GDPR Privacy Addendum

If you are located in the European Economic Area (“EEA”), the United Kingdom (“UK”), or Switzerland, the EU General Data Protection Regulation (“EU GDPR”) and the UK’s Data Protection Act 2018 (“UK GDPR”) (collectively referred to herein as the “GDPR”) provide you with additional rights regarding our collection and use of your “personal data.” This Addendum supplements the information in our Privacy Policy. If you are not located in the EEA, the UK, or Switzerland, this Addendum does not apply to you.

Any capitalized terms used in this Addendum and not defined herein have the meaning set forth in our Privacy Policy.

This Addendum applies to your personal data that Veraset collects from you when you use our Site and communicate with us, as well as information we collect about you from our trusted third-party Data Suppliers‍ for us to provide our data Solutions to Clients. For more information regarding the types of personal data that we collect, how we share such data, and how we secure it, please refer to our Privacy Policy.

Data Controller

Veraset acts as data controller by collecting and processing personal data you provide us. We also act as a data controller when we process your personal data received or obtained from our third party Data Suppliers.

Our Data Suppliers and Clients are independent data controllers, and you should contact them directly for questions about how they process your personal data and about how to exercise your privacy rights in relation to such processing.

Personal Data

The GDPR defines “personal data” as any data that identifies or can identify a particular unique user or device, including, name, address, mobile device identifiers, precise location data, IP, cookie identifiers, and biometric data, among others.

Legal Basis for Processing Your Personal Data

We collect and process your personal data only where we have lawful bases for doing so under the GDPR. The legal bases depend on the purpose of the processing, as outlined below:

‍

Purpose of ProcessingLegal BasisProvision of our Data SolutionsYour consent. We rely on app providers and our third-party Data Suppliers to obtain consent from you. We contractually require our Data Suppliers to comply with all applicable laws and to only provide us with your personal data which they have the rights to transfer to us for our specific usesAuthentication and verification in connection with our SolutionsPerformance of a contract, our legitimate interests, and consent (as applicable)To respond to your inquiries submitted through our SiteYou have provided your consent to us to do soSecurity of our Site and Solutions and to monitor, prevent, detect or investigate fraudulent or illegal activityOur legitimate interests, and to protect your vital interestsAnalytics on our SiteOur legitimate interests and your consent as described in our Cookie PolicyTo market and promote our products and servicesYou have provided your consent to us to do so and/or our legitimate interestsCommunicating with you regarding our Solutions or upon your requestPerformance of a contract, our legitimate interests, and consent (as applicable)To process a request to exercise a right to your personal data and to verify your identity in order to comply with such a requestYou have provided your consent to us to do so and to protect your vital interestsComplying with our legal or regulatory obligationsCompliance with our legal obligations, performance of a contract, and our legitimate interestsIn connection with an acquisition, merger, or sale of or business, or associated due diligence activitiesOur legitimate interests

Personal Data Transfers

Veraset is based in the United States, where we provide our Solution from. We may share your personal data with third parties who are located in jurisdictions outside the EEA, UK, or Switzerland for purposes described in our Privacy Policy and this Addendum. These jurisdictions have privacy laws that the European Commission considers are less protective of personal data than the privacy laws in your own country.

When we transfer Personal Data outside of the EEA, UK, or Switzerland, or to countries the EU has deemed as having inadequate protections, we take steps to make sure that appropriate safeguards are in place to protect your personal data, including, but not limited to, making such transfers in accordance with the European Commission approved Standard Contractual Clauses. In these Standard Contractual Clauses, we make commitments with respect to the privacy and security of such personal data. For more information on the Standard Contractual Clauses, please visit: https://ec.europa.eu/info/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en.

Your Personal Data Rights

The GDPR grants you a number of rights with respect to your personal data that Veraset, as a data controller, holds about you. Each of your rights is outlined below:

• Right to access or know: You have the right to request access to your personal data which we maintain, and if you choose, receive a copy of such data.

• Right to delete or erase: You have the right to request that we delete your personal data which we maintain in certain circumstances, for example where we no longer have a legitimate interest to maintain it.
• Right to correct/rectify/update: You have the right to correct personal data that we hold about you.
• Right to data portability: You have the right to request that your personal data which you have provided directly to us to be provided to you or another data controller in a structured, commonly use and machine-readable format.
• Right to restrict processing: Under some circumstances, you may request to restrict our use of your personal data, for example, where we have a legitimate interest. You also have a right to object to our processing of your personal data for direct marketing purposes.
• Right to withdraw consent: If your personal data is processed by us on the legal basis of consent, you have the right to withdraw your consent. Withdrawing your consent will not affect the lawfulness of processing we conducted prior to such withdrawal, nor will it affect the processing of your personal data conducted in reliance of a legal basis other than consent. Please refer to the Your Privacy Choices section of our Privacy Policy for more information on your opt-out choices. You may directly request to be removed from any data we provide through our Data Solutions by completing our opt-out and do not sale request form at https://www.veraset.com/do-not-sell-my-personal-information.
• Right to lodge a complaint: If you have a complaint about how we use your personal data, we hope that you will contact us according to the below. However, you can always file a complaint with the data protection authority in your jurisdiction. For more information, please contact your local data protection authority (contact details for data protection authorities in the EEA are available at https://edpb.europa.eu/about-edpb/board/members_en. Contact details for the data protection authority in the UK are available at https://ico.org.uk/.

How To Exercise Your Rights

If you would like to exercise any of these rights, please send us an email at privacy@veraset.com. Please note that we may require additional information from you to verify your request or that you are authorized to act on the behalf of another. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We will only use the information you provide to us when exercising your rights above to verify your identity or authority to make the request.

Contact Us

If you have any questions regarding this Addendum, our Privacy Policy, or your privacy rights, please contact us via email at privacy@veraset.com or in writing at:

Attention: Data Privacy Officer

Veraset, LLC
182 Howard Street, Suite 142
San Francisco CA 94105