Beeline Community Privacy Notice

Effective: February 9^th 2024

Introduction

Beeline is committed to maintaining robust privacy protections for its users of our community platform (Community") This Privacy Notice is designed to help you understand how we collect, use, share, and safeguard the information you provide to us through community.

For purposes of this Privacy Notice the terms “we,” “us,” and “our” refer to Beeline and “you” refers to you as a user of Community.

By accessing Community, you accept the terms of this Privacy Notice and consent to our collection, storage, use and disclosure of your Personal Information as described in this Privacy Notice.

This Privacy Notice will be available to you within Community as well as via certain communications from us (such as upon login or via e-mails we may send to you in reference to Community). This Privacy Notice may change from time to time, in which case we will update the Privacy Notice hosted within Community.

Privacy Principles

We are committed to individual privacy and recognize our responsibility for protecting the Personal Information in our possession and care. This Community Privacy Notice embodies the following principles:

Notice: At the time we collect Personal Information from you we will advise how it will be used, and to whom it will be disclosed.

Access: You will be granted access to the Personal Information you provide and will be able to submit corrections to the information where you believe it to be inaccurate (see Inquiries below).

Data Integrity and Purpose Limitation: We will use Personal Information for the purpose of processing it on behalf of and as directed by you, or in the circumstances where we are the data controller for marketing, improving, and securing our Community platform. In the event that we receive a complaint regarding our processing of your Personal Information, we will take steps to ensure that your Personal Information is accurate and current as updated by you.

Onward Transfer and Choice: We will only share your Personal Information with third parties that will support your use of Community. Such third parties agree to maintain appropriate procedures to safeguard your Personal Information and use it only for the purposes of providing the services for which they were retained by us.

In the event that we receive a lawful request to disclose your Personal Information by public authorities, including to meet national security or law enforcement needs, we will comply with the request and will notify you of such request where required by applicable law.

Security: We will treat all Personal Information as confidential and will maintain internal procedures and security safeguards designed to prevent inappropriate disclosure or misuse of your Personal Information by our personnel. Our personnel are responsible for protecting your Personal Information, are trained in the applicable policies, and are expected to adhere to the procedures and intent of this Privacy Notice.

Enforcement: If you believe that we have not properly handled your Personal Information in accordance with this Privacy Notice, you have the right to contact us (see Inquiries below), and we will conduct an investigation and report our findings to you in accordance with applicable law. If you are subject to the General Data Protection Regulation, you may also make use of the appropriate Data Protection Authorities; we will cooperate with EU, UK, or Swiss Data Protection Authorities to investigate and resolve complaints, including complying with any resulting advice given by the Data Protection Authorities.

Data Practices

Information we collect.

We collect “Non-Personal Information” and “Personal Information” from your activity in Community. Non-Personal Information includes information that cannot be used to personally identify you such as anonymous usage data, general demographic information, preferences that you submit and preferences that are generated based on information you submit and clicks that you make. Personal Information includes any information that is identifiable to you or by which you can be identified, such as your name, email address, mailing address, phone numbers, or other personal characteristics or attributes.

We process your Personal Information for the purpose of providing you with access to our Community, including tasks as directed or authorized by you and in order to improve, develop and secure Community.

We also process transaction and information system usage information from Community. This may include information obtained from cookies, which we use for a variety of reasons including remembering registration or login information, survey participation, and to auto-populate correspondence details (see “Use Of Cookies and Similar Technologies” below). We may directly collect Personal Information from you for contact or marketing purposes when you consent to such use in connection with registering for an event or webinar, create your profile in Community, or otherwise submit Personal Information to us. Such Personal Information may be stored for such period of time until no longer required by us to fulfill its purpose or until you request to have your Personal Information erased as permitted under applicable law.

How We Use and Share Your Personal Information

Except as otherwise stated in this Privacy Notice, we do not sell, trade, rent or otherwise share your Personal Information with third parties for marketing purposes without your consent. We do share your Personal Information with third parties who are performing services for us in support of our Community. Those third parties use your Personal Information only at our direction and in accordance with this Privacy Notice. We only use your Personal Information for the purposes for which it was collected as described herein, any other notice we may provide to you and as set forth under the privacy notice of any third party site you elect to visit from Community.

Other Reasons We Share Personal Data

• Use of Personal Information by Our Affiliates: Our affiliates will process your Personal Information in order to provide you with support and other services.
• Engagement with Technology Vendors: We share user engagement information derived from Community with third parties that will generate feedback that will allow us to improve Community. Unless we expressly ask for and you grant consent, the data we will provide to our technology vendors will not include your Personal Information.
• Corporate Mergers and Acquisition Activity: In the event that we or our affiliates acquire or are acquired by another business operation, or in the event of a merger, reorganization or other similar event, your Personal Information will be shared with the acquiring, acquired, or resulting entities and their affiliates including for the purposes of the continued availability of Community to you as well as for the provision of additional products or services offered by the acquiring, acquired or resulting entities.
• Legal Requirements: In certain situations, we may be required to disclose Personal Information in response to lawful requests by governmental agencies and supervisory authorities, including as necessary to meet security or law enforcement requirements. We reserve the right to disclose your Personal Information as required by applicable law and when we believe that disclosure is necessary to protect our rights or to comply with a judicial proceeding, court order, or similar legal process served upon us. We will provide you with notice of such disclosures where required to do so by law.

Updates to This Privacy Notice

Updates to this Privacy Notice shall be made available as they occur within the Community site or by other means that we may select and make available to you upon notice and will apply to your use of Community upon the noted effective date.

Information Security

Personal Information in our possession is protected by our Information Systems Security Policy, which is designed to prevent unauthorized disclosure, misuse, or alteration of Personal Information. The Information Systems Security Policy includes confidentiality procedures applicable to all our personnel, security requirements for physical and electronic security, and compliance policies and procedures for information handling. All of our personnel are required to acknowledge understanding of the Information Systems Security Policy, and adherence is enforced.

Your Community account is protected by your account password, and we encourage you to take steps to keep your Personal Information safe by not disclosing your password and by logging out of your Community account following each visit.

GDPR

If you are subject to the General Data Protection Regulation, the following apply to your Personal Information.

• We are acting as an independent data controller of your Personal Information when you access Community, communicate with us, engage with Elective Content, register for events and consent to receive marketing communications from us. When you register for events you will be redirected from Community to a third party site where you will be subject to the terms of use and the privacy notice of the third party event registrar handling your registration.
• When you establish a Community account with us, we are the data processor and your employer on whose behalf you are granted access to Community is the data controller of your Personal Information that you provide in conjunction with Platform Enhancements, except for purposes of managing the security and functionality of Community, internal reporting, and meeting our compliance obligations, in which case we are an independent data controller of such Personal Information You have certain rights with respect to such Personal Information that include: (i) you may request from us access to, rectification, erasure, or restriction of, processing concerning your Personal Information; and (ii) you have the right to object to the processing, the right to data portability, and the right to lodge a complaint with a supervisory authority.
  • We process your Personal Information inside and outside of the United States and rely upon legally approved mechanisms to lawfully transfer information across borders. Countries where we process data may have laws which are different from, and potentially not as protective as, the laws of your own country.
  • We will only collect and process your Personal Information where we have lawful bases. Lawful bases include consent (where you have given consent), contract (where processing is necessary for the performance of a contract with you e.g., our Terms) or with your employer on whose behalf you are granted access to Community, and for our legitimate business interests.
    Where we rely on your consent to process your Personal Information, you have the right to withdraw or decline your consent at any time and where we rely on legitimate interests, you have the right to object. If you have any questions regarding the lawful bases upon which we collect and use your Personal Information, please contact us (see “Inquiries” below.)
  • We retain some of your Personal Information even after you have closed your Community account with us as reasonably necessary to: comply with our legal obligations or our contractual obligations with your employer on whose behalf you are granted access to Community, meet regulatory requirements, resolve disputes, maintain security, prevent fraud and abuse, enforce our Terms, or fulfill your request to delete or amend your Personal Information.

Data Privacy Framework

EU-U.S. Data Privacy Framework

We participate in and have certified that we adhere to the EU-U.S. Data Privacy Framework and the UK Extension of the EU-U.S. Data Privacy Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of Personal Information transferred from the European Union, and the United Kingdom (and Gibraltar), to the United States. We have certified to the Department of Commerce that we adhere to the EU-U.S. Data Privacy Framework principles (the “DPF Principles”). We are subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC). If there is any conflict between the terms in this Privacy Notice and the DPF Principles, the DPF Principles shall govern. To learn more about the EU-U.S. Data Privacy Framework, and to view our certification (we, Beeline.com, LLC. are a covered entity of IQNavigator, Inc.), please visit https://www.dataprivacyframework.gov/s/participant-search

Swiss-U.S. Privacy Shield Framework - Although the Swiss-U.S. Privacy Shield Framework principles are not yet in effect, we will certify to those principles at that time.

We are committed to protecting all Personal Information received from European Union (EU) member countries, the UK (and Gibraltar), and Switzerland, in accordance with the applicable DPF Principles and to ensure Personal Information collected from individuals in the EU, UK (and Gibraltar) and Switzerland, is accessible to them as part of their individual rights when we are the Data Controller of the Personal Information. (see “Your Privacy Rights” below.)

We are responsible for the processing of Personal Information we receive and subsequently transfer to a third party acting as an agent on our behalf. We comply with the DPF Principles for all onward transfers of Personal Information from the EU, the UK (and Gibraltar), and Switzerland (for examples of such transfers, see “How We Share and Use Your Personal Information” above ) including the onward transfer liability provisions. In certain situations, we may be required to disclose Personal Information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

We are subject to the regulatory enforcement powers of the U.S. Federal Trade Commission.

To learn more about these Data Privacy Framework programs, visit the U.S. Department of Commerce's Data Privacy Framework site https://www.dataprivacyframework.gov.

Your Privacy Rights

Under applicable data protection regulations, you have certain rights regarding your personal information. You may contact us regarding these rights as set out under “Inquiries" below.

Retention and Disposal of Personal Information

We will retain your Personal Information as needed to fulfill the purposes for which it was collected. We will retain and use your Personal Information as necessary to comply with our business requirements and legal obligations, to resolve disputes, protect our assets, and enforce our rights and agreements.

We will not retain Personal Information in identifiable form when the purpose(s) for which the Personal Information was collected has been achieved and there is no legal or business need to retain such Personal Information. Thereafter, the data will either be destroyed, deleted, anonymized, and/or removed from our systems.

Additional Disclosures for California Residents

If you are subject to the California Consumer Protection Act (“CCPA”), the following apply to your Personal Information.

• For business purposes in the last twelve months, we may have collected, used, and shared Personal Information about you as described in this Privacy Notice. Each category of data that may be used by us or shared with third parties is categorically outlined in this Privacy Notice.
• California consumers have a right to: (1) request access, correction, and deletion of their Personal Information, (2) opt out of the sale of their Personal Information, and (3) not be discriminated against for exercising one of their California privacy rights.
• All individuals have the right to request access to and deletion of the information we hold about them via “Inquiries” below.
• We do not sell the Personal Information of California consumers nor do we discriminate against individuals for exercising their privacy rights.
• California Shine the Light: Residents of the State of California, under California Civil Code § 1798.83, have the right to request from companies conducting business in California a list of all third parties to which the company has disclosed Personal Information during the preceding year for direct marketing purposes. Alternatively, the law provides that if the company has a privacy policy that gives either an opt-out or opt-in choice for use of your Personal Information by third parties (such as advertisers) for marketing purposes, the company may instead provide you with information on how to exercise your disclosure choice options. We have a comprehensive Privacy Notice and do not sell or share your Personal Information to third parties for direct marketing purposes. Therefore, we are not required to maintain nor disclose a list of the third parties that received your Personal Information for marketing purposes during the preceding year.

Children's Privacy

We are committed to protecting the privacy of children. Community and any accompanying services offered are not directed at children who are under 13 years of age. We require that individuals requesting information on our products or services be 13 years of age or older. Should we receive personal information from a person whom we know is under 13 years of age, we will endeavor to delete such information from our records, and the information will not be used for any purpose. If you believe that a person under 13 years of age has provided us with his or her Personal Information, please notify us at privacy@beeline.com so that we can take reasonable steps to remove the information from our systems.

Alternative Dispute Resolution (ADR)

In compliance with the DPF Principles, we commit to resolving complaints about our collection or use of your Personal Information. Individuals with inquiries regarding our Data Privacy Framework policy or complaints regarding the handling of your Personal Information should contact privacy@beeline.com.

We have further committed to refer unresolved Data Privacy Framework complaints to JAMS, an alternative dispute resolution provider located in the United States. If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please email privacy@beeline.com for more information. The services of JAMS are provided at no cost to you. To learn more about JAMS, click here. To learn more about binding arbitration under the EU-U.S. Data Privacy Framework, click here.

Use of Sub-Processors

The following sub-processors process your Personal Information on behalf of Beeline. Terms of use and privacy notices are available within Community and at the links provided below. Notification of any changes to our use of Sub-processors will be made available here through an update in advance of such changes to the processing of your Personal Information.

Use of Cookies and Similar Technologies

Community is hosted by Gainsight®. The Gainsight® cookie list can be found here. Certain features of Community such as availability of product content are supported by ProductBoard®. When you engage with a feature of Community supported by ProductBoard® it will be indicated by the URL. The ProductBoard® cookie list can be found here. Beeline uses Google Analytics® within Community. Further information on our use of Google Analytics® and our general use of automatic data collection tools can be found here.

Application of This Privacy Notice

Solely with respect to Platform Enhancements (as defined within the Terms) offered via Community, in the event of a conflict between this Privacy Notice and the terms of any Customer Agreements (as defined within the Terms), the Customer Agreements shall be controlling with respect to those matters covered within the applicable Customer Agreements.

Community is hosted by Gainsight®. Gainsight®’s privacy notice can be found here.

Liability

Beeline’s liability under this Privacy Notice is as set forth in the Terms.

Inquiries

To inquire about any aspect of this Privacy Notice, Personal Information held, or uses of the Personal Information, please contact us at privacy@beeline.com.

If you want to know more about our commitment to Privacy, please contact us at privacy@beeline.com.

If you believe that your account credentials have been compromised or to report any other data security issue, please contact us at secincident@beeline.com.