Privacy Policy

Version Française

At System-3, we take privacy seriously. Please read this Privacy Policy to learn how your information is collected, used, processed and stored when you use the S-3 Solution.

If you have any questions about this Privacy Policy, contact us at privacy@system-3.com.

While we recommend that you read the entire policy, a summary of our treatment of your
personal information can be found in Schedule A at the end of this Policy.

Thank you for: (i) accessing www.system-3.com (the “Site”), and/or (ii) participating in System-3’s software as a service (SaaS) based predictive leadership simulation (the “Leadership Simulation”), and/or (iii) accessing System-3’s analytics dashboard including any information or reports provided therein (the “S-3 Dashboard” and, together with the Site and the Leadership Simulation, the “S-3 Solution”).

The S-3 Solution is owned and operated by System-3 Inc. (“System-3”). All references to ‘we,’ ‘us’ or ‘our’ within this Privacy Policy (the “Policy”) refer to System-3.

‍

1. Agreement to The Policy & Modifications

a) Agreement to this Policy.

By accessing or using the S-3 Solution, you indicate that you understand, accept, and consent to the practices described in this Policy. If you have any questions about the Policy, please email us at privacy@system-3.com.

b) Modifications to this Policy.

We may modify the Policy at any time, at our sole discretion, by posting the modified Policy at https://www.system-3.com/privacy-policy. It’s important that you review the Policy on a regular basis. If you are an Admin (as defined below) we will notify you of any changes to the Policy that we consider to be material modifications by sending an email to the email address affiliated with your Admin ID (as defined below). If you are a User (as defined below), we will notify you of any changes to the Policy that we consider to be material by sending an email to the email address to which your User ID (as defined below) was initially sent. As a User, you can update your contact email with us by emailing privacy@system-3.com and notifying us of your new email. You hereby agree that: (i) if you are an Admin, your continued use of the S-3 Solution after we’ve posted the modified Policy on the Site, and (ii) if you are a User, your failure to notify us via email at privacy@system-3.com that you do not consent to the modified Policy; shall indicate and constitute your agreement to be bound by the modified Policy. If you don’t agree to be bound by the modified Policy, then you may no longer use the S-3 Solution and, if you are a User, please email us and notify us that you do not consent to the modified Policy.

‍

2. Description of the S-3 Solution and Important Definitions

‍‍Below is a brief outline of the nature of the S-3 Solution. This background will help you better understand the Policy.
‍
‍Leadership Simulation
‍The Leadership Simulation is a SaaS based simulation that measures complex decision-making providing an accurate and objective assessment of leadership talent.

‍S-3 Dashboard
‍The S-3 Dashboard is a unique, state of the art, analytics dashboard providing data and information regarding the results generated from Leadership Simulations.

‍User Reports
‍Participants in the Leadership Simulation (“Users”) will receive personal reports regarding the results of their participation (“User Reports”).

‍Customers and Customer Reports
‍The System-3 customer (“Customer”) who has referred the User to participate in the Leadership Simulation will receive reports, data and analysis regarding the results of such User’s participation in the Leadership Simulation including, but not limited to, through data provided on the S-3 Dashboard (all such information and reports, in any form whether written or oral, together, “Customer Reports”).

The Customer may share Customer Reports internally, with their personnel, affiliates and contractors who have a need to know such information pursuant to the MSA, and, when applicable, with Customer’s clients, consultants, portfolio companies, investors or other permitted third-party recipients on a confidential basis (all together “Permitted Recipients”). The Permitted Recipients are identified in the applicable MSA (as defined below). System-3 may also share Customer Reports directly with Permitted Recipients and Permitted Recipients may be granted access to the S-3 Dashboard to access Customer Reports.

Customers engage System-3 in a variety of circumstances, including (i) for the purposes of an internal talent management/assessment/recruitment for their organization, (ii) to assess existing or potential portfolio companies, or (iii) to utilize the Solution with their clients as part of a service that Customers provide to their clients (each such engagement, a “Project”). Each Project is governed by a Master Services Agreement between the Customer and System-3 (the “MSA”).

‍Independent Users
‍If you are a User who was not referred to System-3 pursuant to an MSA or by a Customer, no reports regarding the results of your participation in the Leadership Simulation will be sent to any third parties without your consent. Notwithstanding the above, System-3 will be permitted to collect and make use of your personal information, the results of your participation in the Leadership Simulation, Diversity Survey, and Professional Experience Survey, and any other information, such as publicly available information through LinkedIn and other similar platforms, and information collected via automated tracking technologies pursuant to the terms of this Policy.

‍

3. Personal Information We Collect & From Where We Get it

We collect personal information: (i) from the Customer to enable us to provide Users and Admins access to the S-3 Solution, (ii) directly from Users and Admins provided to us voluntarily when using the S-3 Solution, (iii) from publicly available and/or accessible sources, and (iv) through automated tracking technologies. Below is a detailed list of what information we collect and how it is collected.

‍a) Personal Information Collected Regarding Users:

We collect the names and email addresses of Users aged 18 and over from the Customer so that we can grant Users access to the Leadership Simulation. In certain cases, we may collect additional information regarding Users from the Customer (“Additional Information”), including performance reports and other information regarding the User’s professional performance, all as set out in the applicable MSA. If you are a User and want to know specifically what personal information we will collect about you from the Customer pursuant to the applicable MSA, please review the Chart at the end of this Policy, and if you have additional questions, email us at privacy@system-3.com.

‍Consistent with the United States federal Children’s Online Privacy Protection Act of 1998 (COPPA), we will never knowingly request personally identifiable information from anyone under the age of 13 without requesting parental consent. Only people 18 and older may provide personally identifiable information to us. People 17 and younger may not otherwise provide any personal information.

If you are based in the European Union, the above provisions relating to children’s privacy generally apply to children under the age of 16, but this may vary across different member states.

When you participate in the Leadership Simulation, we will collect your name, contact information and assessment responses, as well as metrics on how you used and interacted with the Leadership Simulation by using a combination of automated technology and other methods, which may include the use of artificial intelligence. We may also request additional information from Users, such as employment and education history and professional credentials.

At the end of the Leadership Simulation, you may be asked to participate in a voluntary survey, which will include a diversity survey (the “Diversity Survey”) and other specific questions related to your professional experience (the “Professional Experience Survey”). The responses you provide to the Diversity Survey and the Professional Experience Survey, if you elect to participate, will not have any impact on your Leadership Simulation results.

System-3 may also, from time to time, collect publicly available and accessible business and career information about Users both prior to and following a User’s participation in the Leadership Simulation (“Public Data”). This Public Data may be collected from a variety of sources including, but not limited to, information available on Users’ LinkedIn profiles as well as information provided about Users on their employers’ or personal websites.

b) Personal Information Collected Regarding Admins:
‍We collect the names and email addresses of Admins from the Customer so that we can grant Admins access to the S-3 Dashboard. We may also collect certain metrics and usage information regarding how you interact with the S-3 Dashboard.

c) Personal Information Collected Regarding Visitors to the System-3 Website

When visitors to the System-3 website (“Visitors”) submit a contact form on our website, we collect personal information such as name, email address, phone number (optional), and any other details that the Visitor chooses to provide. This information is used to respond to inquiries, provide support, and contact Visitors regarding our services.

We also use Google Analytics to gather insights about how Visitors interact with our website, including data such as pages visited, time spent on the site, type of device used, and geographic location, which helps us improve Visitor and User experience.

HubSpot is used to collect and analyze data from Visitors who interact with our content or sign up for newsletters, and it may utilize cookies to track browsing behavior and form submissions, aiding in personalization and service enhancement.

Consistent with the United States federal Children’s Online Privacy Protection Act of 1998 (COPPA), we will never knowingly request personally identifiable information from anyone under the age of 13 without requesting parental consent. Only people 18 and older may provide personally identifiable information to us. People 17 and younger may not otherwise provide any personal information.

If you are based in the European Union, the above provisions relating to children’s privacy generally apply to children under the age of 16, but this may vary across different member states.

d) Automatic Information Collection & Tracking Technologies

‍When you use the S-3 Solution, our technology may automatically collect a variety of technical information as well as information regarding your usage of the S-3 Solution. We may either collect such information ourselves or authorize third party service providers to collect this information on our behalf utilizing their software tools integrated into the S-3 Solution. Information collected via automated tracking technologies may include IP address, browser and device characteristics, operating system, location information, and usage information regarding the way you use and interact with the S-3 Solution.

Geolocation. Based on your interaction with the S-3 Solution, the type of device you use to access the Site, and your device’s connectivity, we may collect location-based information. We may use this type of information to enhance your user experience, including using location information to better understand your interaction with our services. Unless you otherwise provide us with your consent to do otherwise, this information will only be used by us and our third-party service providers to provide you with the services you request or in an aggregated and anonymized format, which does not identify you.

Do Not Track. At present, there is no standard or agreement on how to respond to “do-not-track” signals that may be sent by web browsers. Accordingly, we currently do not take any action in response to these signals. We may reassess how to respond to these signals if and when a final standard is established and accepted. In the meantime, you can opt out of many advertisers’ use of cookies to tailor advertising to you by visiting http://www.aboutads.info/choices/. You may also visit https://globalprivacycontrol.org/.

System-3 uses cookies and other similar tools to conduct web analytics in order to optimize the S-3 Solution’s performance and functionality. You have the option to opt out of the use of cookies. Web browser settings can allow you to control the cookies stored on your hard drive. If you choose to disable cookies, you will still be able to visit the Site, but certain functionalities of the S-3 Solution may be limited.

‍

4. How We Use the Personal Information We Collect

a) Use of Users’ Personal Information

‍
‍‍Name & Contact Information
We use the names and email addresses of Users to contact Users to enable them to participate in the Leadership Simulation

‍Leadership Simulation Data & Results
The data obtained through the User’s participation in the Leadership Simulation will be analyzed by predictive models and machine learning algorithms developed by us to produce an evaluation of a User’s leadership profile and competencies. The results will be shared with the Customer and, as applicable, the Permitted Recipients, in the form of Customer Reports. Customer Reports may also include recommendations to be considered, along with other information to support discussions about talent recruitment, talent development, succession planning, team building, and other recommendations related to the applicable Project.

‍If you are a User and want to know more about the Permitted Recipients who will receive the Customer Reports generated from your personal participation in the Leadership Simulation, please email us at privacy@system-3.com.

‍Users will receive a User Report outlining the results of the User’s participation in the Leadership Simulation.

System-3 will use the data obtained through the Leadership Simulation (including from the Diversity Survey and Professional Experience Survey) as well as Public Data, and Additional Information for internal research and analysis, product refinement, and testing to develop and to improve the Leadership Simulation and System-3’s products and services on an ongoing basis. The Public Data may also be used to track Users’ professional and/or career development in order to improve and refine System-3’s ability to make accurate predictions and enhance its products.

‍Diversity Survey Information
System-3 uses the data obtained through the Diversity Survey on an ongoing basis to improve our  Leadership Simulation and our other products and services and to reduce bias and improve decision-making in leadership identification and talent management.

Professional Experience Survey Information
‍System-3 uses the data obtained through the Professional Experience Survey on an ongoing basis to improve our  Leadership Simulation and our other products and services and improve decision-making in leadership identification and talent management.

‍b) Use of Admins’ Personal Information
We use the names and email addresses of Admins to to enable them to access the S-3 Dashboard. With an Admin’s consent, we may also use such information for marketing purposes.

c) Use of Visitors’ Personal Information

When Visitors submit a contact form on our website, we collect personal information such as name, email address, phone number (optional), and any other details that the Visitor chooses to provide. This information is used to respond to inquiries, provide support, and contact Visitors regarding our services.

We also use Google Analytics to gather insights about how Visitors interact with our website, including data such as pages visited, time spent on the site, type of device used, and geographic location, which helps us improve Visitor and User experience.

HubSpot is used to collect and analyze data from Visitors and Users who interact with our content or sign up for newsletters, and it may utilize cookies to track browsing behavior and form submissions, aiding in personalization and service enhancement.

We use Google AdWords remarketing to advertise on third-party websites to previous Visitors of our site, using cookies to serve relevant ads.

We may share data with third-party service providers like Google Analytics, HubSpot, and Google AdWords for analysis, customer service, and marketing purposes, ensuring these partners adhere to strict data privacy standards.

We will not use data for third-party marketing purposes.

d) Use of Anonymized Data & Aggregated Data
‍Notwithstanding anything to the contrary in this Policy, we may use, share and sell aggregated or anonymized data either collected by us or generated from information collected by us for any purpose and without restriction including to develop, improve and commercialize products and services.

5. With Whom We Share Personal Information

We understand the importance of limiting the sharing your personal information with third parties to what is reasonably necessary for providing and improving our products and services and otherwise fulfilling the purposes for which the information is collected. We may share your personal information in the following circumstances:

With Developers: System-3 software and technology developers have access to information that is related to or useful for the development and improvement of our software, machine learning algorithms, products and services.

Customer Reports: We share System-3 Leadership Simulation results, in the form of Customer Reports, through secure means with the Customer and Permitted Recipients.

Our Service Providers: We may share information with contractors, services providers and other third parties we use to support the S-3 Solution and our products, services and business operations.

Business Transfers: We may share or transfer your information in connection with, or during negotiations of, any merger, sale of System-3 assets, financing, or acquisition of all or a portion of our business.

Affiliates: We may share your information with our affiliates. Affiliates include any parent company, subsidiaries, joint venture partners, or other companies that we control or that are under common control with us.

Comply with Applicable Law: We may share your information as required by any court order, law, legal process or government or regulatory request.

Enforce Our Rights: We may share your information as reasonably necessary to enforce our rights arising from any contract between us and you, including the Terms of Service applicable to you or the applicable MSA.

Protect Us or Others: We may share or transfer your information if we believe it is necessary to protects the rights, property or safety of us, our customers or other Users or Admins.

We use Google AdWords remarketing to advertise on third-party websites to previous Visitors of our site, using cookies to serve relevant ads.

We may share data with third-party service providers like Google Analytics, HubSpot, and Google AdWords for analysis, customer service, and marketing purposes, ensuring these partners adhere to strict data privacy standards.

We will not use data for third-party marketing purposes.

Note that, pursuant to the above, we may transfer personal information to other countries in which case the personal information transferred will be subject to those countries’ laws.

We do not share or sell any personal information with third parties for marketing purposes. As set forth herein, personal information is shared with Customers and Permitted Recipients.

The safeguards we put in place to ensure third parties protect the personal information we share with them are described in Section 6 below.

We may use your personal information to provide you with targeted advertisements or marketing communications about System-3 that we believe may be of interest to you. For more information about how targeted advertising works, you can visit the Network Advertising Initiative’s (“NAI”) educational page at http://www.networkadvertising.org/understanding-online-advertising/how-does-it-work.

You can opt out of targeted advertising by using the links below:

- Facebook: https://www.facebook.com/settings/?tab=ads

- Google: https://www.google.com/settings/ads/anonymous

- Bing: https://advertise.bingads.microsoft.com/en-us/resources/policies/personalized-ads

‍

6. How We Protect Your Personal Information

a) Protective Measures.‍

We use a combination of physical, technological, and organizational controls to protect the personal information we collect:

- System-3 uses Microsoft Azure for data processing and storage, and data is stored on secure servers.

- We retain data for the period of time that we deem necessary depending on the purposes for which it is collected and the permitted uses we make of the data. While data is retained, it is protected. When we deem it no longer necessary to be retained, we destroy the data. Notwithstanding the above, we will retain data as required by applicable law.

- When we transfer personal information to third parties, we use secure channels to transfer information and ensure the information recipients are subject to confidentiality agreements that protect the information being transferred.

- All of our employees and contractors sign confidentiality agreements with us.  

‍b) Inherent Risk.

Despite the above measures, no safeguards are guaranteed, and any collection or transfer of personal information poses risks. No electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Furthermore, we cannot guarantee that third parties will abide by their confidentiality obligations or data security responsibilities‍

c) Breach Protocols.

As a result of the aforementioned risks, System-3 has risk mitigation protocols in place, including protocols for responding to data breaches. These protocols include assessing whether it is reasonable in the circumstances to believe that a breach has created a real risk of significant harm to an individual and, if such a risk is confirmed, reporting the breach to the relevant authorities and to the affected individuals.

7. Your Rights & How to Exercise Them 

Depending on where you are located geographically and where you reside, applicable privacy law may provide you with certain rights regarding your personal information beyond what is explicitly provided for in this Policy. We have outlined some rights that may apply to you below.

If you have any questions about our information management practices or to exercise your rights, please contact us privacy@system-3.com with your request and we will respond promptly.

If you are a resident of certain jurisdictions (see below), and as mandated by those jurisdictions, you may update, correct, or remove your personal information at any time and free of charge by emailing us at privacy@system-3.com. Responses to the Leadership Simulation cannot be corrected. If mandated by your jurisdiction , you have the right to request that System-3 delete your responses to the System-3 Leadership Simulation. We may ask that you identify yourself and the information you wish to access, change, or delete for security purposes, and we will comply with your request as soon as reasonably practicable. By removing some of your information, you may not be able to access some of the Site’s features. We may keep some of your personal information if required by the Customer, law or for recordkeeping purposes.

If you are located in California, California’s “Shine The Light” law (California Civil Code Section 1798.83) permits California residents to request and obtain from us once a year, free of charge, a list of the third parties to whom we have disclosed their personal information, if any, for their direct marketing purposes in the prior calendar year, as well as the type of personal information disclosed to those third parties. California residents may also request that certain information be deleted, but exceptions apply. California law also provides that you are not to be discriminated against if you exercise these rights. If you are a California resident and would like to request this information or opt-out of the sharing of your personal information with third parties for marketing purposes, please submit your request in writing to privacy@system-3.com.

If you are located in Canada, your rights likely include:

· The right to access your personal information that we have collected.

· The right to request that we amend any errors in your personal information.

· The right to be notified of a data breach that creates a real risk of significant harm to you.

For general information on privacy rights in Canada visit www.priv.gc.ca. To make a request with respect to your personal information, please contact us privacy@system-3.com . We will comply with applicable legal obligations and our obligations under this Policy with respect to requests we receive.‍

US States

Many states below have thresholds that businesses must meet for consumers to exercise their rights. The text below assumes that the business meets the threshold. If a State law does not apply to System-3 or our Customer since they do not meet the threshold, we will notify you in response to your request.

For all the enumerated state law rights below, only you or an authorized agent may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request for your minor child.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

All requests must be sent to privacy@system-3.com.

If you are located in Colorado, you have the right to access your personal information, correct inaccurate personal data, obtain a copy of your personal data, and to delete personal data under certain circumstances. We may keep some of your personal information if required by the Customer, law or for recordkeeping purposes. You may opt out of processing personal data under the Colorado Privacy Act regarding (a) Targeted Advertising based on your personal data obtained from your activities over time and across websites or applications; (b) profiling, or (c) the sale of personal data to third parties. If we do not take the action you have requested, you may appeal our decision within 45 days after we send it to you. You may contact the Attorney General if you are not satisfied with our response.https://coag.gov/

‍

If you are located in Connecticut, the Connecticut Data Privacy Act provides Connecticut residents with the following enumerated rights:

· The right to access personal data that a controller has collected about you.

· The right to correct inaccuracies in your personal data.

· The right to delete your personal data, including personal data that a controller collected through third parties.

· The right to obtain a copy of your personal data in a portable and readily usable format that allows you to transfer the data to another controller with ease.

· The right to opt-out of:

- the sale of your personal data;

- the processing of personal data for targeted advertising; and profiling that may have a legal or other significant impact.

‍

If you are located in Delaware, the Delaware Personal Data Privacy Act (DPDPA) provides you with certain rights regarding their personal data, including rights to:

• Access.

• Correct.

• Delete.

• Data portability.

• Know the categories of third parties to which the controller has disclosed the consumer's personal data.

• Opt out of:

- personal data sales, except where required for the consumer's participation in a bona fide voluntary loyalty or rewards program;

- targeted advertising; and

- profiling for solely automated decisions producing legal or similarly significant effects.

The DPDPA also requires a controller to obtain the consumer's prior consent to process sensitive data.

‍

If you are located in Florida, the Florida Digital Bill of Rights (FDBR) provides consumers with certain rights regarding their personal data, including rights to:

• Access.

• Correction.

• Deletion.

• Data portability.

• Opt out of:

- personal data sales;

- targeted advertising;

- profiling for decisions producing legal or similarly significant effects;

- sensitive data collection or processing, including precise geolocation; or

- personal data collection through voice recognition or facial recognition features.

Avoid passive surveillance by digital device features.

‍

If you are located in Indiana, the Indiana Consumer Data Protection Act (INCDPA) provides consumers with certain rights regarding their personal data, including rights to:

• Access.

• Correction.

• Deletion.

• Data portability.

• Opt out of:

- personal data sales;

- targeted advertising; or

- profiling for decisions producing legal or similarly significant effects.

‍

If you are located in Minnesota, the Minnesota Consumer Data Privacy Act provides consumers with certain rights regarding their personal data, including rights to:

• Access.

• Correction.

• Deletion.

• Data portability.

• Opt out of:

- personal data sales;

- targeted advertising; or

- profiling for decisions producing legal or similarly significant effects.

‍

If you are located in Iowa, the Iowa Consumer Data Protection Act provides consumers with certain rights regarding their personal data, including rights to:

• Access.

• Deletion.

• Data portability.

• Opt out of personal data sales.

‍

If you are located in Kentucky, the Kentucky Consumer Data Protection Act (KCDPA) (HB 15 ) provides consumers with certain rights regarding their personal data, including rights to:

• Access.

• Correction.

• Deletion.

• Data portability.

• Opt out of:

- personal data sales;

- targeted advertising; or

- profiling for decisions producing legal or similarly significant effects.

(Section 3 , HB 15.)

The KCDPA also requires a controller to obtain the consumer's prior consent to process sensitive data.

‍

If you are located in Maryland, the Maryland Online Data Privacy Act provides consumers with certain rights regarding their personal data, including rights to:

• Access.

• Correction.

• Deletion.

• Data portability.

• Opt out of:

- personal data sales;

- targeted advertising; or

- profiling for decisions producing legal or similarly significant effects.

‍

If you are located in Montana, the Montana Consumer Data Privacy Act (MCDPA) provides consumers with certain rights regarding their personal data, including rights to:

• Access.

• Correct.

• Delete.

• Data portability.

• Opt out of:

- personal data sales;

- targeted advertising; and

- profiling for solely automated decisions producing legal or similarly significant effects.

The MCDPA also requires a controller to obtain the consumer's prior consent to:

- Sell the personal data of consumers between 13 to 15 years old or process it for targeted advertising.

- Process sensitive data.

‍

If you are located in Nebraska, the Nebraska Data Privacy Act provides consumers with certain rights regarding their personal data, including rights to:

• Access.

• Correction.

• Deletion.

• Data portability.

• Opt out of:

- personal data sales;

- targeted advertising; or

- profiling for decisions producing legal or similarly significant effects.

‍

If you are located in New Hampshire, the New Hampshire Consumer Data Privacy Act (NHDPA) provides consumers with certain rights regarding their personal data, including rights to:

• Access.

• Correct.

• Delete.

• Data portability.

• Opt out of:

- personal data sales;

- targeted advertising; and

- profiling for solely automated decisions producing legal or similarly significant effects.

(N.H. RSA § 507-H:4(I) .)

The NHDPA also requires a controller to obtain the consumer's prior consent to:

- Sell the personal data of consumers between 13 to 15 years old or process it for targeted advertising.

- Process sensitive data.

‍

If you are located in New Jersey, the New Jersey Consumer Data Privacy Act (NJDPA) provides consumers with certain rights regarding their personal data, including rights to:

• Access.

• Correct.

• Delete.

• Data portability.

• Opt out of:

- personal data sales;

- targeted advertising; and

- profiling for decisions producing legal or similarly significant effects.

The NJDPA requires a controller to obtain the consumer's prior consent to:

- Process personal data of consumers between 13 and 16 years old for:

• personal data sales;

• targeted advertising; and

• profiling for decisions producing legal or similarly significant effects.

• Process sensitive data.

‍

If you are located in Oregon, the Oregon Consumer Privacy Act (OCPA) provides consumers with certain rights regarding their personal data, including rights to:

• Access.

• Correct.

• Delete.

• Data portability.

• Opt out of:

- personal data sales;

- targeted advertising; or

- profiling for decisions producing legal or similarly significant effects.

(ORS 646A.574(1) .)

The OCPA also requires a controller to obtain the consumer's prior consent to process sensitive data.

‍

If you are located in Rhode Island, the Rhode Island Data Transparency and Privacy Protection Act provides customers with certain rights regarding their personal data, including rights to:

• Access.

• Correction.

• Deletion.

• Data portability.

• Opt out of:

- personal data sales;

- targeted advertising; or

- profiling for solely automated decisions producing legal or similarly significant effects.

‍

If you are located in Tennessee, the Tennessee Information Protection Act (TIPA) provides consumers with certain rights regarding their personal data, including rights to:

• Access.

• Correction.

• Deletion.

• Data portability.

• Opt out of:

- personal data sales;

- targeted advertising; and

- profiling for decisions producing legal or similarly significant effects.

‍

If you are located in Utah, the Utah Consumer Privacy Act (UCPA) provides consumers with certain rights regarding their personal data, including rights to:

• Access.

• Delete.

• Data portability.

• Opt out of:

- personal data sales; and

- targeted advertising.

‍

If you are located in Virginia, the Virginia Consumer Data Protection Act (VCDPA) provides consumers with certain rights regarding their personal data, including rights to:

• Access.

• Correction.

• Deletion.

• Data portability.

• Opt out of:

- personal data sales;

- targeted advertising; or

- profiling for decisions producing legal or similarly significant effects.

‍

EU and UK GDPR

The General Data Protection Regulation refers to the specific rights of people in the European Economic Area and the United Kingdom regarding how we collect and process personal data.

In accordance with the EU and UK General Data Protection Regulation you have the:

• Right to access information - You have the right to ask us for an overview of your personal data that we process.

• Right to data portability - You have the right to ask us to transfer your personal data directly to you or to another entity. This applies to personal data we process by automated means and with your consent or on the basis of a contract with you. We will transfer your personal data where it is technically feasible.

• Right to erasure - You may ask us to erase your personal data if we no longer need it for its original purpose, you object to us processing your data for our own legitimate interests or for personalized commercial messages, you withdraw your consent for processing your data, we unlawfully process your personal data, or a law of the European Union or a member state of the European Union requires us to erase your personal data.

• Right to object to processing - You can object to us using your personal data for its own legitimate interests. We will consider your objection and whether processing your information has any undue impact on you that requires us to stop doing so. You can also object to receiving personalized commercial messages from us. When you become a Customer we may ask you whether you want to receive personalized offers. Should you later change your mind, you can choose to opt out of receiving these messages by using the “unsubscribe” link located at the bottom of each marketing email. You cannot object to us processing your personal data if we are legally required to do so, for example, if we are obliged to fulfill a contract with you such as shipping an order.

• Right to object to automated decisions - We sometimes use IT systems to make automated decisions based on your personal information if this is necessary to fulfil a contract with you or if you gave us consent to do so. You have the right to object to such automated decisions and ask for an actual person to make the decision instead.

• Right to rectification - If your personal data is incorrect, you have the right ask us to rectify it. If we shared data about you with a third party, it is our obligation to notify this change to the third party.

• Right to restrict processing - You have the right to ask us to restrict using your personal data if in your opinion the information is inaccurate, we are processing the data unlawfully, you have objected to us processing your data for our own legitimate interests.

• Right to complain - Should you not be satisfied with the way we have responded to your concerns you have the right to submit a complaint to us. If you are still unhappy with our reaction to your complaint, you can also contact the data protection authority in your country.

Your data controller is System-3 Inc.

Privacy Policy Addendum for California Residents

Privacy Policy Addendum for Texas Residents

Last updated February 1, 2025.