Data Processing Addendum

HOSTNEY, LLC (HOSTNEY, we, us) recognizes the significance of providing transparency regarding the collection, storage, sharing, and utilization of information pertaining to visitors, subscribers, customers, and vendors of our website.

GDPR (EU including UK and Switzerland).

This Privacy Notice, in accordance with the EU/UK GDPR, our cookie policy, and other legal notices available on our website www.hostney.com (Site), outlines the collection, usage, and disclosure of personal data.

Personal data is collected in the following scenarios:

• when obtained through the Site,
• when you subscribe to or utilize our online Services, or
• during our business activities elsewhere, where we act as the controller of the data and its processing falls under the jurisdiction of the EU General Data Protection Regulation or the UK General Data Protection Regulation (collectively referred to as "GDPR").

Please note that this Notice does not cover information collected, stored, shared, or disseminated by third-party websites. Updates to this Notice may occur periodically.

In accordance with relevant data protection laws, HOSTNEY serves as the controller of any personal data gathered from you on the Site, through the Services, or in the course of conducting business with customers and vendors, for the purpose of developing and maintaining our business. For the purposes of this Notice, personal data refers to any information that identifies or can be used to identify an individual.

1. Information We Collect Automatically

During your visit to our Site or when utilizing our Services, our server automatically gathers specific browser or device-generated information. This information encompasses, but is not limited to:

• Your domain
• Your IP address
• The date, time, and duration of your visit
• Your browser type
• Your operating system
• Your page visits
• Information obtained from third parties
• Other details pertaining to your computer or device
• Internet traffic

It is important to note that some of this information may qualify as personal data. However, we do not employ this automatically-collected information in an attempt to personally identify you, nor do we link it to the information you voluntarily provide, as explained in detail below.

2. Information You Provide

To access specific sections of the Site or Services, enjoy the complete functionality they offer, or engage in business interactions with us, it may be necessary for you to provide certain personal data using the methods outlined below:

• Subscribing to our Services: Individuals subscribing to our Services will be prompted to provide their name, address, email, and any additional billing details required.
• Registration forms: Individuals completing registration forms to become members of our Site will be prompted to provide their email addresses.
• Site Visitors and Suppliers/Subscribers: Personal data may be provided by site visitors, and prospective subscribers when filling out forms (e.g., 'Contact us' form) on our Site or any other business-related interactions. This data may also be provided when downloading documentation, subscribing to newsletters or communications, or corresponding with us via email, or other contact methods. In such cases, the personal data collected may include name, business affiliation, business address, phone number, email address, and any necessary details to address inquiries or complaints.

The provision of this personal data is necessary for establishing or performing a contractual agreement with you (e.g., Service provision). Failure to provide the required information may hinder our ability to deliver the requested Services.

3. Information From Other Sources

We may also acquire fraud and risk-scoring data from third-party providers, namely Stripe, Inc.

4. Cookies

Our website employs cookies. Further details regarding our cookie usage can be found in our Privacy Policy.

5. Use of Personal Data

Here is an overview of how we utilize your personal data, and please note that additional information on our data processing practices may be provided separately in a notice or contract.

All processing and utilization of your personal data is supported by a specific "condition" for processing. In most cases, the processing is justified based on the following reasons:

• Performance of a Contract: The processing is necessary to fulfill our contractual obligations with you. For instance, if you subscribe to our Services or request product information, we need to process your data to carry out these actions.
• Compliance with Legal Obligations: The processing is necessary to comply with relevant legal obligations, such as maintaining accurate accounting records.
• Legitimate Interests: The processing is based on our legitimate interests, which are not outweighed by your interests and fundamental rights. Our legitimate interests include utilizing subscriber, site user, supplier, and customer data to conduct and expand our business activities while ensuring that personal data is used only for purposes that support the growth and development of our business.
• Consent: The processing is based on your consent, which you have voluntarily provided.

We utilize the personal data we collect for the following purposes:

• Provision of Services: We use the collected data to deliver the services you have subscribed to or requested, ensuring their proper functioning.
• Documentation and Communication: We utilize personal data to provide you with the requested documentation and communications, meeting your specific requirements.
• Purchase and Sales Management: We administer and manage the performance of purchase or sales agreements with our suppliers and customers, ensuring smooth transactions.
• After-Sales Support: We provide necessary assistance and support after the completion of a purchase, addressing any concerns or queries.
• Query Resolution: We engage in correspondence with users to resolve their queries or complaints effectively.
• Transaction Processing: Personal data is processed to facilitate, evaluate, and complete various transactions involving the site and HOSTNEY's products and services.
• Site Operations and Improvement: We operate, evaluate, maintain, improve, and develop the site by monitoring trends, and analyzing user access and behavior.
• Security and Risk Management: Personal data is used to protect the site, and HOSTNEY's confidential information, and proprietary data, and ensure the safety of HOSTNEY employees.
• Fraud Prevention and Investigation: We manage, protect against, and investigate instances of fraud, risk exposure, claims, and other liabilities, including violations of our contract terms, laws, or regulations.

HOSTNEY will not sell or rent your personal data to third parties.

6. Disclosure of Personal Data

We may disclose personal data pertaining to Site visitors, users of our Services, suppliers, or customers in certain circumstances, as determined by our discretion. These circumstances include:

• Compliance with Laws: We may disclose personal data if we reasonably believe it is necessary to satisfy any applicable laws, regulations, governmental or legal requests.
• Enforcement of Policies: Personal data may be disclosed if it is necessary to identify, contact, or initiate legal action against individuals who may be violating our Acceptable Use Policy or other user policies.
• Protection of Interests: In order to protect ourselves, our subscribers, and the general public, we may disclose personal data where appropriate or required. This may involve sharing information, including personal data, with law enforcement agencies if a crime is committed, or suspected, or if we are compelled to do so by lawful processes, court orders, or requests from authorities.
• Cooperation with Authorities: We may cooperate, as required by applicable law, with law enforcement authorities, private-party litigants, or others seeking information about our end users. This cooperation may include responding to lawful criminal, civil, or administrative processes, discovery requests, subpoenas, court orders, or reasonable requests from authorized individuals or entities.
• Business Transfers: In the event of a potential or actual sale of our company, any of our assets, or those of any affiliated company, personal data held by us about our users may be shared with third parties as part of the transferred assets.

7. Transfer of Personal Data

If you are located in the UK or the European Economic Area (EEA), including the European Union (EU), and your personal data is transferred outside of these regions to other HOSTNEY affiliates or third-party service providers, we will ensure that your personal data receives an equivalent level of protection as if it remained within the UK or EEA (as applicable).

• If we transfer UK or EEA data to countries outside of the UK or EEA (including the United States of America) that do not have an equivalent legal adequacy decision, we will take steps to safeguard your personal data to the same level of protection. This may include implementing data transfer agreements using relevant and valid standard contractual clauses (SCCs) with our suppliers and other business partners, as well as applying supplementary safeguards as appropriate. Currently, we rely on SCCs for our transfers to the USA.

You have the right to request information about the mechanism used for transferring your personal data outside of the EEA or UK by contacting legal@hostney.com.

8. Children

The Site is intended for users who are 18 years of age or older, and HOSTNEY does not knowingly collect, store, share, or use personal data of individuals under 18 years old. If you are under the age of 18, please refrain from providing any personal data, even if prompted to do so on the Site. If you are under the age of 18 and have mistakenly provided personal data, please request your parent(s) or guardian(s) to contact HOSTNEY so that we can promptly delete such information.

9. Security

We implement various security measures, such as data encryption, to safeguard the transmission of sensitive end-user information. Our network and systems are diligently maintained to uphold their integrity and security. However, it is important to note that while we take reasonable efforts to protect against unauthorized access, we cannot guarantee absolute immunity from illegal activities conducted by third-party hackers. While we make every reasonable attempt to prevent security breaches, we cannot provide a 100% guarantee against such incidents due to the ingenuity of cybercriminals. By using our services, you acknowledge and assume the associated risks in the event of security breaches, despite our diligent security measures.

10. Retention of Your Personal Data

As a general practice, we adhere to the principle of retaining personal data only for the duration necessary to fulfill the purposes for which it was collected. Typically, we retain your personal data for a period corresponding to the applicable statute of limitations to ensure accurate records of your interactions with us. However, there may be instances where we retain personal data for longer periods due to legal, tax, or accounting obligations, or when compelled by a legal process, authority, or governmental entity with proper jurisdiction.

11. External Links

The Site may include links to websites operated by third parties. Please note that HOSTNEY does not have control over, nor is responsible for, the privacy practices of these third-party sites. We strongly recommend that you review the privacy policies of these third-party sites. This Notice specifically pertains to the collection of personal data on our Sites or during the course of our business activities.

12. Your Rights

• Right to withdraw consent: If applicable, you have the right to withdraw your consent at any time. Once you inform us of your withdrawal, we will cease sending you communications unless the nature of the communication indicates otherwise.
• Right of access, rectification, and erasure: You have the right to request access to and receive a copy of any personal data we hold about you. You can also request the correction of any inaccurate data concerning you and request the deletion of your personal data under certain circumstances. Most of this data can be viewed and updated online, or you can reach out to us at support@hostney.com.
• Right to restriction of processing: You have the right to restrict our processing of your personal data, allowing only its storage, in the following circumstances:
  • If you contest the accuracy of the personal data, until we have taken sufficient steps to correct or verify its accuracy.
  • If the processing is unlawful, but you do not want us to erase the personal data.
  • If we no longer need your personal data for the purposes of processing, but you require it for the establishment, exercise, or defense of legal claims.
  • If you have objected to the processing based on legitimate interest grounds (as described below), pending verification of whether we have compelling legitimate grounds to continue processing.
• When your personal data is subject to restriction, we will only process it with your consent or for the establishment, exercise, or defense of legal claims. You also have the right to lodge a complaint with the supervisory authority if you believe that the processing of your personal data infringes applicable law.
• Right to object to processing based on legitimate interest grounds: If we rely on legitimate interests to process your personal data, you have the right to object to that processing. We must stop the processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or if we need to process the personal data for the establishment, exercise, or defense of legal claims. While we believe that we can demonstrate compelling legitimate grounds when relying on legitimate interests, we will evaluate each case individually.

13. Privacy Rights of California Residents

The California Consumer Privacy Act (CCPA) grants certain rights to California residents and households regarding the personal information that we have collected.

• Access and Copies: You have the right to request the following information from us, up to two times within a 12-month period:
  • Categories of personal information collected about you in the past 12 months.
  • Categories of sources from which the personal information is collected.
  • Business or commercial purpose for collecting or, if applicable, selling personal information.
  • Categories of third parties with whom we share personal information.
  • Specific pieces of personal information collected about you.
  • Deletion: You can request the deletion of your personal information. Please note that there are certain limitations to deletion requests, as we may need to retain personal information for lawful purposes like recordkeeping, maintaining an active account, and processing transactions or customer requests.
  • Do Not Sell: We do not sell your Personal Information to third parties.
  • Non-Discrimination: You have the right to exercise your described rights without facing any discriminatory practices prohibited by California law.

We will respond to requests that comply with California law within the permitted timeframe (45 days), depending on the nature of the request.

14. Changes to this Notice

We retain the right to revise, amend, or modify this Notice, as well as our other policies and agreements, at any time and in any manner. To stay updated, we recommend periodically checking for any modifications by revisiting this web page and using the 'refresh' button on your browser.

Please take note of the date of the last revision, which is displayed at the bottom of this Notice.

• If the 'Updated' date remains unchanged after you have clicked the 'refresh' button on your browser, it indicates that no changes have been made since your last reading of the Notice.
• However, if the 'Updated' date has changed, it means that this Notice has been updated or edited, and the updated or edited version supersedes any prior versions immediately upon being posted.