VERADY, INC. Privacy Policy

EFFECTIVE DATE: December 20, 2019, as amended February 18, 2021

In this Privacy Policy ("Policy"), we describe how Verady, Inc. ("Company", "we", "us", "our") collects, uses, and discloses information that we obtain about visitors to our website https://verady.com and https://ledgible.io (the "Site") and the services available through our Site, including the log-in portal for Ledgible users (collectively, the "Services").

By visiting the Site, or using any of our Services, you agree that your personal information will be handled as described in this Policy. Your use of our Site or Services, and any dispute over privacy, is subject to this Policy and, as applicable, our SAAS Agreement and/or Terms of Service, including its applicable limitations on damages and the resolution of disputes. The SAAS Agreement and Terms of Service are incorporated by reference into this Policy.

The Information We Collect About You

We collect information about you directly from you, and automatically through your use of our Site or Services.

Information We Collect Directly From You. The information we collect from you depends on how you use our Services. To create an account, you must provide your user name, email, password. The provision of this information is mandatory in order to create an account an log-in to the Ledgible platform. You may choose to provide us with other personal information when you communicate with us, including if you send us any complaints or enquiries. If you apply for a job with us, we may ask for your contact details, employment and education history, references and information required for right to work purposes under applicable law.

Information We Collect Automatically. We automatically collect information about your use of our Site through cookies, web beacons, local storage objects, java scripts and related technologies. This may include information such as your browser type and operating system; web pages you view on the Site; links you click on the Site; your IP address; the length of time you visit our Site and or use our Services; and the referring URL, or the webpage that led you to our Site. To the extent permitted by applicable law, we combine this information with other information we collect about you, including your personal information. In some jurisdictions, the information collected by these technologies constitutes personal information, and in those cases we comply with applicable law when processing that personal information. Please see the section "Cookies and Other Tracking Mechanisms" below for more information.

How We Use Your Information

We use your information, including your personal information, for the following purposes:

• To provide you with the ability to create an account and log into the Legible platform and our Services.

• To communicate with you about your use of our Services (including about updates to our products and services as well as our legal agreements), to respond to your enquiries (including those submitted through our "Get in touch" form), and for other customer service purposes.

• To tailor the content and information that we may send or display to you, to offer location customization, and personalized help and instructions, and to otherwise personalize your experiences while using the Services.

• To take payments for your use of the Services.

• To send you marketing communications about our products and services including newsletters.

• To better understand how users access and use our Services, both on an aggregated and individualized basis, including through our use of Google Analytics (see below for more information). For example, we will evaluate which features of our Site are more (or least) used by users, and we will use this information to make improvements to our Site.

• To comply with legal obligations, as part of our general business operations, and for other business administration purposes.

• Where we believe necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person or violations of our SAAS Agreement and Terms of Service or this Privacy Policy.

  If you are a resident of the European Economic Area, please see the section "Information for EEA Residents" for information about our lawful basis for processing personal information.

How We Share Your Information

Subject to the imposition of confidentiality obligations at least as protective as those set forth in the parties’ SaaS Agreement, we may share your information, including personal information, as follows:

• Service Providers. We disclose the information we collect from you to service providers, contractors or agents who perform functions on our behalf. These service providers include our payment processor, Stripe (see https://stripe.com/privacy) and our analytics provider, Google Analytics (see https://policies.google.com/privacy?hl=en).

We also disclose information in the following circumstances:

• Business Transfers. If (i) we or our affiliates are or may be acquired by, merged with, or invested in by another company, or (ii) if any of our assets are or may be transferred to another company, whether as part of a bankruptcy or insolvency proceeding or otherwise, we may transfer the information we have collected from you to the other company. As part of the business transfer process, we may share certain of your personal information with lenders, auditors, and third party advisors, including attorneys and consultants.

• In Response to Legal Process. We disclose your information to comply with the law, a judicial proceeding, court order, or other legal process, such as in response to a court order or a subpoena. In the event we are required to disclose your information pursuant to a valid order by a court or other governmental body or as otherwise required by law, prior to any such compelled disclosure, we will (i) notify you of the legal process, and allow you to assert the privileged and confidential nature of the information against the third party seeking disclosure and (ii) cooperate fully with the disclosing party in protecting against any such disclosure and/or obtaining a protective order narrowing the scope of such disclosure and/or use of the Confidential Information. If such protection against disclosure is not obtained, we will be entitled to disclose the Confidential Information, but only as and to the extent necessary to legally comply with such compelled disclosure.

• To Protect Us and Others. We disclose your information when we believe it is appropriate to do so to investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, violations of our SAAS Agreement and Terms of Service or this Policy, or as evidence in litigation in which we are involved.

If you are a resident of California, please see the section "Information for California Residents" for more information about our collection and disclosure of personal information.

Our Use of Cookies and Other Tracking Mechanisms

We and our third party service providers use cookies and other tracking mechanisms to track information about your use of our Site or Services. We may combine this information with other personal information we collect from you (and our third party service providers may do so on our behalf).

Cookies. Cookies are alphanumeric identifiers that we transfer to your device’s hard drive through your web browser for record-keeping purposes. We use these technologies to make our websites function securely (strictly necessary cookies); to gather information about your preferences and personalize your browsing experience; and to collect general / statistical information about your use of the website in order to improve the website for all users. Strictly necessary cookies are mandatory, but you do have a choice to control our use of optional cookies.

As well as being either strictly necessary or optional, cookies can be classified as either "session" or "persistent".

• Session Cookies. Session cookies exist only during an online session. They disappear from your device when you close your browser or turn off your device. We use session cookies to allow our systems to uniquely identify you during a session or while you are logged into the Site and Services. This allows us to process your online transactions and requests and verify your identity, after you have logged in, as you move through our Site and Services.

• Persistent Cookies. Persistent cookies remain on your device after you have closed your browser or turned off your device. We use persistent cookies to track aggregate and statistical information about user activity.

Disabling Cookies. Most web browsers automatically accept cookies, but if you prefer, you can edit your browser options to block optional in the future. The Help portion of the toolbar on most browsers will tell you how to prevent your computer from accepting new cookies, how to have the browser notify you when you receive a new cookie, or how to disable cookies altogether. Visitors to our Site and Services who disable cookies will be able to browse certain areas of the Site, but some features may not function as intended.

Clear GIFs, pixel tags and other technologies. Clear GIFs are tiny graphics with a unique identifier, similar in function to cookies. In contrast to cookies, which are stored on your computer’s hard drive, clear GIFs are embedded invisibly on web pages. We may use clear GIFs (a.k.a. web beacons, web bugs or pixel tags), in connection with our Site and Services to, among other things, track the activities of Site visitors, help us manage content, and compile statistics about Site usage. We and our third party service providers also use clear GIFs in HTML e-mails to our customers, to help us track e-mail response rates, identify when our e-mails are viewed, and track whether our e-mails are forwarded.

Third Party Analytics. We use Google Analytics to evaluate usage of our Site, which helps us improve our Site’s performance and user experiences. These entities may use cookies and other tracking technologies, such as web beacons or local storage objects (LSOs), to perform their services. To learn more about Google’s privacy practices, please review the Google Privacy Policy at https://www.google.com/policies/privacy/. You can also download the Google Analytics Opt-out Browser Add-on to prevent their data from being used by Google Analytics at https://tools.google.com/dlpage/gaoptout.

Cross-Device Use. We and our third party service providers, including Google, may use the information that we collect about you (whether directly from our Site, through your device(s), or from a third party) to help us and our third party service providers identify other devices that you use (e.g., a mobile phone, tablet, other computer, etc.).

Do-Not-Track. Currently, our systems do not recognize browser "do-not-track" requests. You may, however, disable certain tracking as discussed in this section (e.g., by disabling cookies).

Third-Party Links

Our Site and Services may contain links to third-party websites. Any access to and use of such linked websites is not governed by this Policy, but instead is governed by the privacy policies of those third party websites. We are not responsible for the information practices of such third party websites.

Security of My Personal Information

We have implemented reasonable precautions to protect the information we collect from loss, misuse, and unauthorized access, disclosure, alteration, and destruction. Please be aware that despite our best efforts, no data security measures can guarantee security.

You should take steps to protect against unauthorized access by choosing a robust password that nobody else knows or can easily guess, and keeping your log-in and password information private. You should also not use the same password across multiple online accounts. To the extent permissible by law, we are not responsible for any lost, stolen, or compromised passwords or for any activity on your account via unauthorized password activity.

Access To My Personal Information

You may modify personal information that you have submitted by logging into your account and updating your account information.

What Choices Do I Have Regarding Use of My Personal Information?

We may send periodic promotional emails to you. You may opt-out of promotional emails by following the opt-out instructions contained in the email. Please note that it may take up to 10 business days for us to process opt-out requests. If you opt-out of receiving promotional emails, we may still send you emails about your account or any services you have requested or received from us.

If you are a resident of the EEA or California, you should see the sections "Information for EEA Residents" and "Information for California Residents" respectively for more information about your rights under local privacy laws.

Information for EEA Residents

If you are resident in the EEA, then our use of your personal information (i.e. your personal data) may be covered by the extra-territorial application of the General Data Protection Regulation ("GDPR").

Your personal information will be used for the purposes listed in the "How We Use Your Personal Information" section above. Where our use of your personal information is subject to the GDPR, or other data protection laws imposing comparable obligations, we will only collect, use and share your personal information where we are satisfied that we have an appropriate legal basis to do this. In the majority of cases this will be because processing of your personal information is necessary to:

• perform our obligations and exercising our rights under the SAAS Agreement and Terms of Service, including to provide you with access to the Ledgible platform and our Services, where you are an individual customer;

• our legitimate interests as a business, including our legitimate interest in facilitating access to the Legible platform for authorised users of our corporate customers and our legitimate interest in securing the Site and analysing use of the Site;

• compliance with legal obligations (for example, where we are required to make certain disclosures to government bodies); and

• consent, where this is required under local law (for example, where this is required for sending marketing communications).

• to access personal information, together with an explanation about how and why we use your personal information;

• to rectify / erase personal information;

• to restrict the processing of your personal information;

• to object to the processing of personal information (where the lawful basis is "legitimate interests");

• to object to how we use your personal information for direct marketing purposes;

• to obtain a portable copy of your personal information or have it transmitted to another organisation (where the lawful basis is "consent" or "performance of a contract");

• to obtain a copy of personal information safeguards used for transfers outside your jurisdiction; and

• to lodge a complaint with your local supervisory authority (a full list of EU supervisory authorities can be found on the website of the European Data Protection Board).

If you would like to exercise any of those rights, please:

• email support@verady.com;

• let us have enough information to identify you; and

• let us know the information to which your request relates.

Information for California Residents

This section of the Privacy Policy provides additional information solely for California residents, as required under the California Consumer Privacy Act of 2018 ("CCPA"), and applies to personal information, whether collected online or offline. As used in this section of the Privacy Policy, "personal information" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household.

Personal Information Not Covered by this California Section

This section does not address or apply to our handling of publicly available information made lawfully available by state or federal governments or other personal information that is subject to an exemption under Section 1798.145(c) – (f) of the CCPA.

Except for your Right to Opt-out and your Right of Non-Discrimination (see "Your CCPA Rights and Choices" below), the CCPA, and therefore this section of the Policy, does not apply to personal information we collect in a "business-to-business context". This covers California residents with whom we transact or communicate solely in the context of conducting due diligence for, providing or receiving a product or service to or from a company that employs such residents or engages such residents as contractors. For example, where you work for a Verady supplier and we receive your business contact information in the context of receiving services from that supplier.

This section has limited applicability for California job applicants, independent contractors, or current or former full-time, part-time and temporary employees and staff, officers, directors or owners of Verady. Where your personal information is processed in this context, the rights and choices listed below are not currently available to you.

Categories of Personal Information that we Collect and Disclose

Our collection, use and disclosure of personal information about a California resident will vary depending upon the circumstances and nature of our interactions or relationship with such resident. The table below sets out generally the categories of personal information (as defined by the CCPA) about California residents that we collect and disclose to others for a business purpose. We collect these categories of personal information from the sources described in the "The Information We Collect About You" section above, and for the purposes described in the "How We Use Your Personal Information" section above.

Categories of Personal Information Sold

• We do not currently sell personal information under the CCPA.

Your CCPA Rights and Choices

The CCPA provides California residents with specific rights regarding their personal information. This section describes your rights under the CCPA and explains how to exercise those rights. Subject to certain exceptions, California residents have the right to make the following requests:

Right to Opt-out of Sale: We do not currently sell personal information. If at any point we do so, you will have the right to direct us not to sell your personal information ("opt-out"). We do not sell personal information if we have actual knowledge that the consumer is less than 16 years of age, unless we receive affirmative authorization ("opt-in") from either the consumer between 13 and 16 years of age, or the parent or guardian of a consumer less than 13 years of age.

Right to Delete: You have the right to request that we delete and direct any service providers that have received that personal information to delete, the personal information that we have collected and retained, unless an exemption applies. Once we receive and confirm your verifiable request, we will delete (and, if applicable, direct our service providers to delete) your personal information from our records, unless an exemption applies.

Right to Access: You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable request, we will disclose to you:

• the categories of personal information we collected about you;

• the categories of sources of personal information we collected about you;

• our business or commercial purposes for collecting or selling that personal information;

• the categories of third parties with whom we have disclosed or shared that personal information;

• the specific pieces of personal information we collected from you;

• the categories of third parties to whom your personal information has been sold; and

• the categories of personal information that we have sold (if any). Submitting Requests: You can submit a deletion or access request by either:

• Submitting a request online here [Insert link to contact us form on website]

• Sending an email to support@verady.com

We will respond to verifiable requests received from California residents as required by law. You can also designate an authorized agent to make a request under the CCPA on your behalf, but the agent must provide proof that the agent is authorized to make a request on your behalf.

We may ask you for additional information necessary to verify or process your request. Where applicable, we may ask for proof that an authorized agent is entitled to act on your behalf. We may also carry out checks, including with third party identity verification services, to verify your identity before taking any action with your personal information. We will endeavour to respond your verifiable requests within 45 days of receipt. If we require more time (up to 45 additional days), we will inform you of the reason and extension period in writing. Any disclosures we provide will only cover the 12- month period preceding the verifiable consumer request receipt. Generally, California residents can exercise rights free of charge.

Non-Discrimination: You have the right not to receive discriminatory treatment for the exercise of the privacy rights conferred by the CCPA. We will not discriminate against you for exercising any of your CCPA rights or impose unreasonable requirements on financial incentives offered to California consumers related to your personal information. We may offer different prices, rates, or quality of goods or services if the difference is reasonably related to the value of your personal information.

Children Under 13

Our Services are not designed for children under 13. If we discover that a child under 13 has provided us with personal information, we will delete such information from our systems.

Contact Us

If you have questions about the privacy aspects of our Services or would like to make a complaint, please contact us at support@verady.com.

Changes to this Policy

This Policy is current as of the Effective Date set forth above. We may change this Policy from time to time, so please be sure to check back periodically. We will post any changes to this Policy on our Site. If we make any changes to this Policy that materially affect our practices with regard to the personal information we have previously collected from you, we will endeavour to provide you with notice in advance of such change by highlighting the change on our Site.