9Spokes privacy notice

9Spokes Privacy Notice

Last updated: 7 October 2020

At 9Spokes, we put trust at the foundation of our customer relationships and are committed to protecting the privacy of individuals whose information is in our custody. We take the security of personal data very seriously and understand that privacy is not just an essential part of what we do, but also at the core of our business.

9Spokes’ policy is to comply with local laws, including General Data Protection Regulation (GDPR) to ensure compliant handling and use of personal data is maintained at all times. This includes ensuring:

• We only collect data relevant to providing you with the best service.

• We are transparent about how we handle, store and use your data.

• You are able to access and modify your personal data as needed.

• You can contact us about your data at any time at privacy@9spokes.com.

1. YOUR PRIVACY

1.1 9 Spokes International Limited (a New Zealand registered company) and its related companies, including 9 Spokes Operations Limited (a New Zealand registered company), 9 Spokes Australia Pty Limited (an Australian registered company), 9 Spokes UK Limited (a company registered in England and Wales), 9 Spokes US, Inc. (a Delaware Corporation) 9 Spokes Canada Limited (a Canadian registered company) and 9 Spokes Asia Pte Ltd (a company registered in Singapore) (collectively 9Spokes, we or us) takes the issue of safeguarding your privacy online seriously. 9Spokes has created this Privacy Notice in order to demonstrate our firm commitment to being custodians of the information you provide to us and the information we collect in the course of operating our business.

1.2 This Privacy Notice applies if you make any enquiry with us, apply to work with us, or apply or use any of 9 Spokes products and or services via our website and online services, including https://www.9spokes.com/, and https://dashboard.9spokes.com/portal and any other website, mobile app or other online service created or hosted by us from time to time (9S Services); but does not apply in relation to any of the consolidated range of online software applications (“Apps”) that may be made available to you through the 9Spokes service from a range of software developers known as “Online Software Partners” (“OSPs”) please see section 10 (Third Party Links). Please make sure you read each OSP's privacy notice, as 9Spokes is not responsible for the privacy practices of the OSPs or the content of their Apps.

1.3 This Privacy Notice (together with our Terms and Conditions and any other documents referred to on it) explain how as a data controller, 9 Spokes may collect, use and/or share information that we collect from or about you, or that you provide to us (either directly or indirectly), and how it will be processed by us in accordance with the applicable data privacy laws. Where you use the 9S Service, or your personal data is processed in connection with the 9S Service, 9Spokes will be the data controller of such information. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. By visiting https://www.9spokes.com you are accepting and consenting to the practices described in this Notice.

1.4 From time to time, there may be more than one data controller of your information within our group where you have engaged different parts of our broader organization to provide different or jointly delivered services.

1.5 9 Spokes reserves the right to change this Privacy Notice at any time. The most current version will be posted on the 9Spokes website, and we recommend that you check regularly to ensure you are familiar with the most current version of this Privacy Notice. 9Spokes will use its reasonable efforts to communicate any changes to you through the 9S Service.

2. SCOPE OF PRIVACY NOTICE

2.1 This Privacy Notice explains and describes:

1. When this Privacy Notice applies.
2. Collection of personal information.
3. Legal basis for usage of personal data.
4. Where your personal information is stored.
5. Ways we use data.
6. Disclosure of data.
7. Digital Advertising & Analytics
8. In the Employment Context
9. Tracking Technologies We Use.
10. Third Party Links.
11. Security.
12. Reviews.
13. Your rights, access and correction of personal information.
14. Data retention.
15. Further information.
16. Contacting us.

3. WHEN THIS PRIVACY NOTICE APPLIES

3.1 This Privacy Notice applies:

a) to your use of the 9S Services;
b) as a result of your relationship with one or more of our customers, unless we act on their instructions as their data processor;
c) to any information collected from third parties;
d) your supply of services to us where this involves any personal data; and/or
e) where you make enquiries with us, or apply to us for a job or work placement.

3.2 Please note that our 9S Service makes use of cookies and similar technologies, as described in more detail in clause 10 below: (Tracking Technologies We Use).

4. COLLECTION OF PERSONAL INFORMATION

4.1 “Personal data” is any information or opinion that can be used to identify you or that we can link to you or your household, such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

4.2 The personal information 9Spokes collects and stores will depend on what products and services you request from us. This includes (but is not limited to) current and historical personal data, information provided when you submit names (including employee and subcontractor names), information provided to 9Spokes in person, by email, telephone or online such as; title, identification, employment, position held, enquiry/complaint details, information about the organisation with which you are affiliated, emails, usernames, addresses, country of residence, geographic location, log-in information, other contact details, date of birth (where you have applied to us for a job or work placement), telephone numbers, billing information or other personally identifiable information you provide to 9Spokes, or when you process such information through the 9S Service, other online services or any of the Apps.

4.3 The information that 9Spokes collects and stores when you use the 9S Service may include technical information, such as the Internet protocol (IP) address used to connect your computer, tablet, mobile or other device to the 9S Service or any of the Apps, login information, browser type and version, time zone setting, browser plug-in types and versions, operating system and platform, information you post online, full Uniform Resource Locators (URL) clickstream to, through and from the 9S Service or any of the Apps; and other information we collect through the use of cookies and similar technology. See the Digital Advertising & Analytics section of this privacy notice to learn more about the use of this information and the choices available to you. Please see clause 10 below: (Tracking Technologies We Use) for more details about these types of information that we may gather.

4.4 Use of the 9S Service allows you to personally monitor certain financial, personal and other information about your business and/or your customers which you have provided to 9Spokes and/or an OSP through an App (“User Content”). To provide the 9S Service, 9Spokes extracts User Content about your business from the Apps. 9Spokes may also integrate such User Content with other Apps you have signed up to use through the 9S Service.

4.5 If you choose to pay for the 9S Service by card, we will not hold your card details. When you submit your details, they will be transmitted directly to our or an App Partner’s secure billing and payment collection service provider, who will handle your data in accordance with its own policies.

4.6 When you provide, through the 9S Service or an App, personal information of a third party (for example your own customer details), 9Spokes will collect such information from you and use it in accordance with this Privacy Notice and our Terms and Conditions. Where you provide the personal information of a third party, you must ensure that the third party is aware of this Privacy Notice, understands it and has agreed to accept it.

4.7 We will also collect your personal information if you make an enquiry about any aspect of 9Spokes, if you are an actual or potential investor in 9Spokes, request information from 9Spokes, contact 9Spokes through our network of sites or in any other manner, or access 9Spokes' network of sites for any reason.

4.8 In some instances, personal data must be provided to 9Spokes in order for us to legally or contractually provide a service to you, for example where we need to fulfil a password reset request. Where relevant we will highlight this to you.

4.9 We may also receive information about you if you use any other websites that we operate or may operate from time to time or other services we provide. 9Spokes may share information amongst members of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries. We may also work with third parties (including, for example, business partners, sub-contractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, credit reference or employment checking agencies) to help us provide 9S Services and we may receive information about you from them. Where we work with third parties, we check that they are suitable and will treat your personal information as safely and securely as we do.

4.10 Where personal information is classified under applicable laws to be ‘sensitive’ (racial or ethnical origin, political opinions or memberships, religious and philosophical beliefs, trade union, professional or trade association membership, physical or mental health, sexual life, criminal proceedings and offences, and genetic or biometric information, or biometric templates) 9Spokes will only use this information to provide the service you require and we will ask for your explicit consent. In addition, information revealing race, ethnic origin, sexual orientation and any disability may (to the extent permitted under local laws) be processed in order to facilitate effective equal opportunities monitoring and/or to comply with legal obligations to make reasonable adjustments.

5. LEGAL BASES FOR USAGE OF PERSONAL DATA

5.1 Where 9Spokes intends to use your personal data, we rely on the following legal grounds (where recognised under applicable law):

a) Performance of a contract: We may need to collect and use your personal data to enter into a contract with you or to perform a contract that you have with us. For example, registering to join 9Spokes and where we respond to your requests and provide you with services in accordance with our Terms and Conditions or other applicable terms of business agreed with you.

b) Legitimate interests: Where 9Spokes considers use of your information as being non-detrimental to you, within your reasonable expectations, and necessary for our own, or a third party’s legitimate purpose, including:

1. for our own direct marketing or continued communication with you;
2. the prevention of fraud;
3. our own internal administrative purposes;
4. personalisation of the 9S Service(s) we provide to you;
5. ensuring network and information security, including preventing unauthorised access to electronic communications networks and stopping damage to computer and electronic communication systems; or
6. reporting possible criminal acts or threats to you or us, or for public security to a competent authority; and
7. to comply with a contractual obligation to an organization or individual other than that to whom personal data relates, e.g. towards your employing organization.

c) Compliance with a legal obligation: 9Spokes may be required to process your information due to legal requirements, including employment laws, tax laws and other regulatory provisions applicable to us as a provider of the 9S Services and online services.

d) Consent: You may be asked to provide your consent in connection with certain services that 9Spokes offers, for example in respect of any processing of your personal data for our marketing purposes where you or your employing organization is not a customer of 9Spokes, or in respect of certain special categories of personal data such as your health or racial background for which we are legally obliged to gain your consent due to the sensitive nature of such information and the circumstances in which it is gathered or transferred. Where we are reliant upon your consent, you may withdraw this at any time by contacting us in accordance with clause 15 (Further Information) below.

6. WHERE YOUR PERSONAL INFORMATION IS STORED

6.1 9Spokes stores your information on infrastructure operated by third party cloud service providers, and maintains an email database for subscribers to our monthly e-newsletters. 9Spokes also stores investor information with its share registry (Boardroom Pty Limited ABN 14 003 209 836).

6.2 Data that 9Spokes collects from you may be disclosed to our related bodies in the European Union and New Zealand, or to the jurisdiction in which the relevant Channel Partner is located or has otherwise selected (noting that the privacy policy of that Channel Partner will apply in addition to this privacy policy). 9Spokes will ensure that your personal information is protected to at least the same standard as that which is required in the jurisdiction in which you are located.

6.3 The data that 9Spokes collects from you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA") that does not have a similar standard of protection laws to those maintained by the member states of the European Union. It may also be processed by staff operating outside the EEA who work for us or for one of our suppliers. Such staff maybe engaged in, among other things, the fulfilment of any order, the processing of payment details and the provision of support services. We make use of European Commission-approved standard contractual data protection clauses, binding corporate rules for transfers to data processors, or other appropriate legal mechanisms to safeguard the transfer. You have the right to request a copy of the mechanisms used by contacting us using the details set out in clause 16 (Contacting Us).

7. WAYS WE USE DATA

7.1 9Spokes collects your personal information so that we can provide you with the 9S Services and for various internal functions and services. This may include, but is not limited to:

a) carrying out our obligations arising from the contracts entered into between you and us including the provision to you with information, products, services and content that you request from us;

b)allowing you to participate in interactive features of the 9S Service, when you choose to do so;

c)confirming receipt of profile changes;

d)extracting User Content from any of the Apps you have signed up to use through the 9S Service and integrating User Content with other Apps you have signed up to use through the 9S Service;

e)if you use a Channel Partner (e.g., bank or financial service provider) instance of the 9S Service, communicating with and providing assistance to the Channel Partner to ensure your successful use of the 9S Service;

f)providing technical support and other services necessary to ensure your successful use of the 9S Service;

g)invoicing and entering into financial transactions with you;

h)purposes relating to your investment in 9Spokes, including to assess and process your application and to service your needs as an investor and shareholder;

i)as we believe reasonably necessary or appropriate to protect your, our, or others’ rights.

j)dealing with your requests and enquiries;

k)to provide you with information about other goods and services we offer that are similar to those that you have already purchased or enquired about;

l)extracting User Content from any of the Apps you have signed up to use through the 9S Service and integrating User Content with other Apps you have signed up to use through the 9S Service;

m)personalising the way in which content is presented to you and to provide you with the most user-friendly navigation experience;

n)sending out feedback and surveys and addressing any issues or complaints;<

o)answering any queries about 9Spokes and its products and services or any other offering;

p)sending newsletters, advertising and promotions;

q)notifying you about changes to the 9S Service or products or contacting you in relation to service updates that affect you, regulatory updates that affect the 9S Service and any additional information in relation to the 9S Service that we think you may find interesting;

r)researching, planning, service development, security or risk management;

s)sending special deals, promotions and offers based on users interests plus other news on 9 Spokes, including updates of new, or enhanced services;

t)using IP addresses see clause 9.1 (IP Addresses) to identify the location of users, to block disruptive use, to establish the number of visits from different countries and to determine what country you are accessing the 9S Services from;

u)with your consent, or as otherwise disclosed at the time information is collected;

v)as we believe reasonably necessary or appropriate to: comply with our legal obligations; respond to legal process or requests for information issued by government authorities or other third parties;

w)where you have expressly consented to us contacting you for marketing purposes, by ticking the relevant box during the sign-up process, to provide you, or permit selected third parties to provide you, with information about goods or services we feel may interest you. If you are an existing customer, we will only contact you with information about goods and services similar to those which were the subject of a previous sale or negotiations of a sale to you. We will only provide your data to selected third parties for marketing purposes if you have expressly consented to this. If you do not want us to use your data in this way, please ensure that the relevant box is ticked or unticked as appropriate where we collect your data, or you can unsubscribe at any time.

7.2 These functions and services correspond with the following legal bases (where recognised under applicable law): (a) – (h): performance of a contract (please refer to clause 5.1 (a) above); (i) – (t): legitimate interests (please refer to clause 5.1 (b) above), (u): compliance with a legal obligation (please refer to clause 5.1 (c) above), (v): consent.

7.3 However, where and to the extent that we provide our services, features or content, or carry out other obligations arising from a contract with an organization (e.g. your employing organization) or individual other than that to whom personal data relates, we rely on our legitimate interest (please refer to clause 5.1 (b) (vii) above) rather than on the performance of a contract.

7.4 If you do not provide 9Spokes with your personal information, one or more of the above functions or services may not be able to be provided or performed.

7.5 We may combine information that is gathered by different means for the purposes set out above.

7.6 9Spokes may also modify the content of any User Content by removing from such content all material that could identify you or any other person or organisation (De-identified Content). 9 Spokes may then for benchmarking and other purposes use, reproduce and adapt such De-identified Content to provide gap analysis and trend analysis for customers, as well as wider gap and trend analysis of industry verticals.

7.7 If at any time we intend to change the purpose for which we hold your personal data, we will give you prior information of that new purpose so that you are aware of this.

8. DISCLOSURE OF DATA

8.1 In providing our services and operating our business, 9Spokes may allow access to your personal data to the different entities within the 9Spokes group for our internal administrative purposes such as billing, promoting our events and services, and providing you or your organisation with the 9S Services, provided in all instances that such processing is consistent with clause 5 (Legal Basis for Usage of Personal Data), clause 6 (Where Your Personal Information Is Stored), and applicable law.

8.2 9 Spokes will share your information with OSPs where it is necessary to do so to provide the 9S Services you have requested from us. If you use a Channel Partner (e.g. bank or financial service provider) instance of the 9S Service, we will share your information with the Channel Partner where it is necessary to do so to provide the 9S Services you have requested from us or the Channel Partner. The Channel Partner is responsible for selecting the jurisdiction to which any personal information will be sent in relation to the 9S Services.

8.3 9Spokes has established a network of specialist support, business advisors and technical advisors which we refer to as Business Support Partners (BSPs). If you choose to engage with a BSP, they can provide independent advice and support to you. 9 Spokes may share your information with BSPs that you engage, or those BSPs may have access to your information in the course of their supply of services to you.

8.4 9Spokes may also disclose your personal information to its third party service providers as described below:

a)where you have consented to us sharing your personal data in this way or as otherwise disclosed at the time of data collection or sharing;

b)when such sharing is provided for under contract, including our Terms and Conditions for any particular service that we may provide to you;

c)it is relevant in the circumstances to disclose the information to parties with whom we have co-promotional arrangements (such as jointly sponsored events or external venues);

d)we need to enforce or apply our Terms and Conditions to which you have agreed (or other terms that have been agreed to apply to our relationship with you or your employing organization);

e)Third Party professional advisors, such as accountants and IT service professionals, that you have appointed, or that you have requested us to appoint;

f)an OSP support provider where you have requested support in relation to an App;

g)its invoicing and payment collection services to enable 9Spokes to undertake financial transactions with you, such as invoicing, processing of payments, as well as compliance with any applicable legal, tax or regulatory obligations that may affect you or 9Spokes;

h)any entity to which 9Spokes is required, or authorised by or under law, to disclose such information, such as responding to a formal request in a court order, judicial proceeding or subpoena;

i)protect against misuse or unauthorised use of the 9S Service;

j)protect the safety, or property of our stakeholders, or the public;

k)in the event of a sale, merger, or acquisition of some, or all of 9Spokes' assets or shares, your personal information could be disclosed as a part of the proposed transaction;

l)where you invest in 9Spokes, your personal information may be disclosed to 9 Spokes' share registry (Boardroom Pty Limited ABN 14 003 209 836) and regulators;

m)printers and other companies for the purposes of preparation and distribution of documents, marketing, and for handling of mail;

n)market research companies and analytics and search engine providers for the purpose of analysing the 9Spokes Shareholder base and for product development and planning and assisting us in the improvement and optimisation of the 9S Service; and

o)legal and accounting firms, auditors, management consultants and other advisers for the purpose of administering and advising on the 9S Service, 9Spokes' shareholding and shares.

8.5 Any third parties with whom we may share your data with are obliged to keep your details securely, and to use them only to fulfil the service they provide you on 9Spokes’ behalf. When such third parties no longer need your personal data to fulfil this service, they will dispose of such details in line with 9Spokes’ procedures unless they are themselves data controllers in their own rights, in particular they are under a legal obligation to retain information (provided that this will be in accordance with applicable data privacy laws). If 9Spokes wishes to pass your sensitive personal data onto a third party, we will only do so once we have obtained your consent, unless we are legally required to do otherwise.

8.6 9Spokes will not share your information with any third parties for their promotional purposes without your permission. However, you should be aware that:

a)OSPs may separately collect information from you, and they may use or share that information in accordance with their own policies, which you should review separately; and

b)Your engagement of a BSP is independent of 9 Spokes, and BSPs may use or share your information in accordance with their own policies, which you should review separately.

8.7 We own the database rights in the information collected via the 9S Service. We do not sell, rent, or otherwise share information that reasonably identifies you or your organisation with unaffiliated entities for their independent use except as expressly described in this Privacy Notice, or with your express consent.

8.8 Information that does not reasonably identify you or your organization may be shared as permitted by applicable law.

8.9 9Spokes may disclose your personal data if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our standard Terms and Conditions; or to protect our rights, property, our customers, clients, company, or other related third parties. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.

9. DIGITAL ADVERTISING & ANALYTICS

9.1 We may partner with ad networks and other ad serving providers (“Advertising Providers”) that serve ads on behalf of us and others on non-affiliated platforms. Some of those ads may be personalized, meaning that they are intended to be relevant to you based on information Advertising Providers collect about your use of the Site and other sites or apps over time, including information about relationships among different browsers and devices. This type of advertising is known as interest-based advertising.

9.2 We may also work with third parties that collect data about your use of the Sites and other sites or apps over time for non-advertising purposes. 9Spokes uses Google Analytics and other third-party services to improve the performance of the Sites and for analytics and marketing purposes. For more information about how Google Analytics collects and uses data when you use our Sites, visit https://www.google.com/policies/privacy/partners/, and to opt out of Google Analytics, visit https://tools.google.com/dlpage/gaoptout/.

10. IN THE EMPLOYMENT CONTEXT

10.1 If you apply for a job or work placement with 9Spokes, then you may need to provide your contact and identification information, information concerning your career and any other information you submit to us (including during the course of any correspondence you may have with us. We may also carry out screening checks (including reference, background, directorship, financial probity, identity, eligibility to work, vocational suitability and criminal record checks).

10.2 We collect, use and store your personal data for the reasons set out below.

a)Where necessary for our legitimate interests, as listed below, and where our interests are not overridden by your data protection rights:

1. Managing and administering the recruitment process you take part in
2. Planning our recruitment business by administering and improving ongoing recruitment processes
3. Protecting our legitimate business interests and legal rights
4. Where necessary and in accordance with applicable law, carry out background checks to verify the details you have supplied during the recruitment process.

b)Where necessary to establish the employment contract with you;

c)With your consent; we may be required under local law to ask for your consent to:

1. Carry out background checks to verify the details you have supplied during the recruitment process;
2. Consider you for other positions;

d)Where necessary to comply with a legal obligation, including where necessary for the purposes of carrying out obligations in the field of employment and social security and social protection law under local law; information revealing your race, ethnic origin, sexual orientation and any disability may (to the extent permitted under local laws) be processed in order to facilitate effective equal opportunities monitoring and/or to comply with legal obligations to make reasonable adjustments.

10.3 If your application is unsuccessful, we will retain your personal data only for as long as we need it for recruitment processes. We may hold your personal data for longer periods where you give us express permission to do so, for example in order to be considered for other positions that become available. If you accept employment with us, we will retain your personal data throughout your employment in accordance with a separate notice we provide to you upon your acceptance of employment.

10.4 If you work with us and are issued with any type of device and/or building access card or code we may also collect information about you from your use of these items (subject to, and in compliance with, any applicable laws).

10.5 9Spokes may exchange your personal data with academic institutions, recruiters, screening check providers, health service providers, professional and trade associations, law enforcement agencies, recruitment analytics providers, referees and your current and previous employers. Additional information may be gathered about you from publicly available resources such as LinkedIn or other social or professional media platforms and collated with the information that you provide to us. Without your personal data, 9Spokes may not be able to progress considering you for positions with us. 9Spokes will handle any unsolicited information in accordance with law, including destroying or de-identifying such information where we are required to do so.

11. TRACKING TECHNOLOGIES WE USE

11.1 IP addresses: When you visit 9Spokes’ website or click on one of our links, we may automatically record information such as your Internet Protocol (IP) address, operating system, browser version, date and time of your visit, pages you accessed and information you downloaded. This information may be used to generate usage statistics, ensure that our site and emails are accessible to the widest possible audience and to assist in improving the quality and usability of our website. 9Spokes may also use IP addresses to track abuse of our system.

11.2 Links: When 9Spokes provides you with links in emails, they may include a special tracking code unique to you, which allows 9Spokes to determine which content and advertisements are most popular. This data may be shared in aggregate form; however, it will never be shared in individual form.

11.3 Cookies: A cookie is a small string of information that we store on your browser or hard drive of your computer for identification purposes if you agree. Cookies contain information that is transferred to your computer’s hard drive.

11.4 Cookies help us enhance navigation and the functionality of our website, to securely maintain a session for existing customers accessing password-protected areas, and to personalize aspects of a visitor's experience.

11.5 9Spokes uses cookies to make interactions with our website or 9S Service easy and meaningful. When you visit our sites, 9Spokes servers send cookies to your computer.

11.6 Standing alone, cookies do not personally identify you, they merely recognize your web browser. Unless you choose to identify yourself to 9Spokes, either by responding to a promotional offer, opening an account, or filling out a website form (such as a “Contact Me”), you may remain anonymous to us (even though we may be in the position to recognize you on your subsequent visits).

11.7 9Spokes uses cookies that are session-based and persistent-based:

a)session Cookies exist only during one session. They disappear from your computer when you close your browser software or turn off your computer.

b)persistent Cookies remain on your computer after you close your browser or turn off your computer.

11.8 If you have chosen to identify yourself to 9Spokes, we use Session Cookies containing encrypted information to allow us to uniquely identify you. Each time you log into the website or 9S Service, a Session Cookie containing an encrypted, unique identifier that is tied to your account is placed in your browser. These Session Cookies allow us to uniquely identify you when you are logged into the website or 9S Services and to process your online transactions and requests. Session Cookies are required to use the 9S Service.

11.9 9Spokes uses Persistent Cookies that only we can read and use to identify browsers that have previously visited our website. When you purchase from the 9S Service or provide us with personal information, a unique identifier is assigned to you. This unique identifier is associated with a Persistent Cookie that we place on your web browser. We are especially careful about the security and confidentiality of the information stored in Persistent Cookies. For example, we do not store account numbers or passwords in Persistent Cookies.

11.10 If you disable your web browser’s ability to accept cookies, you will be able to navigate our website, but you will not be able to successfully use the Services.

Third Party Cookies

11.11 9Spokes engages third parties to track and analyse usage, behavioural and volume statistical information from individuals who visit our website. 9Spokes may also use other third-party cookies to track the performance of our advertisements. The information provided to third parties does not include personal information, but this information may be re-associated with personal information after we receive it.

11.12 9Spokes may also contract with third-party advertising networks that collect IP addresses and other web site navigational information on our website and emails and on third-party websites.

Pixel Tags

11.13 A Pixel Tag, also known as a clear GIF or Web Beacon, is an invisible tag placed on certain pages of our website but not on your computer. When you access these pages, Pixel Tags generate a generic notice of that visit. They usually work in conjunction with cookies, registering when a particular computer visits a particular page.

11.14 If you turn off cookies, the Pixel Tag will simply detect an anonymous website visit.

How 9Spokes use Cookies and Pixel Tags

11.15 9Spokes itself does not use cookies, Pixel Tags or other technologies to track your use of other websites. 9Spokes may, however, contract with other companies that may use cookies, Pixel Tags, and other online tools to collect information regarding your interaction with 9Spokes advertisements and your use of both 9Spokes and third-party websites. This information may be used to provide 9Spokes advertisements and other advertisements that may be of interest to you when you visit other websites. For more information about this practice and to learn about your choices in connection with it, please visit https://ico.org.uk/for-the-public/online/cookies/.

Control of cookies

11.16 Web browsers allow you to exercise some control of cookies through the browser settings. Most browsers enable you to block cookies or to block cookies from particular sites. Browsers can also help you to delete cookies when you close your browser. You should note, however, that this may mean that any opt-outs or preferences you set on our website will be lost. To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit http://www.allaboutcookies.org/ which includes information on how to manage your settings for the major browser providers.

12. THIRD-PARTY LINKS

12.1 This website (and 9Spokes emails) contains links to other sites, including to those of the OSPs. If you follow a link to any of these websites, please note that these websites have their own privacy notices and 9Spokes is not responsible for the privacy practices or the content of such websites. Please check these notices before you submit any personal data to these websites.

12.2 We may collect information from other sources, such as social media platforms that share information about how you interact with our social media content, and any information gathered through these channels will be governed by the privacy settings, policies, and/or procedures of the applicable social media platform, which we strongly encourage you to review.

13. SECURITY

13.1 9Spokes stores personal information in electronic storage facilities and uses some physical records. We have taken numerous steps to protect your personal information from misuse, interference and loss, and unauthorised access, modification or disclosure.

13.2 Our information security policy is supported by a variety of processes and procedures, and we store information in access-controlled premises or electronic databases requiring logins and passwords. All employees, officers or contractors of 9Spokes and third-party providers with access to confidential information are subject to access controls and confidentiality obligations, and we require our third-party data storage providers to comply with appropriate information security industry standards.

13.3 Whilst we continually strive to ensure that our systems and controls are updated to reflect technological changes, the transmission of information via the internet is not completely secure, and as such, we cannot guarantee the security of your data transmitted to our online services, which is at your own risk.

13.4 If you communicate with us using non-secure web platforms, you assume the risks that such communications between us are intercepted, not received, delayed, corrupted or are received by persons other than the intended recipient.

13.5 Once we have received your information, we will take reasonable steps to use procedures and security features to try to prevent unauthorised access, modification or disclosure.

13.6 You can help us to keep your information secure by ensuring that any username or password in relation to our online services is kept strictly personal to you and not be made available to any other person. You should stop using your username and password and notify us immediately if you suspect that someone else may be using your user details or password.

13.7 While 9Spokes uses encryption technology and a range of other security measures to protect your information, please be aware no security mechanism is 100% secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

14. REVIEWS

14.1 9Spokes provides users with an opportunity to let it know about their experience; we may, and to the extent required under applicable law you provide your consent to us to, post your first name with your review and without us reviewing the material. 9Spokes is not responsible for any personal information that you select to include within the user review.

15. YOUR RIGHTS - ACCESS AND CORRECTION OF YOUR PERSONAL INFORMATION

15.1 Under applicable data protection legislation, 9Spokes has a duty of care to ensure that your personal data is accurate and up to date. You can contact us in accordance with clause 16 (Contacting Us), to update or correct your information or for some 9S Services you can update your details on-line.

15.2 Where you have consented to our processing of certain personal data, you can at any time withdraw such consent and/or tell us not to contact you with updates and information regarding our products and services (or part of them) either at the point such information is collected, (by checking the relevant box) or, where you do not wish us to continue to use your information in this way, by following the unsubscribe instructions on any communications sent to you. You can also exercise this right at any time by contacting us in accordance with clause 16 (Contacting Us).

15.3 You can request:

a)access to the personal data we hold about you;

b)a copy of such data and the information referred to in clause 16.1 below (if available under applicable law);

c)corrections or updates to your details;

d)the erasure of your personal data (if available under applicable law); and

e)the portability of personal data that you have provided to us in a structured, commonly used and machine-readable format (if available under applicable law).

15.4 You also have the right to object to, or request the restriction of, our use of your personal data in certain jurisdictions.

15.5 If you would like to exercise any of the rights set out in this section, please contact us using the details set out in clause 16 (Contacting Us). We may refuse to provide access where we have legitimate reasons for doing so under applicable data privacy laws, in which case we will provide reasons for our decision. In some circumstances, we may charge a fee for access if the relevant legislation allows us to do so, in which case we will inform you of the fee and obtain your agreement before providing access to the information.

15.6 You may submit a complaint to the office of the privacy commissioner in the jurisdiction in which we offer you the 9S Services to you. For example:

a)UK Information Commissioners Office https://ico.org.uk/global/contact-us

b)New Zealand Privacy Commissioner’s Office https://www.privacy.org.nz/

c)Canada Privacy Commissioner’s Office https://www.priv.gc.ca/en/

d)Office of the Australian Information Commissioner https://www.oaic.gov.au/

e)Singapore Personal Data Protection Commission https://www.pdpc.gov.sg/

15.7 If you make a privacy complaint, we will respond within 20 working days to let you know how your complaint will be handled. We may ask you for further details, consult with other parties and keep records regarding your complaint.

15.8 FOR U.S. RESIDENTS OF CALIFORNIA OR NEVADA

If you are a California or Nevada resident, please see below for additional information regarding your rights under state law.

Nevada Privacy Rights

Although we do not currently conduct sales of personal information, Nevada residents may submit a request directing us to not sell personal information we maintain about them if our practices change in the future.

To exercise this right, please contact us at:

Email: privacy@9spokes.com or use our secure online privacy form

California Privacy Rights

This section contains disclosures required by the California Consumer Privacy Act (“CCPA”) and applies only to “personal information” that is subject to the CCPA.

Personal Information We Collect

In the preceding 12 months, we collected the following categories of personal information about California consumers. We do not sell personal information.

Categories of Sources. We collect personal information from the following categories of sources:

a) Consumers;

b) Internet service providers;

c) Data analytics providers;

d) Operating systems and platforms; and

e) Service providers.

Why We Collect, Use, and Share California Information.

We use and disclose the personal information we collect for our commercial and business purposes, as further described in this Policy Notice. These commercial and business purposes include, without limitation:

Our commercial purposes, including marketing, advertising and enabling commercial transactions.

Our business purposes as identified in the CCPA, which include:

a) Auditing related to our interactions with you;

b) Legal compliance;

c) Detecting and protecting against security incidents, fraud, and illegal activity;

d) Debugging;

e) Performing services (for us or our service provider) such as account servicing, processing orders and payments, and analytics;

f) Internal research for technological improvement;

g) Internal operations;

h) Activities to maintain and improve our services; and

i) Other one-time uses.

We disclose the categories of personal information designated above to the categories of third parties listed below for business purposes and subject to all appropriate safeguards to Affiliates not under the 9Spokes brand.

Your Rights Regarding Personal Information.
California residents have certain rights with respect to the personal information collected by businesses. If you are a California resident, you may exercise the following rights regarding your personal information, subject to certain exceptions and limitations:

a) The right to know the categories and specific pieces of personal information we collect, use, disclose, and sell about you; the categories of sources from which we collected personal information about you; our purposes for collecting or selling personal information about you; the categories of personal information about you that we have either sold or disclosed for a business purpose; and the categories of third parties with which we have shared personal information.

b) The right to request that we delete the personal information we have collected from you.

c) The right to opt out of our sale(s) of your personal information. Please note that if you opt out of certain types of sales, we will be unable to provide you with the services that rely on such sales.

d) The right not to receive discriminatory treatment for the exercise of the privacy rights conferred by the CCPA.

To exercise any of the above rights, please contact us using the following information and submit the required verifying information, as further described below:

• Email: privacy@9spokes.com

• Or use our secure online privacy form

Verification Process and Required Information.

Note that we may need to request additional information from you to verify your identity or understand the scope of your request, although you will not be required to create an account with us to submit a request or have it fulfilled. We will require you to provide, at a minimum your full name, email address and phone number.

Authorized Agent.

You may designate an authorized agent to make a CCPA request on your behalf provided they furnish proof you consent to them acting as your agent for this purpose.

Your Choices.

To opt out of our email marketing, you can use the link provided at the bottom of each marketing message.

You may also opt out or unsubscribe from future emails by sending a request to support@9spokes.com using the subject line "Unsubscribe from email communications." To ensure your opt-out request is properly processed, be sure to send your message using the same email account to which we sent our correspondence.

16. DATA RETENTION

16.1 9Spokes will retain your information no longer than is reasonably necessary to fulfil the purposes that such data was originally collected in accordance with our internal data retention polices or to comply with our legal and regulatory obligations.

16.2 A copy of our retention policy is available upon request. Should you wish to review our retention policy then please contact us in accordance with clause 16 (Contacting Us).

16.3 If you wish to request that we no longer use your information to provide you with services, contact us in accordance with clause 16 (Contacting Us). 9 Spokes will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

17. FURTHER INFORMATION

17.1 9 Spokes can, at your request, confirm what information we hold about you and how it is processed. If 9 Spokes does hold personal data about you, you may (if available under applicable law) request the following information by contacting us using the details below:

a) identity and the contact details of the person or organisation that has determined how and why to process your data.

b) the purpose of the processing as well as the legal basis for processing.

c) if the processing is based on the legitimate interests of or a third party, information about those interests.

d) the categories of personal data collected, stored and processed.

e) recipient(s) or categories of recipients that the data is/will be disclosed to.

f) how long the data will be stored.

g) the source of personal data if it wasn’t collected directly from you.

h) any details and information of automated decision making, such as profiling, and any meaningful information about the logic involved, as well as the significance and expected consequences of such processing.

17.2 In order to verify the identity of those who make a request to us, we will accept the following forms of valid ID, as permitted by local laws, when information on your personal data is requested:

a) Passport;

b) Drivers licence, Birth certificate;

c) Government issued ID.

18. CONTACTING US

18.1 If you have any questions or complaints about this Privacy Notice, 9Spokes' privacy practices, your dealings with 9 Spokes, or if you wish to submit a written complaint about how we handle your personal data, please contact our Data Protection Officer via any of the following means:

Email: privacy@9spokes.com

Or use our secure online privacy form

18.2 9Spokes will make all reasonable attempts to respond to and resolve your enquiry or complaint.