Each product or service may define its own series of cookies that can be used, the format and/or names of which are provided below. This list is not exhaustive, however illustrates the primary purposes for our usage of cookies. We may set some or all of the following cookies:

• Cdta.{product}.AF - Allows us to ensure that your requests to our services are made by you as the user, and not a hijacked session or malicious software.
• Cdta.{product}.Auth - Helps us to authenticate you via your Cedita Account.
• Cdta.{product}.Ss - Contains an encrypted identifier for provision of a specific session.
• Cdta.{product}.Td - Contains an encrypted identifier that helps us provide mandatory functionality in certain products and services.
• MeiliRef - Contains an identifier for load balancing purposes.

In addition to the cookies that Cedita may set, third parties may also set cookies when you visit our products or services. For example companies that we engage with to provide services on our behalf, such as analytics or design resources, place cookies when you visit our sites.

Related Technologies

In addition to standard cookies, we may also use similar technology to store and read information on your computer. This is typically done to maintain preferences, or improve speed and performance by storing certaind ata locally.

Cedita do not use this technology to uniquely identify you, and only use it for the purpose of enhancing your experience in our products and services.

For example, HTML5 Local Storage may be used to store a cache of data locally to display it faster, rather than loading it from our servers each time.

The data associated with your Cedita Account, and how it is used, depends on how you use your account.

• Creation of your Cedita Account. When creating a Cedita Account, you will be asked to provide certain personal data and we will assign a unique identifier to your account and associated information. Some data provided may be used to help others find and connect with you within Cedita products. For example, people who know your email address would be able to invite your Cedita Account in to an organisation within the Cedita Cloud platform.
• Signing in to your Cedita Account and Cedita products. When you sign in to your Cedita Account, we will create a record of your sign in, including date information, as well as information related to the product that you signed in to and your IP address / device information. This helps us to protect your Cedita Account from unauthorised entry. When signing in to a Cedita product, you will enable personalisation and consistent experiences across all of them, as well as other enhanced features and settings.
• Signing in to third-party products. Cedita allows select partners to allow sign in via your Cedita Account, we will share data with this third-party in accordance to their privacy policy. The third party will receive only a unique identifier, version number assigned to your account, email address, basic name information, and any data that you explicitely allow it to from your Cedita Account. The third party can use or share the data it receives when you sign in according to their own practices and policies, it is therefore important that you review the privacy policy for each product that you sign in to to determine the usage of your data.

Commitment to security of personal data

We use a range of security technologies and procedures to help protect your personal data from unauthorised access, use, or disclosure. For example, the data that you provide to us has limited access and the servers of which the data is stored are in controlled facilities. Whenever we are transmitting highly confidential data (such as your password) over the internet, we protect it through the use of encryption. Cedita complies with applicable data protection laws, including applicable security breach notification laws.

Where we store and process personal data

Personal data collected by Cedita may be stored and processed in your region, in the United States, and in any other countries where Cedita or its affiliates, subsidiaries, or service providers operate facilities. Cedita maintains servers that are located in Estonia, France, Germany, Ireland, the Netherlands, the United Kingdom and the United States. Typically, the primary storage location is in the customer's region or in the United States, often with a backup to a datacenter in another region. The storage location(s) are chosen in order to operate efficiently, to improve performance, and to create redundancies in order to protect the data in the event of an outage or another problem. We take steps to ensure that the data we collect under this privacy policy is processed according to the provisions of this policy and the requirements of applicable law wherever the data is located.

Data Retention Policy

Cedita retains personal data for as long as necessary to provide the products and fulfill the transactions that have been initiated, or for further legitimate purposes such as complying with our legal obligations, resolving disputes, and enforcing our agreements. These requirements can vary depending on the type of data, context of our interactions with you or your use of products, and as such actual retention periods can vary significantly.

• Where there is an expectation for data to be maintained until the customer removes it. Data stored in our Consumer Products such as Exercise Ninja, or our Enterprise products such as Scandi, are aimed to be maintained until you were to actively delete it.
• Sensitive data is stored for a shortened retention period, only as such is needed to satisfy any transaction.
• Where the customer has provided consent for longer retention periods. We will retain data in accordance with your consent.
• Where Cedita are subject to a legal, contractual, or similar obligation to retain or delete the data. For example in mandatory data retention laws in specific jurisdictions, government orders to preserve data relevant to an investigation, or data retained for the purposes of litigation, we would retain the data for these purposes. Conversely, if we are required by law to remove unlawful content, we will do so.

California Consumer Privacy Act (the "CCPA")

If you are a California resident, we process your personal data in accordance with the California Consumer Privacy Act (CCPA). More information about our compliance with the CCPA can be found on our CCPA Notice.

Changes to this policy

This privacy policy is updated when necessary to provide greater transparency, clarity, or in response to:

• Feedback from customer, regulators, industry or other stakeholders;
• Changes in our products; or
• Changes in our data processing activities or policies.

When we post changes to this policy, the "Effective" and / or "Last Updated" date at the top of the policy will be updated. Furthermore, changes to our legal policies are documented on our Policy History page.

Labs, Preview or free-of-charge releases

Cedita may from time to time offer new Labs products, Preview releases, or other free-of-charge products and features ("previews") to enable to you to evaluate them while providing Cedita with data about your use of the product, including feedback, usage, and device data. As a result, these previews can automatically collect additional data, provide fewer controls, and otherwise employ different privacy and security measures than those typically present in our live products. If you opt to participate in these previews, we may contact you about your feedback or your interest in continuing to use the product after general release.

How to Contact Us

Where Cedita is a controller, unless otherwise stated, Cedita, Inc. and, for those in the European Union, Cedita Eesti OÜ, and, and for those in the United Kingdom Cedita Limited are the data controllers for personal data we collect through the products subject to this policy.

To contact us about this policy, or exercise any of your data protection rights, please use the following contact details:

• Electronic Contact: Please email privacy - at - cedita.com
• Written Contact: Privacy @ Cedita, Peter House, Oxford Street, Manchester, M1 5AN

To find the Cedita subsidiary in your country or region, see the list of Cedita locations around the world.

If you have a technical, Cedita Account, or support question, please visit Cedita Support to learn more about our support offerings.

In the event of a conflict between this Cedita privacy policy and the terms of any signed agreement(s) between a customer and Cedita for Enterprise products, the terms of those agreement(s) will control.

Funraising

Funraising allows charities and other not-for-profit organisations to raise funds via online events hosted on the platform. Our data collection on the platform enables us to give our users the best possible service, and the main use of information is to enable the core functioning of the platform for you and other users.

When you use Funraising as a Fundraiser, we collect information necessary to support your organisation as well as banking information to be able to complete Know Your Charity ("KYC") checks, and maintain compliance with Money Laundering Regulations.

We will also collect and share any marketing information that you choose to provide, which may include:

• Logos and imagery that are related to your organisation.
• Descriptions and articles related to your organisation.
• Information about your stakeholders.
• Details of any events that you host through the platform.

When you use Funraising as a Player, we collect and process information necessary to support your usage of platform, participation in events, and any payouts from the platform where possible.

As part of this, we will share the information that we have about you as a Player to Fundraisers when you participate in an event for the specific Fundraiser. The Fundraiser may go on to contact you about your fundraising and / or send you further information relating to their news, appeals, future events within the platform, and promotions. When this happens, the Fundraiser will become a controller with respect to your personal data. This means that they are responsible for their own compliance with data protection laws when they use your personal data, and as such use is subject to the Fundraisers' own privacy policy. We are not responsible for the Fundraisers' use of your personal data nor the Fundraiser's compliance with applicable laws.

If you wish to change your preferences for a Fundraiser to use your data (to contact you or otherwise), please contact the Fundraiser directly.

Should you choose to opt out of receiving emails or other contact from the Fundraiser directly we will not be aware of that decision.

For both Fundraisers and Players, we may collect your financial information which will include your Bank Account Number and Sort Code (UK only). This information shall be retained and used only for the purposes of processing payouts due from the platform.

If you as a Player make a payment via a credit or debit card, we do not store the credit or debit card details.

Enterprise online services
Other services (inclusive of Onboardi, PureSMS and Scandi) that are not listed elsewhere

In order to provide the Enterprise online services, Cedita uses data that you provide (including Customer Data, Personal Data, Administrator Data, Payment Data, and Support Data) and data Cedita collects or generates with your use of the Enterprise online services. We process data in accordance with the Online Services Agreement.

Personal Data. Customer is the controller of Personal Data and Cedita is the processor of such data. In addition, Cedita has taken on the added responsibilities of a data controller under GDPR when processing Personal Data in connection with its legitimate business operations incident to providing its services to Cedita's commercial customers, such as billing and preparing invoices; account management; compensation; financial reporting; business planning and product strategy; improving core functionality for accessibility, privacy, and energy efficiency; and combatting fraud, cybercrime, and cyberattacks on Cedita products. We use Personal Data in the least identifiable form that will support processing necessary for these legitimate business operations which may include aggregated data sets where the ability to identify specific individuals is not possible.

Administrator Data. Administrator Data is the information provided to Cedita during sign-up, purchase, or administration of the Enterprise online services. We use the Administrator Data to provide the Enterprise online services, complete transactions, service the account, detect and prevent fraud, and comply with our legal obligations. Administration Data includes all data of the Administrator from their Cedita Account, as well as aggregated usage data related to your account or service. Administrator Data also includes contact information for your colleagues or friends if you agree to provide it to Cedita for the limited purpose of sending an invitation to use the Enterprise online services; we contact tholse individuals with communications that include information about you and / or your organisation, such as names and contact information.

Payment Data. Payment Data is used to complete transactions, as well as to detect and prevent fraud.

Support Data. Customers provide or authorise Cedita to collect data in connection with obtaining technical support for the Enterprise online services. We process Support Data to provide technical and account support.

Diagnostic Data. Diagnostic Data is used to keep your services up to date and secure; detect, diagnose and remediate problems; and make product or service improvements. This data does not include any personally identifiable information, or about anything unrelated to the product in question.

Connected Experiences. The Cedita product suite provides experiences that are connected to and backed by cloud-based services, if you choose to use them, required service data will be collected to ensure that these connected experiences are reliable, up to date, remain secure, and perform as expected. An example of a Connected Experience is synchronising your Contact data from Scandi in to PureSMS.

In order to provide Cedita's Lifestyle products, Cedita collects usage, diagnostic, and any other data that you may provide to us. This information may be shared with your contacts and / or publicly, which is controllable via the settings in each individual application. For example, when using Exercise Ninja you can provide us with details of your workouts and optionally share them with your contacts or publicly.

When you sign up for a profile with a Lifestyle service, we assign a unique identifier, and may further assign or take a public username. When you sign in to the services, the data we collect about your usage is stored using these unique identifier(s) as well as your Cedita Account identifier.

Data we collect about your use of the services includes:

• When you sign in and out of a Lifestyle service, your usage of the platform, any purchases you make, and any content you obtain.
• Performance data about the services, and any error or further diagnostic information required to keep the services secure, up to date, and continually improved upon.
• Content you add, upload, or share through the product, including text, pictures, and any additional information you may provide to us.
• Social activity, including the connections you make (friends you add and people who follow you) on the product.

Data use. Cedita uses the data we collect from your use of a Lifestyle service to provide you with those experiences, and make them safer and better over time. Data we collect includes device information and usage statistics.

Data we collect also enables us to provide you with personalised, curated experiences. This includes connecting you to other products and services, as well as presenting you with offers, discounts, and recommendations.

Data visible by others. Your public username (where available), achievements, statistics, any content you share, and other data about your activity using a Lifestyle product may be able to be viewed by:

• Other users of that Lifestyle service.
• Customers of third-party services you have linked to your profile, or
• Other services associated with Cedita (including those of partner companies).

For example, any workout activities may be shared with your friends on Exercise Ninja; or if you set up a team, the tasks you choose will be visible to the members of that team. For any shareable data, there will be privacy controls within the Lifestyle product that allow you to restrict the sharing of such data.