Topsort Legal

To ensure that personal information is collected, protected, used, disclosed and retained in accordance with applicable privacy laws and regulations, and to provide transparency to individuals about how Topsort handles their personal information in connection with our advertising technology services for marketplaces.

This Privacy Policy applies to all personal information processed by Topsort Inc. (doing business as Topsort) ("Topsort", "we", "us") in connection with our advertising technology platform for marketplaces, websites, applications, and business operations.

Important Note for Marketplace Customers

As our services are provided to marketplaces who act as data controllers for their end users, our marketplace customers are responsible for obtaining appropriate consents and providing privacy notices to their users. This Privacy Policy primarily covers our direct relationships and does not replace the privacy obligations of our marketplace customers toward their end users.

Overview

At Topsort, we take the protection of personal information seriously. Personal information means information that identifies you as an individual or from which you can be reasonably identified.

This Privacy Policy applies to Topsort Inc. and provides information about the personal information we collect and handle about our customers, platform users, website visitors, employees, and business partners.

Topsort has a longstanding commitment to privacy and data security in our advertising technology services. We use pseudonymised information to serve interest-based advertisements while protecting individual privacy and complying with applicable privacy laws.

Topsort may update this privacy policy from time to time, with the most up-to-date policy always available at our website.

Why do we collect and handle your personal information?

We collect, hold, use and disclose your personal information so that we can provide our advertising technology services, improve and personalize our platform and communications, and operate our business effectively. This includes, but is not limited to:

Service Provision:

• Managing your account and providing access to our SaaS platform
• Processing transactions and managing billing in accordance with our SaaS Master Service Agreement
• Delivering advertising campaigns using pseudonymised information
• Providing platform analytics and performance reporting
• Offering customer support and technical assistance
• Responding to inquiries and feedback

Business Operations:

• Conducting risk assessments and security monitoring in accordance with our Information Security Management System
• Preventing fraud and ensuring platform security
• Complying with legal obligations under GDPR, ePrivacy Directive, Australian Privacy Act, Brazilian LGPD, and other applicable regulations
• Managing relationships with vendors and business partners per our Third-Party Management Policy
• Conducting internal audits and quality assurance

Communications and Marketing:

• Communicating about our services and platform updates
• Providing marketing materials and promotional information (with appropriate consent)
• Conducting surveys and research to improve our services
• Managing event participation and business development

Legal and Compliance:

• Meeting regulatory requirements and responding to legal process
• Protecting our rights and interests
• Supporting business continuity and disaster recovery
• Complying with export/import regulations applicable to our software

Where you provide us with personal information about someone else, you must have their consent to provide their personal information to us and advise them of this Privacy Policy.

Types of personal information collected

The types of personal information we collect are classified according to our Data Management Policy into Confidential, Restricted, and Public categories:

Confidential Data (Highest Sensitivity):

• Customer Data and Personally Identifiable Information (PII)
• Company financial and banking data
• Salary, compensation and payroll information
• Strategic plans and business information
• Authentication credentials and access keys
• Technical vulnerability reports and incident data
• Source code and proprietary algorithms

Customer and Platform Data:

• Identity and contact details: name, business name, email address, phone number, business address
• Account information: login credentials, user preferences, platform settings
• Financial information: billing details, payment processing data, transaction history
• Platform usage data: interactions, feature usage, campaign performance metrics (using pseudonymised identifiers where possible)

Technical and Analytics Data:

• Technical information: IP addresses, browser information, device identifiers (using opaque identifiers where possible)
• Log data: access logs, error logs, security event logs
• Location information: general geographic location for service delivery
• Aggregated and anonymized data for service improvement and statistical analysis

Employee and Business Data:

• HR information: employment records, performance evaluations, training records
• Professional information: job titles, company information, industry sector
• Access credentials: system permissions, security clearances
• Background check information as required by our Human Resource Security Policy

Communications and Marketing Data:

• Support interactions: customer service tickets, email communications, chat logs
• Marketing preferences: communication preferences, engagement metrics
• Survey responses and research participation data

How do we collect personal information

We collect your personal information when you interact or transact with us. This includes, but is not limited to, when you:

• Register for and use our advertising technology platform
• Create an account or subscribe to our SaaS services
• Contact us for customer support or sales inquiries
• Participate in surveys, research, or marketing activities
• Visit our websites or use our applications
• Attend events or engage with us on social media
• Enter into contracts or business relationships with us
• Apply for employment with Topsort

We may also collect personal information from third parties including:

Business and Public Sources: Public sources and business directories; professional networking platforms; industry events and trade publications; referral partners and business associates.

Service Providers: Cloud infrastructure providers (AWS and other platforms); customer support platforms; business intelligence and analytics platforms; security monitoring service providers; payment processing providers.

Legal and Regulatory Sources: Regulatory bodies and government agencies as required by law; credit reporting agencies for financial services; background check providers for employment screening.

How do we protect the personal information we hold

We hold personal information electronically, at our facilities and with trusted service providers. We implement comprehensive administrative, technical, and organizational security measures in accordance with our Information Security Management System (ISO 27001), including:

Technical Safeguards:

• Encryption of data in transit and at rest for all Confidential data
• Multi-factor authentication and role-based access controls
• Network firewalls and intrusion detection systems
• Regular security assessments and vulnerability testing
• Secure development practices and code review
• Pseudonymization and anonymization techniques for advertising services

Administrative Safeguards:

• Information security policies and procedures
• Employee security training and background checks
• Incident response and breach notification procedures
• Regular security audits and compliance reviews
• Data classification and handling requirements per our Data Management Policy

Organizational Safeguards:

• Need-to-know access principles and documented approval processes
• Vendor security assessments per our Third-Party Management Policy
• Business continuity and disaster recovery planning
• Mobile device security requirements including encryption and screen lock after 15 minutes
• Prohibition of storing Confidential data on personal devices or removable media

Device and Data Security:

• Mobile devices with Confidential data must be encrypted and password protected
• Backups are encrypted for all Confidential information
• Secure disposal procedures including data wiping or physical destruction
• Certificate retention for professional destruction services

Sharing of personal information

We may share personal information within the Topsort organization and with trusted third parties to provide our services and conduct business operations, subject to our data classification requirements:

Technology and Infrastructure:

• Cloud hosting and data processing providers
• Application development and technical support services
• Security monitoring and threat detection services
• Backup and disaster recovery service providers

Business Operations:

• Customer support and communication platforms
• Payment processing and financial services
• Marketing and business development platforms
• Professional services (legal, accounting, consulting)

Regulatory and Legal:

• With your representatives and authorized parties
• With regulatory authorities and law enforcement as required by law
• In connection with business transfers or corporate transactions
• To protect our rights, property, or safety, or that of others

We use systems and service providers located in various countries, and we ensure appropriate safeguards are in place for international data transfers.

Data Sharing Restrictions

• Transfer of Confidential data requires explicit written permission from management or data owner
• All sharing must comply with legal contracts or arrangements
• Third-party vendors must meet our security requirements for data disposal and processing
• Restricted data sharing requires management approval and need-to-know basis

International Data Transfers

We may transfer personal information internationally for processing by our service providers, cloud infrastructure, and business partners. For transfers subject to GDPR, Australian Privacy Act, and Brazilian LGPD requirements, we use Standard Contractual Clauses (SCCs) and adequacy decisions where applicable, and we ensure overseas recipients provide substantially similar data protections.

Transfer Safeguards:

• We implement additional safeguards including encryption, access controls, and contractual protections
• Cross-border data transfer protections comply with applicable international requirements

Brazilian LGPD

For transfers involving Brazilian personal data, we ensure compliance with LGPD international transfer provisions through contractual clauses or adequacy decisions recognized by ANPD. Cross-border processing is limited to countries or organizations providing adequate protection levels.

Data Retention

Retention Principles: We retain personal information only as long as necessary for the purposes for which it was collected, to meet legal and regulatory requirements, and for legitimate business needs.

Specific Retention Periods: As documented in our Data Management Policy and Data Retention Matrix:

• Customer platform data: Customer accounts and data deleted within 30 business days of contract termination
• Support communications: Retained for service improvement purposes
• Employee records: As required by employment law and business needs
• Security and audit logs: Varying periods based on type and regulatory requirements
• Financial records: As required by applicable accounting standards and tax laws

Legal Hold Exceptions: Data subject to legal proceedings is retained as required by legal counsel and reviewed annually for continuing requirements and scope.

Secure Disposal: Data classified as Restricted or Confidential is securely deleted, and hard drives/devices are securely wiped or physically destroyed before disposal.

Your Privacy Rights

🇪🇺

GDPR

EU & EEA Residents

Access: Request copies of your personal information

Rectification: Correct inaccurate or incomplete information

Erasure: Request deletion of your personal information

Restriction: Limit processing of your information

Portability: Receive your data in a portable format

Objection: Object to processing based on legitimate interests

Automated Decision-Making: Object to solely automated processing

🇧🇷

LGPD

Brazilian Residents

Confirmation & Access: Confirm processing and access your data

Correction: Correct incomplete, inaccurate, or outdated information

Anonymization/Deletion: Request anonymization, blocking, or deletion

Portability: Request transfer of your data to another provider

Information about Sharing: Learn how your data has been shared

Consent Withdrawal: Withdraw consent for consent-based processing

Review of Automated Decisions: Request review of automated processing

🇺🇸

CCPA / CPRA

California Residents

Know: Disclose categories and specific pieces of personal information collected

Erasure: Delete personal information we have collected from you

Correction: Correct inaccurate personal information we maintain

Opt Out: Opt out of cross-context behavioral advertising

Limit Use: Limit use of sensitive personal information

Non-Discrimination: We will not discriminate for exercising your rights

🇦🇺

Australian Privacy Act

Australian Residents

Request access to information held

Request correction of inaccurate data

Lodge complaints with us or the OAIC

Rights Under Other Jurisdictions: We comply with applicable privacy rights under other relevant privacy laws in jurisdictions where we operate.

Exercising Your Rights

To exercise your privacy rights:

• Contact us using the contact information in the "Contact Information and Complaints" section
• Provide sufficient information to verify your identity
• Specify the right you wish to exercise and relevant details
• We will respond within applicable timeframes (typically 30 days)

We may be unable to fulfill certain requests where they conflict with legal retention requirements or legitimate business interests.

Marketing Communications, Digital Technologies, and Cookie Consent

Marketing Practices: We may send marketing communications about our platform, services, industry insights, and business opportunities. You can opt out of marketing communications through:

• Unsubscribe links in emails
• Contacting us directly using the contact information in the "Contact Information and Complaints" section
• Managing your account preferences in our platform

Digital Technologies and Cookie Consent: We use cookies and similar technologies across our website (www.topsort.com) and our application platform (app.topsort.com). On our public website, we use cookies for necessary functions (such as privacy preference management and form submissions), analytics to understand how visitors engage with the site, advertising to personalize content and measure ad performance, and functionality features to enhance your experience. For analytics, advertising, and functionality cookies, you may manage your preferences via the cookie consent banner on our public website.

On our application platform, cookies are used to manage authenticated user sessions, maintain your workspace settings, and collect product analytics. Necessary cookies are always active.

Automated Decision-Making and Pseudonymisation

We may use automated systems for fraud detection and security monitoring, advertising optimization using pseudonymised information, platform performance improvement, customer support routing, and business analytics on anonymized datasets. Our advertising services use pseudonymised information and aggregation methods that protect individual privacy. Statistical analysis is performed on anonymized datasets.

When automated decision-making significantly affects you, we provide: information about the logic involved; the right to request human review; the ability to challenge decisions and request explanations; and appropriate safeguards and oversight measures.

Children's Privacy

Our advertising technology services are not directed to children under 16 years of age (or under 13 in Brazil). We do not knowingly collect personal information from children without appropriate parental consent. For Brazilian children's data, our customer must obtain "specific and highlighted consent" from parents or legal guardians before processing personal information of individuals under 18 years of age. If you believe we have collected information about a child, please contact us immediately using the contact information in the "Contact Information and Complaints" section.

Marketplace Customer Responsibilities: Our marketplace customers are responsible for ensuring they have appropriate consents and age verification measures for their end users, including compliance with children's privacy requirements in their respective jurisdictions.

Third-Party Services and Links

Our platform may integrate with or link to third-party services. We are not responsible for the privacy practices of these external services. We encourage you to review their privacy policies. When working with third-party service providers, we ensure they meet our security requirements for data processing and disposal in accordance with our Third-Party Management Policy.

Data Controller vs. Processor Activities

When We Act as Data Controller:

• Our own customer and business data
• Employee information and HR data
• Marketing and business development activities
• Website visitor information
• Internal business operations and analytics

When We Act as Data Processor:

• Customer advertising campaign data processed according to customer instructions
• Platform user behavior data processed on behalf of customers using pseudonymised information
• Analytics and reporting data generated for customers
• Technical support data processed under customer direction

Marketplace Customer Responsibilities as Data Controllers

When we act as a processor for marketplace customers, they are responsible for:

• Providing clear and lawful processing instructions for their users' data
• Ensuring legal basis for processing exists under applicable privacy laws
• Obtaining appropriate consents from their end users for advertising and analytics processing
• Handling individual rights requests from their users (access, deletion, correction, etc.)
• Maintaining appropriate data processing agreements with us
• Providing privacy notices to their end users that adequately describe our processing activities
• Ensuring compliance with children's privacy requirements for their platforms
• Managing cross-border data transfer requirements for their user base

Breach Notification

In the event of a personal data breach that poses a risk to individuals, we will assess the risk, take immediate containment measures, notify supervisory authorities within 72 hours where required by law, and inform affected individuals without undue delay if high risk exists. For customer data processed as a processor, we will notify customers promptly to assist with their breach response obligations.

Brazilian LGPD: We will notify ANPD within 3 working days of becoming aware of any breach affecting Brazilian personal data, inform affected Brazilian individuals in accordance with ANPD guidelines when the breach poses significant risks, and document the breach and response measures taken.

Contact Information and Complaints

For questions about this Privacy Policy or to exercise your privacy rights:

Data Protection Officer

dpo@topsort.com

2459 Greer Road, Palo Alto, California 94303

+1 (650) 530-0012

Supervisory Authorities

🇦🇺 Australia, OAIC · www.oaic.gov.au · 1300 363 992

🇪🇺 European Union, Your local data protection authority

🇺🇸 United States, Federal Trade Commission or relevant state authorities

🇧🇷 Brazil, ANPD · www.gov.br/anpd

Complaint Process

If you have concerns about our handling of your personal information:

• Contact us using the contact information above
• We will acknowledge your complaint and investigate promptly
• We will respond within 30 days with our findings and any corrective actions
• If you are not satisfied, you may contact the relevant supervisory authority

Data Protection Officer

In accordance with applicable privacy laws including GDPR and Brazilian LGPD, we have appointed a Data Protection Officer (DPO) who serves as:

• Primary contact for privacy-related inquiries and rights requests
• Monitor for compliance with data protection laws and regulations
• Point of contact for supervisory authorities on data protection matters

DPO Contact Information

Email: dpo@topsort.com

Address: 2459 Greer Road, Palo Alto, California 94303

Our DPO is available to assist with privacy questions, rights requests, and compliance matters for all jurisdictions where we operate.

Policy Updates

We may update this Privacy Policy to reflect changes in our practices, legal requirements, or business operations. Material changes will be communicated through:

• Email notification to registered users
• Prominent notice on our website
• Direct communication to affected customers
• Updated effective date and last updated information

Continued use of our services after policy changes constitutes acceptance of the updated terms, unless stronger consent requirements apply under applicable law.

Policy Compliance

Topsort will measure and verify compliance with this policy through various methods, including but not limited to business tool reports, internal and external audits, and regular policy reviews in accordance with our Information Security Management System.

Exceptions

Requests for an exception to this policy must be submitted to the Chief Technology Officer or the Chief Executive Officer for approval.

Violations & Enforcement

Any known violations of this policy should be reported to legal@topsort.com or to the Chief Executive Officer. Violations of this policy can result in immediate withdrawal or suspension of system and network privileges and/or disciplinary action in accordance with company procedures up to and including termination of employment.

This Acceptable Use Policy ("Policy") sets forth required actions, as well as prohibited activities and content, that apply to your use of products or services supplied by Topsort Inc. ("we", "us"), including its affiliates and third-party suppliers (collectively, "software and services").

If you violate the Policy or authorize or help others to do so, we may immediately suspend or terminate your use of the software and services. We reserve the right to remove any content or restrict or terminate the use of the software and services without prior notice for activities or content that, in our reasonable judgment, violate this policy or any agreement that grants you the right to use the services.

We may change this Policy from time to time by posting the updated policy on our website (https://www.topsort.com and all related sites operated by or for us) and informing our customers in email updates. You are deemed to accept a change to this Policy upon your continued use of the software and services following any such change. If you do not accept this Policy, you may not access or use the software and services.

Prohibited Activities

You may not use the software and services or permit others to use the software and services to:

• Violate any applicable law or regulation, including, without limitation, laws governing antitrust, encryption, export/import control, intellectual property, obscenity, privacy, securities, gambling, and telecommunications;
• Post, send, receive, use, encourage, promote, facilitate or instruct others to use defamatory, harassing, libelous, obscene, abusive, deceptive, false, misleading, fraudulent, pornographic or threatening materials, or private information without the consent of the individual(s) involved;
• Post, send or receive any content, including, without limitation, text, graphics, images, computer programs, links and "meta tags," that violates any copyright, patent, trademark, trade secret, or other intellectual property right of a third party;
• Obtain or attempt to obtain unauthorized access to any server, system, network or account;
• Interfere or attempt to interfere with the provision of software and services to any user, host, or network by use of any program, script or otherwise;
• Interfere or attempt to interfere with security-related features of the software and services, or features that limit or restrict (a) use of the software and services or (b) use or copying of any content accessible through use of the software and services;
• Avoid any use limitations placed on the software and services, such as access and storage restrictions;
• Monitor data or traffic on a system without permission;
• Send unsolicited bulk and/or commercial messages over the Internet (known as "spamming");
• Send, receive, or use malware, spyware, adware, key loggers, viruses, worms, harmful code and/or Trojan horses, or Internet Relay Chat "bots";
• Engage in "hacking", "cracking", mail bombing, port scanning, denial of service, or other malicious or destructive activities, whether lawful or unlawful, that Topsort determines to be harmful to its Subscribers, operations, reputation, goodwill, or customer relations;
• Resell the software and services, in whole or in part, to any third party without our express prior written consent;
• Violate the terms of any applicable software license or service agreements or the Terms of Use posted on this website;
• Use automation software to interact with our software and services without our express prior written permission.

Enforcement

When we become aware of harmful activities, we may take action to stop the harmful activity, which may include, but is not limited to, removing information, shutting down services in whole or in part, blocking offending transmissions, and denying access to the Internet.

These SaaS Terms of Service ("Agreement") are a legal agreement between the entity subscribing to the Service (as defined below) ("Customer") and Topsort Inc. ("Company") and govern the use of the Services. Unless otherwise set out in the Order (as defined below), this Agreement commences as of the date that the Services are first subscribed to by Customer (the "Effective Date").

Customer's use of the Services is also subject to the Company's policies and procedures set out on https://www.topsort.com/legals or otherwise made available to Customer through the Services (the "Policies").

By accessing, accepting or using the Services, Customer agrees to be legally bound by this Agreement and the Policies. If Customer does not agree to the terms of this Agreement and the Policies, then Customer may not access or use the Services.

If Customer is using the Services on behalf of a company or other entity then "Customer" includes Customer and that entity and Customer represents and warrants that (a) they are an authorized representative of the entity with the authority to bind the entity to this Agreement and (b) Customer agrees to this Agreement on the entity's behalf.

1SaaS Services and Support

1. Services. Subject to all the terms, conditions and restrictions of this Agreement, including full payment of all applicable fees, Company will use commercially reasonable efforts to provide Customer with the Company software-as-a-service platform and related services subscribed to by Customer (the "Services") as set out on the order page (the "Order") during the term of the Agreement. As part of the registration process, Customer will identify an administrative user name and password for Customer's company account. Company reserves the right to refuse registration of, or cancel passwords it deems inappropriate.
2. Support. Subject to the terms hereof, as part of the Services, Company will use commercially reasonable efforts to provide Customer with technical support services in accordance with Company's standard practice, as updated by Company from time to time.

2Restrictions and Responsibilities

1. Customer will not, nor attempt to, nor permit any third party to: (a) reverse engineer, decompile, disassemble or otherwise attempt to discover the source code, object code or underlying structure, know-how or algorithms relevant to the Services or any software, documentation or data related to, or used to provide, the Services ("Software"); (b) modify, translate, or create derivative works based on the Services or Software (except to the extent expressly permitted by Company or authorized in writing within the Services); (c) use the Services or Software for time sharing or service bureau purposes or otherwise for the benefit of a third party; or (d) remove any proprietary notices or labels from the Services. Further, Customer may not remove or export from the United States or allow the export or re-export of the Services, Software or anything related thereto, or any direct product thereof in violation of any restrictions, laws or regulations of the United States Department of Commerce, the United States Department of Treasury Office of Foreign Assets Control, or any other United States or foreign agency or authority. Without limiting the foregoing, Customer represents and warrants it will comply with all applicable laws and regulations of the United States and other applicable jurisdictions in using the Services, including without limitation, import, re-import, sanctions, anti-boycott, export, re-export, data localization, and data privacy and security laws. Customer shall be solely responsible for complying with any home country restrictions on receipt, use or downloading of the Services. As defined in FAR section 2.101, the Software and documentation are "commercial items" and according to DFAR section 252.2277014(a)(1) and (5) are deemed to be "commercial computer software" and "commercial computer software documentation." Consistent with DFAR section 227.7202 and FAR section 12.212, any use modification, reproduction, release, performance, display, or disclosure of such commercial software or commercial software documentation by the U.S. Government will be governed solely by the terms of this Agreement and will be prohibited except to the extent expressly permitted by the terms of this Agreement.
2. Additional Restrictions. Customer will not, nor attempt to, nor permit any third party to: (a) use the Services or Software to deliver spyware, adware, spam, or other deceptive or fraudulent ads and/or malicious code; (b) violate any local, state, national or international law or regulation in connection with use of the Services or Software, or otherwise use the Services in any way that is in furtherance of criminal, fraudulent, or other unlawful activity; (c) interfere with or disrupt the Services or Software or servers or networks connected to the Services; (d) interfere with or attempt to interfere with any other person's use of the Services or Software; (e) gain access to or attempt to gain access to any account, computers or networks related to the Services or Software without Company's express written authorization; (f) forge headers or otherwise manipulate identifiers in order to disguise the origin of any content or communication transmitted through the Services or Software; or (g) use traffic sources generated by toolbars, plugins, piracy sites, and/or any similar sites or applications. Company reserves the right to delete an account or suspend Customer's access to the Services if Customer violates Section 2.1 or this Section 2.2.
3. Customer represents, covenants, and warrants to and with Company that Customer will use the Services only in compliance with Company's Policies and all applicable laws and regulations. Customer will notify Company immediately upon becoming aware of any unauthorized use of the Services or Customer's username or password or account or any other known or suspected breach of security. As between Customer and Company, Customer is fully responsible and liable for compliance with the provisions of this Agreement by its Affiliates and each of their respective employees, agents, subcontractors for any and all activities that occur under Customer's account for the Services. Although Company has no obligation to monitor Customer's use of the Services, Company may do so and may prohibit any use of the Services it believes may be (or alleged to be) in violation of the foregoing.
4. Company will not be responsible or liable for any failure to provide the Services or other damages, losses or claims resulting from or attributable to (a) systems of the Customer or its Affiliates, (b) the Equipment (as defined below) and any other network, telecommunications or other service or equipment used to provide or access the Services, (c) Customer's or a third party's (except for a third party subcontractor engaged by Company to provide the Services) products, services, negligent acts or omissions, (d) Customer's breach of this Agreement, (e) Customer's failure to provide reasonably requested information, assistance and approvals; or (f) scheduled or emergency maintenance.
5. Customer shall be responsible for obtaining and maintaining any equipment and ancillary services needed to connect to, access or otherwise use the Services, including, without limitation, modems, hardware, servers, software, operating systems, networking, web servers and the like (collectively, "Equipment"). Customer shall also be responsible for maintaining the security of the Equipment, Customer account, passwords (including but not limited to administrative and user passwords) and files, and for all uses of the Customer account or the Equipment with or without Customer's knowledge or consent.
6. Company, in its sole discretion, may from time to time modify the Services or add, remove, update, upgrade, or otherwise change features or functionality of the Services in its discretion. Company will use reasonable efforts to notify Customer of such changes to the Services by posting information about them on the Company website or within the Services. If the sunsetting of major features or functionality materially adversely affects Customer's use of the Services, then Customer may terminate this Agreement at any time up until 30 days following the date that the feature or functionality has been sunset by providing written notice to Company ("Sunset Notice Period"). Customer's continued use of the Services after the Sunset Notice Period constitutes Customer's acceptance of these changes.
7. The Services may be used and accessed only by Company employees, agents and contractors that Company has authorized to use the Services ("Authorized Users") who have a need to access the Services. In no event may third parties other than Affiliated Entities use and access the Services. Neither Customer nor any Affiliated Entities or Authorized Users may use the Services or any of the Software to compete with the Company. Customer shall be fully responsible and liable for use of the Services by Authorized Users and their compliance with the terms of the Agreement.
8. Customer agrees that all user information provided to Company by Customer and/or the Authorized Users, whether for purposes of obtaining a username and password, other access credentials or otherwise, will be accurate and complete in all respects.

3Licenses to Customer

1. Grant of License. Company hereby grants to Customer a revocable (in accordance with this Agreement), non-exclusive, non-sublicensable, non-transferable, limited license to use the Services during the Term, and in accordance with the restrictions set forth herein, in the Policies and the applicable Order, for Customer's internal business purposes only. With respect to any Software that is distributed or provided to Customer for use on Customer premises or devices, Company hereby grants Customer a non-exclusive, non-transferable, non-sublicensable license to use such Software during the Term only in connection with Customer's authorized use of the Services.

4Intellectual Property

1. Company owns all right, title and interest (including intellectual property rights) in and to (a) the Services, the Software, the Company websites used to provide the Services (the "Site"), and any other documents, software, materials, content, or other intellectual property provided by or on behalf of Company in connection with the Services (other than Customer Data), including but not limited to the look and feel, structure, organization, design, algorithms, templates, data models, logic flow, text, graphics, logos, and screen displays associated therewith; and (b) all modifications, enhancements, updates and derivative works thereof and thereto. If Customer acquires any right, title or interest in or to any of the foregoing other than the limited licenses expressly granted in this Agreement, Customer hereby assigns all such right, title and interest to Company. Except for the limited rights and licenses expressly granted hereunder, no other license is granted to Customer, no other use is permitted and Company shall retain all right, title and interest in and to the foregoing.
2. Customer Data. Customer shall retain ownership of all content and data provided to Company by Customer or its Authorized Users in connection with Customer's use of the Site, the Software and the Services ("Customer Data"). Customer hereby grants Company a non-exclusive, sublicensable, transferable license during the Term to copy, use, distribute and disclose the Customer Data solely as necessary to provide the Services.
3. Data Use. Company may derive and compile from Customer's usage of the Services certain aggregated and/or analytical information, so long as such aggregated or analytical information does not reveal any information about Customer or any individual. Such aggregated data and metadata may be used for Company's own purposes without restriction, including, but not limited to, using such data in conjunction with data from other sources to improve Company's products and services, create new products and marketing. Company shall have the right to collect and analyze data and other information relating to the provision, use and performance of various aspects of the Services and related systems and technologies (including, without limitation, information concerning Customer Data and data derived therefrom), and Company will be free (during and after the term hereof) to (i) use such information and data to improve and enhance the Services and for other development, diagnostic and corrective purposes in connection with the Services and other Company offerings, and (ii) use, disclose and otherwise exploit such data solely in aggregate or other de-identified form for any lawful purpose. No rights or licenses are granted except as expressly set forth herein.
4. License Grant. Customer hereby assigns to Company any suggestions, ideas, enhancement requests, feedback, or other information provided by Customer or any Authorized User relating to the Services, Site or Software, and Company may use and exploit the foregoing without restriction or renumeration to Customer.

5API Terms

1. Use of API. Company provides an application programming interface ("API") as part of the Services.
2. API Limits. Company may from time to time set and update limits on Customer usage of the API, including without limitation limits on API requests and access to data (the "API Limits"). The API Limits will be described on the Site and/or in Company documentation provided through the Site or Services. Customer agrees to comply with all API Limits, and further agrees that Customer will not use the API in a manner that constitutes excessive or abusive usage, or otherwise is in breach of the terms of this Agreement, the Policies or the API Limits. Without limiting the foregoing, Customer agrees not to use the API in a manner that competes with any software or services provided by Company, or that provides API functionality to third parties. Customer will not circumvent or attempt to circumvent any API Limits.
3. Usage Monitoring. Company reserves the right to monitor Customer API and Software and Services usage to verify compliance with the terms of the Agreement and to improve Company's products and services. Customer agrees not to interfere with any such monitoring.
4. Update of API. Company may update the API from time to time pursuant to Section 2.6.
5. Maintenance Window. Company allocates time weekly on Sundays between 3:00 AM and 3:30 AM within the timezone of the given API server for maintenance. Interruptions during this time window are a possibility.

6Confidentiality

1. Each party receiving Proprietary Information (the "Receiving Party") understands that the party making available such Proprietary Information (the "Disclosing Party") may disclose business, technical or financial information relating to the Disclosing Party's business (hereinafter referred to as "Proprietary Information" of the Disclosing Party). Proprietary Information of Company includes information regarding features, functionality and performance of the Services and Software. The Receiving Party agrees: (i) to take reasonable precautions to protect such Proprietary Information, and (ii) not to use (except in performance or receipt of the Services or as otherwise permitted herein) or divulge to any third person any such Proprietary Information. The Disclosing Party agrees that the foregoing shall not apply with respect to any information (other than trade secrets) after five (5) years following the disclosure thereof or to any information that (a) is or becomes generally available to the public, (b) was in the Receiving Party's possession or known by it prior to receipt from the Disclosing Party, (c) was rightfully disclosed to the Receiving Party without restriction by a third party, or (d) was independently developed without use of any Proprietary Information of the Disclosing Party. The Receiving Party may also disclose Proprietary Information of the Disclosing Party if required by law or regulation or by a court of competent jurisdiction, provided that the Receiving Party will provide notice of such disclosure requirement to the Disclosing Party (unless prohibited by law from doing so) and will use reasonable efforts, at the Disclosing Party's cost, to limit the scope of such disclosure. Each party acknowledges and agrees that any violation of this Section may cause the Disclosing Party irreparable injury for which the Disclosing Party would have no adequate remedy at law, and that the Disclosing Party shall be entitled to seek preliminary and other injunctive relief against the Receiving Party for any such violation. Such injunctive relief shall be in addition to, and not in limitation of, all other remedies or rights that the disclosing party shall have at law or in equity.
2. Upon termination or expiration of the Agreement, the Receiving Party will return to the Disclosing Party or destroy all Proprietary Information delivered or disclosed to the Receiving Party, together with all copies in existence thereof at any time made by the Receiving Party.
3. Customer shall own all right, title and interest in and to the Customer Data, as well as any data that is based on or derived from the Customer Data and provided to Customer as part of the Services. Company shall own and retain all right, title and interest in and to (a) the Services and Software, all improvements, enhancements or modifications thereto, (b) any software, applications, inventions or other technology developed in connection with Implementation Services or support, and (c) all intellectual property rights related to any of the foregoing.
4. Notwithstanding anything to the contrary, Company shall have the right to collect and analyze data and other information relating to the provision, use and performance of various aspects of the Services and related systems and technologies (including, without limitation, information concerning Customer Data and data derived therefrom), and Company will be free (during and after the term hereof) to (i) use such information and data to improve and enhance the Services and for other development, diagnostic and corrective purposes in connection with the Services and other Company offerings, and (ii) disclose such data solely in aggregate or other de-identified form in connection with its internal business. No rights or licenses are granted except as expressly set forth herein.

6.5Publicity

1. Company may use Customer's name and logo solely to identify Customer as the Company's customer (a) on the Company's website; (b) on the Company's social media channels (i.e. Facebook, Instagram, Twitter and LinkedIn, etc.), and (c) in the Company's printed marketing materials, in each case, within a list of Company's clients.
2. For the avoidance of doubt, in using the Customer's name and logo, the Company may not: (a) single out or highlight Customer in any way; or (b) otherwise state that Customer recommends, promotes or endorses the Company or its services.
3. If the Company wishes to publish Customer's testimonials or a case study based on the services it provides to the Customer, it shall only do so upon agreeing the proposed content of such testimonial and/or a case study with the Customer in writing in advance.
4. The authorization granted in this clause is: (i) subject to the Company's abiding to all Customer's branding guidelines at all times, as those may be amended or supplemented by Customer; (ii) revocable and limited to the duration of the Agreement. Once the Agreement is terminated, the Company shall cease any use of Customer's name and logo, unless specifically agreed otherwise in writing.

7Payment of Fees

1. Customer agrees to pay Company all fees and applicable charges associated with the Services as set forth in the Order (the "Fees"). Unless otherwise set forth in the Order, the following payment terms shall apply: (i) Base fees for the first year are due upon the Effective Date and payable annually; (ii) Subsequent fees will be invoiced, in arrears, within five (5) days after the end of each 30 day period during the Term. If credit card payments are specified on the Order, Customer authorizes its credit card to be charged by Company for the invoiced amount at the time of invoice. If Customer is not paying by credit card, then Customer agrees to pay the invoiced amount within thirty (30) days of receipt. Company reserves the right to change the Fees and to institute new Fees at the end of the Initial Service Term or the current Renewal Term, upon thirty (30) days prior notice to Customer (which may be sent by email). If Customer believes that Company has billed Customer incorrectly, Customer must contact Company no later than the due date for the corresponding invoice in order to receive an adjustment or credit. Inquiries should be directed to Company's account manager responsible for Customer. Except as expressly set out in this Agreement, all payments under this Agreement are non-refundable and, unless otherwise agreed by Company, shall be made in United States dollars. Past-due payments will be subject to late payment charges of the lesser of: (a) one percent (1%) per month, or (b) the maximum rate allowed by law.
2. If a payment of any Fees becomes five (5) days or more overdue, Company reserves the right to suspend Customer's access to the Services, without liability to Customer, until payment is made in full. If any payment becomes ten (10) days or more overdue, Company may terminate the Agreement upon notice to Customer.
3. If Customer has procured the Services through a Partner Transaction, then different terms regarding invoicing, payment and taxes may apply as specified between Customer and the Partner. Customer acknowledges that: (a) Company may share information with the Partner related to Customer's use of Company's Services; (b) the termination provisions contained herein will also apply if Customer's Partner fails to pay applicable fees; and (c) Partner is not authorized to make any changes to this Agreement or otherwise authorized to make any warranties, representations, promises or commitments on behalf of Company or in any way concerning the Services.
4. The fees do not include Taxes and similar assessments. For purposes of this Agreement, "Taxes" shall mean any sales, excise, value-added (and other similar) taxes, duties and charges of any kind imposed by a governmental authority on amounts payable under this Agreement, other than taxes imposed on Company's income. Customer shall be responsible for all Taxes associated with Services. Customer shall also be responsible for all the costs involved in the payment of the Fees to Company, whether they are costs involved in a bank transfer of the fees, costs associated with a payment processing company that handles the transfer of the fees, costs associated with payment of the fees through credit cards, or others costs of transferring payment of the Fees. If Customer is required by applicable law or regulations to deduct or withhold from any amounts payable to Company under this Agreement any Taxes or other amounts, the amounts payable to Company shall be increased as necessary so that after making all required deductions (including deductions applicable to additional amounts payable under this Section) Company receives an amount equal to the sum it would have received had no such deductions been made.

8Term and Termination

1. Subject to earlier termination as provided below, this Agreement commences on the Effective Date and continues for the initial service term as specified in the Order (the "Initial Service Term"), and shall be automatically renewed for the periods specified in the Order (each, a "Renewal Term", and collectively, the "Term"), unless written notice of non-renewal is requested by either party at least thirty (30) days prior to the end of the Initial Service Term or then-current Renewal Term.
2. In addition to any other remedies it may have, either party may also terminate this Agreement immediately upon written notice, (a) if the other party materially breaches any provision of this Agreement and fails to cure such breach within 30 days (or 5 days in the case of non-payment) after receiving written notice of such breach from the non-breaching party, or (b) if the other party makes any assignment for the benefit of creditors, or a receiver, trustee in bankruptcy or similar officer is appointed to take charge of any or all of the other party's property, or the other party seeks protection under any bankruptcy, receivership, trust deed, creditors arrangement, composition or comparable proceeding or such a proceeding is instituted against the other party and is not dismissed within 90 days, or the other party becomes insolvent or, without a successor, dissolves, liquidates or otherwise fails to operate in the ordinary course. Company may suspend or terminate Customer's use of the Services at any time without prior notice: (a) in order to prevent damages to, or degradation of, Company's network integrity or infrastructure; (b) if needed to comply with any law, regulation, court order, or other governmental request or order; (c) in order to otherwise protect Company from potential legal liability; (d) if Customer does not provide a valid payment method; (e) if the Customer violates the usage restrictions contained herein or in the Policies; (f) if the Customer is found to use abusive or harassing language toward any of Company's employees; or (g) as otherwise provided in this Agreement.
3. Upon termination or expiration of this Agreement: (a) Customer will pay the remaining Fees for the Services in full; and (b) Customer will, and will cause its Authorized Users to, immediately cease use of the Services and to uninstall and delete any local Software. Upon any expiration or termination of this Agreement, Company will make all Customer Data available to Customer for electronic retrieval for a period of thirty (30) days, but thereafter Company may, but is not obligated to, delete stored Customer Data.
4. All sections of this Agreement which by their nature should survive expiration termination will survive expiration or termination, including, without limitation, accrued rights to payment, confidentiality obligations, warranty disclaimers, and limitations of liability.

9Warranty and Disclaimer

1. Customer and Company each represent and warrant to each other that they have full authority to enter into the Agreement and are not bound by any contractual or legal restrictions from fulfilling their obligations hereunder.
2. Customer represents and warrants to Company as follows: (a) the Customer Data is owned by Customer or Customer has the full right to provide the Customer Data to Company for the purposes described herein; (b) the use of Customer Data by Company pursuant to this Agreement does not and will not infringe or misappropriate any copyright, trademark, trade secret or other intellectual property right; (c) the Customer Data does not violate any person's right of privacy or publicity; (d) the Customer Data does not contain any unlawful, obscene, defamatory or libelous material; and (e) Company's use and distribution of Customer Data in connection with the Services, and as otherwise permitted herein, will not breach any covenant or obligation of confidentiality that Customer has to any other person or entity. Customer is solely responsible for the content of the Customer Data, and acknowledges that Company has no responsibility or intent to review or monitor any Customer Data.
3. Customer shall be solely responsible for its use of the Services, and Customer acknowledges and agrees that the Services are strictly a tool to be used in conjunction with good and reasonable business judgment by competent personnel.
4. COMPANY DOES NOT WARRANT THAT THE SERVICES AND SOFTWARE WILL BE UNINTERRUPTED OR ERROR FREE; NOR DOES IT MAKE ANY WARRANTY AS TO THE RESULTS THAT MAY BE OBTAINED FROM USE OF THE SERVICES OR SOFTWARE. EXCEPT AS EXPRESSLY SET FORTH IN THIS SECTION, THE SERVICES AND SOFTWARE ARE PROVIDED "AS IS" AND COMPANY DISCLAIMS ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE AND NON-INFRINGEMENT.

10Indemnity

1. Customer Indemnification. Customer, at its own expense, shall indemnify, defend and hold Company harmless from and against all liability, damages, injuries, losses, costs and expenses (including attorneys' fees) arising out of or relating to Customer's use of the Services, including but not limited to liability, damages, injuries, losses, costs and expenses arising from any claims relating to: (a) Customer's breach of any provisions of this Agreement, (b) Customer's violation of applicable laws and regulations, (c) the Customer Data or its use by the Company as permitted hereunder; and (d) any activities that occur through Customer's account for the Services. Company shall provide Customer with prompt written notice of any such claim.
2. Company at its own expense, shall indemnify, defend and hold Customer harmless from and against all liability, damages, injuries, losses, costs and expenses (including attorneys' fees) in each case to the extent any of the foregoing are incurred as a result of a claim, action or proceeding brought against Customer by a third party alleging that the Services (excluding, for the avoidance of doubt, the Customer Data), or Customer's use of the Services in accordance with the Policies and this Agreement, infringe, misappropriate or otherwise violate the U.S. patent, copyright, trademark, trade secret or other intellectual property rights of such third party (each, an "Infringement Claim"). Customer must immediately notify Company of any Infringement Claim, allow Company to control the defense and settlement of the claim, and provide reasonable cooperation to Company (at Company's expense) in the defense of the claim. Company will not enter into a settlement of any such claim in a manner that imposes any liability on Customer without Customer prior written consent (not to be unreasonably withheld). Company will not be responsible for any settlement it does not approve in writing.
3. If Services are held by a court of competent jurisdiction to be, or are believed by Company to be, infringing, misappropriating or violating any intellectual property rights, Company may, at its option and expense (a) replace or modify the Services to be non-infringing provided that such modification or replacement contains substantially similar features and functionality, (b) obtain for Customer a license to continue using the Services as contemplated by this Agreement, or (c) if neither of the foregoing is commercially practicable, terminate this Agreement and require Customer and its Authorized Users to cease using the Services upon written notice and promptly refund to Customer, on a pro rata basis, the share of any Fees prepaid by Customer for the future portion of the Term that would have remained but for such termination. Section 10.2 and this Section 10.3 states Company's sole and exclusive obligation, and Customer's sole and exclusive remedy, for any claim that the Services, or any use of the Services, infringe, misappropriate or violate any third party's intellectual property rights.
4. The foregoing obligations in Sections 10.2 and 10.3 do not apply: (a) with respect to portions or components of the Services (i) not supplied by Company, (ii) made in whole or in part in accordance with Customer specifications, (iii) that are modified after delivery by Company, or (iv) that are combined with other products, processes or materials where the alleged infringement relates to such combination; (b) where Customer continues the allegedly infringing activity after being notified thereof or after being informed of modifications that would have avoided the alleged infringement; or (c) where the applicable claim arises from Customer's use of the Services in violation of this Agreement or the Policies.

11Limitation of Liability

1. Company's maximum liability (whether in contract, tort, negligence, strict liability in tort, or by statute or otherwise) to Customer or to any third party concerning performance or non-performance by Company, or in any manner related to this Agreement or the Services, for any and all claims shall not exceed in the aggregate the Fees paid by Customer to Company hereunder (excluding any Fees or charges relating to approved expenses incurred by Company on behalf of Customer) during the three (3) months prior to the date that the first cause of action accrued.
2. In no event shall either party be liable for special, consequential, incidental, indirect or punitive loss, damage or expenses whether arising in contract or tort (including but not limited to lost profits, loss of data, or the cost of recreating lost data), even if it has been advised of their possible existence, provided that the foregoing will not apply to limit: (a) Customer's obligations or liability under Section 10.1, (b) Customer's liability for breaches of Section 6, or (c) Customer's infringement, misappropriation of violation of any intellectual property rights of Company or its licensors.
3. The allocations of liability in this Section represent the agreed and bargained-for understanding of the parties and Fees payable hereunder reflect such allocation. These limitations of liability will apply notwithstanding any failure of essential purpose of any limited remedy.

12Miscellaneous

1. Force Majeure. Neither party shall be liable for any failure or delay in the performance of its obligations (except for payment obligations hereunder) due to causes beyond the reasonable control of the party affected, including but not limited to war, sabotage, insurrection, riot or other act of civil disobedience, strikes or other labor shortages, act of any government affecting the terms hereof, acts of terrorism, accident, fire, explosion, flood, hurricane, pandemic, severe weather or other act of God, failure of telecommunication or internet service providers.
2. Entire Agreement; Amendment. This Agreement (including the Policies and Order and any attachments thereto specifically agreed by the parties) constitutes the complete and exclusive statement of the mutual understanding of the parties and supersedes and cancels all previous written and oral agreements, communications and other understandings relating to the subject matter of this Agreement. Notwithstanding any language to the contrary therein, no terms or conditions stated in a Customer purchase order or in any other Customer order documentation shall be incorporated into or form any part of this Agreement, and all such terms or conditions are hereby rejected and shall be null and void. In the event of any conflict between this Agreement and the Order, then the Order will take priority to the extent of such conflict. All waivers must be in a writing signed by both parties, except as otherwise provided herein. No agency, partnership, joint venture, or employment is created as a result of this Agreement and Customer does not have any authority of any kind to bind Company in any respect whatsoever. In any action or proceeding to enforce rights under this Agreement, the prevailing party will be entitled to recover costs and attorneys' fees. Company may modify this Agreement from time to time in which case it will update the "Last Revised" date at the top of the webpage on which this Agreement is contained. If Company makes changes that are material, it will use reasonable efforts to attempt to notify Customer, such as by e-mail and/or by placing a prominent notice on its website. The updated Agreement will be effective as of the time of posting, or such later date as may be specified in the updated Agreement; provided, however, that if the Company makes any material changes to this Agreement, then the Customer may, within 10 days of receiving notice (or otherwise becoming aware) of such changes, terminate this Agreement upon written notice to the Company. Customer's continued access or use of the Services after such 10-day period will be deemed Customer's acceptance of such modifications. No amendment shall apply to a dispute for which an action has been initiated in a court of competent jurisdiction prior to the amendment in this Agreement.
3. Assignment. This Agreement and the rights and obligations hereunder may not be assigned, transferable or sublicensable in whole or in part by Customer except with Company's prior written consent. Company may transfer, subcontract and assign this Agreement or any of its rights and obligations under this Agreement without consent.
4. Severability. Every provision of the Agreement is intended to be severable. If any section of the Agreement is found to be invalid or unenforceable, then such section will be limited or removed from the Agreement to the minimum extent necessary and the rest of the Agreement will remain in full force and effect and enforceable.
5. Independent Contractors. The parties are and intend to be independent contractors with respect to the services contemplated hereunder and so represent themselves in all regards. Neither party is the agent of the other, and neither may make commitments on the other's behalf. Company agrees that neither it, its employees nor its contractors shall be considered as having an employee status with Customer. No form of joint employer, joint venture, partnership, or similar relationship between the parties is intended or hereby created. Except for Section 10, there are no intended third-party beneficiaries under the Agreement.
6. Notices. All notices under this Agreement will be in writing to (a) in the case of Customer, to the Customer address in the Order, and (b) in the case of Company, to the Company address in the Order (or such other address identified by Company from time to time). Notices will be deemed to have been duly given when received, if personally delivered; when receipt is electronically confirmed, if transmitted by facsimile or e-mail; the day after it is sent, if sent for next day delivery by recognized overnight delivery service; and upon receipt, if sent by certified or registered mail, return receipt requested.

Governing Law & Press Release. This Agreement shall be governed by the laws of the State of California without regard to its conflict of laws provisions. The state and federal courts located in the State of California shall have exclusive jurisdiction to adjudicate any dispute arising out of or relating to this Agreement. Each party hereby consents to the exclusive jurisdiction of such courts, provided that nothing in this Section prohibits either party from seeking or obtaining in any jurisdiction injunctive or similar relief in connection with the enforcement of this Agreement. The parties shall work together in good faith to issue at least one mutually agreed upon press release within 90 days of the Effective Date, and Customer otherwise agrees to reasonably cooperate with Company to serve as a reference account upon request.

Purpose

To ensure that information is classified, protected, retained and securely disposed of in accordance with its importance to the organization.

Scope

All Topsort, Inc data, information and information systems.

Policy

Topsort, Inc classifies data and information systems in accordance with legal requirements, sensitivity, and business criticality in order to ensure that information is given the appropriate level of protection. Data owners are responsible for identifying any additional requirements for specific data or exceptions to standard handling requirements. Information systems and applications shall be classified according to the highest classification of data that they store or process.

Data Classification

To help Topsort, Inc and its employees easily understand requirements associated with different kinds of information, the company has created three classes of data.

Confidential

Highly sensitive data requiring the highest levels of protection; access is restricted to specific employees or departments, and these records can only be passed to others with approval from the data owner, or a company executive. Examples include:

• Customer Data
• Personally identifiable information (PII)
• Company financial and banking data
• Salary, compensation and payroll information
• Strategic plans
• Incident reports
• Risk assessment reports
• Technical vulnerability reports
• Authentication credentials
• Secrets and private keys
• Source code
• Litigation data

Restricted

Topsort, Inc proprietary information requiring thorough protection; access is restricted to employees with a "need-to-know" based on business requirements. This data can only be distributed outside the company with approval. This is the default for all company information unless stated otherwise. Examples include:

• Internal policies
• Legal documents
• Meeting minutes and internal presentations
• Contracts; internal reports
• Slack messages
• Email

Public

Documents intended for public consumption which can be freely distributed outside Topsort, Inc. Examples include:

• Marketing materials
• Product descriptions
• Release notes
• External facing policies

Labeling

Confidential data should be labeled "confidential" whenever paper copies are produced for distribution.

Confidential Data Handling

Confidential data is subject to the following protection and handling requirements:

• Access for non-pre-approved roles requires documented approval from the data owner
• Access is restricted to specific employees, roles and/or departments
• Confidential systems shall not allow unauthenticated or anonymous access
• Confidential Customer Data shall not be used or stored in non-production systems/environments
• Confidential data shall be encrypted in transit over public networks
• Mobile device hard drives containing confidential data, including laptops, shall be encrypted
• Mobile devices storing or accessing confidential data shall be protected by a log-on password or passcode and shall be configured to lock the screen after 5 minutes of non-use
• Backups shall be encrypted
• Confidential data shall not be stored on personal phones or devices or removable media including USB drives, CDs, or DVDs
• Paper records shall be labeled "confidential" and securely stored and disposed
• Hard drives and mobile devices used to store confidential information must be securely wiped prior to disposal or physically destroyed
• Transfer of confidential data to people or entities outside the company shall only be done in accordance with a legal contract or arrangement, and the explicit written permission of management or the data owner

Restricted Data Handling

Restricted data is subject to the following protection and handling requirements:

• Access is restricted to users with a need-to-know based on business requirements
• Restricted systems shall not allow unauthenticated or anonymous access
• Transfer of restricted data to people or entities outside the company or authorized users shall require management approval and shall only be done in accordance with a legal contract or arrangement, or the permission of the data owner
• Paper records shall be securely stored and disposed
• Hard drives and mobile devices used to store restricted information must be securely wiped prior to disposal or physically destroyed
• Removable devices are not permitted for data storage

Public Data Handling

No special protection or handling controls are required for public data. Public data may be freely distributed.

Data Retention

Topsort, Inc shall retain data as long as the company has a need for its use, or to meet regulatory or contractual requirements. Once data is no longer needed, it shall be securely disposed of or archived. Data owners, in consultation with legal counsel, may determine retention periods for their data. Retention periods shall be documented in the Data Retention Matrix in Appendix B to this policy.

Data & Device Disposal

Data classified as restricted or confidential shall be securely deleted when no longer needed. Topsort, Inc shall assess the data and disposal practices of third-party vendors in accordance with the Third-Party Management Policy. Only third-parties who meet Topsort, Inc requirements for secure data disposal shall be used for store and process restricted or confidential data. Topsort, Inc shall ensure that all restricted and confidential data is securely deleted from company devices prior to, or at the time of disposal.

Annual Data Review

Management shall review data retention requirements during the annual review of this policy. Data shall be disposed of in accordance with this policy.

Legal Requirements

Under certain circumstances, Topsort, Inc may become subject to legal proceedings requiring retention of data associated with legal holds, lawsuits, or other matters as stipulated by Topsort, Inc legal counsel. Such records and information are exempt from any other requirements specified within this Data Management Policy and are to be retained in accordance with requirements identified by the Legal department. All such holds and special retention requirements are subject to annual review with Topsort, Inc's legal counsel to evaluate continuing requirements and scope.

Policy Compliance

Topsort, Inc will measure and verify compliance to this policy through various methods, including but not limited to, business tool reports, and both internal and external audits.

Exceptions

Requests for an exception to this policy must be submitted to the Chief Executive Officer for approval.

Violations & Enforcement

Any known violations of this policy should be reported to the Chief Executive Officer. Violations of this policy can result in immediate withdrawal or suspension of system and network privileges and/or disciplinary action in accordance with company procedures up to and including termination of employment.

Appendix A

Internal Retention and Disposal Procedure

Topsort, Inc's Data Science team is responsible for setting and enforcing the data retention and disposal procedures for Topsort, Inc managed accounts and devices.

Customer Accounts

• Customer accounts and data shall be deleted within ninety (90) days of contract termination through manual data deletion processes.

Devices

• Employee devices will be collected promptly upon an employee's termination. Remote employees will be sent a shipping label and the return of their device shall be monitored.
• Collected devices will be cleared to be re-provisioned, or removed from stock, Topsort, Inc will securely erase the device.
• Device images may be retained at the discretion of management for business purposes.

Destroying Devices or Electronic Media

In cases where a device is damaged in a way that Topsort, Inc cannot access the Recovery Partition to erase the drive, Topsort, Inc may optionally decide to use an E-Waste service that includes data destruction with a certificate. Topsort, Inc will keep certificates of destructions on record for one year. Physical destruction can be optional if it is verified that the device is encrypted with Full Disk Encryption, which would negate the risk of data recovery. Management will review this procedure at least annually.

Appendix B

Data Retention Matrix

Key definitions for terms used in this Privacy Policy. For legal advice or specific data protection questions, please consult qualified legal counsel or contact our Data Protection Officer.

A

Adequacy Decision

A formal determination by a regulatory authority (such as the European Commission or ANPD) that a third country provides an adequate level of data protection, allowing personal data to be transferred without additional safeguards.

Aggregated Data

Data combined from multiple sources and presented in summary form, typically preventing the identification of individual persons.

Anonymization

The process of removing or altering personal information so that individuals cannot be identified, either directly or indirectly.

ANPD (Autoridade Nacional de Proteção de Dados)

Brazil's National Data Protection Authority responsible for enforcing the LGPD and handling privacy complaints from Brazilian residents.

Australian Privacy Principles (APPs)

Thirteen principles under the Australian Privacy Act 1988 that govern how personal information should be collected, used, disclosed, and managed.

Automated Decision-Making

Processing of personal data using automated means (without human intervention) that produces legal effects or similarly significant effects for individuals.

B

Breach Notification

The legal requirement to notify supervisory authorities and affected individuals when a personal data breach occurs that poses risks to individual rights and freedoms.

Business Transfer

Corporate transactions such as mergers, acquisitions, or asset sales that may involve the transfer of personal information.

C

CCPA (California Consumer Privacy Act)

A California state law that provides privacy rights and consumer protection for California residents.

Confidential Data

Topsort's highest classification level for highly sensitive information requiring the strictest protection measures.

Consent

A freely given, specific, informed, and unambiguous agreement by an individual to the processing of their personal data.

Controller (Data Controller)

The entity that determines the purposes and means of processing personal data. Marketplace customers typically act as controllers for their end users.

Cross-Border Data Transfer

The transmission of personal data from one country to another, subject to specific legal safeguards and requirements.

D

Data Classification

Topsort's system for categorizing information based on sensitivity: Confidential (highest), Restricted (internal), and Public (freely distributable).

Data Minimization

The principle that personal data collection should be adequate, relevant, and limited to what is necessary for the specified purposes.

Data Processor

An entity that processes personal data on behalf of a data controller. Topsort typically acts as a processor for marketplace customers.

Data Protection Impact Assessment (DPIA)

A systematic process for evaluating the privacy risks of processing activities likely to result in high risk to individuals, required under GDPR for high-risk processing operations.

Data Protection Officer (DPO)

A designated person responsible for monitoring compliance with data protection laws and serving as a point of contact for privacy matters.

Data Retention Matrix

A structured reference document defining the retention periods and disposal requirements for different categories of Topsort data, as referenced in the Data Management Policy.

Data Subject

An individual whose personal data is being processed, including marketplace end users and Topsort's direct customers.

E

Encryption

The process of encoding data so that only authorized parties can access and read it, protecting information during storage and transmission.

ePrivacy Directive

European Union legislation governing privacy in electronic communications, including requirements for cookies and marketing communications.

F

Fair Use Policy

Topsort's Acceptable Use Policy that specifies required actions and prohibited activities for users of Topsort's software and services.

G

GDPR (General Data Protection Regulation)

European Union regulation that governs data protection and privacy for individuals within the EU and European Economic Area.

I

Information Security Management System (ISMS)

Topsort's systematic approach to managing sensitive information based on ISO 27001 standards.

International Data Transfer

The transmission of personal data to a recipient located in a country other than the country of origin, subject to applicable legal safeguards such as Standard Contractual Clauses or adequacy decisions. See also: Standard Contractual Clauses, Adequacy Decision.

ISO 27001

International standard for information security management systems that Topsort follows to protect personal and business information.

L

Legal Basis

The lawful justification for processing personal data under privacy laws (e.g., consent, contract performance, legitimate interests, legal obligation).

Legal Hold

The preservation of data beyond normal retention periods due to litigation, regulatory investigations, or other legal requirements.

Legitimate Interests

A legal basis for processing personal data where the processing is necessary for legitimate business purposes that don't override individual privacy rights.

LGPD (Lei Geral de Proteção de Dados)

Brazil's General Data Protection Law that governs the processing of personal data of individuals in Brazil, providing comprehensive privacy rights and obligations for organizations.

M – O

Marketplace Customer

A business that uses Topsort's advertising technology platform and typically acts as a data controller for their end users' personal data.

OAIC (Office of the Australian Information Commissioner)

Australia's privacy regulator responsible for enforcing the Privacy Act and handling privacy complaints.

Opaque Identifiers

Technical identifiers that cannot be easily traced back to specific individuals, used to protect privacy in advertising technology.

P – R

Personal Data / Personal Information

Information that identifies or can reasonably be used to identify an individual person, including names, contact details, and online identifiers.

Pseudonymization

The processing of personal data so that it can no longer be attributed to a specific person without additional information that is kept separately.

Rectification

The right to have inaccurate or incomplete personal data corrected without undue delay.

Restricted Data

Topsort's middle classification level for proprietary information requiring protection but allowing need-to-know access within the organization.

Retention Period

The defined length of time personal data or organizational information is kept before being deleted, anonymized, or archived, as documented in the Data Retention Matrix.

Right of Access

The right of individuals to obtain confirmation of whether their personal data is being processed and, where applicable, to receive a copy of that data.

Right of Erasure

The right of individuals to request deletion of their personal data in certain circumstances (also known as the "right to be forgotten").

Right of Portability

The right to receive personal data in a structured, commonly used, machine-readable format, and to request its transmission to another controller.

Risk Assessment

An evaluation of potential privacy and security risks associated with data processing activities, used to identify and implement appropriate safeguards.

S – V

SaaS (Software as a Service)

A cloud-based software delivery model where Topsort provides its advertising technology platform to customers via subscription over the internet.

Standard Contractual Clauses (SCCs)

Legal mechanisms approved by regulatory authorities to provide appropriate safeguards for international data transfers.

Supervisory Authority

Government bodies responsible for monitoring and enforcing compliance with data protection laws (e.g., OAIC, ANPD, EU data protection authorities).

Third-Party Management Policy

Topsort's internal policy governing security and compliance requirements for external vendors and service providers who access or process Topsort data.

Transparency

The principle that individuals should be clearly informed about how their personal data is collected, used, and shared.

User Data

Personal information belonging to end users of marketplace customers' platforms, processed by Topsort on behalf of marketplace customers acting as data controllers.

Vulnerability Assessment

Regular evaluation of security weaknesses in systems and processes that could affect the protection of personal data.