Privacy Notice

Privacy Notice

Effective Date: 01 September 2026

This Privacy Notice is to explain how Privy Pty Ltd and its affiliates, subsidiaries, and associated companies (“Privy”) collect, use, store, or otherwise process personal information about customers and other individuals within https://privyid.com/ site, its derivative sites, as well as the Privy Application (hereinafter referred to as the “Site” and “Privy Application” respectively). This Privacy Notice applies only to Privy Services, including but not limited to PrivySign, PrivyPass, PrivyChat and other services provided by Privy over time (hereinafter referred to as the “Privy Services”). This Privacy Notice is intended to provide Privy Users with information regarding how Privy undertakes the collection, processing, transformation, disclosure, retention, securing, analysis, erasure, and/or destruction of Privy Users Personal Data for Privy Services purposes (hereinafter referred to as the “Processing” or “To Process” or “Being Processed”). By using the Privy Service, Users understand that Privy will process User personal data as described in this Privacy Notice. The usage of Privy is governed by this Privacy Notice and the Terms of Use of the Privy Service.

This Privacy Notice shall become effective upon the User’s explicit consent to this Privacy Notice, either expressly or through the methods outlined within this Privacy Notice. Privy reserves the right to modify or amend this Privacy Policy from time to time. This Privacy Policy was last updated on the Effective Date.

1.DEFINITION

Each of the capitalized terms shall have the following meanings:

A.“Privy Account” is every account issued by Privy, with the name PrivyID, where each account owner will be given a userID, choose a password, and can store his/her Personal Data.

B.“Privy Application” is a mobile application (mobile apps) operated by Privy.

C.“Basic Data” is Personal Data required by Privy to be able to provide its services as set out in the Section 2 of this Privacy Notice.

D.“Personal Data” or "Personal Information" is any data that identifies or can be used to identify an individual, alone or in combination with other data/information, directly or indirectly, in electronic and/or non-electronic systems, which is divided into Specific/Sensitive Personal Data and General Personal Data. Privy classifies the Personal Data that we process in Section 2 below.

E.“Marketing Communications” means advertisement, communication, and marketing related to Services.

F.“Privy Services” means services for issuing Electronic Certificates, creating Privy Electronic Signatures (PrivySign), Privy Document Management System, PrivyPass, Electronic Seals, PrivyChat, PrivyHub, PrivyPal, and/or other Privy Services stated by Privy from time to time, either through Privy Site or Application.

G.“Processing” or “To Process” or “Being Processed” means collecting, processing, processing, disclosing, storing, securing, analyzing, deleting and/or destroying User Personal Data for the purposes of the Privy Services.

H.“User”, "You", or "Your" means every individual and/or legal entities/business entities who access the Privy Platform and/or use the Privy Services.

I.“Third Party” is an individual and/or legal entity/business entity that collaborates with Privy and can be proven by a document that binds the rights and obligations of each party.

J.“Privy” or "Us" means Privy is as described above and/or its subsidiaries, affiliated companies that have a direct or indirect relationship with Privy.

K.“PrivyID” means an alphanumeric code issued by Privy, which can be associated with a unique name (username), to identify Users when using Privy Services.

L.“Site” means any URL that uses the domain with the address "https://privyid.com/privacy/” or other sites stated by Privy from time to time.

2.PERSONAL INFORMATION PROCESSED BY PRIVY

To create a Privy Account and utilize Privy Services, User are required to provide their Personal Data to Privy accurately, clearly, precisely, and comprehensively. In the event that a User fails to provide the obligatory Personal Data as specified herein, or provides statements and guarantees, information, or Personal Data that are false, unclear, inaccurate, and/or incomplete, Privy retains the right to decline the application for creating a Privy Account for User and to suspend or terminate partially or entirely the Privy Services granted to the User.

Users may provide Personal Information about themselves in connection with their use of our Services such as:

The types of Personal Information that User may provide may include:

•Identification and Contact Information. This may include user’s full name, place date of birth, email address, phone number, personal id (including but not limited to your government identification card, driving license and/or passport).

•Payment and Commercial Information. This may include billing details, payment information (such as payment card number, expiration date, and security verification code), as well as information relating to Privy's products or Services that User purchase or subscribe to.

•Account and Profile Information. This may include User's account credentials, such as your email address and password, together with profile information that you choose to provide, including your name, contact details, and profile photo, biometric (including selfie/photo, liveness video).

•Customer Support and Communication Information. This may include inquiries, requests, comments, feedback, or other communications that User submit through online forms, email, customer support channels, or feedback surveys. If User communicate with Privy through chat features, Privy may also collect the Personal Information that voluntarily share during those interactions, including User’s name, email address, contact information, or other information that User choose to provide, and We may retain chat records for the purposes described in this Privacy Notice

Users may also provide Personal Information relating to other individuals when using certain features of our Services, including when they:

•Initiate or participate in an electronic transaction, such as Privy eSignature; and/or

•Share information through Privychat.

A.Data that Privy collects automatically

When Users access or use Privy Services, including when visiting our websites or applications, we may automatically collect certain Personal Data relating to the User, the device used to access the Services, and the User’s activities on the Services. The Personal Data collected may include, but is not limited to:

•Device and Technical Information, such as IP Address, unique device identifiers, operating system, browser type and version, and other attributes of the device used to access Privy Services.

•Usage and Activity Information, such as web log information, frequency of use of Privy Services, timestamps of activities, error logs, and other information relating to the User’s interaction with Privy Services.

•Transactional Data, including information relating to the User’s activities in connection with a transaction, such as IP Address, authentication method, transaction subject or subject line, history of actions performed in relation to the transaction (including reviewing documents, signing documents, or enabling certain features), and information relating to the devices used by the parties involved in the transaction.

B.Data that Privy collects from third parties

Users may create or access a Privy Account through a Third Party in order to access or use services provided by that Third Party. In such circumstances, the Third Party may act as the registration authority and provide Privy with the Personal Data submitted by the User during the registration process for the purpose of creating the User’s Privy Account.

Privy may also receive Personal Data concerning a User from other parties in connection with the use of Privy Services. For example, another customer or User may provide a User’s name and email address when requesting that the User participate in an electronic transaction or sign an electronic document through the Privy Services.

Where permitted under applicable laws and regulations, Privy may also receive Personal Data from Third Parties, including partners, service providers, affiliates, and other parties that are legally authorized to provide such information to Privy.

Where Personal Data is obtained from different sources, Privy may combine such information with Personal Data collected directly from Users or their devices and process the combined information in accordance with this Privacy Notice.

C.Cookies

In improving Privy Services quality, Privy uses cookies as long as the User uses the Privy Services, to recognize and remember certain information on the User's browser including session management, service personalization, and User activity recording. Users may choose to disable or manage cookies through their browser settings. However, disabling or restricting cookies may affect the availability or functionality of certain features of the Privy Services.

3.PURPOSE OF PERSONAL INFORMATION PROCESSING FOR USER

Privy processes User's Personal Data for the following purposes:

A.General Purpose

i.To provide Privy Services, such as:

a.Issuing PrivyID, creating Privy Account, as well as issuing, managing, and revoking Electronic Certificates issued by Privy.

b.Collecting, recording, and analyzing data related to user activities involving the Privy Services.

c.Notifying Users regarding transactions and/or activities occurring within the Privy Application or other systems connected to the Privy Application.

ii.The transmission of information regarding the Privy Services, updates, developments, and/or enhancements of the Privy Services, or services provided by Third Party collaborating with Privy.

iii.Internal product development purposes, including but not limited to audits and analysis related to the development, maintenance, testing, troubleshooting, enhancement, and customization of Privy Services to meet the needs and preferences of User.

iv.Fulfillment of Privy’s obligation to competent authorities in accordance with applicable laws and regulations.

v.Personalization of the Privy Application and/or Services for User provided by Privy and/or Third Party collaborating with Privy.

vi.Processing User request in connection with Privy Services, including but not limited to access, correction, updating, and/or deletion/destruction of the User’s Personal Data within the Privy system, as well as contacting the User regarding such User request.

vii.Other purposes as long as those purposes are not prohibited by applicable laws and regulations. Privy will inform User about those other purposes when seeking the User’s consent if required by applicable laws and regulations.

B.Marketing Communications Purpose

Privy may send Users marketing and promotional communications relating to the Services, including personalized content and advertisements based on relevant User attributes or demographic characteristics derived from the User’s profile. Such communications may also include information relating to sponsors of events, webinars, or other activities in which the User participates.

Privy may also work with advertising networks, advertising measurement and analytics providers, remarketing providers, and other marketing partners to deliver, measure, analyze, and improve relevant marketing content and advertisements. For these purposes, Privy and its marketing partners may use cookies and similar technologies on Privy’s Site and, where applicable, on Third Party websites or applications.

The delivery of such information may be carried out by Privy or by Third Party in partnership with Privy, including sponsors and advertisers. Privy will ensure that every delivery of such Marketing Communications is carried out in accordance with applicable laws.

These Marketing Communications may be distributed through various media, including but not limited to:

i.Privy’s official platforms (including but not limited to Privy’s official social media, Privy Application and/or Site);

ii.Short Message Services (SMS);

iii.Messaging applications (including but not limited to WhatsApp and Telegram);

iv.Push notifications; and/or

v.E-mail.

4.PROCESSING AND LEGAL BASIS FOR PERSONAL INFORMATION

The Processing of Personal Data may be based on the User’s consent, the performance of contractual obligations necessary to provide the Services, compliance with applicable legal and regulatory requirements, or legitimate interests pursued by the organization. Where consent is relied upon, User will be provided with information regarding the relevant Processing and how consent may be managed or withdrawn. Where legitimate interests apply, the Processing will take into consideration the purpose and necessity of the Processing, as well as the rights and interests of the User as the Personal Data Subject.

The table below provides further details on the purposes for which Personal Data may be processed, and the legal bases applicable to such Processing in connection with Privy Services. The examples set out in the table are illustrative and do not constitute an exhaustive list of the purposes, categories of Personal Data, or legal bases that may apply.

5.DISCLOSURE OF USER PERSONAL INFORMATION

Privy may disclose User's personal information for the following purposes and for other purposes permitted by applicable laws and regulations:

a.To enable Privy to provide the Privy Services and/or to perform or render services to the User, including but not limited to disclosures to:

i.Companies within the Privy Group or Affiliates, Privy may share Users’ Personal Data with entities that are part of the same corporate group or are subject to common ownership or control. These entities may process the Personal Data for purposes consistent with this Privacy Notice and in accordance with the applicable data protection laws and regulations.

ii.Other Users, as parties directly associated with the User in relation to the User’s utilization of the Privy Services;

iii.Service Providers, Privy may provide access to Users’ Personal Data to Third Party providers engaged to assist Privy in operating, maintaining, and delivering its Services. Such providers may perform functions including data search and analysis, advertising, user authentication, billing and payment processing, fraud prevention, and customer support.

iv.Marketing Partners, Privy may share Users’ Personal Data with third parties that support Privy’s marketing and promotional activities as explained in Section 3(B) above.

v.Public or Government Authorities. Privy may disclose or provide access to Users’ Personal Data to relevant government institutions, regulatory bodies, law enforcement agencies, courts, or other authorized public authorities where such disclosure is required or permitted under applicable laws and regulations. This may include responding to lawful requests, court orders, subpoenas, investigations, audits, or other legal or administrative proceedings. Privy may also disclose Personal Data where reasonably necessary to address situations involving threats to the safety of individuals, suspected unlawful activities, breaches of applicable terms or agreements, or to safeguard the rights, interests, property, and security of Privy, its Users, employees, or other parties.

vi.Corporate Transactions. In connection with any proposed or completed corporate transaction involving Privy, Users’ Personal Data may be disclosed or transferred to relevant parties as necessary for the transaction or related due diligence process. Such transactions may include mergers, acquisitions, restructuring, consolidation, joint ventures, transfer or assignment of business or assets. Where such transaction results in a change to the party responsible for or controlling Users’ Personal Data, Privy will provide appropriate notice regarding the change and, where applicable, inform Users of any choices or rights available to them.

vii.The organization or legal entity to which a User is associated and registered through the Privy Services (if any).

b.To comply with laws and regulations, including where required for law enforcement and/or preventive measures in connection with unlawful activities, alleged criminal acts, legal violations, or legislative regulations.

c.Privy may disclose or share Users’ Personal Data where the User has specifically requested such disclosure or has provided the necessary consent.

Users’ Personal Data may also be shared or disclosed in accordance with the circumstances and purposes described below:

a.Profile Information. When a User creates and maintains a profile within Privy Services, certain information included in the User’s profile may be accessible to or visible to other Privy Users, depending on the features and functionalities used.

b.Employer or Organization. When a User creates an account or is assigned a user role using an email address associated with their employer, organization, or other institution, that organization may be able to identify or locate the User’s account and, where applicable, perform certain actions or manage specific aspects of the account in accordance with the Services and features made available to the organization.

In the event that a User provides consent to a third party to utilize the User's Privy Account to access services provided by a third party, any utilization of the User’s personal information by the third party will be subject to the relevant terms and conditions and/or privacy notice of the third party and Privy is not responsible for the privacy practices of those third parties. Privy recommends that Users review the terms and conditions and/or privacy policies of each third party that the User engages with.

6.PERIOD OF PROCESSING AND STORAGE OF PERSONAL DATA

Privy processes, in particular stores, Personal Data in accordance with applicable laws and regulations, taking into account the following conditions:

A.Collection and Commencement of Processing. Privy may commence processing Personal Data when the Personal Data is collected or otherwise obtained by Privy on a lawful basis in accordance with applicable laws and regulations. This may include when the User provides consent, creates or uses a Privy Account, provides Personal Data through Privy’s Applications or Sites, or when Personal Data is obtained through a Third Party pursuant to an agreement or other lawful arrangement with Privy. Personal Data may also be processed on any other lawful basis permitted under applicable laws and regulations.

B.Retention Period. Personal Data is retained:

i.for as long as the User continues to use Privy Services for the duration of the User’s use of the Privy Services, to the extent that the Personal Data remains necessary for the provision of such Services;

ii.for such additional period as may be necessary to comply with applicable legal or regulatory obligations, establish, exercise, or defend legal claims, resolve disputes, conduct audits, prevent fraud or misuse, or otherwise comply with applicable laws and regulations.

Upon expiration of the applicable retention period, Privy will delete, destroy, anonymize, or otherwise process the Personal Data in accordance with applicable laws and regulations and Privy’s applicable data retention and deletion procedures.

C.Termination of Processing. Privy will cease processing Personal Data when the applicable purpose of processing has been fulfilled or when there is no longer a lawful basis or legitimate need for such processing, subject to applicable retention requirements. This may occur when:

i.the purposes for which the Personal Data was collected or otherwise processed have been fulfilled and no further processing is necessary;

ii.the User withdraws their consent, where the processing is based on consent, and there is no other lawful basis for Privy to continue the relevant processing;

iii.the User submits a valid request for erasure or termination of processing, to the extent that Privy is required to comply with such request under applicable laws and regulations;

iv.the applicable retention period has expired and Privy is not required or otherwise permitted to retain or process the Personal Data; and/or

v.the relevant legal or contractual relationship has expired or been terminated and there is no continuing lawful basis or obligation requiring further processing.

Notwithstanding the foregoing, Privy may continue to retain or otherwise process certain Personal Data where necessary or required under applicable laws and regulations, including for compliance with legal or regulatory obligations, the establishment, exercise, or defense of legal claims, dispute resolution, audit purposes, or other lawful purposes.

7.USE OF ARTIFICIAL INTELLIGENCE (AI) SYSTEMS AND AUTOMATED PROCESSING

Privy may use artificial intelligence (AI)-based systems, tools, or technologies as part of its Personal Data Processing activities in internal operations, product development, the provision of Services, data analysis, and business support functions. In this context, the use of AI may involve the automated processing of Personal Data as regulated by applicable laws and regulations.

Any output generated by an AI system will undergo a process of review, validation, and internal oversight before it can be implemented and used, and is subject to relevant evaluations to ensure compliance with applicable laws and regulations. For example, AI may be used for the following purposes:

A.Improving operational efficiency, including identifying trends, news, or information, and optimizing internal processes.

B.Handling User inquiries regarding Privy Services through the chatbot feature.

C.Development and improvement of other Privy Services, which will be communicated to Users from time to time.

Privy implements appropriate technical and organizational measures to ensure that data processing activities related to the use of AI are conducted securely, lawfully, and responsibly. Privy may also update, modify, enhance, or discontinue the use of certain AI technologies from time to time as part of an ongoing evaluation of technological suitability, regulatory developments, security considerations, and business needs.

8.SECURITY OF USER PERSONAL INFORMATION

Privy has implemented appropriate technical and organizational measures to protect the confidentiality and security of User Personal Data against accidental, unlawful, or unauthorized destruction, loss, alteration, disclosure, acquisition, access, or other unlawful processing. Any content uploaded or transmitted by Users through Privy Services will be stored securely and transmitted confidentially using industry-standard security measures. To support these measures, Privy has implemented an Information Security Management System and a Privacy Information Management System and has obtained ISO 27001:2022 and ISO 27701:2019 certifications. Access to User Personal Data is restricted to authorized parties and only to the extent necessary for the applicable purposes.

Privy will notify affected Users of any failure to protect the confidentiality of their Personal Data in Our systems, as required under applicable laws and regulations. Users are responsible for maintaining the confidentiality of their account credentials, including passwords and One-Time Passwords (OTPs), and for maintaining the security of the devices used to access Privy Services.

9.USER RIGHTS

Upon User request, Privy will provide Users with the ability to access and correct the User's personal information that Privy holds. If a User wishes to access or correct their personal information held by Privy, the User should submit the request to Privy using the details set out in the sub sections below. The availability and scope of these rights may depend on the applicable laws and circumstances of the processing:

a.Access Request

Users may request and obtain a copy of the User’s Personal Data stored within Privy system. Granting access and a copy of data to Users will be carried out in accordance with the provisions of the applicable laws and regulations. Privy will provide such access unless exempted by law and/or regulation.

b.Change Request

Users may request the correction, completion, or updating of their Personal Data where such Personal Data is inaccurate, incomplete, or no longer up to date. Where the relevant functionality is available, Users may review and update certain Personal Data directly through their profile, account settings, or other mechanisms provided within the Privy Application. For Personal Data that cannot be updated directly through such mechanisms, Users may submit a request to Privy using the contact details provided in this Privacy Notice.

Privy may request supporting information or documentation and conduct reasonable verification as necessary to verify the User’s identity, the accuracy of the requested changes, and the validity of the request, in accordance with Privy’s applicable procedures. Privy will process and implement requests for correction, completion, or updating of Personal Data in accordance with applicable laws and regulations.

c.Anonymity

Where possible, Privy will allow you to interact with us anonymously or using a pseudonym. For example, if you contact Privy with a general inquiry, we will not ask for your name unless we need it to adequately handle your inquiry. However, as noted above, for most of our activities and services, we usually need your name and contact information.

d.Closing Account

Users may request to close or deactivate their Privy Account through the mechanisms made available by Privy or by contacting Privy using the contact details set out in this Privacy Notice. Closing or deactivating Privy Account does not necessarily result in the immediate deletion of all Personal Data associated with the User. Privy may retain certain Personal Data where required or permitted under applicable laws and regulations.

e.Other Privacy Rights

Subject to the applicable laws and regulations, Users may exercise their privacy rights, where applicable. Where applicable, Privy will provide such Personal Data in a commonly used and machine-readable format.

Users may object to certain processing of their personal information, including direct marketing activities, where such right is available under applicable laws and regulations. Where the processing of personal information is based on the User’s consent, the User may withdraw such consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.

Users may also manage or restrict certain permissions granted to the Privy Application or their browser, including access to location data, through their device, browser, or application settings. Restricting or disabling such permissions may affect the availability or functionality of certain Privy Services or features that require the relevant information.

Certain Personal Data may be exempt from the exercise of these rights under applicable laws and regulations. In addition, certain Personal Data may be necessary for Privy to provide its products and services. If a User requests the deletion or restriction of such Personal Data, User may no longer be able to access or use certain Privy Services.

f.Complaints

Users may contact Privy if they have any questions, concerns, or complaints regarding the collection, use, storage, or other processing of their Personal Data for Privy Services, or regarding this Privacy Notice. Privy will handle such complaints in accordance with its applicable procedures and applicable laws and regulations. Where applicable under applicable laws and regulations, Users may also have the right to raise a complaint with the relevant data protection authority.

g.Verification of Requests

If a User makes a request to exercise any of the rights described above, Privy may require the User to provide certain information or complete an appropriate verification process to confirm the User’s identity and protect the User’s Personal Data from unauthorized access or disclosure. If the User fails or refuses to provide the information reasonably required for such verification, or if Privy is otherwise unable to reasonably verify the User’s identity, Privy may decline to process or fulfill the request, to the extent permitted by applicable laws and regulations. Privy will inform the User of such decision and the reasons for it, where required by applicable laws and regulations.

10.CHILDREN’S PRIVACY

Privy Services are generally intended for individuals who are at least 18 years of age, or who have otherwise reached the age at which they may independently provide valid consent or enter into the relevant transaction under applicable laws and regulations.

Where a User is considered a child or minor under applicable laws and regulations, Privy may require consent or authorization from the User’s parent, legal guardian, or other legally authorized representative before collecting or otherwise processing the User’s Personal Data or permitting the User to access or use certain Privy Services.

Privy does not knowingly collect or process Personal Data of children or minors without obtaining any consent or authorization required under applicable laws and regulations. If Privy becomes aware that Personal Data of a child or minor has been collected or processed without the required consent or authorization, Privy will take appropriate measures, which may include restricting or terminating access to the relevant Services and deleting the Personal Data, unless its continued retention or processing is required or otherwise permitted by applicable laws and regulations.

11.CONTACT AND NOTIFICATIONS

a.Notice from Privy

Every notification from Privy addressed to Users will be announced on the Site and sent via email, SMS, or push notifications through the Privy Application installed on the User's device registered with Privy.

b.Notice from User

For questions regarding this Privacy Notice, Users may contact Privy via the e-mail address dpo@privy.id. For questions or complaints regarding Privy's collection, use or handling of Personal Information, Users may contact Privy via the e-mail address helpdesk@privy.id.

12.CHANGES TO THIS PRIVACY NOTICE

Privy may review and amend this Privacy Notice from time to time to reflect changes in applicable laws and regulations, Privy Services, or Privy’s Personal Data processing practices. Where required, Privy will notify Users of any material changes through the notification methods described in this Privacy Notice or through other appropriate means.

Privy’s processing of Personal Data will be subject to the version of this Privacy Notice in effect at the relevant time. Users are encouraged to periodically review this Privacy Notice to stay informed of any changes.

13.SUPPLEMENTAL PRIVACY PROVISIONS FOR CUSTOMERS AND/OR USERS IN CERTAIN JURISDICTIONS

If you reside in any of the jurisdictions listed below, the applicable privacy provisions will also govern the processing of your Personal Data. If those provisions are inconsistent with this Privacy Notice, the jurisdiction-specific provisions will prevail solely to the extent of the inconsistency.

A.Australia

•Application of the Australian Privacy Laws. Privy Australia Pty Ltd is regulated under the Privacy Act 1988 (Cth). For Users located in Australia, this section applies in addition to the other provisions of this Privacy Notice and should be read together with applicable Australian privacy laws, including the Privacy Act 1988 (Cth) and the Australian Privacy Principles, as applicable.

•Disclosure of Users personal information. To enable Privy to provide the Privy Services and/or to perform or render services to the User, Privy may disclose User's personal information to agents, contractors, or third parties who provide services to Privy to enable Privy to provide services to its Users. These Agents, contractors, or third parties may render services to Privy in the form of verification and authentication (including, for example, identity verification service providers and Gateway Service Providers (GSP) for the Australia Document Verification Service (DVS)), analysis, promotions, fraud detection, payment, or other User support services.

•How to Contact Us. If you have any questions or complaints regarding Privy’s processing of your Personal Data or its compliance with applicable Australian privacy laws, you may contact Privy via the e-mail address support@privyid.com or at dpo@privyid.com and/or through a physical document sent to Privy Australia Pty Ltd with the address:

International Towers Two, Suite 1, Level 39, 200 Barangaroo Avenue, Sydney NSW 2000.

If you submit a complaint, we will endeavour to respond within 30 days. If you are dissatisfied with our response, you have the right to submit a complaint to the Office of the Australian Information Commissioner through the following contact information:

i.Phone: 1300 363 992

ii.Fax : +61 2 6123 5145

iii.Email: enquiries@oaic.gov.au

iv.Post: GPO Box 5228 Sydney NSW 2001

B.United States (California)

•Application of the California Consumer Privacy Act. Where applicable, Privy processes Personal Information relating to California residents in accordance with the California Consumer Privacy Act of 2018, as amended, including by the California Privacy Rights Act of 2020 (collectively, the “CCPA”). This section applies to individuals who are California residents and qualify as “Consumers” under the CCPA.

The rights and disclosures described in this section supplement the information provided elsewhere in this Privacy Notice and apply only to the extent that Privy and the relevant processing activities are subject to the CCPA.

•Personal Information We Collect, Use, and Disclose. Privy may collect, use, retain, and disclose the categories of Personal Information described in this Privacy Notice for the business or commercial purposes described herein. Where required by the CCPA, Privy will provide information regarding the categories of Personal Information collected, the purposes for which such Personal Information is collected or used, and the categories of sources from which it is collected.

•Sale or Sharing of Personal Information. The CCPA provides California Consumers with the right to opt out of the “sale” of their Personal Information and the “sharing” of their Personal Information for cross-context behavioral advertising, as those terms are defined under the CCPA.

To the extent Privy engages in activities that constitute a “sale” or “sharing” of Personal Information under the CCPA, California Consumers may exercise their right to opt out through the mechanisms made available by Privy, including any applicable privacy preference or opt-out mechanism provided through Privy’s Services.

Privy may use or work with advertising, analytics, measurement, and marketing partners that use cookies or similar technologies in connection with Privy’s websites or Services. Depending on the nature and circumstances of such processing, certain disclosures of Personal Information to these parties may constitute “sharing” under the CCPA.

•California Consumer Rights. Subject to applicable exceptions, limitations, and verification requirements under the CCPA, California Consumers may have the right to Know and Access, Delete, Correct, Opt Out, Limit the Use and Disclosure of Sensitive Personal Information, and Non-Discrimination.

•Exercising California Privacy Rights. California Consumers may exercise their applicable rights using the methods specified in this Privacy Notice or through other mechanisms made available by Privy. Privy may take reasonable steps to verify the identity of the Consumer and, where applicable, the authority of an authorized agent before processing a request. Privy may decline or limit a request where permitted under the CCPA, including where Privy is unable to reasonably verify the Consumer’s identity or where an applicable exception applies

C.European Union (EU), European Economic Area (EEA), and/or United Kingdom (UK)

•Application of the EU General Data Protection Regulation 2016/679 (“GDPR”) the United Kingdom General Data Protection Regulation (“UK GDPR”). Where Privy processes Personal Data in circumstances that are subject to EU GDPR, UK GDPR, or other applicable data protection laws in the EU, EEA, or UK, Privy will process such Personal Data in accordance with the applicable requirements of those laws. Where applicable, Privy will comply with requirements relating to, among others, lawful bases for processing, transparency, purpose limitation, data minimization, accuracy, retention, security and confidentiality, accountability, and the exercise of applicable data subject rights.

•Rights of Individuals in the EU, EEA, and UK. Where the EU GDPR or UK GDPR applies to the processing of a User’s Personal Data, the User may exercise the rights available to them under the applicable data protection laws, subject to the conditions, limitations, and exemptions provided under such laws. These rights may include the right to access, rectify, erase, or restrict the processing of Personal Data, the right to object to certain processing, the right to data portability, and, where processing is based on consent, the right to withdraw consent. Users may exercise their applicable rights by contacting Privy through the contact details specified in this Privacy Notice. Privy may take reasonable steps to verify the identity of the User before processing such request

•International Transfers. Where processing subject to the EU GDPR or UK GDPR involves an international transfer of Personal Data that is subject to applicable transfer restrictions, Privy will ensure that such transfer is conducted in accordance with applicable data protection laws and that an appropriate transfer mechanism or safeguard is implemented where required. Depending on the circumstances, such mechanisms or safeguards may include an applicable adequacy decision or regulation, standard contractual clauses or other approved contractual safeguards, or another transfer mechanism permitted under applicable data protection laws

D.Republic of Indonesia

•Application of the Indonesian Privacy Laws. Privy is registered by the Ministry of Communication and Digital Affairs of the Republic of Indonesia as an Electronic Certification Provider (Penyelenggara Sertifikasi Elektronik/ PSrE) and therefore, Privy processes Personal Data in accordance with applicable Indonesian Personal Data protection laws and regulations including but not limited to the Law No 27 of 2022 on Personal Data Protection. For Users located in Indonesia, this section applies in addition to the other provisions of this Privacy Notice and should be read together with applicable Indonesian laws and regulations concerning Personal Data protection and electronic systems.

•Data Residency. Personal Data processed by Privy specifically in connection with its activities and obligations as PSrE will be processed and stored within Indonesia. This data residency commitment applies specifically to Personal Data processed within the scope of Privy’s PSrE services.

•Data Retention. Personal Data processed by Privy in its capacity as PSrE will be retained for the applicable retention period specified in Privy’s Certification Practice Statement (CPS).