Privacy Policy

APEX Analytix, LLC Privacy Policy

APEX Analytix, LLC (“APEX,” “we”, or “us”) is sensitive to your concerns about how we use the personal information we collect from you through our website, www.apexanalytix.com (the “Site”) and applications, APIs, or services exchanging information with APEX, including but not limited to apexESG, smartvm, Cyber Risk, AuditView, and any other services sold by APEX or its authorized resellers (“Services”). The Site and Services are sometimes collectively referred to as “Online Services”.

This Privacy Policy is specific to APEX and its headquarters located in the United States and covers APEX’s treatment of the Personal Information (defined below) we collect when you access and use the Online Services (visitors may also be referred to as “you” or “your”). It also governs your visit to the Site and describes the choices available regarding our use of your Personal Information and how you can access and update this information. We are committed to ensuring that the information we collect and use is appropriate for this purpose and does not constitute an invasion of your privacy.

By using the Online Services, you accept all of the terms of this Privacy Policy. If you do not agree with any terms of this Privacy Policy, do not use the Site or submit any Personal Information through any of our Services.

If you have questions or concerns about the Privacy Policy, please contact us at privacy@apexanalytix.com.
For purposes of data protection laws, APEX Analytix, LLC, 1501 Highwoods Blvd., Suite 200, Greensboro, North Carolina 27410, is the entity responsible for your information.

What Information Do We Collect? Information You Provide to Us

“Personal Information” (also referred to as “Personal Data”) means any information relating to an identified or identifiable natural person (“Data Subject”); an identifiable natural person can be identified, directly or indirectly, particularly by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

APEX does not collect Personal Information unless you voluntarily provide it to us, and you may be required to provide us with Personal Information to access and use some of our Services. We collect Personal Information from you when you choose to interact with us. You can provide such information by completing inquiry and/or registration forms or by writing or emailing us. The type of Personal Information collected through our Online Services varies but may include, among other things, your name, address, phone number, company affiliation, and e-mail address.

Information We Collect Automatically

As you interact with the Online Services, we may also collect information automatically about your visit to our Site and/or use of the Services. This information is not Personal Information, but it may disclose aspects of your browsing history or certain information about you, such as an Internet Protocol (“IP”) address and publicly available information (collectively, the “Non-Personal Data”). Non- Personal Data is only used in aggregate form.

Information from Other Sources

We may collect information about you from third parties, such as resellers, marketing partners, customers, and researchers. Our resellers may provide information about you, such as your contact data, to facilitate contracting through our Online Services. We may combine this information with information we collect from you and use it as described in this Privacy Policy.

How Do We Use the Information We Collect?

We use the information we collect from the Online Services, including Personal Information, to:

• provide you with the Online Services;
• contact you when necessary, such as to provide answers to your questions or provide support;
• provide personalized service, such as by answering your emails or online requests;
• deliver and conduct surveys or evaluations;
• analyze and improve the Online Services or any other products and services we provide;
• provide information or materials regarding the Online Services;
• extend invitations to marketing events;
• register for a webcast or other event;
• provide access to content and news from APEX from time to time;
• consider your application for employment with APEX;
• analyze the behavior, habits, and preferences of persons who contact or interact with us to improve our service offerings; comply with our legal obligations or as permitted by law;
• protect the safety and/or integrity of our users, employees, third parties, members of the public, and/or the Online Services; and prevent fraud and enforce our legal terms.

We also use Non-Personal Data for various purposes, including helping diagnose problems with our server(s), building marketing profiles, aiding strategic development, administering and auditing usage of the Online Services, and improving their usability.

We may combine the information we collect from you through the Online Service with information obtained from other sources. We may also aggregate and/or de-identify information collected through the Online Services. De-identified or aggregated data may be used for any purpose, including, but not limited to, research and marketing purposes.

How Do We Disclose the Information We Receive?

Except as disclosed here, we do not rent, sell, or disclose your Personal Information to third parties. We disclose Personal Information as follows:

Third Parties, including Third Party Marketing

Unless specifically authorized by you, we do not provide Personal Information to third parties for marketing purposes. If we use a third-party service provider to provide any of the processing of Personal Data set forth herein, any third parties that we may share your data with are obliged to keep your details securely and to use them only to fulfill the Service they provide you on our behalf. When they no longer need your data to provide this service, they will dispose of the details in line with our procedures and applicable law. If you express interest in a third-party offer or purchase a package that includes a third-party offer, we may provide your Personal Information to that third party solely in connection with the offer you have selected.

Required by Law

We reserve the right to disclose your Personal Information as required by law, such as in response to lawful requests by public authorities, including law enforcement agencies, or if we are required to do so by law under regulation, a subpoena, court order, or by a government entity, including any requirement to meet national security requirements, or similar legal process, and when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, investigate fraud, or respond to a legal request. In these circumstances, we may also share your Personal Information with our professional advisors.

Other Transfers

We may disclose Personal Information and other data to businesses controlling, controlled by, or under common control with us. If we are merged, acquired, or sold, or if some or all of our assets or equity are transferred, we may disclose or transfer Personal Information and other data in connection with the associated transactions.

Bankruptcy

In the event of an APEX bankruptcy, insolvency, reorganization, receivership, or assignment for the benefit of creditors, or applying laws or equitable principles affecting creditors’ rights generally, we may not be able to control how your personal information is treated, transferred, or used. If such an event occurs, your Personal Information may be treated like any other APEX asset and sold, transferred, or disclosed to third parties in accordance with applicable law or used in ways not contemplated or permitted under this Privacy Policy. In this case, you will be notified via email and/or a prominent notice on our Site and in our Legal Center of any change in ownership or uses of your personal information, and any choices you may have regarding your personal information.

Consent

In addition to the disclosures described in this Privacy Policy, we may disclose information about you whenever you consent to or direct such disclosure.

Uploading Content

You are solely responsible for the Personal Information and other content you post on or through the Online Services. You warrant that you have permission to upload any third-party information, and you agree to indemnify, defend, and hold harmless APEX and its affiliates, owners, directors, and personnel from and against any claim, liability, cost, and expense arising in connection with your provision of that information.

Do Not Track Requests; Third-Party Tracking (applicable to the Site)

We cannot presently omit you from usage analytics to the extent your browser only sends us a “do not track” message and does not otherwise screen you from tracking without any action on our part. Third parties, other than our vendors (such as our website analytics provider), do not have authorization from us to track which websites you visited before and after visiting the Site. That said, we cannot control third-party tracking, and some third-party tracking may occur without our knowledge or consent.

Use of Cookies and Third-Party Websites

We may maintain links to other websites and other websites may maintain links to the Online Services. This Privacy Policy applies only to the Site and not to other websites accessible from us or that you use to access our Online Services, each of which may have privacy policies materially different from this Privacy Policy. If you visit other websites, we are not responsible for the privacy practices or content of those sites. You are responsible for reviewing non-APEX website privacy policies to confirm that you understand and agree with them.

We may use cookies and certain visit recognition software services, such as Google Analytics and LeadLander, to improve the functionality of our Site and build a demographic profile. A cookie is a small piece of information sent by a web server to a web browser, enabling the server to collect information from the browser. You can configure your browser to reject cookies by modifying your browser settings, but if your browser settings do not accept cookies from us, then some Site functions may not operate as intended. Please be aware that the information sent by your browser as part of a web page request, including cookies and your IP address, may be collected through Google Analytics. In that case, Google will also receive this information, and Google’s privacy policy governs its use.

Your Options (under the laws of the EU, EEA, UK and Switzerland)

Under the laws of certain countries, you may have certain rights and choices regarding the Personal Information we collect and maintain about you, and how we communicate with you.

If you are a resident of the European Union (“EU”), the European Economic Area (“EEA”), the United Kingdom (“UK”), or Switzerland, you can request the following information regarding the Personal Information we store about you and how it is processed:

• Identity and the contact details of the person or organization that has determined how and why to process your data. (In some cases, this will be a representative located in the EU).
• Contact details of the data protection officer, where applicable.
• The purpose of the processing and the legal basis for processing.
• If the processing is based on the legitimate interests of APEX or a third party, information about those interests.
• The categories of Personal Data collected, stored, and processed.
• Recipient(s) or categories of recipients to whom the data is/will be disclosed

If we intend to transfer Personal Data to a third country or international organization, we must ensure this is done securely. The EU has approved sending Personal Data to some countries because they meet a minimum standard of data protection. In other cases, we will ensure specific measures are in place to secure your information. To this end, we need certain information to transfer the Personal Data:

• How long will the data be stored?
• Details of your rights to access, correct, erase, restrict, or object to such processing.
• Information about your right to withdraw consent at any time.
• How to lodge a complaint with the supervisory authority.
• Whether the provision of Personal Data is a statutory or contractual requirement or a requirement necessary to enter into a contract, as well as whether you are obliged to provide the Personal Data and the possible consequences of failing to provide such data.
• The source of Personal Data, if it was not collected directly from you.

Any details on automated decision-making, meaningful information about the logic involved, and the significance and expected consequences of such processing may be requested by the Data Subject. To make such a request, please contact us as described in this Privacy Policy’s “Contact Us” section.

We will implement the requested changes as soon as possible, subject to reasonable limitations, such as the need to verify your identity. When you edit or change your preferences, the data you remove may remain in our databases or backup media because it is impossible to completely remove or delete data from these locations.

You have the right to decline to share certain Personal Information with us, but we may not be able to provide you with some of the features and functionality of the Online Services.

You can also opt out of receiving future promotional communications and marketing from us. You may receive periodic email newsletters from us. These newsletters contain information on new features and facilities of note at the Site and within the Online Services. You can opt out of receiving such mailings. The registration forms allow you to tick a box if you do not wish to receive information about our services. If you receive electronic notifications from us through an email list, each message will include instructions on how to unsubscribe from that list. Your choice not to receive future promotional and marketing material will not prevent us from corresponding with you, by email or otherwise, regarding your existing or past business relationships with us.

Data Retention

We will process Personal Data for the period considered strictly necessary to provide the Services and to comply with applicable law. We will endeavor to keep your information accurate and up to date and not keep it longer than necessary. At a minimum, we will retain your information for as long as needed to provide you with the Services and as required to comply with our legal obligations, resolve disputes, and enforce our agreements. Therefore, we may maintain some or all of this data in our archives even

after removing it from the Online Services. Personal Data processed to provide the Services may be stored for a longer period to enable any disputes concerning the provision of the Service to be handled. We will keep Personal Data processed for marketing purposes from the point at which the data subject provides his/her consent until this consent is revoked or we no longer deem the data to be accurate and up to date, whichever is earlier. Personal Data processed with a job application will only be retained for a year after the position is filled or until the data subject revokes his/her consent, whichever is earlier. If consent is revoked, the Personal Data may no longer be processed for the purposes. However, they may still be stored to comply with local regulations and provisions that the local Data Protection Authority may establish from time to time.

Data Security

To prevent unauthorized access, maintain data accuracy, and ensure the correct use of information, we have put physical, electronic, and managerial procedures in place to safeguard the information we collect. We strive to ensure our servers and connections (to our servers) incorporate industry-standard encryption and security devices. The Internet, however, cannot be guaranteed to be completely secure; therefore, we cannot warrant the security of any Personal Information you provide. Accordingly, you provide this information at your own risk. WE DISCLAIM LIABILITY FOR THE THEFT, LOSS, OR INTERCEPTION OF OR UNAUTHORIZED ACCESS OR DAMAGE TO YOUR DATA OR COMMUNICATIONS BY USING THE SITE AND/OR OUR ONLINE SERVICES. YOU ACKNOWLEDGE THAT YOU UNDERSTAND AND ASSUME THESE RISKS.

IF YOU BELIEVE YOUR PRIVACY HAS BEEN BREACHED THROUGH THE USE OF OUR WEBSITE OR ONLINE SERVICES, PLEASE CONTACT US IMMEDIATELY AT privacy@apexanalytix.com.

Legal Basis for Use of Your Information

Our legal grounds for processing your information are as follows:

To honor our contractual commitments to you: most of our processing of Personal Data is to meet our contractual obligations to our users. For example, we handle Personal Data on this basis to allow you to sign up for our Online Services.

Consent: Where required by law, and in some other cases, we handle Personal Data based on your implied or express consent, including your consent to the processing of your Personal Data according to this Privacy Policy.

Legitimate interests: In many cases, we handle Personal Data on the basis that it furthers our legitimate interests in commercial activities in ways that are not overridden by the interests or fundamental rights and freedoms of the affected individuals. This includes operating our business and the Online Services; providing security for our websites, products, software, or applications; marketing; receiving payments; preventing fraud; and knowing the customers we provide the Online Services to.

Legal compliance: We must use and disclose Personal Data in certain ways to comply with our legal obligations (such as disclosing data to tax authorities).

We will not use your Personal Information in a manner inconsistent with the purpose of its original collection unless you have provided your consent.

Data Subject Rights

Residents of the European Economic Area (“EEA”), Switzerland, and the UK can exercise certain data subject rights under applicable data protection laws. Where such rights apply, we will comply with requests to exercise these rights under applicable law. Please note, however, that certain information may be exempt from such requests in some circumstances, including if we need to keep processing your information for our legitimate interests or to comply with a legal obligation. If these rights apply to you, they may permit you to request that we:

• provide access to and/or a copy of certain information we hold about you
• prevent the processing of your information for direct marketing purposes (including any direct marketing processing based on profiling)
• update information that is out of date or incorrect
• delete certain information that we are holding about you
• restrict the way that we process and disclose certain of your information transfer your information to a third-party provider of services
• revoke your consent for the processing of your information

For more information on exercising these rights, please contact us using the information in the “Contact Us” section below. If applicable, you may file a complaint with the data protection supervisory authority in the country where you are based. Alternatively, you may seek a remedy through local courts if you believe your rights have been breached.

International Data Transfers

Due to the nature of the Internet, if you visit the Site or use Online Services from a country other than the United States, your communications will inevitably transfer information across international boundaries. If you are located outside of the United States, please be advised that any information you provide to us will be transferred to the United States and that by browsing the Site and submitting information to the Site or using the Online Services, you explicitly authorize its transfer. Information submitted to us will be transferred to, processed, and stored in the United States or, for certain customers, the European Union or the United Kingdom. If you post or transfer any information to or through the Online Services, you are agreeing to such information, including Personal Information, being hosted and accessed in the United States, the European Union, and the United Kingdom. Please note that the privacy laws of the United States, the European Union, and the United Kingdom may differ from those where you are a resident.

We adhere and comply with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the UK Extension to the EU-U.S. Data Privacy Framework (“UK Extension to the EU-U.S. DPF”), and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”), respectively developed by the U.S. Department of Commerce and the European Commission, the UK Government, and the Swiss Federal Administration to provide U.S. organizations with reliable mechanisms of Personal Data transfers to the United States from the European Union / European Economic Area, the United Kingdom (and Gibraltar), and Switzerland, while ensuring data protection that is consistent with EU, UK and Swiss law. Please see the Data Privacy Framework (DPF) Program section below for additional details. Where required, we will use appropriate safeguards for transferring data outside the EEA, Switzerland, and the UK. This may include signing Standard Contractual Clauses that govern the transfers of such data, which may be used with additional safeguards. For more information about these transfer mechanisms, please contact us as detailed in the “Contact Us” section below.

Data Privacy Framework (DPF) Program

We comply with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. DPF. We have submitted our self- certification to the U.S. Department of Commerce that we adhere to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) concerning the processing of Personal Data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. We have submitted our self-certification to the U.S. Department of Commerce that we adhere to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”) regarding the processing of Personal Data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the DPF program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

APEX and its U.S. subsidiary APEX Analytix HK Holding Corporation adhere to the EU-U.S. DPF Principles regarding Personal Data transferred from the European Union and the United Kingdom and the Swiss-U.S. DPF Principles regarding Personal Data transferred from Switzerland. As described above, we rely on the direct collection of personal information from individuals located outside of the U.S., or we use another basis, such as Standard Contractual Clauses, for cross-border transfers of personal information from the EU member countries and the United Kingdom and from Switzerland to the U.S. We are committed to being subject to the DPF Principles regarding all Personal Data received from the EU, the United Kingdom (and Gibraltar), and Switzerland in reliance on the EU-U.S. DPF. We are subject to the investigatory and enforcement powers of the Federal Trade Commission (“FTC”). We may also incur liability in cases of onward transfers to third parties.

Supplemental Privacy Notice for California Residents

This Supplemental Privacy Notice supplements the information in our Privacy Policy above and, except as provided herein, applies solely to California residents. It applies to personal information we collect on or through the Online Services and through other means (such as information collected offline, in person, and over the telephone). It does not apply to the personal information we collect from our employees and job applicants in their capacity as employees and job applicants. It also does not apply to personal information we process as a service provider.

According to Section 1798.83 of the California Civil Code, residents of California have the right to request from a business with whom the California resident has an established business relationship certain information concerning the types of personal information the business shares with third parties for direct marketing purposes by such third party and the identities of the third parties with whom the business has shared such information in the immediately preceding calendar year. To access this information, please contact us as described in this Privacy Policy’s “Contact Us” section.

Summary of Information We Collect
If you are a California resident, California law requires us to provide you with some additional information regarding how we collect, use, and disclose your “personal information” and “sensitive personal information” (as defined in the California Consumer Privacy Act (“CCPA”)).

Throughout our Privacy Policy, we describe the specific pieces of personal information and sensitive personal information we collect, the sources of that information, and how we disclose it. Under the CCPA, we also have to provide you with the “categories” of personal information we collect and disclose for “business purposes” (as those terms are defined by applicable law). Those categories include identifiers (such as name, address, email address, phone number, other account information, and cookies); commercial information (such as transaction data); internet or other network or device activity (such as IP address or service usage); geolocation information (general location); professional or employment-related data; other information that identifies or can be reasonably associated with you. The categories of sensitive personal information are account log-in and password or other credentials allowing access to your account.

We collect the categories of personal information identified above from the following sources: (1) directly from you; (2) through your use of the Online Services; (3) affiliates; and (4) third parties such as our resellers and service providers.

We or our service providers may collect and disclose the above categories of information for the purposes described in our Privacy Policy. This includes the following business or commercial purposes (as those terms are defined in applicable law):

• Our or our service provider’s operational purposes;
• consumer interactions on our site;
• Detecting, protecting against, and prosecuting security incidents and fraudulent or illegal activity;
• Bug detection and error reporting;
• Customizing content that we or our service providers display on the Online Services;
• Providing Online Services (e.g., account servicing and maintenance); and
• Improving the Online Services and developing new services (e.g., by researching to develop new products or features);

Other uses about which we notify you

We may also use the above categories of personal information to comply with applicable laws and regulations. We may combine the information we collect (“aggregate”) or remove pieces of information (“de-identify”) to limit or prevent the identification of any particular user or device.

We may disclose certain categories of personal information with third parties (as defined by the CCPA) for the business purposes

described above. For example, we may disclose identifiers and other information that identifies or can reasonably be associated with you with counterparties to your agreements. We may disclose identifiers with our marketing partners, and we may also disclose any of the categories described above with our subsidiaries and affiliates. If you connect your account with social media services or interact with social media plugins or links on the Online Service, we may disclose identifiers, commercial information, internet or other network or device activity, or general location with those social media services.

Consumer Rights

If you are a California resident, you may have certain rights. California law may permit you to request that we:

• Provide you the categories of personal information we have collected or disclosed about you; the categories of sources of such information; the business or commercial purpose for “collecting,” “selling,” or “sharing” your personal information; the categories of third parties to whom we disclose or “sell,” or with whom we “share,” personal information; and the categories of personal information we “sell.”
• Provide access to and/or a copy of certain information we hold about you.
• Delete certain information we have about you.
• Correct inaccurate personal information that we maintain about you.

You may have the right to receive information about the financial incentives we offer you (if any). You also have the right not to be discriminated against for exercising your rights. Certain information may be exempt from such requests under applicable law. We need certain types of information to provide the Online Services to you. If you ask us to delete it, you may no longer be able to access or use the Online Services.

“Sale” of Personal Information
California residents may opt out of the “sale” of their personal information. The CCPA broadly defines “sale” in a way that may include allowing third parties to receive certain information, such as cookie identifiers, IP addresses, and/or browsing behavior, to add to a profile about your device, browser, or you.

Depending on how you use the Service, we may disclose the following categories of information for such interest-based advertising, which may be considered a “sale” as defined by the CCPA: identifiers (such as IP address, device identifiers, and cookies) and internet and device activity. To opt out of such “sales,” please submit a request to privacy@apexanalytix.com.

“Sharing” of Personal Information

California residents may opt out of the “sharing” of their personal information. The CCPA defines “sharing” as the targeting of advertising to a consumer based on that consumer’s personal information obtained from the consumer’s activity across websites.

Children Under 18

The Online Services are not intended for children under the age of 18. We do not knowingly solicit or collect Personal Information from children. If you are under 18, please do not submit your e-mail address or any other personal information to us through the Site or any Online Services. If you are a parent or guardian and believe we may have collected information about your child, please contact us as described in this Privacy Policy’s “Contact Us” section.

Sensitive Personal Information

The CCPA also allows you to limit the use or disclosure of your “sensitive personal information” (as defined in the CCPA) if your sensitive personal information is used for certain purposes. Please note that we do not use or disclose sensitive personal information other than for purposes for which you cannot opt-out under the CCPA.

Retention of Your Personal Information:

Please see the “Data Retention” section above.

Children’s Privacy

The Online Services are not directed to children under the age of 13. We do not knowingly collect personal information (as that term is defined in the Children’s Online Privacy Protection Act (COPPA)) from children under 13. If we discover that an individual under 13 has provided us with personal information, we will delete the personal information as required by COPPA.

We do not knowingly process data of EU residents under 16 without parental consent. If we become aware that we have collected data from an EU resident under 16 without parental consent, we will take reasonable steps to delete it as soon as possible.

Changes to this Policy

We reserve the right to change or replace this Privacy Policy at our sole discretion. All revisions will be posted to the Legal Center and become effective when the modified policy is posted. If you disagree with being bound by those changes, you should not use the Online Services any further after publication. Your continued use of the Online Services after posting changes to our Privacy Policy means you accept the changes.

Contact Us

We welcome your questions and comments about our Privacy Policy. We want to know if you are or have become aware of a known or suspected privacy or security breach or for purposes of any of the other requests or inquiries outlined in this Privacy Policy.

You may also seek recourse through an independent dispute resolution body designated to address complaints free of charge, including, where applicable, the panel established by the EU Data Protection Authorities and, as applicable, the UK Information Commissioner’s Office (“ICO”) (and the Gibraltar Regulatory Authority (“GRA”)), the Swiss Federal Data Protection and Information Commissioner (“FDPIC”). You may also invoke binding arbitration under certain conditions.

To contact APEX regarding its Privacy Policy, please use the Contact Us link provided or write to us at: Attention: Data Privacy Officer
APEX Analytix, LLC
1501 Highwoods Blvd., Suite 200

Greensboro, North Carolina 27410 United States

privacy@apexanalytix.com