PRIVACY POLICY
Last Updated and Effective: September 18, 2023

This is the Privacy Policy (“Policy”) of Nodal Solutions, LLC (“Company”, “us”, “our”, or “we”), a Colorado limited liability company with offices at 3798 Marshall St., Suite 5, Wheat Ridge, CO 80033. You can contact us using the information below. This Privacy Policy describes how we collect, use, disclose, and process your Personal Data (as defined below). We also describe your choices and rights with respect to how we process that Personal Data. Please read this Policy carefully. You may print a copy of this Privacy Policy for your records.

SCOPE
This Policy applies to our “Services” which include”:

• our website at www.nodalsolutions.com (including any subdomains or mobile versions the “Site”); and
• our cloud-based software application, web portals, and related services (the “Platform”).

Any capitalized term not defined in this Policy will have the definition provided in our Terms of Use.
Your use of our Services indicates your acknowledgement of the practices described in this Policy.

THIRD PARTIES
We provide certain service and process information on behalf of third parties that have entered into an agreement with us to provide our Services (our “Customers”). This Policy reflects only how we process Personal Data through our Services. This Policy does not apply to information processed by or on behalf of our Customers, which will be subject to the Customer’s privacy policy. Similarly, this Policy does not apply to third parties, for example, operators of third-party websites or third-party services, unless those parties collect or process information on our behalf. Please review any relevant third party’s privacy policy for information regarding their privacy practices.

COLLECTION AND USE OF PERSONAL DATA
Personal Data We Collect
In order to provide our Services, we may collect and process information that relates to identified or identifiable individuals (“Personal Data”). We collect and process the following categories of Personal Data (note, specific Personal Data elements are examples and may change):

Identity Data:
Personal Data about you and your identity, such as your name, username, biographic/profile data, business or employer affiliation, and other Personal Data you may provide on registration forms or as part of an account profile.

Contact Data:
Identity Data used to contact an individual, e.g., email address, physical address, or phone number.

Transaction Data:
Personal Data we collect in connection with a transaction or purchase, such as your order, the price, and other similar information.

Payment Data:
Payment card information. Note that Payment Data may be considered “sensitive personal information” or “sensitive personal data” under applicable law.

Device/Network Data:
Personal Data relating to your device, browser, or application e.g., IP addresses, MAC addresses, application ID/AdID/IDFA, identifiers from cookies, session history and similar browsing metadata, and other data generated through applications and browsers, including via cookies and similar technologies.

General Location Data:
Personal Data relating to your general physical location data (e.g., city, state, or approximate location).

User Content:
Personal Data included in content provided by users of the Service in any free-form or unstructured format, such as in a “contact us” box, free text field, in a file or document, or messages to us.

Inference Data:
Personal Data relating to inferred preferences and trends, such as portions of the Services you use, trends and patterns in usage, Platform performance, and similar matters, and (in the case of our marketing operations) inferred demographics or interests.

How We Collect Personal Data
We collect Personal Data from various sources based on the context in which the Personal Data will be processed:

Data we collect from you:
We collect Personal Data from you directly, for example, when you input information into an online form, or contact us directly.

Data we receive from others:
We receive Personal Data from third parties with whom we have a relationship in connection with a relevant transaction, for example, we may receive certain Personal Data when a Customer signs up for our Services and provides a list of Authorized Users.

Data collected automatically:
We may collect certain Personal Data automatically. For example, we collect Device/Network Data automatically using cookies and similar technologies when you use our Service, access our Sites, or when you open our marketing communications.

Data that we create or infer:
We may create Inference Data using other Personal Data we process, or generate Aggregate Data relating to certain trends, habits or other analytics.

CONTEXTS FOR COLLECTING AND PROCESSING PERSONAL DATA / NOTICES AT COLLECTION
Our use of Personal Data depends on who you are and how you interact with us. When you use our Services, we process Personal Data in specific contexts and for certain specified purposes, as well as for our general Business Purposes. Residents of certain jurisdictions may be entitled to additional notices under applicable law; see the “Supplemental Privacy Rights and Notices” section below for more information.

Our Platform
Subscription & Account Registration
Customers and the users authorized to access our Services on their behalf (“Authorized Users”) may register and create an account (for themselves or on behalf of other Authorized Users) in order to use our Platform. If you choose to register, we will process Identity Data, Contact Data, Device/Network Data, and any User Content requested on the registration form and as part of an Authorized User account profile. We may also collect additional User Content from you, for example, in response to a request for data, information, questionnaire responses, file uploads, or similar matters.

If you subscribe to the Platform, we (or our third party service provider) will collect and process Identity Data, Contact Data, Device/Network Data and Payment Data as necessary to process, secure, and document your payment transaction. We do not store your Payment Data within the Platform, and Payment Data is processed solely as necessary to process the payment transactions.

We use this Identity Data, Contact Data, and User Content collected in this context as necessary to create, maintain, and provide you with important information about your account, and to otherwise provide the services and features Customers or Authorized Users request. We may use Contact Data to send you information relating to your account or the Platform (such as payment confirmations and service-related alerts), and if permitted by law, in connection with Marketing Communications. We also process Personal Data collected in this context for our Business Purposes.

Platform Use
We process Device/Network Data, Contact Data, Identity Data, General Location Data, and Inference Data when you use our Platform. We use this Personal Data as necessary to operate our Platform, such as keeping you logged in, delivering pages, etc., for our Business Purposes, and our other legitimate interests, such as:

• analyzing the use of our Platform, including navigation patterns, clicks, etc. to help understand and make improvements to the Platform and provide contextually relevant information to you, and other features related to service usage; and

• creating aggregate information about users’ login locations and patterns, which we use to help improve and secure our Platform.

Marketing Communications
We may process Identity Data, Device/Network Data and Contact Data in connection with email marketing communications (such as promotional emails), which you might receive if you register for an account, choose to receive marketing communications, or engage in a transaction allowing us to send you those marketing communications. We may also automatically collect Device/Network Data when you open or interact with those marketing communications so that we can better understand engagement with our marketing communications.

Subject to your rights & choices, we use Identity Data and Contact Data as necessary to customize, deliver, and otherwise process marketing communications, and in order to tailor certain communications to individuals’ preferences and requests. Additionally, we may process Device/Network Data from devices receiving those marketing communications as part of our business interests in understanding whether our emails are opened or other aspects of engagement with such marketing communications.

Contact Us
When you contact us though the Site using a contact us box, through our chat, or via email, we process Personal Data such as Identity Data, Device/Network Data, and any Personal Data contained within any User Content. We use Identity Data, Contact Data, and User Content as necessary to communicate with you about the subject matter of your request and related matters. We may also process data collected in this context for our Business Purposes.

Cookies and Similar Tracking Technologies
We, and certain third parties, automatically collect and process Identity Data, Contact Data, and Device/Network Data when you interact with cookies and similar technologies on our Services. We may receive this data from third parties to the extent allowed by the applicable partner. Please note that the privacy policies of third parties may also apply to these technologies and the Personal Data collected through them.

Subject to your rights & choices, we may use this information as follows:

1. for “essential” or “functional” purposes, such as to enable certain features of the Services, or keeping you logged in during your session; and

2. for “analytics” and “personalization” purposes, consistent with our business interest in how the Services are used or perform, how users engage with and navigate through our Service, what sites users visit before visiting the Service, how often they visit the Service, and other similar information, as well as to greet users by name and modify the appearance of the Service to usage history, tailor the Service based on geographic location or Customer, and understand characteristics of users in various technical and geographic contexts.

Note:     Some of these technologies can be used to identify you across platforms, devices, sites, and services.

Business Purposes of Processing
In addition to the processing described above, we generally process Personal Data for several common purposes in connection with our business, as described further below (“Business Purposes”):

Service Provision and Contractual Obligations
We process Personal Data as necessary to provide our Services, to authenticate users and their rights to access the Service and as otherwise necessary to fulfill our contractual obligations to you, and provide you with the information, features, and services you request. Similarly, we may use Personal Data as necessary to audit compliance, and log or measure aspects of service delivery.

Internal Processing and Service Improvement
We may use any Personal Data we process through our Services as necessary in connection with our legitimate interests in improving the design of our Service, understanding how our Services are used or function, for customer service purposes, for internal research, technical or feature development, to track service use, QA and debugging, audits, and similar purposes.

Security and Incident Detection
We may process any Personal Data we collect in connection with our legitimate business interest in ensuring that our properties and locations are secure, identify and prevent crime, prevent fraud, and ensure the safety of our users. Similarly, we process Personal Data on our Platform as necessary to detect security incidents, protect against, and respond to malicious, deceptive, fraudulent, or illegal activity. We may analyze network traffic, device patterns and characteristics, maintain and analyze logs and process similar Personal Data in connection with our information security activities.

Personalization
We process certain Personal Data as necessary in connection with our legitimate business interest in personalizing our Services. For example, aspects of the Services may be customized to you so that it displays your account information and other appearance or display preferences, to display content that you have interacted with in the past, or to display content that we think may be of interest to you based on your interactions with our Services and other content. This processing may involve the creation and Personal Data that we infer based on your preferences.

Aggregated Data
We process Personal Data about our customers and users in order to identify trends (to create aggregated and anonymized data about our customers/users use of our Services, and other similar information (“Aggregated Data”). We may pass Aggregated Data to the third parties referred to in the section below to give them a better understanding of our business and to bring you a better service. Aggregated Data that does not contain Personal Data is not subject to this Privacy Policy.

Compliance, Health, Safety, Public Interest
We may also process any Personal Data as necessary to comply with our legal obligations, such as where you exercise your rights under data protection law and make requests, for the establishment and defense of legal claims, or where we must comply with our legal obligations, lawful requests from government or law enforcement officials, and as may be required to meet national security or law enforcement requirements or prevent illegal activity. We may also process data to protect the vital interests of individuals, or on certain public interest grounds, each to the extent allowed under applicable law. Please see the How We Share Personal Data section for more information about how we disclose Personal Data in extraordinary circumstances.

Other Business Purposes
If we process Personal Data in connection with our Service in a way not described in this Privacy Notice, this Privacy Notice will still apply generally (e.g., with respect to your rights and choices) unless otherwise stated at collection. We will process such information in accordance with the notice provided at the time of collection or in a manner that is necessary and proportionate to achieve the operational purpose for which the personal information was collected or processed or for another operational purpose that is compatible with the context in which the personal information was collected.

DATA SHARING
Information we collect may be shared with a variety of parties, depending upon the purpose for and context in which that information was provided. We generally transfer data to the categories of recipients or in connection with specific Business Purposes, each described below.

Customers
We process data on behalf of our Customers, and we may share certain Personal Data with Customers to the extent such information was provided to us for processing on the Customer’s behalf, or in the event the Customer has a legitimate business purpose for receiving the information. For example, users’ account information (for example name and email) may be made available to the relevant Customer as necessary to document a Customer’s use of the Service, or as appropriate to ensure the security of Customer accounts.

Business Purposes
In connection with our general business operations, product/service improvements, to enable certain features, and in connection with our other lawful business interests, we may share Personal Data with contractors, service providers or subprocessors who provide certain services or process data on our behalf. For example, we may use cloud-based hosting providers to host our Services or disclose information as part of our own internal operations, such as security operations, internal research, etc.).

Corporate Events
Your Personal Data may be processed in the event that we go through a business transition, such as a merger, acquisition, liquidation, or sale of all or a portion of our assets. For example, Personal Data may be part of the assets transferred, or may be disclosed (subject to confidentiality restrictions) during the due diligence process for a potential transaction.

Affiliates
In order to streamline certain business operations, share promotions and content we believe would be of interest to you, and develop products and services that better meet the interests and needs of our customers, we may share your Personal Data with any of our current or future affiliated entities, subsidiaries, and parent companies, including, but not limited to, a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Nodal Solutions, LLC’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by Nodal Solutions, LLC about our Site users is among the assets transferred.

Legal Disclosures
In limited circumstances, we may, without notice or your consent, access and disclose your Personal Data, any communications sent or received by you, and any other information that we may have about you to the extent we believe such disclosure is legally required, to prevent or respond to a crime, to investigate violations of our Terms of Use or a customer agreement, or in the vital interests of us or any person. Note, these disclosures may be made to governments that do not ensure the same degree of protection of your Personal Data as your home jurisdiction. We may, in our sole discretion (but without any obligation), object to the disclosure of your Personal Data to such parties.

YOUR RIGHTS & CHOICES
Your Rights
Applicable law may grant you rights in your Personal Data. These rights vary based on your location, state/country of residence, and may be limited by or subject to our or our Customers’ own rights in your Personal Data. In cases where we process Personal Data on our own behalf, you may exercise rights you have by contacting us at privacy@nodalsolutions.com. If we process your Personal Data on behalf of a Customer, please contact the Customer to exercise your rights.

You may have other rights and choices regarding the Personal Data we process. See the “Regional Supplements” section below for rights available to you in your jurisdiction.

We verify your identity as required by applicable law, as described below.

Your Choices

Marketing Communications
You can withdraw your consent to receive marketing communications by clicking on the unsubscribe link in an email. You can also withdraw your consent to receive marketing communications or any other consent you have previously provided to us by contacting us at the address below. To opt-out of the collection of information relating to email opens, configure your email so that it does not load images in our emails.

Withdrawing Your Consent/Opt-Out
You may withdraw any consent you have provided at any time. The consequence of you withdrawing consent might be that we cannot perform certain services for you, such as location-based services, personalizing or making relevant certain types of advertising, or other services conditioned on your consent or choice not to opt-out.

Cookies, Similar Technologies, and Targeted Advertising
If you do not want information collected through the use of cookies, you can manage/deny cookies (and certain technologies) using your browser’s settings menu. You may need to opt out of third-party services directly via the third party. For example, to opt-out of Google’s analytic and marketing services, visit Google Analytics Terms of Use, the Google Policy, or Google Analytics Opt-out.
Our Services do not respond to your browser’s do-not-track request.

Verification of Rights Requests
If you submit a request, we typically must verify your identity to ensure that you have the right to make that request, reduce fraud, and to ensure the security of Personal Data. If an agent is submitting the request on your behalf, we reserve the right to validate the agent’s authority to act on your behalf.

We may require that you match personal information we have on file in order to adequately verify your identity. If you have an account, we may require that you log into the account to submit the request as part of the verification process. We may not grant you access to certain Personal Data if prohibited by law.

SECURITY
We implement and maintain reasonable security measures to safeguard the Personal Data you provide us. However, we sometimes share Personal Data with third parties as noted above, and though we may enter contracts to help ensure security, we do not control third parties’ security processes. We do not warrant perfect security and we do not provide any guarantee that your Personal Data or any other information you provide us will remain secure.

DATA RETENTION
We retain information for so long as it, in our discretion, remains relevant to its purpose, and in any event, for so long as is required by law. We will review retention periods periodically, and may sometimes pseudonymize or anonymize data held for longer periods, if appropriate. What is necessary may vary depending on the context and purpose of processing. We generally consider the following factors when we determine how long to retain data (without limitation):

• Retention periods established under applicable law;
• Industry best practices;
• Whether the purpose of processing is reasonably likely to justify further processing;
• Risks to individual privacy in continued processing;
• Applicable data protection impact assessments;
• IT systems design considerations/limitations; and
• The costs associated continued processing, retention, and deletion.

MINORS
Our Services are neither directed at nor intended for use by minors under the age of majority in the relevant jurisdiction. Further, we do not knowingly collect Personal Data from such individuals. If we learn that we have inadvertently done so, we will promptly delete it.

INTERNATIONAL TRANSFERS
We operate in and use service providers located in the United States. If you are located outside the U.S., your Personal Data may be transferred to the U.S. The U.S. may not provide the same legal protections guaranteed to Personal Data in foreign countries. Contact us for more information regarding transfers of data to the U.S.

REGIONAL SUPPLEMENT: US State & California Privacy Rights & Choices
Under the California Consumer Privacy Act (“CCPA”) and other state privacy laws, residents of certain US states may have the following rights, subject to regional requirements, exceptions, and limitations.
Confirm – Right to confirm whether we process your Personal Data.
Access/Know – Right to request any of following: (1) the categories of Personal Data we have collected, sold/shared, or disclosed for a commercial purpose; (2) the categories of sources from which your Personal Data was collected; (3) the purposes for which we collected or sold/shared your Personal Data; (4) the categories of third parties to whom we have sold/shared your Personal Data, or disclosed it for a business purpose; and (5) the specific pieces of Personal Data we have collected about you.
Portability – Right to request that we provide certain Personal Data in a common, portable format.
Deletion – Right to delete certain Personal Data that we hold about you.
Correction – Right to correct certain Personal Data that we hold about you.
Non-Discrimination – California residents have the right to not to receive discriminatory treatment as a result of your exercise of rights conferred by the CCPA.
List of Direct Marketers – California residents may request a list of Personal Data we have disclosed about you to third parties for direct marketing purposes during the preceding calendar year.

Submission of Requests
You may submit the requests to exercise your rights under CCPA and other applicable state laws, as follows (please our review verification of rights section). If you have any questions or wish to appeal any refusal to take action in response to a rights request, contact us at privacy@nodalsolutions.com. We will respond to any request to appeal within the period required by law.

CHANGES TO OUR POLICY
We may change this Policy from time to time. Please visit this page regularly so that you are aware of our latest updates. Your use of the Services following notice of any changes indicates acceptance of any changes.

CONTACT US
Feel free to contact us with questions or concerns using the appropriate address below.
General inquires:                info@nodalsolutions.com
Privacy Rights & Compliance:            privacy@nodalsolutions.com