Privacy Policy

1. Introduction

The purpose of this privacy notice is to tell you what information Civo Ltd collects from you, how and when it may be collected and what happens to it. For the purpose of this privacy notice, “Civo”, “we” and “us” refers to Civo Ltd.

We take the protection of your personal data very seriously and strictly adhere to the rules laid out by data protection laws, Data Protection Act 2018 and the General Data Protection Regulation (GDPR-EU and GDPR-UK).

Please note that this privacy notice does not apply to the extent we process personal data in the role of a "data processor" (see our Data Processing Agreement for more information).

We have appointed a Data Protection Officer (DPO) who is responsible for monitoring and providing guidance with our GDPR status. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the DPO/us using the contact information in section 16 of this privacy notice.

2. Why we Collect your Personal information

We may collect your personal information when you request services from us (or otherwise contact us from time to time) by:

• inputting your data onto our website;
• by directly contacting our business,
• when you speak to one of our customer service agents by telephone, live chat or through our webpage; or
• another business or organization passes your details to us;
• when you register your interest to attend an event organized by us.
• providing the requested services and/or information to you;
• responding to your queries;
• transmitting personal information between our offices or functions for internal administrative purposes;
• hosting and maintaining our websites;
• to create and activate your account as part of the services you requested;
• to send you an invoice;
• ensuring network and information security;
• carrying out direct marketing; and/or
• when you register your interest in or attend an event we organize.

1. 2.1 How we use the Personal information that you provide to us

   We undertake the following processing of your personal information on the legal basis that it is necessary to perform the contract with you and to provide the services we have agreed to provide to you. Where we have not entered into a contract with you, we may also carry out this processing because in that pre-contractual stage where we consider it is necessary in our legitimate business interests in order to deal with requests, inquiries, or comments you have made to us.

   Pre-contract processing - we collect your personal information which you provide to us when applying for a service with us to comply with our legal obligations and to carry out fraud checks. We may also process your personal information for this purpose where we consider it necessary for the performance of the contract with you, or otherwise with your consent.

   Enhancing your experience and our business - we may use your personal information to administer our site and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes. We may also share limited personal information with social media platforms to provide you with tailored services relevant to the services you have requested or received.

   Other lawfully permitted processing - we may also use any personal information that you provide to us for example to other companies within Civo Ltd or to other organizations required to provide you with the requested service. If you choose not to provide personal information requested by us, we may not be able to provide you with the services and/or information you have requested or otherwise fulfill the purpose(s) for which we have asked for the personal information.

   Marketing - we may also use any personal data that we collect to recommend products and services that might be of interest to you, to send you marketing and advertising messages such as newsletters, announcements, or special offers or to notify you about our upcoming events. Providing you with marketing communications is not essential to providing the Services to you, therefore you may opt-out from receiving such communications.

   You are entitled to opt-out from receiving marketing communication at any time (see Marketing Opt-out below). Your decision to opt-out from our marketing communications will not affect your ability to continue receiving our Services from us.

   Marketing Opt-Out - you are entitled to opt-out from receiving marketing communication at any time and free of charge by using the “unsubscribe” option included in any marketing e-mail or other marketing material received from us or by contacting us using the contact information in section 16 of this privacy notice.

3. Lawful Basis Of Processing Information

We only collect and use personal information about you when the law allows us to. Most commonly, we use it where:

• The data subject (you) has given consent to the processing activity taking place
• If the processing is necessary for the performance of a contract
• If the processing is necessary for compliance with a legal obligation to which the controller is subject
• If the processing is necessary for the purpose of the legitimate interest pursued by us or our partners i.e. to generate weekly reports our accounts team.

Where legitimate interest is identified as a lawful basis, we will undertake a legitimate interest assessment which is a three-part test covering:

The Purpose test - to identify the legitimate interest;

Necessity test - to consider if the processing is necessary for the purpose identified; and

Balancing test - considering the individual's interests, rights or freedoms and whether these override the legitimate interests identified.

4. What Information we collect and where from

When you interact with us in the different ways described below, we may ask you for the following information:

• personal and contact details (for example your name, email address, billing address, phone number with the area code, credit card information, IP detected country, and signature of the web browser);
• personal and contact details which you give us when subscribing to receive emails, newsletters, or marketing information from us;
• information we collect via cookies or similar technology stored on your device (you can find out more from our Cookie Policy);
• technical information, including the Internet Protocol (IP) address used to connect your computer or device to the Internet, your login information, browser type and version, time zone setting, browser plug- in type and versions, operating systems and platform and geographic location;
• information about your visit, including the full Uniform Resource Locators (URL), clickstream to, through and from our site (including date and time, products you have viewed or searched for, choices you make during your visit, page response times, download errors, on page errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs) and methods used to browse away from the page;
• information from social media activity (such as likes, shares and tweets) when you interact with us on social media;
• information and records obtained when you contact our customer service department by live chat or web;
• information you provide if you report a problem with our website or service; or
• additional information which you provide voluntarily and/or which we may ask from you to better understand you and your interests;

We collect certain information when we organize our events.

All events organized by us are public events. Where it is not possible to gain your consent for photographs and videos, we would like to reassure you that we will take all necessary measures to safeguard your privacy. In such cases, we will blur any personal data related to you, such as the names on the lanyards. We want to make it clear that we do not endorse or take any responsibility for photographs or videos taken by third-party individuals.

1. 4.1 Special Category Data

   When you register your interest to attend one of our events, we may collect the following special category data from you:

   • Food Allergies / Dietary Restrictions

   We will only process special category data where we have an Article 9 exception allowing us to do so, in this case, we will rely on Article 9(2)(a) condition of the UK GDPR (explicit consent).

   Where special category data may be collected during the course of activities relating to photography for marketing and publicity materials, we will rely on explicit consent.

5. How Long we Keep Information For

We will only retain your personal data for as long as reasonably necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation with respect to our relationship with you.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting, or other requirements. If you would like to find out how long your information is being retained, please see "additional information", section 16 of this policy.

6. Security of Personal information

We take the responsibility for protecting your privacy very seriously and we will ensure your data is secured in accordance with our obligations under the Data Protection laws. We have in place technical and organizational measures to ensure personal information is secured and to prevent your personal data from being accessed in an unauthorized way, altered, or disclosed. We have in place a robust access control policy which limits access to your personal data to those employees, contractors and other third parties who only have a business need to know. The processing of your personal data will only take place subject to our instruction.

We have policies and procedures to handle any potential data security breaches and data subjects, third parties and any applicable regulators will be notified where we are legally required to do so.

Any payment transactions will be encrypted using SSL technology. Where we have given you (or where you have chosen) a password which enables you to access certain parts of the site, you are responsible for keeping this password confidential. We ask that you do not share your password with anyone.

Unfortunately, the transmission of information via the Internet is not completely secure so we cannot guarantee the security of your information when it is transmitted to our website or from third party websites, any transmission is at your own risk, however, we use strict procedures and security features to prevent unauthorized access.

From time to time, this site may contain links to and from the websites of our partner networks, advertisers, and affiliates. If you follow a link to any of these websites, we cannot accept any responsibility or liability and you will have to agree to such company's privacy notice, please ensure you agree to such policies before submitting your personal data.

We acknowledge that the information you provide may be confidential. We do not sell, rent, distribute, or otherwise make personal information commercially available to any third party, but we may share information with our service providers for the purposes set out in this privacy notice. We will keep your information confidential and protect it in accordance with our privacy notice and all applicable laws.

We have ensured that all employees have had information security and data protection training. If you would like more details of the security we have in place, please see "additional information", section 16 of this notice.

7. Children's information

We do not knowingly collect information on children. If we have collected personal information on a child, please contact us immediately using the details in section 16, so we can remove this information without any undue delay.

8. Your individual rights

In this Section, we have summarized the rights that you have under General Data Protection Regulation. Some of the rights are complex, and not all the details have been included in our summaries. Accordingly, you should read the relevant laws and guidance from the regulatory authorities for a full explanation of these rights.

Your principal rights under General Data Protection Regulation are:

• Right to Object;
• Right of Access;
• Right to be informed;
• Right to Rectification;
• Right to Erasure;
• Right to Restrict Processing; and
• Right to Data Portability.

If you have any question about these rights, please see "additional information", section 16 of this notice.

9. Consent

Where you have given consent for processing, or explicit consent in relation to the processing of special category data, you have the right to withdraw this consent at any time, but this will not affect the lawfulness of processing based on consent before its withdrawal.

10. Failure To Provide Personal information

Where we need to collect personal data by law or in order to process your instructions or perform a contract, we have with you and you fail to provide that data when requested, we may not be able to carry out your instructions or perform the contract we have or are trying to enter into with you. In this case, we may have to cancel our engagement or contract you have with us, but we will notify you if this is the case at the time.

11. Cookies

When you visit our website for the first time, you will be asked to consent or reject the collection and use of cookies and similar tracking technologies. If you reside in the United Kingdom (UK), European Union (EU), the European Economic Area (EEA), or Switzerland, we do not collect cookies until you consent or opt-in using Cookie Preferences. Please see our Cookie Policy.

You may update, change, or read more about the specific cookies we collect by reviewing your Cookie Preferences from the icon available on the landing page.

12. Automated Decision Making

Your personal data is used in automated decision making (a decision made solely by automated means without any human involvement) for verification to determine the validity of the information you provided to us in order to activate your account with us, and profiling (automated processing of personal data to evaluate certain conditions about an individual) based on the cookies for retargeting and to show you ads based on your preferences.

For automated decisions making the below information will be used:

• Country billing address, detected country, and phone number

If your account verification has failed, as part of the automated decision making, we will manually check the validity of the information and make a decision.

We only perform profiling if you have consented to the use of tracking cookies on our website. These cookies help us understand your interests based on your online activity, enabling us to show you ads that are relevant to you.

For more information regarding cookies, please see our cookie policy.

Where we make an automated decision which has a legal or substantially similar effect, you have the right to speak to us and we may then review the decision, provide a more detailed explanation and assess if the automated decision was made correctly.

13.Transfers To Third Parties

We may disclose your personal data, listed in section 4 to some third parties to help us deliver our services/products. All third parties are contractually bound to protect the personal data we provide to them. We may use several or all of the following categories of recipients:

• Country billing address, detected country, and phone number
• Business partners, suppliers, and sub-contractors for the performance of any contract we enter into with them or you;
• Companies within our businesses and to other functions or offices within the same corporate group as defined by section 1159 of the Companies Act for the purposes set out above;
• Where we employ third-party companies or individuals to process personal information provided by us on our behalf for business functions, including (without limitation) IT support, hosting our data on cloud platforms, legal, accounting, audit, consulting and, other professional service providers, and providers of other services related to our business;
• Advertisers (we do not disclose information about identifiable individuals to our advertisers but will provide them with aggregate information to help us serve more relevant advertisements to a cohort of visitors and/or customers on various advertising platforms) analytics, search engine providers and, evaluation companies;
• Portions of our services may be provided by organizations with which we have a contractual relationship, including subcontractors. We only provide these organizations with the information that they need to be able to perform their services;
• Payment service providers;
• Professional advisors e.g. lawyers, auditors;
• Web analytics and search engine provider to ensure the continued improvement and optimisation of our website; or
• Regulators and law enforcement agencies, where we are required by law to do so, where necessary for the purposes of preventing and detecting fraud, and other criminal offenses and/or to ensure network and information security.

14. Transfers Outside Of The UK

In this section, we provide information about the circumstances in which your personal data may be transferred and stored in countries outside the UK.

We may share personal information to third parties outside of the UK. Any personal information transferred will only be processed on our instruction and we ensure that information security at the highest standard would be used to protect any personal information as required by the Data Protection laws.

Where personal data is transferred outside of the UK to a country without an adequacy decision, we will ensure appropriate safeguards are in place prior to the transfer. These could include:

• EU Standard Contractual Clauses + UK Addendum
• International Data Transfer Agreement
• Binding Corporate Rules
• An exception as defined in Article 49 of the EU GDPR

For more information about transfers and safeguarding measures, please contact us using the information in section 16.

15. Right to complaint

We take any complaints about our collection and use of personal information very seriously.

If you think that our collection or use of personal information is unfair, misleading, or inappropriate, or have any other concern about our data processing, please raise this with us in the first instance.

To make a complaint, please contact us via email on dpo@civo.com

Alternatively, you can contact us:

By Post: Units H-K, Gateway 1000, Whittle Way, Stevenage, Hertfordshire, SG1 2FP

Alternatively, you can make a complaint to the Information Commissioner's Office:

By Post: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

By Website: Click Here

By Email: Click Here

By Phone: 0303 123 1113 (Local rate) or 01625 545 745 (National rate)

16. Additional information

Your trust is important to us. That is why we are always available to talk with you at any time and answer any questions concerning how your data is processed. If you have any questions that could not be answered by this privacy notice or if you wish to receive more in-depth information about any topic within it, please contact our DPO and Compliance Team via email on dpo@civo.com.

17. European Union Representation

For customers based in the EU, our EU representative is DP-Dock GmbH and can be contacted on civo@gdpr-rep.com. If you wish to exercise your rights under the EU GDPR or have any questions regarding data privacy, please contact them on this email address or via post at Civo Ltd. Ballindamm 39, 20095 Hamburg, Germany.

DP-Dock COR Services GmbH serves as our designated representative for the EU Digital Services Act within the European Union. If you have any questions regarding the Act, please contact them on civo@rep-services.eu email address, via post at Civo Ltd. Grüffkamp 10, 24159 Kiel, Germany or via telephone number: +49 40-57308352.

18. Global Privacy Compliance

We operate on a global scale, serving customers across various countries. As a result, we are committed to ensuring that your information is handled securely and responsibly, adhering to the privacy standards established by the respective jurisdiction where we operate.

This section of our privacy notice is dedicated to our clients, event attendees and visitors (hereinafter referred as Users) who are residents of the United States. It outlines your rights under US federal and state privacy laws.

Federal Privacy Laws: The US has various federal privacy laws that protect personal information. Notably, the Privacy Act of 1974 governs the collection, use, and dissemination of personal information. Additionally, sector specific laws such as the Health Insurance Portability and Accountability Act (HIPAA) provide protection for health information.

State Privacy Laws: Several US states have enacted privacy laws that may apply to you. For instance, California's Consumer Privacy Act (CCPA), Virginia Consumer Data Protection Act (CDPA), And Colorado's Privacy Act (CPA) offer consumers rights similar to those in the GDPR, such as right to access, correct, and delete personal data, as well as the right to opt-out of certain data processing activities.

Please note that state law may vary, and Civo is committed to complying with all applicable laws where our clients, event attendees and web visitors reside. For more detailed information on your specific rights under state laws, please refer to the below section. For more details regarding each specific state law, please check the below sections.

Further information for users in California

This section applies to Users in California, and, for such Users, supersedes any other possibly divergent or conflicting information contained in the privacy policy.

The California Consumer Privacy Act ('CCPA') provides California residents with rights to receive certain disclosures regarding the collection, use, and sharing of information about them, as well as rights to know/access, delete, and limit the sharing of personal information. You have the right to be free from discrimination based on your exercise of your CCPA rights.

For information on the categories of personal information we collect and the purpose of each category, please check sections 2 'Why we collect your personal information' and 4 'What information we collect and where from' of this notice.

Civo will collect the categories of personal data mentioned in section 4 of this privacy notice, directly from you, when you use our website, register to an event, or enter into a contract with us.

Civo will retain your personal information as detailed in section 5 of this privacy notice.

Civo will share your Personal information with the third parties listed in section 13 of this privacy notice.

While Civo does not sell personal information in exchange for any monetary consideration, we do share personal information for other benefits as defined by Cal. Civ. Code 1798.140(ad)(2). We have shared in the preceding 12 months personal information as necessary for specific “business purposes,” as defined by Cal. Civ. Code 1798.140(e) and specified in section 13 “Transfer to third parties”. You have a right to direct Civo not to sell or share your personal information. We want to assure you that Civo does not sell or share the personal information of consumers.

Your privacy rights under the California Consumer Privacy Act and how to exercise them:

The right to access personal information: the right to know and to portability

You have the right to request that we disclose to you:

• the categories of personal information that we collect about you;
• the sources from which the personal information is collected;
• the purposes for which we use your information;
• to whom we disclose such information; and
• the specific pieces of personal information we have collected about you.

You also have the right to know what personal information is sold or shared and to whom. In particular, you have the right to request two separate lists from us where we disclose:

• the categories of personal information that we sold or shared about you and the categories of third parties to whom the personal information was sold or shared; or
• the categories of personal information that we disclosed about you for a business purpose and the categories of persons to whom it was disclosed for a business purpose.

The disclosure described above will be limited to the personal information collected or used over the past 12 months.

If we deliver our response electronically, the information enclosed will be "portable", i.e. delivered in an easily usable format to enable you to transmit the information to another entity without hindrance - provided that this is technically feasible.

• The right to request the deletion of your personal information

You have the right to request that we delete any of your personal information, subject to exceptions set forth by the law (such as, including but not limited to, where the information is used to identify and repair errors on this Website, to detect security incidents and protect against fraudulent or illegal activities, to exercise certain rights, etc.).

If no legal exception applies, as a result of exercising your right, we will delete your personal information and notify any of our service providers and all third parties to whom we have sold or shared the personal information to do so — provided that this is technically feasible and doesn't involve disproportionate effort.

• The right to correct inaccurate personal information

You have the right to request that we correct any inaccurate personal information we maintain about you, taking into account the nature of the personal information and the purposes of the processing of the personal information.

• The right to opt out of sale or sharing of personal information and to limit the use of your sensitive personal information

You have the right to opt out of the sale or sharing of your personal information. You also have the right to request that we limit our use or disclosure of your sensitive personal information.

• The right of no retaliation following opt-out or exercise of other rights (the right to non-discrimination)

We will not discriminate against you for exercising your rights under the CCPA. This means that we will not discriminate against you, including, but not limited to, by denying goods or services, charging you a different price, or providing a different level or quality of goods or services just because you exercised your consumer privacy rights.

However, if you refuse to provide your personal information to us or ask us to delete or stop selling your personal information, and that personal information or sale is necessary for us to provide you with goods or services, we may not be able to complete that transaction.

To the extent permitted by the law, we may offer you promotions, discounts, and other deals in exchange for collecting, keeping, or selling your personal information, provided that the financial incentive offered is reasonably related to the value of your personal information.

To fully exercise your right to limit the use or disclosure of your sensitive personal information, please contact us using the details in section 16 of this notice.

How and when we are expected to handle your request

We will confirm receipt of your verifiable request within 10 days and provide information about how we will process your request.

We will respond to your request within 45 days of its receipt. Should we need more time, we will explain to you the reasons why, and how much more time we need. In this regard, please note that we may take up to 90 days to fulfill your request.

Our disclosure(s) will cover the preceding 12-month period. Only with regard to personal information collected on or after January 1, 2022, you have the right to request that we disclose information beyond the 12-month period, and we will provide it to you unless doing so proves impossible or would involve a disproportionate effort.

Should we deny your request, we will explain to you the reasons behind our denial.

We do not charge a fee to process or respond to your verifiable request unless such request is manifestly unfounded or excessive. In such cases, we may charge a reasonable fee, or refuse to act on the request. In either case, we will communicate our choices and explain the reasons behind it.

Further information for users in Virginia

This section applies to all Users, who are consumers residing in the Commonwealth of Virginia, according to the “Virginia Consumer Data Protection Act" (the "VCDPA"), and, for such consumers, it supersedes any other possibly divergent or conflicting information contained in the privacy policy.

This part of the document uses the term “personal data” as defined in the VCDPA.

For information on the categories of personal data we collect and the purpose of each category, please check sections 2 'Why we collect your personal information' and 4 'What information we collect and where from' of this notice.

Civo will collect the categories of personal data mentioned in section 4 of this privacy notice, directly from you, when you use our website, register for an event or enter into a contract with us.

Civo will retain your personal data as detailed in section 5 of this privacy notice.

Civo will share your personal data with the third parties listed in section 13 of this privacy notice.

Sale of your personal data

For our purposes, the word “sale” means any “exchange of personal data for monetary consideration by us to a third party“ as defined by the VCDPA.

While Civo does not sell personal data in exchange for any monetary consideration, we do share Personal information for other benefits, please note that according to the VCDPA, the disclosure of personal data to a processor that processes personal data on behalf of a controller does not constitute a sale. In addition, other specific exceptions set forth in the VCDPA may apply, such as, but not limited to, the disclosure of personal data to a third party for the provision of a product or service requested by you. As specified in section 13 “Transfer of data to third parties” of this privacy notice, our use of your personal information may be considered a sale under VCDPA.

Civo does not sell your personal data to any third parties for monetary considerations as defined in VCDPA.

Processing of your personal data for targeted advertising

For our purposes, the word "targeted advertising" means "displaying advertisements to you where the advertisement is selected based on personal data obtained from your activities over time and across non-affiliated websites or online applications to predict your preferences or interests" as defined by the VCDPA.

Please note that according to the VCDPA, targeted advertising does not include: “advertisements based on activities within a controller's own websites or online applications; advertisements based on the context of a consumer's current search query, visit to a website or online application; advertisements directed to a consumer in response to the consumer's request for information or feedback; or processing personal data solely for measuring or reporting advertising performance, reach, or frequency”.

Your right to opt out of the processing of your personal data for targeted advertising and how you can exercise it

You have the right to opt out of the processing of your personal data for targeted advertising. This means that whenever you ask us to stop processing your data for targeted advertising, we will abide by your request. To fully exercise your right to opt out you can contact us at any time, please see contact us using the details in section 16 of this notice.

Your privacy rights under the Virginia Consumer Data Protection Act

You may exercise certain rights regarding your data processed by us. In particular, you have the right to do the following:

• access personal data: the right to know. You have the right to request that we confirm whether or not we are processing your personal data. You also have the right to access such personal data;
• correct inaccurate personal data. You have the right to request that we correct any inaccurate personal data we maintain about you, taking into account the nature of the personal data and the purposes of the processing of the personal data;
• request the deletion of your personal data. You have the right to request that we delete any of your personal data;
• obtain a copy of your personal data. We will provide your personal data in a portable and usable format that allows you to transfer data easily to another entity — provided that this is technically feasible;
• opt out of the processing of your personal data for the purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning you; and
• non-discrimination. We will not discriminate against you for exercising your rights under the VCDPA. This means that we will not, among other things, deny goods or services, charge you a different price, or provide a different level or quality of goods or services just because you exercised your consumer privacy rights. However, if you refuse to provide your personal data to us or ask us to delete or stop selling your personal data, and that personal data or sale is necessary for us to provide you with goods or services, we may not be able to complete that transaction. To the extent permitted by the law, we may offer a different price, rate, level, quality, or selection of goods or services to you, including offering goods or services for no fee, if you have exercised your right to opt out, or our offer is related to your voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program.

To fully exercise your rights under VCDA you can contact us at any time, using the details in section 16 of this notice.

How and when we are expected to handle your request

Civo will respond to your request without undue delay, but in all cases and at the latest within 45 days of its receipt. Should we need more time, we will explain to you the reasons why, and how much more time we need. In this regard, please note that we may take up to 90 days to fulfill your request.

Should we deny your request, we will explain to you the reasons behind our denial without undue delay, but in all cases and at the latest within 45 days of receipt of the request. It is your right to appeal such a decision by submitting a request to us via the details provided in this document. Within 60 days of receipt of the appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied you may contact the Attorney General to submit a complaint.

We do not charge a fee to respond to your request, for up to two requests per year. If your request is manifestly unfounded, excessive or repetitive, we may charge a reasonable fee or refuse to act on the request. In either case, we will communicate our choices and explain the reasons behind them.

Further information for users in Colorado

This section applies to all Users, who are consumers residing in the State of Colorado, according to the “Colorado Privacy Act" (the "CPA"), and, for such consumers, it supersedes any other possibly divergent or conflicting information contained in the privacy notice.

This part of the document uses the term “personal data” as defined in the CPA.

For information on the categories of personal data we collect and the purpose of each category, please check sections 2 'Why we collect your personal information' and 4 'What information we collect and where from' of this notice.

Civo will collect the categories of personal data mentioned in section 4 of this privacy notice, directly from you, when you use our website, register for an event or enter into a contract with us.

Civo will retain your personal data as detailed in section 5 of this Privacy Notice.

Civo will share your personal data with the third parties listed in section 13 of this privacy notice.

Sale of your personal data

The use of your personal data, as detailed in section 2 of this privacy notice, may be considered a sale under the CPA.

For our purposes, the word "sale", "sell", or "sold" means "the exchange of personal data for monetary or other valuable consideration by a controller to a third party" as defined by the CPA.

Please note that according to the CPA, the disclosure of personal data to a processor that processes personal data on behalf of a controller does not constitute a sale. In addition, other specific exceptions set forth in the CPA may apply, such as, but not limited to, the disclosure of personal data to a third party for the provision of a product or service requested by you.

Civo does not sell your personal data to any third parties for monetary considerations as defined by the CPA.

Your right to opt out of the processing of your personal data for targeted advertising and how you can exercise it

Please note that according to the CPA, targeted advertising does not include: “advertisements directed to a consumer in response to the consumer's request for information or feedback; advertisements based on activities within a controller's own websites or online applications or any affiliated website or online application; advertisements based on the context of a consumer's current search query, visit to an internet web site or online application; or processing personal data solely to measure or report advertising frequency, performance or reach”.

You have the right to opt out of the processing of your personal data for targeted advertising. This means that whenever you ask us to stop processing your data for targeted advertising, we will abide by your request. To fully exercise your right to opt out you can contact us at any time, please see contact us using the details in section 16 of this notice.

Your privacy rights under the Colorado Privacy Act and how to exercise them

You may exercise certain rights regarding your data processed by us. In particular, you have the right to do the following:

• opt out of the processing of your personal data for the purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.
• access personal data. You have the right to request that we confirm whether or not we are processing your personal data. You also have the right to access such personal data.
• correct inaccurate personal data. You have the right to request that we correct any inaccurate personal data we maintain about you, taking into account the nature of the personal data and the purposes of the processing of the personal data.
• request the deletion of your personal data. You have the right to request that we delete any of your personal data.
• obtain a copy of your personal data. We will provide your personal data in a portable and usable format that allows you to transfer data easily to another entity - provided that this is technically feasible.

To fully exercise your rights under CPA you can contact us at any time, using the details in section 16 of this notice.

How and when we are expected to handle your request

We will respond to your request without undue delay, but in all cases and at the latest within 45 days of its receipt. Should we need more time, we will explain to you the reasons why, and how much more time we need. In this regard, please note that we may take up to 90 days to fulfill your request.

Should we deny your request, we will explain the reasons behind our denial without undue delay, but in all cases and at the latest within 45 days of receipt of the request. It is your right to appeal such a decision by submitting a request to us via the details provided in this document. Within 45 days of receipt of the appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied you may contact the Attorney General to submit a complaint.

We do not charge a fee to respond to your request, for up to two requests per year.

Further information for users in Connecticut

This section applies to all Users, who are consumers residing in the State of Connecticut, according to “An Act Concerning Personal data Privacy and Online Monitoring " (also known as "The Connecticut Data Privacy Act" or the “CTDPA"), and, for such consumers, it supersedes any other possibly divergent or conflicting information contained in the privacy notice.

This part of the document uses the term “personal data” as defined in the CTDPA.

For information on the categories of personal data we collect and the purpose of each category, please check sections 2 'Why we collect your personal information' and 4 'What information we collect and where from' of this notice.

Civo will collect the categories of personal data mentioned in section 4 of this privacy notice, directly from you, when you use our website, register for an event or enter into a contract with us.

Civo will retain your personal data as detailed in section 5 of this privacy notice.

Civo will share your personal data with the third parties listed in section 13 of this privacy notice.

Sale of your personal data

The use of your personal data, as detailed in section 2 of this privacy notice, may be considered a sale under the CTDPA.

For our purposes, the word "sale", "sell", or "sold" means "the exchange of personal data for monetary or other valuable consideration by a controller to a third party" as defined by the CTDPA.

Please note that according to the CTDPA, the disclosure of personal data to a processor that processes personal data on behalf of a controller does not constitute a sale. In addition, other specific exceptions set forth in the CTDPA may apply, such as, but not limited to, the disclosure of personal data to a third party for the provision of a product or service requested by you.

Civo does not sell your personal data to any third parties for monetary considerations as defined by the CTDPA.

Processing of your personal data for targeted advertising

Civo may use your personal data for targeted advertising purposes.

For our purposes, the word "targeted advertising" means "displaying to a consumer an advertisement that is selected based on personal data obtained or inferred over time from the consumer's activities across non-affiliated websites, applications, or online services to predict consumer preferences or interests" as defined by CTDPA.

Please note that according to the CTDPA, targeted advertising does not include: “advertisements based on activities within a controller's own web sites or online applications; advertisements based on the context of a consumer's current search query, visit to an internet web site or online application; advertisements directed to a consumer in response to the consumer's request for information or feedback; or processing personal data solely to measure or report advertising frequency, performance or reach”.

Your right to opt out of the processing of your personal data for targeted advertising and how you can exercise it

You have the right to opt out of the processing of your personal data for targeted advertising. This means that whenever you ask us to stop processing your data for targeted advertising, we will abide by your request. To fully exercise your right to opt out you can contact us at any time, please see contact us using the details in section 16 of this notice.

Your privacy rights under the Connecticut Data Privacy Act and how to exercise them

You may exercise certain rights regarding your data processed by us. In particular, you have the right to do the following:

• access personal data. You have the right to request that we confirm whether or not we are processing your personal data. You also have the right to access such personal data.
• correct inaccurate personal data. You have the right to request that we correct any inaccurate personal data we maintain about you, taking into account the nature of the personal data and the purposes of the processing of the personal data.
• request the deletion of your personal data. You have the right to request that we delete any of your personal data.
• obtain a copy of your personal data. We will provide your personal data in a portable and usable format that allows you to transfer data easily to another entity - provided that this is technically feasible.
• opt out of the processing of your personal data for the purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

To fully exercise your rights under CTDPA you can contact us at any time, using the details in section 16 of this notice.

How and when we are expected to handle your request

We will respond to your request without undue delay, but in all cases and at the latest within 45 days of its receipt. Should we need more time, we will explain to you the reasons why, and how much more time we need. In this regard, please note that we may take up to 90 days to fulfill your request.

Should we deny your request, we will explain to you the reasons behind our denial without undue delay, but in all cases and at the latest within 45 days of receipt of the request. It is your right to appeal such a decision by submitting a request to us via the details provided in this document. Within 45 days of receipt of the appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, you may contact the Attorney General to submit a complaint.

We do not charge a fee to respond to your request, for up to one request per year.

Further information for Utah consumers

This section applies to all Users, who are consumers residing in the State of Utah, according to the “Consumer Privacy Act" (the “UCPA"), and, for such consumers, it supersedes any other possibly divergent or conflicting information contained in the privacy policy.

This part of the document uses the term “personal data” as defined in the UCPA.

For information on the categories of personal data we collect and the purpose of each category, please check sections 2 'Why we collect your personal information' and 4 'What information we collect and where from' of this notice.

Civo will collect the categories of personal data mentioned in section 4 of this privacy notice, directly from you, when you use our website, register for an event or enter into a contract with us.

Civo will retain your personal data as detailed in section 5 of this privacy notice.

Civo will share your personal data with the third parties listed in section 13 of this privacy notice.

Sale of your personal data

The use of your personal data, as detailed in section 2 of this privacy notice, may be considered a sale under the UCPA.

For our purposes, the word "sale", "sell", or "sold" means "the exchange of personal data for monetary or other valuable consideration by a controller to a third party" as defined by the UCPA.

Please note that according to the UCPA, the disclosure of personal data to a processor that processes personal data on behalf of a controller does not constitute a sale. In addition, other specific exceptions set forth in the UCPA may apply, such as, but not limited to, the disclosure of personal data to a third party for the provision of a product or service requested by you.

Civo does not sell your personal data to any third parties for monetary considerations as defined by the UCPA.

Processing of your personal data for targeted advertising

Civo may use your personal data for targeted advertising purposes.

For our purposes, the word "targeted advertising" means "displaying to a consumer an advertisement that is selected based on personal data obtained or inferred over time from the consumer's activities across non-affiliated websites, applications, or online services to predict consumer preferences or interests" as defined by UCPA.

Please note that according to the UCPA, targeted advertising does not include: “advertisements based on activities within a controller's own websites or online applications or any affiliated website or online application; advertisements based on the context of a consumer's current search query, visit to an web site or online application; advertisements directed to a consumer in response to the consumer's request for information, product, a service or feedback; or processing personal data solely to measure or report advertising performance, reach or frequency.”

Your right to opt out of the processing of your personal data for targeted advertising and how you can exercise it

You have the right to opt out of the processing of your personal data for targeted advertising. This means that whenever you ask us to stop processing your data for targeted advertising, we will abide by your request. To fully exercise your right to opt out you can contact us at any time, please see contact us using the details in section 16 of this notice.

Your privacy rights under the Utah Consumer Privacy Act and how to exercise them

You may exercise certain rights regarding your data processed by us. In particular, you have the right to do the following:

• access personal data. You have the right to request that we confirm whether or not we are processing your personal data. You also have the right to access such personal data.
• request the deletion of your personal data. You have the right to request that we delete any of your personal data.

• obtain a copy of your personal data. We will provide your personal data in a portable and usable format that allows you to transfer data easily to another entity - provided that this is technically feasible.
• opt out of the processing of your personal data for the purposes of targeted advertising or the sale of personal data.

To fully exercise your rights under CTDPA you can contact us at any time, using the details in section 16 of this notice.

How and when we are expected to handle your request

We will respond to your request without undue delay, but in all cases and at the latest within 45 days of its receipt. Should we need more time, we will explain to you the reasons why, and how much more time we need. In this regard, please note that we may take up to 90 days to fulfill your request.

Should we deny your request, we will explain to you the reasons behind our denial without undue delay, but in all cases and at the latest within 45 days of receipt of the request.

We do not charge a fee to respond to your request, for up to one request per year.

19. Further information for Users in Switzerland

This section applies to Users in Switzerland, and, for such Users, supersedes any other possibly divergent or conflicting information contained in the privacy policy.

For information on the categories of personal data we collect and the purpose of each category, please check sections 2 'Why we collect your personal information' and 4 'What information we collect and where from' of this notice.

Civo will collect the categories of personal data mentioned in section 4 of this privacy notice, directly from you, when you use our website, register for an event or enter into a contract with us.

Civo will retain your personal data as detailed in section 5 of this privacy notice.

Civo will share your personal data with the third parties listed in section 13 of this privacy notice.

The rights of Users according to the Swiss Federal Act on Data Protection:

Users may exercise certain rights regarding their Data within the limits of law, including the following

• right of access to personal data;
• right to object to the processing of their personal data (which also allows Users to demand that processing of personal data be restricted, personal data be deleted or destroyed, specific disclosures of personal data to third parties be prohibited);
• right to receive their personal data and have it transferred to another controller (data portability);
• right to ask for incorrect personal data to be corrected.

To fully exercise your rights under the Swiss Federal Act on Data Protection you can contact us at any time, using the details in section 16 of this notice.

20. Further information for Users outside of the UK, EU, US, and Switzerland

Civo recognises the importance of protecting personal data and respects the data protection laws that apply across various jurisdictions globally. This section outlines our commitment to comply with the data protection regulations that may be applicable for outside of the UK, EU, US and Switzerland.

Commitment to Global Data Protection Standards

Civo is dedicated to upholding the highest standards of data privacy and has implemented measures to ensure compliance with global data protection laws. We adhere to principles of transparency, accountability and individuals' rights concerning their personal information.

Civo is committed to follow the guidance and regulations set forth by the Data Protection Authorities applicable in your jurisdiction. Our practices are designed to meet the requirements of various international data protection laws.

While Civo operates on a global scale, it respects local laws and customs regarding data protection. Our policies and procedures are designed to be flexible and adaptable to meet the specific legal requirements of each country where we operate.

We want to assure you that Civo is continuously monitoring the legal developments in data protection around the world and updates its practices accordingly to remain compliant with new and evolving laws and standards.

For more information about our global data privacy approach, please contact us using the information in section 16.

21. Policy Review and Amendments

We keep this notice under regular review. This notice was last updated on 04/06/2024.

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.