This Privacy Notice describes how HostPapa, Inc. (also “we”, “us”, “our” and “ours”), the operator of the Managed.com website (the “Site”), collects, uses, stores, transfers, and shares your Personal Information. The Site is informational in nature, and we do not sell products or services through the Site.

Our Site is intended for general business and consumer audiences, and we do not knowingly solicit or collect Personal Information from individuals under the age of 18.

We pride ourselves on protecting your privacy and supporting a safe online experience. We are governed by the Personal Information Protection and Electronic Documents Act (“PIPEDA”) in Canada, Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data (the “GDPR”), the UK General Data Protection Regulation as it forms part of UK law together with the UK Data Protection Act 2018 (the “UK GDPR”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, the “CCPA”), and any other data protection laws and regulations that may apply to us in the regions in which we operate.

We follow strict principles when we collect, use, store, transfer, or share any factual or subjective information, recorded or not, about an identifiable individual, or in general any information relating to an identified or identifiable living person (“Personal Information”): (a) we hold ourselves accountable for the Personal Information under our control; (b) we collect Personal Information only for the explicit purposes specified when collected, stated in this Privacy Notice, or for legitimate purposes not incompatible with those; (c) we will collect, use, store, transfer, and share Personal Information only with appropriate consent or legal grounds to do so; (d) we only collect Personal Information through fair and lawful means; (e) unless we have your consent or are otherwise permitted or required by law, we will only use Personal Information for the purpose it was collected, and will retain it only as long as required to serve that purpose; (f) to the best of our ability, we will keep Personal Information accurate and up to date to the extent necessary to fulfill its purpose; (g) we will protect Personal Information from unauthorized access and use by implementing appropriate technical and organizational security measures and controls; (h) we will make available our policies and practices related to Personal Information; and (i) we will establish processes to enable you to exercise your rights to be informed about, access, rectify, erase, restrict, port, or object to the processing of your Personal Information, and those in relation to automated decision-making, and to report any non-compliance with these principles.

What this Privacy Notice covers

This Privacy Notice describes how we may collect, use, store, transfer, and share your Personal Information in connection with the Site. It also informs you about your rights and choices regarding your Personal Information, the steps we take to protect it, how to contact us, and how we comply with applicable privacy laws and regulations. If you are a contractor or job applicant, Personal Information we collect from you in that context may be subject to a separate privacy notice provided to you where appropriate.

Under the GDPR and UK GDPR, we act as the data controller of the Personal Information we collect through the Site.

What we collect your Personal Information for

We collect your Personal Information in order to operate the Site, respond to your inquiries, comply with our legal obligations, and monitor and improve the experience of visitors to our Site. We may combine your Personal Information with other information we receive from third parties, and we may aggregate anonymized Personal Information only after ensuring that it can no longer identify you.

What Personal Information we may collect

The Personal Information collected through the Site may include:

• Personal Identification: such as your name.
• Contact Information: such as your email address, provided when you use our Contact Us form.
• Technical Information: such as your IP address, browser type, operating system, device information, domain names, referring website addresses, and access times, collected automatically through your use of the Site.
• Other Information: such as the content of any message you submit through our Contact Us form, or other information you voluntarily provide to us.

How we collect Personal Information

We collect Personal Information: (a) directly from you, such as when you submit our Contact Us form; and (b) automatically, through your use of the Site, including through cookies and similar tracking technologies such as Google Analytics (see “How we use cookies” below).

Please keep in mind that if you directly disclose Personal Information through any of our social media pages, that information may be collected and used by others.

How we use your Personal Information

We use your Personal Information for the purposes we collected it for. We can only use your Personal Information for a purpose different from the one we collected it for if there is a need to do so and the new purpose is compatible with the original one. If we need to use your Personal Information for a purpose different from and unrelated to the one we collected it for, we will notify you and provide the legal grounds for doing so, or a reasonable opportunity to object.

We DO NOT SELL any of your Personal Information, and we will not use or share your Personal Information except as described in this Privacy Notice. We may only use your Personal Information without your knowledge or consent when required or permitted by applicable laws and regulations.

Responding to Inquiries

We use the information you submit through our Contact Us form to respond to your questions, comments, or requests.

Web Analytics

We use analytics tools, such as Google Analytics, to understand how visitors use our Site, including which pages are viewed and how visitors navigate the Site. This data helps us determine which content is most useful and improve the design and performance of our Site. Personal Information collected through analytics tools may also be used to determine the effectiveness of any promotional content on our Site.

Business Continuity

Should we acquire a new company or business unit, or become part of a merger, acquisition, corporate reorganization, or other change of control, your Personal Information may be shared with our new owners, the resulting entity, or a business we acquire. If this happens, we will make reasonable efforts to notify you and inform you of any choices you may have regarding the Personal Information you shared with us.

Legal Disclosure

We may be required to disclose or process Personal Information we collect in order to comply with lawful requests from public authorities, regulators, or governmental agencies (including court, law-enforcement, or national security requests). In such cases, we will use the Personal Information we have collected only to the extent necessary to comply with those legal obligations or requests.

Our legal basis for processing your Personal Information

Consent: Where you provide consent for non-essential cookies, we process your Personal Information on the basis of your consent, which you may withdraw at any time as described in this Privacy Notice.

Legal Obligation: We may be required to process Personal Information we collect in order to comply with legal, regulatory, and law-enforcement requests.

Legitimate Interest: We may need to use your Personal Information for our legitimate business interests, such as responding to your inquiries; maintaining the security of our Site and systems; preventing fraud or misuse of our Site; data analytics; enhancing, modifying, or improving the Site; identifying usage trends; administrative tasks; and exercising our legal rights in or outside of court proceedings.

We may also use your Personal Information to protect the public interest or the vital interest of an individual.

Where we store your Personal Information

The data we collect is stored primarily in Canada and is regulated by the Personal Information Protection and Electronic Documents Act (PIPEDA). Canada has been recognized by the EU and UK as providing adequate data protection (as per article 45 of Regulation (EU) 2016/679), which allows personal information of EU and UK residents to be freely transferred to Canada.

Where we transfer Personal Information from the EU, UK, or other jurisdictions with data transfer restrictions to a country that has not been recognized as providing an adequate level of data protection, we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses or the UK's International Data Transfer Addendum, to protect your Personal Information.

How we transfer your Personal Information

Your Personal Information may be transferred and used in jurisdictions other than the jurisdiction of your residence, from where you use the Site, or from where you contact us, and such jurisdictions may have data protection laws and regulations that differ from those of your own jurisdiction.

We, our affiliates, and our third-party service providers may operate in a number of countries. That means that when you provide us with Personal Information, it may be transferred to any jurisdiction in which we or our service providers operate. We have taken appropriate measures to keep those transfers lawful and your Personal Information protected in accordance with this Privacy Notice.

If you visit our Site or contact us from a country other than the country in which our servers or service providers are located, your communications with us may result in the transfer of Personal Information across international borders. In all cases, your Personal Information will be handled under the terms of this Privacy Notice.

How we protect your Personal Information

We keep the Personal Information we collect in a controlled, secure environment and maintain safeguards designed to protect against unauthorized access, use, modification, and disclosure. Where possible, we use industry-standard encryption (such as SSL/TLS) when transmitting your Personal Information.

However, no data transmission over the Internet or a wireless network can be guaranteed to be 100% secure, so while we strive to protect your Personal Information, there are security and privacy limitations of the Internet that are beyond our control. Personal Information may be viewed or tampered with by a third party while in transit.

How we retain your Personal Information

We retain the Personal Information you submit through our Contact Us form for as long as necessary to respond to and resolve your inquiry, and thereafter for a reasonable period in accordance with our internal record-keeping practices and applicable law.

Personal Information collected through cookies and analytics tools is retained in accordance with the retention periods set out in our cookie preference tool. When Personal Information is no longer required for the purpose it was collected, we will ensure it is deleted or anonymized.

How to change your Personal Information

You may request access to, review, update, or correct any inaccuracies in your Personal Information by contacting us at privacy@managed.com. We may ask you to provide additional information in order to verify your identity before responding to your request.

You also have the right to request that we delete your Personal Information. We will honor such requests to the extent possible, unless we need to retain the Personal Information to comply with a legal obligation or for another purpose permitted by applicable law.

How we use cookies

We use “cookies” to help personalize your online experience. A cookie is a text file that is placed on your computer or device by a website server. Cookies cannot be used to run programs or deliver viruses to your computer. Cookies are uniquely assigned to your computer or device and can only be read by a website server in the domain that issued the cookie to you.

One of the primary purposes of cookies is to provide a convenience feature to save you time while browsing. Some cookies help our Site remember your cookie preferences on return visits.

Some cookies are necessary for our Site to work properly. Some cookies, like the ones used by Google Analytics, help us see how visitors use our Site. Others, if used, may be used to customize your advertising experience.

For any cookies that are not strictly necessary to operate the Site — including analytics and advertising cookies — we will ask for your consent through our cookie preference tool before those cookies are set. You can accept, reject, or customize your preferences at any time via the cookie control pop-up on the Site, and you may withdraw consent at any time as easily as you gave it. Strictly necessary cookies (e.g., those required to remember your cookie preferences) do not require consent, as our Site could not function without them.

If you withdraw consent after you have begun browsing our Site, we will immediately stop reading, using, or setting any previously placed non-essential cookies, with the exception of strictly necessary cookies.

We maintain governance controls over the cookies placed through our Site's cookie management system to ensure any new cookie is reviewed and correctly categorized for consent purposes before it is set. In the rare event that a change to a third-party service introduces a cookie outside this review process, we will identify it, correctly categorize it, and, if required, ensure consent is collected before it is used.

Links to Third-Party Sites

Our Site may contain links to other websites. If you provide personal information to a site or service that is not provided by us, we have no control over that third party's use of the information you provide them. We therefore have no responsibility or liability for the manner in which the organizations that operate such linked sites may collect, use, disclose, secure, share, transfer, or otherwise deal with your Personal Information. We provide these links as a convenience to you, but do not provide any representation or warranty, nor take any liability for the actions of the organizations operating such sites. Please exercise care when visiting linked sites, which will have separate and independent privacy notices or policies.

Future changes to our Privacy Notice

We reserve the right to modify this Privacy Notice at any time. Please check back regularly to make sure you are aware of any changes and to stay informed of how we protect your Personal Information.

How to contact us

We welcome your comments regarding this Privacy Notice. If you believe we have not adhered to this Privacy Notice, or if you would like to exercise any of your rights or request access to your Personal Information, please contact us at privacy@managed.com.

You may also contact our Managed.com Privacy Office at the email address above.

Alternatively, you can contact us in writing at:

Managed.com

Attn.: Privacy Office

5063 North Service Road, Suite 102, Burlington, ON L7L 5H6, Canada

We will use commercially reasonable efforts to promptly determine and remedy the problem.

California Consumer Privacy Statement

This California Consumer Privacy Statement supplements the Privacy Notice above and applies solely to individuals who qualify as California consumers under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, the “CCPA”). The CCPA provides California consumers with certain additional rights regarding their personal information (“California Personal Information”) that businesses collect.

We are committed to meeting our compliance obligations under the CCPA.

Your California Rights

If you are a California resident, you have certain rights related to your California Personal Information. You may exercise these rights free of charge except as otherwise permitted under applicable law.

• Right to Know. You may request that we disclose the categories and specific pieces of California Personal Information we have collected about you, the categories of sources from which it was collected, our business or commercial purpose for collecting it, and the categories of third parties, if any, with whom we share it.
• Right to Delete. You may request that we delete California Personal Information we have collected from you, subject to certain exceptions permitted by law.
• Right to Correct. You may request that we correct inaccurate California Personal Information that we maintain about you.
• Right to Opt Out of Sale or Sharing. We do not sell your California Personal Information for monetary consideration. Our use of analytics and, if applicable, advertising cookies may be considered “sharing” of California Personal Information for cross-context behavioral advertising purposes under the CCPA. You may opt out of this sharing at any time via the cookie control pop-up on the Site or as described below. We also honor Global Privacy Control (GPC) signals as a valid opt-out request where technically feasible.
• Right to Non-Discrimination. Subject to applicable law, we will not discriminate against you for exercising any of the rights described above, including by denying you goods or services, charging different prices or rates, or providing a different level or quality of goods or services.

You may request to exercise these rights by emailing us at privacy@managed.com. Please include your name and email address in the body of your request so that we can identify and respond to it.

As required or permitted under applicable law, we may take steps to verify your identity before granting you access to information or acting on your request to exercise your rights, and we may limit our response as permitted under applicable law.

We have collected the following categories of California Personal Information through the Site within the last 12 months:

• Identifiers, such as your name, email address, and online identifiers such as your IP address;
• Internet or other electronic network activity information, including your interaction with the Site; and
• Geolocation data, limited to approximate location derived from your IP address.

Within the last 12 months, we have not sold California Personal Information as defined by the CCPA. As noted above, our use of analytics and, if applicable, advertising cookies may constitute “sharing” of California Personal Information within the meaning of the CCPA.

We obtain California Personal Information: (a) directly from you, such as through our Contact Us form; and (b) automatically, through your use of the Site, including via cookies and analytics tools.

We use California Personal Information for the business purposes described in the Privacy Notice above, including:

• Detecting and protecting against security incidents, and malicious, deceptive, fraudulent, or illegal activity;
• Debugging to identify and repair errors that impair existing intended functionality of the Site;
• Responding to your inquiries and communications;
• Short-term, transient use, including contextual customization of advertising, if applicable;
• Conducting internal research to develop and improve the Site; and
• Auditing interactions with the Site.

Other U.S. State Privacy Rights

In addition to the California Consumer Privacy Act addressed above, a number of other U.S. states have enacted comprehensive consumer privacy laws that may apply to our processing of your Personal Information, including, among others, Virginia (Virginia Consumer Data Protection Act), Colorado (Colorado Privacy Act), Connecticut (Connecticut Data Privacy Act), Utah, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Montana, Oregon, Texas, Indiana, Kentucky, and Rhode Island (together, the “Other State Privacy Laws”). This section describes the rights these laws generally provide to residents of the applicable states. Because these laws are not identical, the specific rights, thresholds, and exceptions that apply to you will depend on your state of residence and on whether we meet the applicability threshold of that state's law.

Your Rights Under Other State Privacy Laws

Subject to certain exceptions under the applicable law, if you are a resident of a state with an Other State Privacy Law, you generally have the right to:

• Confirm whether we are processing your personal data and access that personal data;
• Correct inaccuracies in your personal data;
• Request deletion of your personal data;
• Obtain a copy of the personal data you previously provided to us in a portable and, to the extent technically feasible, readily usable format;
• Opt out of the processing of your personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects; and
• Appeal our decision on your request, as described below.

Exercising Your Rights

You may exercise these rights by contacting us at privacy@managed.com.

As permitted or required by the applicable law, we may need to verify your identity before responding to your request. If we decline to act on your request, you may appeal our decision by contacting us at privacy@managed.com and stating that you wish to appeal. We will respond to your appeal within the timeframe required by the applicable state law. If your appeal is denied, some states provide a right to contact your state Attorney General to submit a complaint.

Sale, Targeted Advertising, and Universal Opt-Out

We do not sell your personal data for monetary consideration. As described in “How we use cookies” above, our use of analytics and, if applicable, advertising cookies may constitute “targeted advertising” or a “sale” of personal data as those terms are defined under certain Other State Privacy Laws (which, unlike the CCPA, may define “sale” to include transfers of personal data for consideration other than money). You may opt out of such processing at any time via the cookie control pop-up on the Site. Where required by applicable law, we also recognize opt-out preference signals, such as the Global Privacy Control (GPC), as a valid request to opt out of targeted advertising and the sale of personal data.

Sensitive Data

We do not knowingly collect sensitive personal data (such as data revealing racial or ethnic origin, religious beliefs, health conditions, sexual orientation, citizenship or immigration status, or precise geolocation) through the Site. If this changes, we will obtain your consent prior to processing sensitive personal data where required by applicable law.

Nevada Opt-Out Disclosure

You Have the Right Not to Have Your Personal Information Sold

You have the right to request that we do not sell any of your personal information.

Personal information for this section means a natural person's first name or first initial and last name in combination with any one or more of the following data elements when the name and data elements are not encrypted: social security number; driver's license number, driver authorization card number, or identification card number; account number, credit card number, or debit card number, in combination with any required security code, access code, or password that would permit access to the person's financial account; a medical identification number or health insurance identification number; or a username, unique identifier, or electronic mail address in combination with a password, access code, or security question and answer that would permit access to an online account.

We do not sell personal information as defined in this section. If you nonetheless wish to submit a request under Nevada law, please email us at privacy@managed.com, stating that you do not want any of your personal information sold. Please include enough information so that we can reasonably verify your identity. We will respond to your request within 60 days of receiving it.

EU and UK GDPR (“General Data Protection Regulation”)

GDPR Statement and FAQs

The EU General Data Protection Regulation (“GDPR”) and the UK GDPR are data protection laws that regulate how organizations use and treat the personal data of individuals residing in the EU and UK, regardless of whether the organization has an established presence there. These laws give individuals residing in the EU or UK (“data subjects”) certain rights over how their personal data is collected, processed, retained, and transferred.

Our Managed.com Privacy Office is responsible for EU and UK GDPR compliance initiatives and works on an ongoing basis with relevant stakeholders to assess and advance compliance. Below are answers to some frequently asked questions.

Do we transfer personal data outside the EU or UK?

• The data we collect is stored primarily in Canada and is regulated by the Personal Information Protection and Electronic Documents Act (PIPEDA). Canada has been recognized by the EU as providing adequate data protection (as per article 45 of Regulation (EU) 2016/679), which allows personal information of EU residents to be freely transferred to Canada.
• As HostPapa works with a number of US-based partners, we also transfer data (in accordance with Article 45 of the GDPR) under appropriate safeguards, such as the European Commission's Standard Contractual Clauses and the UK's International Data Transfer Addendum.

Do we keep records of our data processing activities?

• Yes. We maintain records of our data processing activities in accordance with EU and UK GDPR requirements.

Do we require our service providers to comply with the EU and UK GDPR?

• Service providers that process personal data on our behalf are required to enter into EU and UK GDPR-compliant data processing terms.

What are your rights under the EU and UK GDPR?

• If you are located in the EU or UK, you have the right to request access to, correction of, or erasure of your personal data; to restrict or object to our processing of your personal data; to request portability of your personal data; and, where processing is based on consent, to withdraw that consent at any time. You may exercise these rights by contacting us at the email address shown below. You also have the right to lodge a complaint with your local data protection supervisory authority.

Contact privacy@managed.com with any questions.

Additional Resources

• European Commission: https://ec.europa.eu/justice/smedataprotect/index_en.htm
• UK Information Commissioner's Office (ICO): https://ico.org.uk