Personal Data means any information that may be used to identify you, such as your name, title, phone number, email address, or mailing address. Personal Data also includes the following types of information:

• Your business email address if you want to subscribe to a periodic communication such as a newsletter;
• Additional Personal Data, such as name, company name, address, phone number, and email address, for additional activities on our site that may require you to be registered (e.g., to read a white paper, download trial or free software, when you express an interest in obtaining additional information about the Services, or register for an event);
• Your billing information, such as billing name and address and credit card number, when purchasing Services or registering for an event; and
• Any other information you submit to Sibme through the Services or information provided to you by Sibme through your use of the Services (e.g., license key).

These specified types of information are referred to collectively as "Personal Data".

This Privacy Policy covers Sibme's information practices, including, to the extent applicable, addressing data subjects (which includes both individuals and households) whose Personal Data we:

• receive from our customers in our Services as well as in the course of providing consulting services and customer support services;
• receive directly through websites that link to this Privacy Policy and are managed and controlled by Sibme (collectively referred to as the "Websites");
• receive from our business partners;
• receive from individuals for event, webinar, and other registrations; or
• process to promote our Services.

Human Resources Personal Data. This Privacy Policy does not apply to the Personal Data of employees, job applicants (including Personal Data considered to be Applicant Information), contractors, business owners, directors, officers, and staff of Sibme.

Personal Data We Process as a "Processor". In some of the cases where we receive Personal Data from our customers in our Services, we do not decide why or how that Personal Data will be processed. To this end, if not stated otherwise in this Privacy Policy or in a separate disclosure, we process such Personal Data in the role of a mere processor on behalf of a customer (and/or its affiliates) who is the responsible controller of the Personal Data concerned. We are not responsible for and have no control over the privacy and data security practices of our customers, which may differ from those set forth in this Privacy Policy. We will only access Personal Data to provide the Services that our customer has directed us to provide, or if we are required to do so by law.

When you give your Personal Data to one of our customers or when we collect your Personal Data on their behalf, our customer's privacy policy, rather than this Privacy Policy, will apply to our processing of your Personal Data. If your Personal Data has been submitted to us by or on behalf of a Sibme customer and you wish to exercise any rights you may have under applicable data protection laws, please inquire with the applicable customer directly. Because we may only access a customer's Personal Data upon instruction from that customer, if you wish to make your request directly to us, please provide to us the name of the Sibme customer who submitted your Personal Data to us. We will refer your request to that customer, and we will support them as needed in responding to your request within a reasonable timeframe.

Information Which Does Not Constitute Personal Data. If we do not maintain information in a manner that identifies, relates to, describes, is reasonably capable of being associated with, or could be reasonably linked, directly or indirectly, with a particular individual or household, such information is not considered Personal Data and this Privacy Policy will not apply to our processing of that information. Such information includes anonymous, aggregate statistics from web traffic to our Websites that we collect and analyze through web analytics software in order to understand our customers' and visitors' needs and to continually improve our Websites for them.

In the context of this Privacy Policy, we act either as a data controller or data processor for the Personal Data we process, depending on our relationship with you and with our customers. For example, we act as a data controller when we process your Personal Data when you contact us through our Websites or if we call you at your request. On the other hand, we generally act as a data processor in connection with the Services we provide to our customers.

We collect information to provide better Services to all of our users. We collect information in the following ways (collectively, "Data").

• Information you give us when you use the Site; request information regarding our Services, access promotional materials published by Sibme; or participate in other activities on Sibme's Site. Sibme collects minimal personal information to provide its Services. The only information required to create an account are your email address, user ID and password. Sibme may collect personal information such as your phone number and mailing address for certain optional functionality. Personal Information means any information that may be used to identify you, such as, your name, title, phone number, email address, or mailing address. The personal information we collect may include name, physical address, telephone number, email address and other personal information that you choose to provide to us in exchange for certain optional functionality.
• Information we get from your use of our Services. We collect information about Sibme Services that you use and how you use them. Sibme collects your personal information to provide certain Services to you, for authorized educational/school purposes, or as authorized by the parent/student, the teacher or the educational institution/agency. This information includes:
• Device information — We collect device-specific information (such as your hardware model, operating system version, unique device identifiers, and mobile network information including phone number).
• Log information — When you use our Services or view content provided by Sibme, we automatically collect and store certain information in server logs. This includes:
• Internet Protocol (IP) address.
• Device event information such as crashes, system activity, hardware settings, browser type, browser language, the date and time of your request and referral URL.
• Cookies that may uniquely identify your browser or your Sibme account.
• Location information — When you use Sibme Services, we may collect and process information about your actual location using your IP address because it helps us to improve performance.
• Unique application numbers — Certain Sibme Services include a unique application number. This number and information about your installation (for example, the operating system type) may be sent to Sibme when you install or uninstall that Service or when that Service periodically contacts our servers, such as for automatic updates.
• Cookies and other tracking technologies — We use various technologies to collect and store information when you use a Sibme Service, and this may include using cookies or other tracking technologies (including web beacons, email pixels and script-based trackers) to identify your browser or device ("Website Navigational Information"). Website Navigational Information allow web applications to respond to you as an individual.
• We may use traffic log cookies to identify which pages are being used. This helps us analyze data about web page traffic and improve our website in order to tailor it to customer needs.
• Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.
• You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.
• Hashed identifiers — We collect hashed identifiers derived from email addresses for the purposes of cross-device tracking for targeted advertising. Hashing is a process that pseudonymizes (i.e. digitally scrambles) information, such as email addresses. For example, when legal@sibme.com is run through a typical hashing function, it becomes the following string of characters: $2y$12$3ebUq9.w6JrQhdbTaVOXt.WOPvDjhJihGvLQjJahV.VyxwjpgQssC. We take this step to de-identify data and protect email addresses, while being able to use the unique identifier created for the purpose of targeting ads to you across different electronic devices and browsers. We do not send targeting ads to users who access the Sibme SaaS application (i.e. our product).
• Other functionality — The Site also provides functionality that permits you to enter information relating to third parties ("Third Party Information"). Third Party Information is treated the same way that we treat your personal information unless such Third-Party Information relates to children under the age of 13 years old. Please see section 5 below to understand which information we collect in such circumstances.

We will process your Data only if it is legally permitted to do so, and more specifically in the circumstances described below.

Providing our Site and Services. Sibme uses Data about Sibme's customers to perform the Services requested and fulfill its obligations under applicable terms of use/service and for the use of its website; where you have not entered into a contract with Sibme, we process your Data to operate and administer our Site and to provide you with the content you access and request. For example, to download content from our Site or if you fill out one of our web forms, Sibme will use the information provided to contact you about your interest in the Services.

Managing user registrations. If you have registered for an account with us, we process your Data by managing your user account for the purpose of performing our contract with you according to applicable terms of service.

Promoting the security of our Site and Services. Sibme processes your Data by tracking use of its Site and Services, creating aggregated, non-personal data, verifying accounts and activity, investigating suspicious activity and enforcing our terms and policies to promote the safety and security of the Services, systems and applications and to protect our rights and the rights of others. For example, we may check for license compliance validation using your user/login ID or other account details.

Developing and improving our Site and Services. We process your Data to analyze trends and to track your usage of and interactions with our Site and Services to develop and improve our Site and Services and provide our users with more relevant content and service offerings.

Handling contact and user support requests. If you fill out one of our web forms or request user support, or if you contact us by other means including via a phone call, we process your Data to perform our contract with you, fulfill your requests and communicate with you.

Reviewing compliance with applicable usage terms. We process your Data to review compliance with the applicable usage terms in our customer's contract and to ensure adherence to the relevant terms.

Assessing and improving user experience. Sibme processes device and usage data as described in Section 1 above, which in some cases may be associated with your Data, in order to analyze trends, assess and improve the overall user experience and Service offering. In addition, Sibme uses Website Navigational Information to operate and improve the Site. Sibme may also use Website Navigational Information alone or in combination with Data about customers and Data about webinar attendees to provide personalized information about Sibme. For additional information about the use of Website Navigational Information, please see Section 1 above.

Managing event registrations and attendance. Sibme also uses Data about webinars attendees to plan and host corporate events, host online forums and social networks in which you have registered or that you may participate, including sending related communications to you, to perform our contract with you. Additional information on Sibme's privacy practices with respect to Data about webinars attendees may be found in additional privacy statements on the event websites, as the case may be. Sibme may also use Data about customers and webinar attendees for marketing purposes. For example, Sibme may use information you provide to contact you to further discuss your interest in the Services and to send you information about Sibme product recommendations related to our contract with you or your interest. Sibme may also receive information about customers and attendees from other sources, including third parties from whom we have purchased data, and combine this information with Data we already have about you.

Managing contests or promotions. If you register for a contest or promotion, we process your Data to perform our contract with you. Some contests or promotions have additional rules containing information about how we will process your Data.

Assessing capacity requirements. Sibme processes your Data to assess and ensure that it is meeting the capacity requirements of its Services.

Identifying customer opportunities. Sibme processes your Data to assess potential new opportunities with customers to ensure that it is meeting the demands of its customers and their users' experiences.

Displaying personalized advertisements and content. We process your Data to conduct marketing research, advertise to you, provide personalized information about us on and off our websites and to provide other personalized content based upon your activities and interests. To the extent your consent is required, and you have provided your prior consent, such consent can be withdrawn by you at any time without having to provide any specific reason for such withdrawal.

Sending marketing communications. We will process your Data to send you marketing information, product recommendations and other non-transactional communications (e.g., marketing newsletters, telemarketing calls, SMS, or push notifications) about us and our partners, including information about our products, promotions, or events. To the extent your consent is required, and you have provided your prior consent, such consent can be withdrawn by you at any time without having to provide any specific reason for such withdrawal.

Managing payments. If you have provided financial information to us, Sibme processes your Data to verify that information and to collect payments to the extent that doing so is necessary to complete the transaction and perform our contract with you.

Complying with legal obligations. We process your Data when cooperating with public and government authorities, courts or regulators in accordance with our legal obligations under applicable laws to the extent this requires the processing or disclosure of Data or is necessary to protect against misuse or abuse of our websites, to protect personal property or safety, to pursue remedies available to us and limit our damages, to comply with judicial proceedings, court orders or legal processes or to respond to lawful requests.

Except as noted in this Privacy Policy, Sibme will not sell or rent your personal information to third parties outside Sibme without your permission. Note that subscribers that have super administrative (i.e. Sibme administrative) rights can access all of the data for that account. Parties with whom we may share your information:

Business Partners. From time to time, Sibme may partner with other companies to jointly offer products, services (such as technical and customer support) or programs (such as webinars or downloadable content) such as our channel partners to fulfill product trials and information requests and provide customers and prospective customers with information about Sibme and its products. To do this, we may pass your information to them to the extent necessary for that purpose only, and they are prohibited from using that information for any other purpose. Sibme does not share your Data with business partners for purpose of webinars or events, unless: (1) you specifically opt in to such sharing, such as via an event registration form; or (2) you attend a joint event by Sibme and its business partner(s) and allow Sibme or its business partner(s) to scan your attendee badge. If you do not wish for your information to be shared in this manner, you may choose not to opt in and choose not to have your badge scanned at Sibme events. If you choose to share your information with business partners in the manners described above, your information will be subject to the business partners' respective privacy statements. Sibme sometimes hires vendor companies to provide limited services on our behalf, including packaging, mailing and delivering items, sending postal mail, providing technical support, and processing event registrations. We provide those companies only the information they need to deliver the service, and they are prohibited from using that information for any other purpose. Our Business Partners will be given access to your information as is reasonably necessary to provide the Service under reasonable confidentiality terms and are obligated to implement these same commitments to which Sibme is committing itself. Your Request. We may share certain information pursuant to a request made by you. On occasion when Sibme transfers personal information to one of those third parties for purposes of responding to a request from you, that third party may need to furnish the information to an unaffiliated party for further assistance. BY USING THE SIBME SITE AND PROVIDING US WITH YOUR PERSONAL DATA, YOU CONSENT TO THIS TRANSFER OF YOUR PERSONAL DATA TO SUCH THIRD PARTY TO SUPPORT THE AUTHORIZED EDUCATIONAL/SCHOOL PURPOSES OR AS AUTHORIZED BY THE PARENT/STUDENT.

Compelled Disclosure. Sibme may also disclose your personal information if required to do so by law or, to the extent permitted by applicable law, as necessary in connection with a sale, merger, transfer, exchange or other disposition (whether of assets, stock or otherwise) of all or a portion of a business of Sibme and/or its subsidiaries or to (1) conform to legal requirements or comply with legal process served on Sibme or this Site; (2) protect and defend the rights or property of Sibme and this Site; (3) enforce its agreements with you, or (4) act in urgent circumstances to protect personal safety or the public. In individual instances, Sibme may also share with professional advisers acting as processors or joint controllers including lawyers, bankers, auditors and insurers based in countries in which we operate who provide consultancy, banking, legal, insurance and accounting services, and to the extent we are legally obliged to share or have a legitimate interest in sharing your Data.

Third Parties. Sections 5 and 8 of this Privacy Policy specifically addresses the information we or third parties collect through cookies and other tracking technologies, and how you can control tracking through your web browser. We may also disclose your personal information to any third party with your prior consent. Note that Sibme will not use or disclose the information collected for behavioral targeting of advertisements to students.

Service Providers. Sibme may share Data about Sibme Site visitors, customers, and webinar attendees with Sibme's contracted service providers so that these service providers can provide services on our behalf. These service providers are authorized to use your personal information only as necessary to provide the requested services to us. Without limiting the foregoing, Sibme may also share Data about Sibme Site visitors, customers, and webinar attendees with Sibme's service providers to ensure the quality of information provided, and with third-party social networking and media websites, such as Facebook, for marketing and advertising on those websites. Unless described in this Privacy Policy and with your consent, Sibme does not share, sell, rent, or trade any information with third parties for their promotional purposes.

Billing. Sibme uses a third-party service provider to manage credit card processing. This service provider is not permitted to store, retain, or use billing information except for the sole purpose of credit card processing on Sibme's behalf.

Merger or Acquisition. In addition, if Sibme sell or otherwise transfer part or the whole of Sibme or our assets to another organization (for example, in the course of a transaction like a sale, merger, acquisition, bankruptcy, dissolution, liquidation), your information such as name and email address and any other information collected through the Service may be among the items sold or transferred. The buyer or transferee will have to honor the commitments we have made in this Privacy Policy.

Any Data or other information you choose to submit in communities, forums, blogs or chat rooms on our Site may be read, collected and used by others who visit these forums, depending on your account settings.

A "cookie" is a small file stored on your device that contains information about your device. We may use cookies and other commonly used information-gathering tools such as Web beacons to provide basic relevant ads, website functionality, authentication (session management), usage analytics (web analytics), and to remember your settings, and generally improve our Websites and Services.

Sibme or its Service Providers may retain information (including your profile information) collected for the time period required to support the authorized educational/school purposes, or as authorized by the parent/student. After the termination or deactivation of your account, Sibme may retain your information for a commercially reasonable time for audit purposes or as required by applicable law. We determine the appropriate retention period for the Personal Data on the basis of the amount, nature and sensitivity of your Personal Data processed, the potential risk of harm from unauthorized use or disclosure of your Personal Data and whether we can achieve the purposes of the processing through other means, as well as on the basis of applicable legal requirements (such as applicable statutes of limitation).

When you decide to delete certain information in your account, we will fulfill your request and update this information on our platform. We will also notify third parties that we have authorized to use that information of your request. Note that Sibme will permanently delete student personal information after the termination or deactivation of your account. Account data, when deleted, cannot be recovered.

Sibme complies with the Children's Online Privacy Protection Act. As such, Sibme does not knowingly collect and retain personal identifying information from persons under the age of 13 and has safeguards in place to attempt to ensure it does not inadvertently collect and retain such information. SIBME STRONGLY URGES CHILDREN TO CHECK WITH THEIR PARENTS BEFORE ENTERING INFORMATION ON THE SIBME SITE, AND IT URGES PARENTS TO DISCUSS WITH THEIR CHILDREN RESTRICTIONS CONCERNING THE ONLINE RELEASE OF PERSONAL IDENTIFYING INFORMATION TO ANYONE THEY DO NOT KNOW.

We are open to suggestions and feedback, but we are not under any obligation to compensate you for doing so or acknowledge to the public in any way that a suggestion or idea came from you.

We are committed to ensuring that your information is secure. In order to prevent unauthorized access or disclosure we have put in place industry-recognized security safeguards coupled with carefully developed physical, electronic and managerial security procedures to safeguard and secure the information we collect online. Please note that while we have implemented industry-standard security mechanisms and procedures to protect data from loss, misuse and unauthorized access, disclosure, alteration and destruction, no method of storage or transmission is 100% secure. You are solely responsible for protecting your password, limiting access to your devices and signing out of websites after your sessions. We are not responsible for the breach by third parties of the safeguards we put in place to protect the privacy of your data.

Sibme complies with the principles of the EU-U.S. Data Privacy Framework, the UK Extension to the EU-U.S. Data Privacy Framework (EU-U.S. DPF), and the Swiss-U.S. Data Privacy Framework (collectively, the "Data Privacy Framework" or "DPF") as set forth by the U.S. Department of Commerce. Sibme has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of Personal Data received from the European Union and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Sibme has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of Personal Data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. Data Privacy Framework Principles and/or the Swiss-U.S. Data Privacy Framework Principles, the respective Principles shall govern.

To learn more about the Data Privacy Framework Principles and to view our certification information, please visit https://www.dataprivacyframework.gov/s/ and https://www.dataprivacyframework.gov/list respectively.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, Sibme commits to resolve complaints about your privacy and our collection or use of your Personal Data transferred to the U.S. pursuant to Data Privacy Framework. EU, UK, and Swiss individuals with Data Privacy Framework inquiries or complaints should first contact Sibme at legal@sibme.com. Sibme has further committed to refer unresolved Data Privacy Framework complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to BBB, an alternative dispute resolution provider located in the U.S. If you do not receive a timely acknowledgement of your complaint from us, or if we have not addressed your complaint to your satisfaction, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers/ProcessForConsumers for more information or to file a complaint. The services of BBB Data Privacy Framework are provided at no cost to you.

Contact details for the EU data protection authorities can be found at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

If your Data Privacy Framework complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf

Sibme is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission. Sibme may be required to disclose Personal Data that we handle under the Data Privacy Framework in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Pursuant to the Data Privacy Frameworks, EU, UK and Swiss individuals have the right to obtain our confirmation of whether we maintain personal information relating to you in the United States. Upon request, we will provide you with access to the personal information that we hold about you. You may also correct, amend, or delete the personal information we hold about you. An individual who seeks access, or who seeks to correct, amend, or delete inaccurate data transferred to the United States under Data Privacy, should direct their query to legal@sibme.com. If requested to remove data, we will respond within a reasonable time frame.

We will provide an individual opt-out or opt-in choice before we share your data with third parties other than the parties listed in this Privacy Policy, or before we use it for a purpose other than which it was originally collected or subsequently authorized. To request to limit the use and disclosure of your personal information, please submit a written request to legal@sibme.com. Sibme's accountability for personal data that it receives in the United States under the Data Privacy Framework and subsequently transfers to a third party is described in the Data Privacy Principles. In particular, Sibme remains responsible and liable under the Data Privacy Principles if third-party agents that it engages to process the personal data on its behalf do so in a manner inconsistent with the Data Privacy Principles, unless Sibme proves that it is not responsible for the event giving rise to the damage. Please note that Sibme also receives some data via other compliance mechanisms, including data processing agreements based on the EU Standard Contractual Clauses or UK International Data Transfer Agreement or UK International Data Transfer Addendum to the European Commission Standard Contractual Clauses for International Data Transfer.

To exercise your rights, please contact us by using the information in Section 20 below ("Contacting us"). We try to respond to all legitimate requests within one month and will contact you if we need additional information from you in order to honor your request. Occasionally it may take us longer than a month, taking into account the complexity and number of requests we receive. If you are an employee of a Sibme customer, we recommend you contact your company's system administrator for assistance in correcting or updating your information. Some registered users may update their user settings, profiles, organization settings and event registrations by logging into their accounts and editing their settings or profiles.

As described above, we may also process Data submitted by or for a customer to our cloud products and Services. To this end, if not stated otherwise in this Privacy Policy or in a separate disclosure, we process such Data in the role of a processor on behalf of a customer who is the responsible controller of the Data concerned. We are not responsible for and have no control over the privacy and data security practices of our customers, which may differ from those set forth in this Privacy Policy. If your data has been submitted to us by or on behalf of a Sibme customer and you wish to exercise any rights you may have under applicable data protection laws, please inquire with the applicable customer directly. Because we may only access a customer's data upon instruction from that customer, if you wish to make your request directly to us, please provide to us the name of the Sibme customer who submitted your data to us. We will refer your request to that customer and will support them as needed in responding to your request within a reasonable timeframe.

Sibme's Site may contain links to enable you to visit other websites of interest easily. However, once you have used these links to leave our Site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information, which you provide while visiting such sites and such sites are not governed by this Privacy Policy. This privacy policy applies solely to personal information provided directly to Sibme in furtherance of our business relationship. You should exercise caution and look at the privacy policy applicable to the website in question. Portions of this website may also make chat rooms, forums, message boards, and/or news groups available to visitors. Please remember that any information that is disclosed in these areas becomes public information and exercise caution when deciding to disclose any personal information.

You acknowledge that local policies or regulations promulgated by your school district or employer may be applicable to you and you are responsible for complying with all such policies and regulations. You shall use Sibme Services and the Site only in strict compliance with these policies and regulations. You shall use Sibme Services and the Site only in strict compliance with the Terms of Service, all United States federal, state and local laws and all other laws, regulations and governmental authority (including, but not limited to, policies and laws related to privacy, defamation, copyright and trademark infringement) applicable to you.

You may manage your receipt of marketing and non-transactional communications by clicking on the "unsubscribe" link located on the bottom of Sibme's marketing emails. Additionally, you may unsubscribe by contacting us at any time at legal@sibme.com. Please note that opting out of marketing communications does not opt you out of receiving important business communications related to your current relationship with us, such as communications about your subscriptions or event registrations, service announcements or security information. You can also opt out of seeing personalized online ads from companies participating in the Network Advertising Initiative ("NAI") using the NAI opt out tool at http://optout.networkadvertising.org/.

Sibme reserves the right to change this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements and other factors. If we do, we will update the "effective date" at the top of this Privacy Policy. If we make a material update, we may provide you with notice prior to the update taking effect, such as by posting a conspicuous notice on our website or by contacting you using the email address you provided. We encourage you to periodically review this Privacy Policy to stay informed about our collection, processing and sharing of your personal information.

If you have any questions or concerns about our collection, use or disclosure of your personal information or would like to delete or make a correction of personal information you have provided to us, please email us at legal@sibme.com. Sibme supports access to and correction of a student's personally identifiable information by the student or their parent or authorized guardian, either by assisting the educational institution in meeting its requirements or when the information is collected directly from the student with student/parent/guardian consent.

Sibme
Attn: Legal Department
4201 Main St. Ste. 200-192
Houston, TX 77002