PASSKIT PRIVACY STATEMENT

Last Updated: May 8, 2024.

PassKit, Inc. offers Wallet Pass Management software and services. PassKit is committed to protecting the privacy of Personal Information you provide to us. When referring to “Personal Information” in this Statement, we mean information that relates to an identified or identifiable individual, and can include information about how you engage with our Services (e.g. your name, email address, device information, IP Address). Accordingly, PassKit provides this privacy and information practices statement to inform you about our information practices, the kinds of information we may collect, how we intend to use and share that information, and how you can correct or change such information (“Privacy Statement”).

1. What does this Privacy Statement cover?

This Privacy Statement applies to Personal Information that we collect when you: (i) visit websites we operate and that link to this Privacy Statement, including https://passkit.com and https://app.passkit.com (the “Sites”); (ii) use our demo mobile wallet passes, mobile applications (including the PassKit PassReader app), or any other software applications made available by us that link to this Privacy Statement; (iii) visit our branded social media pages; (iv) visit our offices; (v) receive communications from us, including emails, phone calls or texts; (vi) register for, attend and/or otherwise take part in our events or webinars; (vii) submit a job application to us; (viii) submit information to us in connection with a potential business relationship with us; or (ix) register to use the PassKit Platform as an authorized user (for example, as an employee of one of our customers who provided you with login access to the PassKit Platform) or contact us for support, referred to in this Statement as “Account Information”, (collectively, including the Sites, the “Services”). “You” refers to any individual who visits or uses the Services.

In general, with respect to the Personal Information we collect directly from the Sites or other Services, PassKit is a data controller. This means that as a data controller we determine the purposes for which and the manner in which the Personal Information we collect is to be processed.

With the exception of Account Information, this Privacy Statement does not apply to our security and privacy practices concerning the Personal Information we receive and process on behalf of our customers through PassKit's technology platforms and related services (collectively, “PassKit Platform”). In this capacity, we are acting in the role of a data processor or service provider on behalf of our customers, and our security and privacy commitments are detailed in and governed by our agreements with our customers, including the Terms of Subscription Service or such other applicable agreement entered into between our customer and PassKit and that is related to our customer's access to and use of the PassKit Platform. PassKit does not have control over and is not responsible for the data practices of our customers. For privacy information related to our customers' uses of the PassKit Platform in connection with their mobile applications, websites, emails, texts or other digital properties, please reach out to the respective customer directly.

In addition, the Services may contain links to other third party websites. The privacy statements and policies of such third party websites govern their respective personal information and security practices as provided in Section 11 of this Privacy Statement.

2. What Personal Information does PassKit collect?

The Personal Information we collect will be determined by the type of interaction you have with PassKit, as described in further detail in the following categories:

2.1 Personal Information we collect directly

Site usage. When you use the Services or fill out forms on our Site, we may provide you with opportunities to sign up to receive specific information or Services, download content, or register for an event or webinar, and we may ask for your contact information. Personal Information we may collect includes, but is not limited to: name, title, company name, industry, company address, phone number or email address, country, downloads and engagement with PassKit content and other publications. Our sites use cookies and other technologies, and as a result we also collect information as described in Section 5 below. When activating or installing updates to our mobile applications or mobile wallet passes, we may collect information about your device (manufacturer, model, IP address), or information about the application such as the version, date of activation, successful or unsuccessful updates.

Registering for and attending a meeting or an event. If you register to attend an event or meeting (whether in person or online), we may ask for your contact information (name and email address), job title, employer, and may retain copies of meeting audio and video recording in accordance with our Data Retention Policy and based on your consent to participate in a recorded meeting. If you attend an event, we may, with your consent, scan your attendee badge which will provide us with your information, such as name, title, company name, address, country, phone number,email address, and record of event attendance.

Your communications with us. We collect Personal Information from you such as name, email address, phone number, mailing address, job title, marketing subscription status, and information regarding your engagement with PassKit content and other publications when you request information about our Services, download or otherwise engage with our content and publications, request customer or technical support, apply for a job or engage with a job posting, or otherwise communicate with us.

Account Information for PassKit Platform. f you register to use the PassKit Platform as an authorized user or sign up for a free account, we collect Personal Information about you that may include name, email address, IP address, company name, company industry, and website name or information.

Surveys. We may contact you to participate in surveys. If you decide to participate, you may be asked to provide certain information which may include name, email address, employer, job title and other contact information.

Social media content. We may offer forums, blogs, or social media pages. Any content you provide on these channels will be considered “public” and is not subject to privacy protections.

Visiting our offices. If you visit our offices, you may be required to register as a visitor and provide your name, email address, phone number, company name and time and date of arrival.

2.2 Personal Information collected from others

Information from Other Sources. We may also receive other information including your Personal Information from other sources and third parties such as public databases, joint marketing partners, social media platforms, as well as from other third parties who provide us with contact information for prospects or leads. When acquiring information from third parties, we will obtain contractual or other legally compliant commitments from the third parties that the information was acquired lawfully and with the appropriate level of consent..

Billing Information. Through our third-party billing and payment processors, and to the extent we charge a fee for the Services, we may collect billing, payment, and contract related information from you if you are a business representative of one of our customers. Personal Information collected for billing, payment and contract related purposes is name, title, company name, company address, phone number or email address, country, and payment related information such as accounts.

Under certain circumstances, the credit or debit card or other payment method information you provide in this context may be transmitted by the payment processor. Our payment processor provider is Stripe, Inc. The purpose of this transmission is to process the payment made on an invoice due to us for our Services. The payment processor's terms and conditions and data protection terms entered into by PassKit with the payment processor as our data processor or service provider apply to such payment transactions.

3. How does PassKit use Personal Information and what are the legal bases for these uses?

We use Personal Information that we collect about you or that you provide to us for a range of different business purposes. Depending on how you interact with us, we and our third-party service providers use Personal Information in a variety of ways, including:

Providing information and Services you requested. We may use the Personal Information about you to fulfill requests for programs, Services, or information that you may request such as information about potential or future Services, including to: (a) generally manage your information and accounts; (b) respond to questions, comments and requests; (c) provide access to certain areas and features of the Services; (d) link or combine information we get from others to help understand your needs and provide you with better Service; and (e) allow you to register for events, participate in a contest or promotion, post in a forum or participate in webinars, and provide related information and communications.

Legal bases for our use of your Personal Information under applicable data protection laws are:

• Performance of a contract, e.g. when we provide you with Services, or communicate with you about them. This includes when we use your Personal Information to process Orders or payments orders, or deliver the Services you requested;
• Our legitimate business interests and the interests of our customers to process your request, and further (to the extent our interests also prevail in this regard) to improve our Services, to detect and prevent fraud and abuse in order to protect the security of our customers, ourselves, or others, and partly to provide you with advertising based on the interests you indicate to us; or
• Your consent when we ask for your consent to process your Personal Information for a specific purpose that we communicate to you via a link or by combining information we get from others. When you consent to our processing your Personal Information for a specified purpose, you may withdraw your consent at any time and we will stop processing of your data for that purpose.

To fulfill a contract or take steps linked to a contract. This is relevant when you register for the PassKit Platform. We may use the Personal Information about you for administrative purposes or to fulfill the obligations of a contract, including, without limitation, to: (a) to fulfill your and prospective customers' requests related to the PassKit Platform or other products that you have requested; (b) to provide you with the PassKit Platform for which you have registered; (c) perform internal quality control; (d) maintain and improve our Services; (e) verify identity; (f) send communications regarding the Services, your account, or any changes to any PassKit policy or terms of use; (g) process payments; (h) provide technical and customer support; and (i) enforce our Terms of Use, Acceptable Use Policy or other agreement entered into with you.

Legal bases for our use of your Personal Information under applicable data protection laws are:

• Performance of a contract, e.g. when we provide you with Services, or communicate with you about them. This includes when we use your Personal Information to process orders, deliver Services, and process payments; or
• Our legitimate business interests and the interests of our customers to fulfill our contractual obligations, and further (to the extent our interests prevail in this regard) to improve our Services.

Marketing products and services. We may use Personal Information about you to provide you with materials about offers, products and services offered by us, including new content or information about future services. We may provide you with these materials by phone, postal mail, text or email, as permitted by applicable law. Such uses include: (a) to tailor content, advertisements, and offers; (b) to notify you about offers, products, and services that may be of interest to you; (c) to provide Services to you; (d) measure interest in the Services; (e) monitor and analyze trends, usage and activities in connection with our Services; (f) for other purposes disclosed at the time that you provide Personal Information; or (g) otherwise with your consent. If you do not wish us to use your Personal Information for marketing purposes, you may contact us at any time to opt out of the use of your Personal Information for such purposes, as further described below.

Legal bases for our use of your Personal Information under applicable data protection laws are:

• Our legitimate business interests (to the extent our interests prevail) to improve our Services, to detect and prevent fraud and abuse in order to protect the security of our customers, ourselves, or others, and partly to provide you with interest-based advertising; or
• Your consent when we ask for your consent to process your Personal Information for a specific purpose that we communicate to you, e.g. link or combine information we get from others. When you consent to our processing your Personal Information for a specified purpose, you may withdraw your consent at any time and we will stop the processing of your data for that purpose.

Research and development. We may use your Personal Information to create non-identifiable information that we may use alone or in the aggregate with information obtained from other sources, in order to help us to optimally deliver our existing products and Services or develop new products, processes and services, or develop content related to industry trends and market reports and analyses. Non-identifiable or aggregated information is used for a variety of functions, including the measurement of visitors' interest in and use of various portions or features of the Services, and usage trends for mobile applications and websites. After this process of de-identification, non-identifiable or aggregated information is not Personal Information, does not identify you or any individual, and we use such information in a number of ways, including research, internal analysis, analytics, benchmark or industry reports, and any other legally permissible purposes. We share this information internally within PassKit and with our customers or partners for our or their purposes in a non-identifiable or aggregated form that is designed to prevent anyone from identifying you.

Legal bases for our use of your Personal Information under applicable data protection laws are:

• Our legitimate business interests (to the extent our interests prevail) to improve our Services; or
• Your consent when we ask for your consent to process your Personal Information for a specific purpose that we communicate to you via a link, contract, or by combined information we get from others. When you consent to our processing your Personal Information for a specified purpose, you may withdraw your consent at any time and we will stop processing of your data for that purpose.

Public content. If you post any content to our website forums or social media accounts, we may publish this content and make it generally available to any user or visitor of our website or company social media webpages.

Legal bases for our use of your Personal Information under applicable data protection laws are:

• Your consent to publish your content when you decide to post it on our website forums or Company Social Media Webpages. When you consent to our processing your Personal Information for a specified purpose, you may withdraw your consent at any time and we will stop processing of your data for that purpose; or
• Our legitimate business interests and the interests of our customers to provide you with the requested information, when we detect and prevent fraud and abuse in order to protect the security of our customers, ourselves, or others, and partly when we provide you with interest-based advertising, and further (to the extent our interests also prevail in this regard) to improve our Services.

Complying with legal obligations. As permitted by local laws, we may use your Personal Information when cooperating with public and government authorities, courts or regulators in accordance with our legal obligation under applicable laws to protect our rights or as necessary to protect against misuse or abuse of our Sites or Services, prevent potentially prohibited or illegal activities and fraud, promote safety and security of the Services and in protecting our rights and the rights of others, pursuing remedies available to us and limiting our damages, complying with judicial proceedings, court orders or legal processes or to respond to lawful requests.

Legal bases for our use of your Personal Information under applicable data protection laws are:

• Compliance with a legal obligation when we use your Personal Information to comply with laws. For instance, we collect customer place of establishment and bank account information for identity verification purposes.

Other Uses. We may use your Personal Information for other purposes disclosed to you at the time you provide Personal Information, with your consent or to conduct our business and pursue our legitimate interests, such as registering for meetings, investigating and responding to any comments or complaints that you may send us, providing internal training, and recruiting, interviewing and hiring job candidates.

4. Who does PassKit share Personal Information with?

We disclose your information to third parties only as necessary to carry out your request, for a variety of our professional or legitimate business purposes, including to provide our Services, to protect us or others, in the event of a major business transaction such as a merger, sale, or asset transfer, as described below, or as otherwise required or permitted by law. Where we do transfer your personal data to third parties or service providers, appropriate safeguards will be in place in order to ensure correct and secure data processing in compliance with applicable data protection law.

4.1 Disclosures to provide our Services

Service Providers. PassKit may share Personal Information with our service providers that we have retained to perform Services on our behalf including (i) provision of IT, hosting, backup, storage, and related Services; (ii) provision of information and Services you have requested; (iii) payment processing and to collect amounts owed to PassKit; and (iv) customer service activities. These third-party service providers may have access to or process your Personal Information for the purpose of providing these services for us. Payment information will be used and shared only to effectuate your order and may be stored by a service provider for purposes of future orders. PassKit has executed appropriate contracts with our service providers that prohibit service providers from using or sharing your Personal Information except as necessary to perform the contracted services on our behalf or to comply with applicable legal requirements.

Business Partners. From time to time, PassKit may partner with other companies to jointly offer products, services or programs (such as webinars, events or downloadable content). If you purchase, specifically express interest in, or register for a jointly-offered product, service or program from or through PassKit, we may share your Personal Information with our business partners. PassKit does not control our business partners' use of shared Personal Information and their use of such Personal Information will be in accordance with their own privacy policies. If you do not wish for your Personal Information to be shared in this manner, you may opt not to purchase or to specifically express interest in a jointly-offered product or service, or you may otherwise opt-out through any mechanism offered at the time the Personal Information is collected.

Affiliates. We may share Personal Information with our affiliated companies.

Advertising Partners. Through our Services, we may allow third-party advertising partners to set technologies and other tracking tools to collect information regarding your activities and your device (e.g., your IP address, mobile identifiers, page(s) visited, location, time of day). We may also combine and share such information and other information (such as demographic information and past purchase history) with third-party advertising partners. These advertising partners may use this information (and similar information collected from other websites) for purposes of delivering targeted advertisements to you when you visit third-party websites within their networks. This practice is commonly referred to as “interest-based advertising” or “online behavioral advertising.” We may allow access to other data collected by the Services to share information that may be useful, relevant, valuable or otherwise of interest to you. Please refer to Section 5 below for more information on how these technologies and tracking tools work. If you prefer not to share your Personal Information with third-party advertising partners, you may follow the instructions in Section 11 below.

4.2 Disclosures to protect us or others

Protection of PassKit and others. We may disclose Personal Information about you when we have a good faith belief that we are required to provide information: (a) if we are required to do so by law, court order or legal process; (b) in response to lawful requests by public authorities, including to meet national security or law enforcement requirements; (c) under the discovery process in litigation; (d) to enforce PassKit policies or contracts; (e) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss or in connection with an investigation or prosecution of suspected or actual illegal activity; or (f) if we, believe that disclosure is otherwise necessary or advisable.

In addition, from time to time, server logs and other systems may be reviewed for security purposes (e.g., to detect unauthorized activity on the Services). In such cases, records containing Personal Information may be shared with service providers, third parties and law enforcement bodies in order that they may prevent fraud and/or identify users in connection with their investigation of the unauthorized activities.

4.3 Disclosure in the event of merger, sale, or other asset transfers

Business Transfers. We reserve the right to disclose or transfer any Personal Information in the event of a proposed or actual purchase, any reorganization, sale, lease, merger, joint venture, assignment, amalgamation or any other type of acquisition, disposal or financing of all or any portion of our business or of any of the business assets or shares (including in connection with any bankruptcy or similar proceeding).

5. What device and usage data does PassKit process?

We use common information-gathering tools for collecting usage data, cookies and similar technologies to automatically collect information that may contain Personal Information from your computer or mobile device as you navigate our Sites or use our Services.

5.1 Cookies, and other tracking technologies in our Services

As you navigate the Sites and use the Services, certain passive information may also be collected through the use of cookies and other tracking technologies to obtain certain information about your computer, device, browsing actions, and patterns. This includes IP addresses, cookie IDs, navigational data, content clicked, the name of the domain and host from which you access the Internet, the browser software you use and your operating system, your browser settings, your device type and similar information, the date and time you access our Services and other device identifiers. This type of information is used for the purposes of gathering data to provide improved administration of our Services and to improve the quality of your experience when interacting with our Services (see Your Privacy Rights section below for more information).

Cookies. A cookie is a small text file that a website saves on your computer or mobile device when you visit the website. Cookies are then sent back to the originating website on each subsequent visit, or to another website that recognizes that cookie, to develop a record of the user's online activity. When you visit our Sites, we or an authorized third party may place a cookie on your browser and/or device which collects information, including Personal Information, about your online activities over time and across different sites. Cookies allow us to track usage, determine your browsing preferences and improve and customize your browsing experience. For more information about cookies and web beacons, please visit https://www.allaboutcookies.org/.

We use both session-based and persistent cookies on our Sites. Session-based cookies exist only during one session and disappear from your computer when you close your browser or turn off your computer or device. Persistent cookies remain on your computer or device after you close or turn off. You can control the use of cookies at the individual browser level, but choosing to disable cookies may limit your use of certain features or functions on our Services.

Types of cookies on our Sites.

• Essential Cookies. These cookies are necessary for the Sites to function and cannot be switched off. Some examples include: session cookies needed to transmit the website, authentication cookies, and security cookies. These cookies also support certain features on the Sites, such as the live chat feature. You can set your browser to block or alert you about these cookies, but some parts of the site will then not work.
• Functional Cookies. These cookies enhance functions, performance and services on the Sites. They enable us to count visits and traffic sources so we can measure and improve the performance of our Sites. Functional cookies also enable us to improve how our Sites function and to help us provide you with more relevant communications, including marketing communications. They help us to know which pages are the most and least popular and see how visitors move around and use the Sites. We may use our own technology or third-party technology to track and analyze usage information to provide enhanced interactions and more relevant communications and to enable certain features on the Sites.
• Targeting Cookies. These cookies track activity across websites in order to understand a visitor's interest, and to direct specific marketing to them. Targeting and advertising cookies may be set through our Site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites.

SDKs. We may use third party APIs and software development kits (“SDKs”) as part of the functionality of our Services. APIs and SDKs may allow third parties, including analytics and advertising partners, to collect your personal information for various purposes including to provide analytics services and content that is more relevant to you.

Microsoft Clarity. We partner with Microsoft Clarity to capture how you use and interact with our website through behavioral metrics, heatmaps, and session replay to improve and market our products/services. Website usage data is captured using first and third-party cookies and other tracking technologies to determine the popularity of products/services and online activity. Additionally, we use this information for site optimization and fraud/security purposes. For more information about how Microsoft collects and uses your data, visit the Microsoft Privacy Statement.

5.2 Social media features

PassKit may collect Personal Information to enable individuals to use online social media resources offered either by PassKit or a third party. We may also enable you to use these social media resources to post or share Personal Information with others. When using social media resources, you should take into careful consideration what Personal Information you share with others.

In addition, social media links such as Facebook, LinkedIn, Twitter, Instagram, Vimeo and YouTube (that might include widgets such as the “share this” button or other interactive mini-programs) may be on our Site. These features may collect your IP address, which page you are visiting on our site, and may set a cookie to enable the feature to function properly. These social media features are either hosted by a third party or hosted directly on our Site. Your interactions with these features apart from your visit to our Site are governed by the privacy policy of the company providing it.

5.3 Analytics

We may also use Google Analytics and Google Analytics Demographics and Interest Reporting and other similar providers to collect information regarding visitor behavior and visitor demographics on some of our Sites, and to develop website content. For more information about Google Analytics, please visit www.google.com/policies/privacy/partners/. You can opt out of Google’s collection and processing of data generated by your use of the Services by going to https://tools.google.com/dlpage/gaoptout. You can also opt out of our analytics partners by setting your preference in the Cookie Settings link at the bottom of the web page of the Site you are visiting.

6. International data transfers

We store Personal Information sent or collected via or by us in the United States or the European Economic Area, in the cloud, our servers, the servers of our affiliates or the servers of our service providers. To facilitate our global operations, we may transfer, store and access such information from the locations where PassKit has operations – specifically the United Kingdom, Hong Kong SAR, or Thailand. Your Personal Information may be processed in any of these countries, and they may have data protection laws that are different or that may not provide the same level of data protection as your country. For such cases, we rely on international transfer mechanisms such as the European Commission approved Standard Contractual Clauses, adequacy decisions about certain countries, or we will ask you for your prior consent for the transfer of your Personal Information, as applicable. In addition, we ensure the recipient of your Personal Information has in place adequate levels of protection for your Personal Information. For more information about the protections in place and a sample copy of the model contractual clauses, please contact us at privacy@passkit.com.

7. What security measures does PassKit have in place?

The security of Personal Information provided to us is of utmost importance to us. We have implemented industry-standard technical, administrative, and physical safeguards to help protect information on our servers against unauthorized access, alteration, disclosure or destruction. You are responsible for maintaining the secrecy of your own passwords. If you have reason to believe that your passwords or Personal Information is no longer secure, please promptly notify us at privacy@passkit.com.

8. How long does PassKit retain Personal Information?

We retain the Personal Information we receive as described in this Privacy Statement for as long as you use our Services or as necessary to fulfill the purpose(s) for which it was collected, provide our products and Services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements and comply with applicable laws.

9. Are PassKit's Sites intended for children?

Due to the nature of our business, Services are not marketed to or intended for minors under the age of 18. PassKit does not knowingly solicit or collect Personal Information from children under the age of 16. If you are a parent or guardian and believe your child has provided us with Personal Information without your consent, please contact us by using the Contact Us information below, and we will take steps to delete such Personal Information from our Services.

10. Your privacy rights

You have certain choices available to you when it comes to your Personal Information. Below is a summary of those choices, how to exercise them and any limitations.

Opt-out. Where you have consented to our processing of your Personal Information, you may withdraw that consent at any time and opt out by following the instructions in this section. Additionally, before we use Personal Information for any new purpose not originally authorized by you, we will provide information regarding the new purpose and give you the opportunity to opt out. Where your consent for the processing of Personal Information is otherwise required by law or contract, we will comply with the applicable law or contract. Note that, due to the nature of the Services or of the PassKit Platform, you may have to log in to your account or provide the email and/or other identifying value that is associated with your Personal Information in order for us to complete your request. Note that if you withdraw your consent to processing, some features of the Services may not be available.

Email unsubscribe. An “Unsubscribe” link will be provided in each email communication sent by us so that you can opt out. However, we may continue to send non-promotional, transaction-related emails regarding any products, the PassKit Platform, or any Services you have requested in response to your request. We may also need to send you certain communications regarding our programs and Services and you will not be able to opt out of those communications (e.g., communications regarding updates to our Terms of Use or this Privacy Statement).

Opt-out of cookies and ads.We will only use cookies with your permission in compliance with applicable laws. You may stop or restrict the placement of technologies on your device or remove them by adjusting your preferences as your browser or device permits, or for this Site using the Cookies Settings link at the bottom of the webpage. The online advertising industry also provides websites from which you may opt out of receiving targeted ads from data partners and other advertising partners that participate in self-regulatory programs. You can access these and learn more about targeted advertising and consumer choice and privacy, at www.networkadvertising.org/managing/opt_out.asp, https://www.youronlinechoices.eu/, https://youradchoices.ca/choices/, and www.aboutads.info/choices/. To separately make choices for mobile apps on a mobile device, you can download DAA's AppChoices application from your device's app store. Alternatively, for some devices you may use your device's platform controls in your settings to exercise choice.

Please note you must separately opt out in each browser and on each device. Advertisements on third-party websites that contain the AdChoices link may have been directed to you based on information collected by advertising partners over time and across websites. These advertisements provide a mechanism to opt out of the advertising partners' use of this information for interest-based advertising purposes.

Do Not Track. Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. DNT is a way for users to inform websites and services that they do not want certain information about their webpage visits collected over time and across websites or online services. PassKit does not recognize or respond to browser-initiated DNT signals, whether that signal is received on a computer or a mobile device. For information about “do-not-track”, visit https://www.allaboutdnt.org.

Access, correct, amend, port, restrict processing, or delete Personal Information.You have the right to control or change certain uses and disclosures of your Personal Information, as set out in this Privacy Statement. Subject to any exemptions provided by law, you have the right to: seek confirmation regarding whether we are processing Personal Information about you; request access to Personal Information; request to know more details about the categories or specific pieces of personal information we collect; to ask that we correct, update, amend or delete your Personal Information; to ask that we do not sell your Personal Information (where “sale” is defined according to the local regulations in your state of residency); and to not be discriminated against for exercising these rights. Please note that we do not currently sell your Personal Information as sales are defined under the laws of Nevada or California, as further detailed below in the sections dedicated to those locations. We will respond to such requests within a reasonable timeframe.

You may log into your account or email privacy@passkit.com to exercise one of the individual rights outlined above with regard to Personal Information held about you by us. Such requests will be processed in accordance with local laws. We will respond to such requests within a reasonable timeframe. Although we make good faith efforts to provide individuals with access to their Personal Information, there may be circumstances in which we are unable to provide access, including but not limited to: where the information contains legal privilege, would compromise others’ privacy or other legitimate rights, where the burden or expense of providing access would be disproportionate to the risks to the individual’s privacy in the case in question, or where it is commercially proprietary. If we determine that access should be restricted in any particular instance, we will provide you with an explanation of why that determination has been made and a contact point for any further inquiries. To protect your privacy, we will take commercially reasonable steps to verify your identity before granting access to or making any changes to your Personal Information. In addition, please note that we may need to retain certain information for record keeping purposes, to complete transactions or to comply with our legal obligations.

EU residents. If you are located in the European Economic Area or the UK, in addition to the rights mentioned above,you also have the right to lodge a complaint with a supervisory authority if you believe our processing of your Personal Information violates applicable law. In addition, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects (“Automated Decision-Making”). Automated Decision-Making currently does not take place on our Sites or Services.

CA residents. If you are a resident of California, you have the following rights

• the right to know what personal information is collected, used, shared or sold, both as to the categories and specific pieces of personal information;
• the right to delete personal information held by businesses and by extension, a business's service provider;
• the right to opt-out of sale of personal information. Consumers are able to direct a business that sells personal information to stop selling that information. Children under the age of 16 must provide opt in consent, with a parent or guardian consenting for children under 13;
• the right to non-discrimination in terms of price or service when a consumer exercises a privacy right under CCPA.

You can exercise these rights by contacting us at privacy@PassKit.com with the subject line “California Data Rights Request” and providing us with your name and the email address associated with your account.

Colorado residents. If you are a resident of Colorado, you have the right to: opt out of the processing of Personal Information; seek confirmation regarding whether we are processing Personal Information about you; request access to Personal Information; request deletion of Personal Information; or obtain and transfer your Personal Information. You can exercise these rights by contacting us at privacy@PassKit.com with the subject line “Colorado Data Rights Request” and providing us with your name and the email address associated with your account.

Nevada residents. If you are a resident of Nevada, you have the right to opt-out of the sale of certain Personal Information to third parties who intend to license or sell that Personal Information. You can exercise this right by contacting us at privacy@PassKit.com with the subject line “Nevada Do Not Sell Request” and providing us with your name and the email address associated with your account. Please note that we do not currently sell your Personal Information as sales are defined in Nevada Revised Statutes Chapter 603A.

Virginia residents. If you are a resident of Virginia, you have the right to: seek confirmation regarding whether we are processing Personal Information about you; request access to Personal Information; request corrections of inaccuracies in your Personal Information; request deletion of Personal Information; or to opt out of processing of your Personal Information for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. Please note that we do not currently sell your Personal Information or engage in profiling as those terms are defined in the Virginia Data Consumer Protection Act. You can exercise these rights by contacting us at privacy@PassKit.com with the subject line “Virginia Data Rights Request” and providing us with your name and the email address associated with your account.

Customer Data. If you are an individual seeking to exercise your data protection rights (including to seek access to, or to correct, amend, delete, port or restrict processing) in respect of Personal Information stored or processed by us on behalf of one of our customers within the PassKit Platform, then you should direct your request to our customer (the data controller). Upon receipt of a request from one of our customers for us to remove the personal data, we will respond to their request within provided in our agreements with the customer. We will retain Personal Information that we process and store on behalf of our customers for as long as needed to provide the services to our customers.

Redress, compliance and accountability. If, after reviewing this Privacy Statement, you would like to submit a request or you have any questions or privacy concerns, please contact: privacy@PassKit.com.

PassKit will address your concerns and attempt to resolve any privacy issues in a timely manner.

If you are an EU, Swiss or UK citizen and feel that PassKit is not abiding by the terms of this Privacy Statement, please contact us at the contact information provided below. If any request remains unresolved, you may contact the national data protection authority for your EU Member State, Switzerland or United Kingdom.

11. Third party sites

Please note that our Services may contain links to other websites or digital properties for your convenience and information. We do not control third-party websites, digital properties or their privacy practices, which may differ from those set out in this Privacy Statement. We do not endorse or make any representations about third-party websites or digital properties. Any Personal Information you choose to give to an unrelated third party is not covered by this Privacy Statement. We encourage you to review the privacy policy of any company, website or digital property before submitting your Personal Information. Some third parties may choose to share their users' Personal Information with us; that sharing is governed by that company's privacy policy, not this Privacy Statement.

12. Changes to this Privacy Statement

We may update this Privacy Statement from time to time as deemed necessary in our sole discretion. We will provide notification of any material changes to this Privacy Statement through our Sites or as otherwise required by applicable law. We encourage you to review this Privacy Statement periodically to be informed regarding how we are using and protecting your Personal Information and to be aware of any policy changes. Your continued relationship with us after the posting or notice of any amended Privacy Statement shall constitute your agreement to be bound by any such changes. Any changes to this Privacy Statement take effect immediately after being posted or otherwise provided by us.

13. Contact Us

If you have any questions about our privacy practices or this Privacy Statement, or if you wish to submit a request to exercise your rights, please contact us at:

PassKit, Inc
6E Golden Sun Centre
59-67 Bonham Strand West
Sheung Wan
Hong Kong SAR
privacy@passkit.com
852-5804-9280