California Privacy Rights

This notice to California residents supplements the Iron Software Privacy Statement and
is provided under California law, including the California Consumer Privacy Act of 2018
(“CCPA”), as amended by the California Privacy Rights Act of 2020 (“CPRA”).
Capitalized terms not defined in this document have the meaning stated in the Privacy
Statement or the Terms of Service.

1. Your Privacy Rights

This notice supplements the Iron Software Privacy Statement and applies to all visitors,
users, and others, who are California residents (“consumers” or “you”). Any terms
defined in the CCPA have the same meaning when used in this notice. For further
information about your rights under California’s privacy laws, please see California’s
“Privacy and Data Security” website at https://oag.ca.gov/privacy or any website that
supplements or replaces it.

The CCPA applies to “information that identifies, relates to, describes, references, is
capable of being associated with, or could reasonably be linked, directly or indirectly,
with a particular consumer or device,” which we refer to as “Personal Data” in this
Privacy Statement.

You have the right under the CCPA and other privacy and data protection laws, as
applicable, to exercise these rights free of charge:

1.1 Disclosure of Personal Data We Collect About You

You have the right to know:

• The categories of Personal Data we have collected about you, including sensitive
  Personal Data;
• The categories of sources from which the Personal Data is collected;
• Our business or commercial purpose for collecting, selling, or sharing Personal
  Data;
• The categories of third parties with whom we share Personal Data, if any; and
• The specific pieces of Personal Data we have collected about you.

Please note that we are not required to:

• Retain any Personal Data about you if, in the ordinary course of business, that
  information about you is not retained;
• Reidentify or otherwise link any data that, in the ordinary course of business, is
  not maintained in a manner that would be considered Personal Data; or
• Provide the Personal Data to you more than twice in a 12-month period.

1.2 Disclosure of Personal Data Sold, Shared, or Disclosed for a Business
Purpose.

In connection with any Personal Data we may sell, share, or disclose to a third party for
a business purpose, you have the right to know:

• The categories of Personal Data about you that we sold or shared and the categories of third parties to whom the Personal Data was sold or shared; and
• The categories of Personal Data that we disclosed about you for a business purpose and the categories of persons to whom the Personal Data was disclosed for a business purpose.
• We have provided a list below with the type of information that you are entitled to receive upon request to us.

1.3 Disclosure of Personal Data to Third Party for Direct Marketing

If you are a California resident, California Civil Code Section 1798.83 permits you to
request information regarding the disclosure of your Personal Data by us to third parties
for the third parties’ direct marketing purposes. To make such a request, see the section
“How to Exercise Your Rights,” below.

• Pursuant to California Civil Code Section 1798.83(c)(2), we do not share users’
  Personal Data with affiliate companies or others outside Iron Software for those
  parties’ direct marketing use, if a user has exercised an option that prevents that
  information from being disclosed to third parties for those purposes.

1.4 Right to Opt-Out of the Sale or Sharing of Personal Data

You have the right to opt-out of the sale or sharing of your Personal Data. To do so, use
this link or the link on our main page titled "Do Not Sell or Share My Personal
Information"

1.5 Right to Limit Use and Disclosure of Sensitive Personal Data

You have the right to opt-out of the use and disclosure of your sensitive Personal Data
for anything other than supplying requested goods or services. To do so, use this link or
the link on our main page titled “Limit the Use of My Sensitive Personal Information.”

Under the CCPA, Sensitive Personal Data is personal information which reveals a
consumer’s:

• Social security, driver's license, state identification card, or passport number.
• Account log-in, financial account, debit card, or credit card number in
  combination with any required security or access code, password, or credentials
  allowing access to an account.
• Precise geolocation.
• Racial or ethnic origin, religious or philosophical beliefs, or union membership.
• Genetic data.

Also considered Sensitive Personal Data are:

• The contents of a consumer's mail, email, and text messages unless the
  business is the intended recipient of the communication.
• Biometric and health information.
• Information regarding a consumer's sex life or sexual orientation.

1.6 Right to Correction

You have the right to request correction of inaccurate Personal Data maintained by us
about you. Upon receipt of a verifiable request from you, we will use commercially
reasonable efforts to correct the inaccurate Personal Data.

1.7 Right to Deletion

Subject to certain exceptions set out below, on receipt of a verifiable request from you,
we will:

• Delete your Personal Data from our records.
• Direct any service providers or contractors to delete your Personal Data from their records.
• Direct third parties to whom the business has sold or shared your Personal Data to delete your Personal Data unless this proves impossible or involves disproportionate effort.

In addition to the exceptions set forth in the Privacy Statement, please note that we may
not delete your Personal Data if it is necessary to:

•  Comply with the California Electronic Communications Privacy Act; or
• Enable solely internal uses that are reasonably aligned with your expectations
  based on your relationship with us and compatible with the context in which you
  provided the Personal Data.

1.8 Protection Against Discrimination

You have the right to not be discriminated against by us because you exercised any of
your rights under the CCPA. This means we cannot, among other things:

• Deny goods or services to you;
• Charge different prices or rates for goods or services, including through the use
  of discounts or other benefits or imposing penalties;
• Provide a different level or quality of goods or services to you; or
• Suggest that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

Please note that we may charge a different price or rate, or provide a different level or
quality of goods or services to you, if that difference is reasonably related to the value
provided to you by your Personal Data.

2. Categories of Information We Collect, Disclose for a Business Purpose, Share, or Sell.

The following list details categories of Personal Data and indicates whether we have
collected this Personal Data in the past 12 months, the commercial or business purpose
behind the collection, and whether the Personal Data was shared with, or sold to, a third
party. If the Personal Data was shared with or sold to a third party, the list details
categories of the third parties. Additionally, we can provide this information in
connection with your own Personal Data upon written request from you.

A. Identifiers such as a real name, alias, postal address, unique personal identifier,
online identifier, Internet Protocol address, email address, account name, social
security number, driver’s license number, passport number, or other similar identifiers.

Collected: Yes.
Business Purpose: Required in order to verify the user of the Services.
Shared With or Sold to 3rd Party in Past 12 months?: No.

B. Personal information categories in the California Customer Records statute (Cal.
Civ. Code § 1798.80(e)), including: Signature, social security number, physical
characteristics or description, address, phone number, passport number, driver’s
license or state identification card number, insurance policy number, education,
employment, employment history, bank account number, credit card number, debit
card number, or any other financial information, medical information, or health
insurance information.

Collected: Yes.
Business Purpose: Financial information is required when a User engages in
financial transactions.
Shared With or Sold to 3rd Party in Past 12 months?: No.

C. Characteristics of protected classifications under California or federal law, such as
age, race, religion, military status. California provides a list of its classes at
https://www.senate.ca.gov/content/protected-classes. The Federal EEOC provides a
list of Federal classes at https://www.eeoc.gov/employers/small-business/3-who-
protected-employment-discrimination.
Collected: No.

D. Commercial information, including records of personal property, products or services
purchased, obtained, or considered, or other purchasing or consuming histories or
tendencies.
Collected: No.

E. Biometric information.
Collected: No.

F. Internet or other electronic network activity information, including, but not limited to,
browsing history, search history, and information regarding a consumer’s interaction
with an Internet website application, or advertisement.

Collected: Yes.
Business Purpose: Improving the website’s functionality and ensuring security.
Shared With or Sold to 3rd Party in Past 12 months? No.

G. Geolocation data.
Collected: Yes.
Business Purpose: Improving the website’s functionality and ensuring security.
Shared With or Sold to 3rd Party in Past 12 months?: No.

H. Audio, electronic, visual, thermal, olfactory, or similar information.
Collected: No.

I. Professional or employment-related information.
Collected: No.

J. Education information, defined as information that is not publicly available personally
identifiable information as defined in the Family Educational Rights and Privacy Act
(20 U.S.C. section 1232g, 34 C.F.R. Part 99).
Collected: No.

K. Inferences drawn from any of the information in the categories above to create a
profile about a consumer reflecting the consumer’s preferences, characteristics,
psychological trends, preferences, predispositions, behavior, attitudes, intelligence,
abilities, and aptitudes.
Collected: Yes.
Business Purpose: Improving the website’s functionality and ensuring security.
Shared With or Sold to 3rd Party in Past 12 months? No.

L. Sensitive personal information.
Collected: No.

3. Why We Collect Your Personal Data

We use your Personal Data for the following reasons:

• Auditing related to a current interaction with the consumer and concurrent
  transactions, including, but not limited to, counting ad impressions to unique
  visitors, verifying positioning and quality of ad impressions, and auditing
  compliance with this specification and other standards;
• Detecting security incidents, protecting against malicious, deceptive, fraudulent,
  or illegal activity, and prosecuting those responsible for that activity;
• Debugging our software and systems to identify and repair errors that impair
  existing intended functionality;
• Short-term, transient use, provided the Personal Data that is not disclosed to
  another third party and is not used to build a profile about a consumer or
  otherwise alter an individual consumer’s experience outside the current
  interaction, including, but not limited to, the contextual customization of ads
  shown as part of the same interaction;
• Performing services on behalf of the business or service provider, including
  maintaining or servicing accounts, providing customer service, processing or
  fulfilling orders and transactions, verifying customer information, processing
  payments, providing financing, providing advertising or marketing services,
  providing analytic services, or providing similar services on behalf of the business
  or service provider;
• Undertaking internal research for technological development and demonstration;
  and
• Undertaking activities to verify or maintain the quality or safety of a service or
  device that is owned, manufactured, manufactured for, or controlled by the
  business, and to improve, upgrade, or enhance the service or device that is
  owned, manufactured, manufactured for, or controlled by the business.

4. Parties With Whom We Share Your Personal Data

We routinely share Personal Data with:

• our affiliates, including companies within our group;
• service providers and contractors whom we use to help deliver our goods and
  services to you, such as payment service providers, warehouses and delivery
  companies;
• other third parties we use to help us run our business, such as marketing
  agencies or website hosts;
• third parties approved by you, including social media sites you choose to link
  your account to or third-party payment providers;
• credit reporting agencies;
• our insurers and brokers; and
• our banks.

5. How to Exercise Your Rights

If you would like to exercise any of your rights as described in this Privacy Policy and
Policy Statement, please:

• Complete a data subject request form available on our website;
• Call us toll-free at +1 (855) 515 3060
• Email us at legal@ironsoftware.com

Please note that you may only make a data access or data portability disclosure request
twice within a 12-month period.

6. Verifying Your Identity

If you choose to contact us directly, you will need to provide us with:

• Enough information to identify you (e.g., your full name, address and customer or
  matter reference number);
• Proof of your identity and address (e.g., a copy of your driving license or passport
  and a recent utility or credit card bill); and
• A description of what right you want to exercise and the information to which your
  request relates.

We are not obligated to make a data access or data portability disclosure if we cannot
verify that the person making the request is the person about whom we collected
information, or is someone authorized to act on such person’s behalf.
Any Personal Data we collect from you to verify your identity in connection with your
request will be used solely for the purposes of verification.

7. Contact Us

If you have questions or concerns about this Privacy Statement, please contact us
online at legal@ironsoftware.com.

8. Revision Date and History

This Privacy Statement was last revised: 4/10/2025
Prior versions of this Privacy Statement are listed below: 4/11/2021