-Leach-Bliley Act (GLBA). This program includes administrative, technical, and physical safeguards, regular risk assessments, employee training, oversight of service providers, and ongoing evaluation and adjustment of security measures.
• As required by the GLBA, SureCircle LLC provides annual privacy notices to its customers describing our privacy practices, the categories of NPI collected, and the rights and choices available to consumers.
• You have the right to opt out of certain disclosures of your nonpublic personal information to non-affiliated third parties. To exercise this right, please contact us at privacy@surecircle.net.
• SureCircle LLC requires its service providers and contractors to implement appropriate safeguards to protect your personal information and NPI, and regularly reviews their compliance with our privacy and security standards.

FTC Compliance

This section applies only to users residing in the United States (with SureCircle LLC as the operating entity).

• SureCircle LLC collects only the personal information necessary for the purposes described in this Statement, and does not use personal information for purposes that are incompatible with those disclosed.
• In the event of a security breach affecting your personal information, SureCircle LLC will notify you as required by applicable law, using email, app notifications, or other appropriate means.

Compliance with Digital Services Privacy (DSP) requirements issued under Executive Order 14117 (EO 14117)

This section applies only to users residing in the United States (with SureCircle LLC as the operating entity).

SureCircle LLC will not transfer, disclose, or otherwise make available bulk sensitive personal information or government-related data to any entity or individual located in, or subject to the jurisdiction of, a country of concern as defined by applicable U.S. law and Executive Order 14117, except as expressly permitted by law, regulation, or government authorization. Prior to any cross-border transfer of personal information, SureCircle LLC will assess the recipient's jurisdiction and ensure compliance with all applicable restrictions.

Before engaging in any transfer of personal information to a foreign entity or service provider, SureCircle LLC will conduct enhanced due diligence to assess the risks associated with such transfer, including the recipient's data protection practices, legal environment, and potential for unauthorized access by foreign governments. SureCircle LLC will require contractual commitments from all foreign recipients to implement appropriate safeguards and will regularly review their compliance.

SureCircle LLC will maintain records of all cross-border transfers of sensitive personal information and government-related data, including the nature of the data, the recipient, and the jurisdiction. SureCircle LLC will cooperate with U.S. government authorities and provide timely reports regarding such transfers as required by Executive Order 14117, its implementing regulations, or other applicable law. SureCircle LLC will promptly notify the relevant authorities of any unauthorized or suspicious transfer or access involving countries of concern.

COOKIE NOTICE

Scope of This Notice

We, as well as third parties that provide content, advertising, or other functionality on our Services, may use cookies and other technologies ("Technologies") to automatically collect information through your use of our Services.

What is a Cookie?

A cookie is a small text file that is downloaded onto your computer or mobile device when you access a website. Cookies are designed to store your preferences and identify you across different websites in order to facilitate and enhance your experience.

Websites can use different types of cookies including 'first-' and 'third-' party cookies and session or persistent cookies. We briefly explain those different types of cookies below:

• First-party cookies are cookies set by the website visited by a user (i.e., the website displayed at the top of the browser).
• Third-party cookies are cookies that are set by a domain other than the one being visited by a user. If you visit a website but another company sets a cookie through that website, it would be a third-party cookie.
• Session cookies allow websites to link a user's actions during their browser session. Session cookies are temporary and remain on your device until you leave the website you are currently visiting.
• Persistent cookies, unlike session cookies, remain on a user's device in between browser sessions and remember the user's actions and preferences on a website or even potentially across different websites. Persistent cookies may be used to remember your preferences.

We also use the following:

• APIs/SDKs. We may use third-party application program interfaces ("APIs") and software development kits ("SDKs") as part of the functionality of our Services. For more information about our use of APIs and SDKs, please contact us as set forth in our Privacy Statement.

Our uses of these Technologies fall into the following general categories:

• Operationally Necessary. This includes Technologies that allow you access to our Services, applications, and tools that are required to identify irregular website behavior, prevent fraudulent activity, improve security, or allow you to make use of our functionality;
• Performance-Related. We may use Technologies to assess the performance of our Services, including as part of our analytic practices to help us understand how individuals use our Services;
• Functionality-Related. We may use Technologies that allow us to offer you enhanced functionality when accessing or using our Services. This may include identifying you when you sign into our Services or keeping track of your specified preferences, interests, or past items viewed;

What are my Choices Regarding Cookies and Similar Technologies?

If you do not allow cookies to be set on your computer or device, you may be unable to access certain parts of our online and mobile resources or certain parts of our online and mobile resources may have reduced functionality.

You have the right to decline our use of non-essential cookies by clicking the link change "Cookie Settings"

Updates to This Cookie Notice

We reserve the right to update this Notice from time to time. Please check our online and e-mail periodically for such updates since all information collected as described herein is subject to the Notice in place at the time of collection.