Website Privacy Policy

This Website Privacy Policy (this “Policy”) describes how Reality Defender, Inc. and our subsidiaries and affiliated companies (collectively, “Reality Defender”, “we”, or “us”) collect, use, and disclose information about you.

This Privacy Policy applies to information we collect: (a) when you access or use our website and other online services (collectively, the “Website”); (b) when individuals communicate with us about you in a business capacity, such as vendors and professional service providers; (c) when you visit our offices or attend our events; and (d) through any other business interactions you may have with us, such as through our customer support channels or on social media pages.

We provide different, additional notices regarding our privacy practices with respect to the commercial services we provide to contracted customers and the proprietary software related to or associated with those services or the performance thereof.

We may change this Policy from time to time. If we make changes, we will notify you by revising the date at the top of this Policy. We may also provide you with additional notice (for example, by adding a statement to our General Terms of Use or by sending you a notification). We encourage you to review this Policy regularly to stay informed about our information practices and the choices available to you.

The personal information we collect about you depends on how you interact with us or use the Website. We describe below the categories of personal information we collect and the sources of this information.‍

Information You Provide to Us‍.

We collect information you provide directly to us. For example, we collect information directly from you when you create an account, fill out a form through the Website, or submit or post content, communicate with us via third-party platforms, participate in a contest or promotion, request customer support, or otherwise communicate with us. The types of information about you that we may collect include your name; email address; postal address; phone number; account username; account password; a form of identification; photos, images, videos, audio files; and voice recordings; and any other information you may choose to provide. Other types of personal information may be automatically collected when you access or use the Website. The types of personal information collected may include:

• Device and Usage Information. Certain information about how you access the Website may be captured automatically, including data about the device and network you use, such as your hardware model, operating system version, mobile network, IP address, unique device identifiers, and browser type. Information about your activity on the Website may also be collected, such as access times, pages viewed, links clicked, and the page you visited before navigating to the Website.
• Audio and Video Recordings and Photos. We capture photographs and video recordings in our physical facilities for security and safety purposes.
• Information Collected by Cookies and Similar Tracking Technologies. The Website (and third parties that perform work for us) use tracking technologies, such as cookies and web beacons, to collect information about your interactions. Cookies are small data files stored on your hard drive or in device memory that help us improve the Website and your experience on it, see which areas and features of the Website are popular, and count visits. Web beacons (also known as “pixel tags” or “clear GIFs”) are electronic images that we use on the Website and in our emails to help deliver cookies, count visits, and understand usage and campaign effectiveness.

Information We Collect from Other Sources.

We obtain information from other sources. For example, we may collect information from identity verification services, and data analytics providers. Additionally, if you create or log into your Reality Defender account through a third-party platform (such as Google), we will have access to certain information from Google’s platform, such as your name, birthday, and profile picture, in accordance with the authorization procedures determined by the platform.

Information We Derive.

We have the ability to derive information or draw inferences about you based on collected information. For example, we could make inferences about your approximate location based on your IP address.

We principally use the collected information to administer your account. We also use the collected information for the following purposes:

• To provide, maintain, improve, and develop new products and services, including to debug and repair errors in or on the Website;
• To personalize your experience with us;
• To send you technical notices, security alerts, support messages, and other relationship messages;
• To communicate with you, such as about products, services, and events offered by Reality Defender and others and provide news and information that we think will interest you (see the “Your Choices” section below for information about how to opt out of these communications at any time);
• To monitor and analyze trends, usage, and activities in connection with the Website;
• For legal and compliance purposes, such as to implement internal policies, detect, investigate, and respond to suspected fraud, security incidents, or other activity that is illegal or violates our policies, exercise a legal claim, cooperate with law enforcement investigations, and comply with applicable laws, regulations, legal processes, or governmental requests;
• To create de-identified, anonymized, or aggregated information;
• To enable solely internal uses in a lawful manner that are reasonably aligned with your expectations based on our interactions with you and that are compatible with the context in which the information was provided to us; and
• To carry out any other purpose described to you at the time the information was collected.

We may disclose your personal information as follows or as otherwise described in this Policy:

• We disclose personal information to vendors, service providers, contractors, and consultants that access personal information to perform work for us, such as companies that assist us with web hosting, information technology and software services, mailing services, marketing services, event management services, background check providers, cyber and physical security services, and customer service.
• If you provide a product review or otherwise share content on the Website, we may disclose this information publicly and to other users of the Website.
• If you choose to use integrations we offer on the Website, we may disclose certain information with the integration partners.
• We may disclose personal information if we believe that disclosure is in accordance with, or required by, any applicable law or legal process, including lawful requests by public authorities to meet national security or law enforcement requirements.
• We may disclose personal information if we believe that your actions are inconsistent with our user agreements or policies, if we believe that you have violated the law, or if we believe it is necessary to protect the rights, property, and safety of Reality Defender, our users, the public, or others.
• We may disclose personal information with our lawyers and other professional advisors where necessary to obtain advice or otherwise protect and manage our business interests.
• We may disclose personal information in connection with, or during negotiations concerning, any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company.
• Personal information may be disclosed between and among Reality Defender and our current and future parents, affiliates, and subsidiaries and other companies under common control and ownership.
• We may disclose personal information with your consent or at your direction.
• We may also disclose aggregated or de-identified information that cannot reasonably be used to identify you.

We engage others to provide Website analytics services. These entities may use cookies, web beacons, device identifiers, and other technologies to collect information about your use of the Website and other websites and applications, including your IP address, web browser, mobile network information, pages viewed, time spent on pages or in apps, links clicked, and conversion information. This information may be used by Reality Defender and others to, among other things, analyze and track data, determine the popularity of certain content, and better understand your online activity.

Reality Defender is headquartered in the United States, and we have operations and vendors in the United States and other countries. Therefore, we and those that perform work on our behalf may transfer your personal information to, or store or access it in, jurisdictions that may not provide levels of data protection that are equivalent to those of your home jurisdiction. We provide adequate protection for the transfer of personal data in accordance with applicable law.

As the legal basis for transfers of personal data into the United States, Reality Defender relies on the existence of certain Data Privacy Framework (DPF); in particular, for transfers: (a) from the European Economic Area (EEA), Reality Defender relies on the EU-U.S. DPF; (b) from the United Kingdom (including Gibraltar) (UK), Reality Defender relies on the UK Extension to the EU-U.S. DPF; and (c) from Switzerland, Reality Defender relies on the Swiss-U.S. DPF. The applicable Data Protection Framework are described in greater detail in Section 9 of this Policy.

You have certain choices with respect to your personal information, as described below.

• Account Information: You may update and correct certain account information at any time through your profile settings.
• Cookies: Most web browsers are set to accept cookies by default. If you prefer, you can usually adjust your browser settings to remove or reject browser cookies. Please note that removing or rejecting cookies could affect the availability and functionality of the Website. In addition, you may manage your preference through the Cookie Settings link on the Website itself.
• Do Not Track: We do not respond to do not track signals.
• Communications Preferences: You may opt out of receiving messages or promotional emails from Reality Defender by following the instructions in those communications. If you opt out, we may still send you non-promotional emails, such as those about your account or our ongoing business relations.

Your Privacy Rights.

Certain U.S. states afford consumers rights with respect to their personal information. Companies that are regulated by the California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020, (collectively, the “CCPA”) are required to explain some information using definitions and categories set out within the CCPA. If you are a resident of California, this section applies to you.

Collection and Use of Personal Information Under the CCPA.

Reality Defender may collect the categories of personal information set forth in the table below.

Sources of Information.

We collect the categories of personal information listed above from the following categories of sources:

• Directly from you. For example, when you communicate with us.
• Indirectly from you. For example, from observing your actions on the Website, from information your computer or mobile device transmits when interacting with the Website, email sent to your inbox from us, or interactions with us in social media.
• Third parties. For example, third party partners may give us information about you.

How We Use Personal Information‍.

As set forth in the table below, Reality Defender may disclose certain categories of personal information to certain categories of recipients in connection with the “Uses of Information” identified in Section 3.

Other Details About Our Information Practices.

We do not “sell” or “share” and have not “sold” or “shared” personal information in the preceding twelve (12) months under the laws applicable to you, and we do not knowingly sell or share personal information about individuals under the age of 16. Nor does Reality Defender use or disclose sensitive personal information for the purpose of inferring characteristics about you.

Data Retention‍.

We will not retain your personal information for longer than is reasonably necessary to carry out the applicable, identified purposes. To determine the length of time we retain personal information, we consider numerous factors, including legal and regulatory obligations, whether retention of personal information is needed to resolve disputes, make and defend legal claims, conduct audits, pursue legitimate business purposes, and/or enforce agreements.

Your Privacy Rights and Choices.

Depending on where you reside, you may have the right to: (a) know more about and access the personal information we collect, use, and disclose about you and to receive your data in a portable format; (b) delete your personal information; (c) correct inaccurate personal information; and (d) object to, or request that we restrict, certain processing.

DPF Opt-Out. If your personal data was received by Reality Defender from the EEA, UK, or Switzerland in reliance on the DPF Frameworks, you have the right to opt out of: (a) disclosure of your personal data to a third-party controller; or (b) use of your personal data for a materially different purpose than that for which it was originally collected. To exercise this right, contact us at privacy@realitydefender.com. For sensitive personal data (as defined in Section 10.5), we will only disclose or use such data for a materially different purpose after obtaining your express consent to do so (opt-in).

Exercising Your Rights.

To exercise the rights described above, please submit a request to us by emailing us at privacy@realitydefender.com. We will verify your request by asking you to provide information sufficient to confirm your identity, such as your name, email address, and information about your interactions with us. If you would like to use an authorized agent to exercise your rights, we may request evidence that you have provided such agent with power of attorney, or that the agent otherwise has valid signed authority to submit requests on your behalf, and ask that you verify your identity directly with us.

If you are located in the EEA, the UK, or Switzerland, you have certain additional rights and protections under the law regarding the processing of your personal data, and this Section 8 applies to you.

In addition to the rights described in this Section 8, individuals in the EEA, UK, and Switzerland whose personal data is processed by Reality Defender in reliance on Data Privacy Framework (and extensions thereto) have additional rights and recourse mechanisms as described in Section 9 of this Policy.

Legal Basis for Processing.

When we process your personal data, we will do so in reliance on the following lawful bases:

• To perform our responsibilities under a contract (e.g., information that you have requested).
• When we have a legitimate interest in processing your personal data to operate our business or protect our interests (e.g., to provide, maintain, and improve the Website, conduct data analytics, and communicate with you).
• To comply with our legal obligations (e.g., to maintain a record of your consents and track those who have opted out of marketing communications).
• When we have your consent to do so (e.g., when you opt in to receive marketing communications from us). Note that when consent is the legal basis for our processing your personal data, you may withdraw such consent at any time.

Data Retention.

For details about Reality Defender’s data retention practices, see the Data Retention section above.

Privacy Rights.

Subject to certain limitations, you have the following privacy rights:

• Access: You are entitled to ask us if we are processing your information and, if we are, you can request access to your personal information. This enables you to receive a copy of the personal information we hold about you and certain other information about it.
• Correction: You are entitled to request that any incomplete or inaccurate information we hold about you be corrected.
• Erasure: You are entitled to ask us to delete or remove personal data in certain circumstances. There are also certain exceptions where we may refuse a request for erasure, for example, where the personal data is required for compliance with law or in connection with claims.
• Restriction: You are entitled to ask us to suspend the processing of certain of your personal information about you, for example if you want us to establish its accuracy or the reason for processing it.‍
• Portability: You may ask us to help you transfer certain of your personal information to another party.
• Objection: Where we are processing your personal data based on legitimate interests (or those of a third party), you may challenge this. However, we may be entitled to continue processing your information in case there are compelling legitimate grounds to do so. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Consent: Where we are processing personal data with consent, you can withdraw your consent.

Exercising Your Rights.

To exercise any of the rights described above, please submit a request to us by emailing us at privacy@realitydefender.com.

Under Article 27 of the European Union General Data Protection Regulation (EU GDPR), we have appointed an EU GDPR Representative to act as our data protection officer. Our nominated EU GDPR Representative can be contacted as follows:

Under Article 27 of the United Kingdom General Data Protection Regulation (UK GDPR), we have appointed a UK GDPR Representative to act as our data protection officer. Our nominated UK GDPR Representative can be contacted as follows:

Questions or Complaints.

If you have a concern about our processing of personal data that we are not able to resolve, you have the right to lodge a complaint with the Data Protection Authority where you reside. Contact details for your Data Protection Authority can be found using the links below:

• For individuals in the EEA: https://edpb.europa.eu/about-edpb/board/members_en
• For individuals in the UK: https://ico.org.uk/global/contact-us/ ‍
• For individuals in Switzerland: https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact.html

DPF Certification and Principles.

Reality Defender complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Reality Defender has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. Reality Defender has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the DPF Program, and to view our certification, please visit https://www.dataprivacyframework.gov/ .

Scope of Personal Data Covered Under the DPF.

Reality Defender's DPF certification covers personal data received from the EEA, the UK, and Switzerland in connection with: (i) use of Reality Defender's website and online services; (ii) receipt of commercial services or products from Reality Defender; and (iii) business interactions with Reality Defender, including communications with vendors and professional service providers.

Purposes for Processing Personal Data Under the DPF.

In reliance on the DPF, Reality Defender processes personal data received from the EEA, UK, and Switzerland for the following purposes:

• To provide, maintain, and improve our products, services, and website;
• To communicate with you regarding your account, transactions, and inquiries;
• To send you marketing and promotional communications, where you have provided consent or where otherwise permitted by applicable law;
• To conduct data analytics and monitor usage trends;
• To detect and prevent fraud, security incidents, and other harmful or illegal activity;
• To comply with our legal obligations and respond to lawful requests from public authorities; and
• To carry out any other purpose described to you at the time the personal data was collected.

Onward Transfer to Third Parties Under the DPF.

Reality Defender may transfer personal data received under the DPF to third parties acting as agents or controllers, as described in Section 4 (Disclosing Information) of this Policy. Reality Defender remains responsible for the processing of personal data it receives under the DPF and subsequently transfers to a third party acting as an agent on its behalf. Reality Defender shall remain liable under the DPF if its agent processes such personal information in a manner inconsistent with the DPF, unless Reality Defender proves that it is not responsible for the event giving rise to the damage.

When transferring personal data to a third-party agent, Reality Defender: (a) transfers such data only for limited and specified purposes; (b) requires agents to provide at least the same level of privacy protection as required under the DPF; (c) takes reasonable and appropriate steps to ensure agents process personal data consistently with Reality Defender's obligations under the DPF; and (d) requires agents to notify Reality Defender if they determine they can no longer provide the same level of protection. Upon such notice, Reality Defender will take reasonable and appropriate steps to stop and remediate unauthorized processing.

When transferring personal data to a third-party controller, Reality Defender enters into a contract requiring that: (a) such data be processed only for limited and specified purposes consistent with the individual's consent; (b) the recipient provides the same level of protection as required under the DPF; and (c) the recipient notifies Reality Defender if it can no longer meet these obligations.

Choice and Sensitive Personal Data Under the DPF.

Reality Defender offers individuals the opportunity to choose (opt out) whether their personal data is disclosed to a third-party controller or used for a purpose materially different from the purpose for which it was originally collected. To exercise your opt-out right, please contact us at privacy@realitydefender.com.

With respect to sensitive personal data — including data specifying medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, or information specifying an individual's sex life — Reality Defender will obtain affirmative express consent (opt-in) before disclosing such data to a third party or using it for a purpose materially different from the purpose for which it was originally collected.

Individual Rights Under the DPF.

Individuals whose personal data is processed by Reality Defender in reliance on the DPF have the right to access the personal data that Reality Defender holds about them, and to correct, amend, or delete such data where it is inaccurate or has been processed in violation of the DPF, except where the burden or expense of providing access would be disproportionate to the risks to the individual's privacy, or where the rights of persons other than the individual would be violated.

To exercise these rights, please submit a request to privacy@realitydefender.com. Reality Defender will respond to requests within a reasonable timeframe.

Independent Recourse Mechanism and Dispute Resolution Under the DPF.

In compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF, Reality Defender commits to resolve complaints about our collection or use of your personal data. Individuals in the EEA, UK, and Switzerland who have inquiries or complaints regarding our handling of personal data received in reliance on the DPF may contact Reality Defender at: privacy@realitydefender.com.

Reality Defender has committed to refer unresolved DPF complaints to JAMS, an alternative dispute resolution provider headquartered in the United States, with an international hub located in London, England. If you do not receive timely acknowledgment of your complaint from us, or if we have not addressed your complaint to your satisfaction, please visit https://www.jamsadr.com/DPF-Dispute-Resolution for more information or to file a complaint. The services of JAMS are provided at no cost to you.

Binding Arbitration Under the DPF.

Under certain conditions, and as a last resort, individuals may have the possibility to invoke binding arbitration for complaints regarding DPF compliance not resolved by any other mechanism. For additional information on binding arbitration, see Annex I to the EU-U.S. DPF Principles, available at https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction.

FTC Jurisdiction and Enforcement.

Reality Defender is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (FTC) with respect to its compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF.

Compelled Disclosure to Public Authorities.

Reality Defender may be required to disclose personal data in response to lawful requests by public authorities and to meet national security or law enforcement requirements. Reality Defender will only disclose such personal data to the extent required by law and will endeavor to provide prompt notice to affected individuals where legally permissible.

If you have any other questions about this Policy, please contact us at privacy@realitydefender.com.