13. ANNEXURE A: Jurisdiction-specific provision:

California Privacy Rights Act (CPRA)

This CPRA Privacy Policy describes Affinity practices regarding the collection, use, and disclosure of the personal information of California residents, describes the rights of California residents under the California Privacy Rights Act (“CPRA”), and explains how California residents may contact Affinity to exercise those rights. This CPRA Privacy Policy only applies to the personal information of California residents.

CPRA Categories of Personal Data

No Sale of Personal Data:

Affinity has not sold Personal Data in the preceding twelve (12) months.

Right To Opt-Out Of The Sale Of Personal Data:

Affinity does not sell your personal data.

If in case, Affinity ever changes its policy and choose to sell Personal Data, you would have the right to opt-out of the sale of your Personal Data by clicking on the Cookie Settings.

Sensitive data:

We do not generally seek to collect sensitive data through this site or otherwise. In the limited cases where we do seek to collect such data, we will do this in accordance with California Privacy Rights Act("CPRA") requirements. If in case, Affinity ever chooses to use Sensitive Personal Data, you would have the right to limit the use of your sensitive personal Data.

The term "sensitive data" refers to the various categories of personal data identified by CPRA as requiring special treatment, including in some circumstances the need to obtain explicit consent from you. These categories include racial or ethnic origin, political opinions, religious, philosophical, or other similar beliefs, membership of a trade union, physical or mental health, biometric or genetic data, sexual life or orientation, or criminal convictions and offences (including information about suspected criminal activities).

Disclosures of Personal Data for a Business Purpose:

In the preceding twelve (12) months, Affinity has not disclosed Personal Data for business purposes.

Your Rights:

The CPRA provides consumers (California residents) with specific rights regarding their personal information. This section describes your CPRA rights and explains how to exercise those rights.

• Access to Specific Information

  You have the right to request that Affinity disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you:

  • The categories of personal information we collected about you.
  • The categories of sources for the personal information we collected about you.
  • Our business or commercial purpose for collecting or selling that personal information.
  • The categories of third parties with whom we share that personal information.
  • The specific pieces of personal information we collected about you (also called a data portability request).
  • If we sold or disclosed your personal information for a business purpose, two separate lists disclosing:
    • Sales, identifying the personal information categories that each category of recipient purchased; and
    • Disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.
• Deletion Request Rights

  You have the right to request Affinity delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.

  We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

  • Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
  • Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
  • Exercise free speech, ensure the right of another consumer to exercise their free speech rights or exercise another right provided for by law.
  • Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
  • Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement if you previously provided informed consent.
  • Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
  • Comply with a legal obligation.
  • Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
• Right to Correct Inaccurate Personal Information

  You have a right to request for correction of Inaccurate personal information. We shall use commercially reasonable efforts to correct the inaccurate personal information as directed by the consumer.

• Right to Know What Personal Information is Sold or Shared and to Whom

  You have a right to request us information about what personal information is sold or shared by us and with whom. Once request received, we shall disclose the following:

  • The category or categories of consumers’ personal information it has sold or shared, or if we have not sold or shared consumers’ personal information, it shall disclose that fact.
  • The category or categories of consumers’ personal information it has disclosed for a business purpose, or if we have not disclosed consumers’ personal information for a business purpose, it shall disclose that fact.
• Right to Opt Out of Sale or Sharing of Personal Information

  You have a right to opt out of sale or sharing of personal information if we sell or share such personal information. We shall prohibit from selling or sharing the consumer’s personal information after its receipt of the consumer’s direction, unless the consumer subsequently provides consent, for the sale or sharing of the consumer’s personal information.

• Right to Limit Use and Disclosure of Sensitive Personal Information

  You have a right to request us to limit Use and Disclosure of Sensitive Personal Information. Upon such request we shall prohibit, from using or disclosing the consumer’s sensitive personal information for any other purpose after its receipt of the consumer’s direction unless the consumer subsequently provides consent for the use or disclosure of the consumer’s sensitive personal information for additional purposes.

• Right of No Retaliation Following Opt Out or Exercise of Other Rights – Non-Discrimination

  We will not discriminate against you for exercising any of your CPRA rights. Unless permitted by the CPRA, we will not:

  • Deny you goods or services.
  • Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
  • Provide you a different level or quality of goods or services.
  • Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

  Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

  You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

  • Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
  • Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

  We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.

• Response Timing and Format

  We endeavour to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.

  Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

  We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

CONTACT FOR MORE INFORMATION

If you have any questions or concerns about Affinity’s privacy policy and practices, please contact us by email at compliance@affinity.com, or by mail at:
20 N. Wacker Drive, 12th Floor,
Chicago, IL 60606

Privacy policy change

We will review and update this CPRA Privacy Policy periodically and will note the date of its most recent revision at the top of this CPRA Privacy Policy. If we make material changes to this Policy, we will post the revised Policy on our website and may take additional measures to inform you about such changes prior to such changes taking effect, if required by applicable data protection laws. We encourage you to review this Policy frequently to be informed of how Affinity is protecting your information.

14. ANNEXURE B: EU-U.S. Data Privacy Framework for Data Transferred to the United States from the EU

Participation in EU-US Data Privacy Framework (EU-US DPF) and UK extension to the EU-U.S. DPF:

Affinity Global Inc. has created this privacy notice based on the EU-U.S. Data Privacy Framework to help you understand how we are subject to and comply with the EU-U.S. Data Privacy Framework (EU -U.S.DPF) and UK extension to the EU-U.S. DPF.

The U.S. Department of Commerce has established this framework regarding the collection, use, and retention of personal information transferred from the European Union (“EU”) and the UK to the United States.

Affinity Global Inc, a Delaware Corporation headquartered in Chicago, Illinois, has certified that it adheres to the EU-U.S. DPF Principles and the UK Extension to the EU-U.S. DPF as set forth by the U.S. Department of Commerce with respect to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. If there is any conflict between the policies in this privacy policy and the data subject rights under the EU- U.S. DPF Principles, the EU -U.S. DPF Principles and UK extension to the EU-U.S. DPF shall govern.

To learn more about the EU US DPF program and to view our certification page, please visit Home (dataprivacyframework.gov) for more details.

Scope

We are an ad tech company and create user engagement products for digital media.

• Affinity.com
• mCanvas - Brand Marketing Platform,
• VEVE - Performance Marketing Platform,
• SitePlug - Performance Marketing Platform,
• YieldSolutions - Publisher Monetisation Solution,
• AdOPSOne - Ad Operations Assistant,
• NucleusLinks - Merchant Links Automation Platform and
• Opinary - Consumer Engagement Tech Platform.

Type of Personal Data in Scope of EU-U.S. Data Privacy Framework and UK Extension to the EU-U.S. DPF:

We cover non-HR data in the framework. Based on the nature of the businesses listed above, Affinity will process any of the data elements listed in the sections End User’s Data and Other Data.

Purpose of Data in Scope of EU-U.S. Data Privacy Framework and UK Extension to the EU-US DPF:

Refer to the sections How We Use Your Data and Lawful bases for processing for the purpose of processing and its lawful basis.

Notice

We may be required to disclose Personal Data in response to lawful requests by public authorities, including requests to meet national security or law enforcement requirements. Prior to the transfer of Personal Data from the EU and the UK to the United States, we require a contractual confirmation from the Controller from whom we acquired the information that the Personal Data has been provided to us in accordance with GDPR, EU U.S. DPF and UK extension to the EU-U.S. DPF, or the applicable EU Member State Data Protection law, thereby ensuring the data subjects have been provided with proper notice regarding how their Personal Data will be used.

Choice

Pursuant to the EU U.S. DPF Framework and UK extension to the EU-U.S. DPF, EU and UK individuals have the right to obtain our confirmation of whether we maintain personal information relating to you in the United States. Upon request, we will provide you access to the personal information we hold about you. You may also correct or amend\ the personal information we hold about you. Furthermore, you may delete data that has been handled in violation of the DPF Principles. An individual who seeks access or who seeks to correct, amend inaccurate date or delete mishandled information transferred to the United States under EU U.S. DPF and UK extension to EU-U.U. DPF should direct their query to compliance@affinity.com. If requested to remove data, we will respond within a reasonable timeframe.

We will provide an individual opt-out choice, or opt-in for sensitive data, before we share your data with third parties other than our agents or before we use it for a purpose other than which it was originally collected or subsequently authorized.

To request to limit the use and disclosure of your personal information, please submit a written request to compliance@affinity.com.

Accountability for onward transfer

Affinity Global Inc. is responsible for processing personal data it receives under the EU U.S. Data Privacy Framework and UK extension to EU-U.S. DPF and subsequently transferring it to third parties as described in sections Your information shared with others.

Since we share Personal Data with third parties as referenced above, we comply with the notice and choice principles as described above for all data disclosed or transferred to a third party. We take reasonable and appropriate steps designed to ensure that the third party effectively processes the Personal Data transferred in a manner consistent with our obligations under the Principles.

When we use data processors to perform processing tasks on our behalf and at our direction and instruction, we require our data processors either:

• Subscribe to the EU US DPF Program and UK extension to EU-U.S. DPF (in the case of US-based processors), comply with the General Data Protection Regulations or
• Enter into a written agreement with us requiring the data processor(s) to process the data only for limited and specified purposes and to provide the same level of protection as Affinity Global Inc.

In cases of onward transfer to third parties, we remain liable for the acts of the third party that are in violation of the EU U.S DPF. Principles and UK extension to EU-U.S. DPF unless we can prove we were not a party giving rise to the damages.

We may be required to release EU and/or UK personal data in response to lawful requests by public authorities including to meet national security and law enforcement requirements.

Data Security

We have an information security policy in place designed to protect Personal Data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. Refer to Security Measures to Protect your Data for more details.

Data Integrity & Purpose Limitation

Any personal information received from our customers in which personal data of EU and UK citizens may be contained is treated as “Confidential,” and adequate technical and administrative controls are implemented across Affinity Global Inc.

The personal information is used only for the purpose for which it has been collected and is shared within the organization on a need-to-know basis.

The technical and administrative controls ensure the preservation of the confidentiality, integrity, and availability of information per the contractual obligations to which Affinity has committed itself.

Data Access

An individual may request access to the Personal Data processed pursuant to the EU U.S. DPF and UK extension to EU-U.S. DPF we process as part of our Services. Individuals have the right to learn whether data about him or her is found in our information products and to correct, amend or delete that information when it is inaccurate. This right applies only to Personal Data about the individual making the request and is subject to other limitations as defined by law.

Individuals can request access by sending a request to compliance@affinity.com. We agree to process all reasonable requests for access within a reasonable time period but reserve the right to deny access or limit access in cases where the burden or cost of providing access would be disproportionate to the risks to the individual’s privacy or when the request is manifestly unfounded or excessive.

Recourse, Enforcement, and Liability

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, Affinity Global Inc. commits to resolve DPF Principles-related complaints about our collection and use of your personal information.  EU and UK individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF should first contact us at: compliance@affinity.com

Affinity Global Inc. has further committed to refer unresolved privacy complaints under the EU US DPF and the UK Extension to the EU-U.S. DPF to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by BBB National Programs If you do not receive timely acknowledgment of your complaint, or if your complaint is not addressed satisfactorily, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers/ProcessForConsumers for more information and to file a complaint. This service is provided free of charge to you.

Under certain conditions, an individual may invoke binding arbitration to resolve residual claims. We are subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.

If your EU-US DPF and the UK Extension to the EU-U.S. DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See EU US DPF Annex 1 at ANNEX I (introduction) (dataprivacyframework.gov).

Contact Information

If you have any questions or concerns about Affinity Global Inc's privacy policy and practices, please contact us by email at compliance@affinity.com, or by mail at:
20 N. Wacker Drive, 12th Floor,
Chicago, IL 60606

Privacy policy change

We will review and update this Privacy Policy periodically and note the date of its most recent revision at the top of this Privacy Policy. If we make material changes to this Policy, we will post the revised Policy on our website and may take additional measures to inform you about such changes prior to such changes taking effect, if required by applicable data protection laws. We encourage you to review this Policy frequently to know how Affinity Global Inc. protects your information.