ACCURIS Privacy Policy

This Privacy Policy applies to ACCURIS’s Platforms and provides you with guidance on your rights and obligations in relation to your personal information.

This Privacy Policy establishes and communicates the key principles that ACCURIS follows in protecting the personal information that we collect. Please note that some privacy rights and obligations may differ in certain locations based on local law, in which case ACCURIS will comply with the local legal requirements. To the extent a notice provided at the time of collection from a website or specific product conflicts with this Privacy Policy, such specific notice or supplemental privacy statement will control.

“Personal information” is any information that can be used to identify an individual or device, and may include things such as your name, physical address, email address, phone number, login information, marketing preferences, company affiliation, geographic location, or payment card information. ACCURIS may collect personal information that is necessary for legitimate business purposes, which will be disclosed to you at the time of collection. ACCURIS will use this information for the purposes for which it was collected. ACCURIS may also collect personal information from trusted third-party sources and engage third parties to collect personal information to assist us.

One of the most common methods of collecting personal information is during the online form submission or registration process, including where a website user is requesting a free trial or a courtesy newsletter, registering for an event, or responding to similar offers such as sample reports, white papers, or further product information.

In some instances, ACCURIS and the third parties we engage may automatically collect and aggregate data using cookies, weblogs, web beacons, and other similar applications. This information is used to better understand and improve the usability, performance, and effectiveness of our Platforms and to help us tailor content or offers for you. Please read Section 9 (Cookies) below for more information.

ACCURIS may use your personal information for operational, legal, administrative, and other legitimate purposes permitted by applicable law. Some of the ways we may use personal information include:

• Providing you with requested products or services.
• Providing you with information regarding similar products or events.
• Analyzing and monitoring extent of use.
• Providing customized product and service information.
• Allowing users to participate voluntarily in mailings or other events.
• Providing product service updates, information, and alerts.
• Sending communications, including for marketing or other customer satisfaction purposes.
• Order processing and to provide transaction documents.
• To contact users for information verification purposes.
• Analyzing and monitoring extent of use and enhancing ACCURIS’s Platforms.

ACCURIS’s legal basis for collecting and processing personal information depends on the personal information concerned, the context in which ACCURIS collects it and the applicable laws and regulations. Generally, ACCURIS collects personal information from you when:

• we have your consent to do so;
• we need the personal information to perform our contractual obligations to you or your employer (for example, where you subscribe to one of our products);
• the processing is in our legitimate interests and not overridden by your data protection interests or fundamental rights and freedoms and the processing is otherwise consistent with applicable law;
• It is necessary to comply with a legal or regulatory obligation.

We strive to make sure that our information is reliable, accurate, and up-to-date. While personal information is maintained by ACCURIS, individuals in certain jurisdictions will have rights over how their personal information is processed. To find out what rights apply in your jurisdiction, please visit Section 12 (Additional Information for Certain Jurisdictions).

To make a request regarding your personal information, please reach out to our privacy team at privacy@accuristech.com

Below is a brief description of rights that may apply to you:

5.1 Right of access

You may have the right to access your personal information to review, update, and correct inaccuracies. There are some exemptions, which means you may not always receive all the information we process. Additionally, there may be limits to the amount of information we will provide access to. For example, in some cases, we may limit access to personal information where the request is manifestly unfounded or excessive, in particular because of the requests have been repetitive in character, or where doing so would violate the rights of others.

5.2 Right to information

In some circumstances and subject to certain exceptions, you may have the right to request information about the processing of your information. Information typically requested includes:

• The categories or specific types of personal information we have collected.
• The business purpose for collecting, disclosing, and/or selling the information.
• The sources from which personal information was collected.
• The categories of third parties with whom we share personal information.
• The criteria used to determine the time that personal information will be held.
• The existence of automated decision-making, including profiling that uses your personal information.
• The safeguards we’ve applied to protect your information when it is transferred internationally.

5.3 Right to rectification

You may have the right to ask us to rectify personal information you think is inaccurate. This could also include the right to ask us to complete information you think is incomplete.

5.4 Right to erasure

In some circumstances and subject to certain exceptions, you may have the right to ask us to erase your personal information.

5.5 Right to restrict processing

In certain circumstances, you may have the right to ask us to restrict the processing of your information.

5.6 Right to object to the processing of your personal information

You may have the right to object to the processing of your information. The right to object to the processing of personal information is most commonly used by individuals when asking a business to cease direct marketing.

5.7 Right to data portability

In some circumstances, you may request copies of your information in a portable and, to the extent technically feasible, readily usable format that allows you to transmit this information to another entity without hindrance.

5.8 Right to opt out of the sale of your personal information

You may have the right to direct us not to sell your personal information.

5.9 Right to nondiscrimination

You may have the right to not be treated differently for exercising your rights.

Upon receipt of a valid request made through our privacy inbox (privacy@accuristech.com), we will take the necessary steps to assess and respond. Please be aware that in order to accommodate some requests, we must verify your identity before we can respond to a privacy request and this may require you to provide photographic identity information to ACCURIS. Because your personal information—for example, your email address—is often required to access or use ACCURIS Platforms and technologies, we retain personal information as long as your account is active. You may have the opportunity to correct, update, or modify this information by logging into your account and updating your information online. Please note that some information may be retained in our systems, where permitted by law, even after you request deletion.

To support the purposes listed in Section 3 (Purpose and Use of Personal Information), ACCURIS may share or disclose personal information to:

• ACCURIS’s parent, subsidiary, affiliates, and other related companies for the purposes listed in Section 3 (Purpose and Use of Personal Information).
• The organization that arranges your access to our products or services (if that is not you) to fulfill its contractual obligations and to provide our products and services.
• Service providers, professional advisers, consultants and business partners for the purposes of operating our business, delivering, improving, and customizing our products or services, sending marketing and communications related to our business, payment processing, and for other legitimate purposes permitted by applicable law or otherwise with your consent.

Personal information handled by these service providers is subject to their terms of use and privacy policies. Please review the service provider’s terms of use and privacy policies to better understand how they manage your personal information.

There may also be instances when ACCURIS may disclose your personal information without providing you with a choice in order to:

• Honor a request that you have made through the products or services.
• Comply with the law or in response to a court order, government request, or other legal process.
• Protect the interests, rights, safety, or property of ACCURIS or others.
• Protect against fraud or for risk management purposes.
• Respond to adverse third parties (i.e., adverse parties and their counsel and other agents) in the context of litigation.

In addition, if ACCURIS sells all or part of its business or makes a sale or transfer of assets or is otherwise involved in a merger or business transfer, you acknowledge that ACCURIS may transfer your personal information to a third party as part of that transaction. You may be informed of the identity and contact details of the third party where required by applicable law.

In all cases, ACCURIS requires all unaffiliated third parties to treat personal information as confidential. ACCURIS will not provide personal information to third parties for their own marketing purposes without your consent.

If you participate in a discussion forum, chat room, or provide comments related to ACCURIS on a social media or other public platform, you should be aware that the information you provide there (i.e., your public profile) will be made broadly available to others, and could be used to contact you, send you unsolicited messages, or for purposes neither ACCURIS nor you have control over. Also, please recognize that social media forums and chat rooms not controlled by ACCURIS may have additional rules and conditions. ACCURIS is not responsible for the personal information or any other information you choose to submit on these forums that are not controlled by ACCURIS.

The Platforms may offer you the ability to share personal information through a social networking site (e.g., Facebook, Twitter), using integrated tools (e.g., Facebook “Like” button, or Twitter “Tweet” button). The use of such integrated tools enables you to share personal information about yourself with other individuals or the public, depending on the settings that you have established with such social networking site. For more information about the purpose and scope of data collection and use in connection with such social networking site or a site’s integrated tools, please visit the privacy policies of the entities that provide these social networking sites.

ACCURIS has physical, administrative, and technical safeguards in place to help protect the personal information ACCURIS collects. While there is no such thing as perfect security on the Internet, we will take reasonable and appropriate steps to ensure the safety of your personal information.

ACCURIS will retain your personal information for as long as necessary to fulfill the purposes for which it was collected. We will retain and use your personal information as necessary to comply with our business requirements, legal obligations, resolve disputes, protect our assets, and enforce our agreements.

We use four types of Cookies – ‘Strictly Necessary’, ‘Performance’, ‘Functional’ and ‘Targeted Advertising’. A detailed explanation of the types of Cookie and the purposes for which we use them is found within the ACCURIS Cookie Notice available here However, if you are just looking for a summary, we use strictly necessary cookies to make our site work. We also like to set optional performance, functional, and advertising cookies to help us improve the site and give you a bespoke experience so it works better for you.

As a global organization, we may transfer your personal information to ACCURIS affiliates, agents, contractors, service providers, and to third parties in various countries and jurisdictions around the world. By using our Platforms, or providing any personal information to us, where applicable law permits, you acknowledge the transfer, processing, and storage of such information outside of your country of residence where data protection standards may be different.

ACCURIS safeguards and enables the global transfer of personal information in a number of ways:

Standard Contractual Clauses

The EU Standard Contractual Clauses and the UK Addendum are examples of mechanisms approved by the European Commission and under UK law to ensure adequate safeguards for personal information transferred from the EU or UK to countries not found to offer adequate protection for personal information. In some circumstances, ACCURIS will rely upon Standard Contractual Clauses or the UK Addendum to lawfully transfer personal information.

Adequacy Decisions

According to EU Regulation and under the UK GDPR, international transfers may take place when there is an adequate level of protection to the fundamental right of individuals to data protection. The European

Commission and the UK GDPR have determined that several countries ensure an adequate level of protection. In some circumstances, ACCURIS will rely upon an adequacy decision to lawfully transfer personal information.

If you submit an application for employment to or are currently an employee of ACCURIS, ACCURIS is authorized to collect the information in any form it obtains through your application for employment or continued employment with ACCURIS, and your submission of employee related documents, including but not limited to the personal information that you submit in connection with your employment or intended employment (collectively “Employee Information”).

Examples of Employee Information collected in connection with your employment or application for employment includes but is not limited to your name, date of birth, government issued identification (passport, social security number, driver’s license number), banking information, marital status, health information, benefit information, title, employment history, education, job qualifications, and other relevant employee personal information. We also collect some of this information about your dependents when you provide it to us. By providing personal information about family members or other individuals, you represent that you have their consent to provide this information to us for the purposes set forth in this Privacy Policy.

ACCURIS will collect, use, store and retain, and secure your social security number in accordance with this Privacy Policy. ACCURIS will not intentionally communicate or make available, in any manner, your social security number to the general public. ACCURIS will not print your social security number on any card required for you to access colleague member services provided by ACCURIS. ACCURIS will not require you to transmit your social security number over the Internet, unless the connection is secure or the social security number is encrypted. ACCURIS will not print your social security number on any materials that are mailed to you, unless state or federal law requires or permits the social security number to be on the document to be mailed.

In accordance with applicable law, ACCURIS may use Employee Information to evaluate applications for employment, manage work-related aspects of the employee-employer relationship (e.g., training, payroll, benefits, travel, reimbursement expenses, performance appraisals, succession planning, team member health and safety), investigate and respond to any claims related to your employment, and comply with applicable laws and regulations. Your professional information, such as your name, job title, professional photo, area of expertise, reporting line, and work experience may be shared with clients or potential clients in connection with your job responsibilities. Your professional information may also be shared through internal resources accessible to ACCURIS colleagues, such as organizational charts and other documents available on ACCURIS’s secure intranet. ACCURIS will not use your Employee Information to market to you directly or through a third party service provider, unless you specifically consent to such use.

ACCURIS shares your Employee Information with third parties who provide outsourced human resource functions to us and are required to protect your Employee Information. ACCURIS may disclose your Employee Information if required or permitted to do so by law (such as when part of a governmental agency action or litigation), governmental or quasi-governmental requests, or a regulatory organization, or to relevant third parties such as site technicians, brokers, auditors, lawyers, or professional advisors. In the event that ACCURIS considers it necessary or where required by law to disclose Employee Information in certain situations where the health, safety, or wellbeing of a team member is at imminent risk, we may share your Employee Information with our outside lawyers, law enforcement or others who are legally authorized. As ACCURIS continues to develop our business, we may buy or sell assets. In the unlikely event that ACCURIS or substantially all of our assets are acquired, Employee Information may be one of the transferred assets.

Employee Information may be stored in hard copy or electronic format within your branch office or in the cloud in the United States or other countries where ACCURIS, its affiliates, agents, or contractors conduct business. Your Employee Information may be transferred into our human resources systems and used to manage your employment, may become part of your personnel file, and may be used for other workrelated purposes. Your Employee Information will be kept for as long as is legally required, and in some instances longer depending upon the needs of the organization and industry practices.

If you have any complaints regarding our compliance with this Privacy Policy, you should first contact us via our privacy mailbox, at privacy@accuristech.com Alternatively, you can write to us at the address listed below under Section 15 (Contact Information). If you are a resident of the European Union or another applicable jurisdiction and you have an unresolved concern regarding your Employee Information that we have not addressed satisfactorily, please contact your local data protection authority.

European Economic Area

EU General Data Protection Regulation

The ACCURIS Policy for the Processing of Data Governed by the GDPR addresses our commitment to the processing of personal information under the EU General Data Protection Regulation 2016/679.

California

For the purposes of this section, “personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household.

In some circumstances and subject to certain exceptions, California residents have the right to information; erasure; access/data portability; object to the sale of information; and the right to nondiscrimination, as detailed in Section 5 (Your Rights). Residents of the State of California also have the right to request information regarding third parties to whom the company has disclosed certain categories of personal information during the preceding year for the third parties’ direct marketing purposes.

For information about the requests we receive, including the number of requests and the average number of days we’ve taken to respond to requests, please click here The data included here is from 2022, when Accuris was part of the SPGI business.

The following is a summary of ACCURIS data collection practices, including the personal information ACCURIS collects, whether ACCURIS discloses that information for business purpose, and whether ACCURIS “sells” and/or “shares” (as those terms are defined by California law). ACCURIS may use all of the information for any of the purposes described in this Policy unless limitations are listed. ACCURIS has no actual knowledge that it sells or shares the personal information of consumers under 16 years of age. As discussed elsewhere in the Privacy Policy, ACCURIS uses cookies and similar tracking technologies for purposes of targeted advertising. For more information, please see the ACCURIS Cookie Notice The categories we use to describe the information are those set out in the CCPA.

In some circumstances and subject to certain exceptions, individuals in the People’s Republic of China (“PRC”) have the right to:

• withdraw consent, which will not impact data processing by ACCURIS that took place prior to the withdrawal;
• be informed regarding the processing of their personal information;
• decide, restrict, or refuse the processing of their personal information;
• access or copy their personal information;
• data portability;
• rectify or delete their personal information;
• seek explanation with respect to ACCURIS’s policies for the processing of their personal information;
• make a complaint; and
• opt out of any automated decision-making that may apply to them.

Brazil

ACCURIS is committed to complying with Brazil’s General Data Protection Law (“LGPD”). Under the LGPD, you have the right to:

• Confirm the existence of processing of your personal data;
• Access data;
• Correct incomplete, inaccurate, or out of date data;
• Anonymize, block, or delete unnecessary or excessive data or data that is not being processed in compliance with the LGPD;
• Portability of data to another service or product provider, by means of an express request;
• Delete personal data processed with your consent;
• Information about public and private entities with which we have shared data;
• Information about the possibility of denying consent and the consequences of such denial;
• Revoke consent;
• Request review of decisions taken solely on the bases of automated processing of personal data that affects your interests.

You or an authorized agent may exercise your rights through the Privacy Request Page. The LGPD also provides that you may file a complaint regarding your data directly with the Brazilian data protection regulator, ANPD.

South Africa

ACCURIS, through its affiliate ACCURIS UK Holding Limited (“Responsible Party”) processes the personal information of natural persons and juristic persons in South Africa in accordance with Protection of Personal Information Act 4 of 2013 (“POPIA”).

POPIA provides individuals with the right to:

• Be notified that your personal information is being processed; and/or whether the personal information has been unlawfully accessed or acquired by an unauthorised person;
• Access
• Rectification
• Erasure
• Object to the processing of your personal information
• Not be subjected to direct marketing by means of unsolicited electronic communications Not to be subjected to automated decision making that results in legal consequences and that is based solely on automated processing of personal information; and
• Submit a complaint to the Information Regulator

To exercise these rights, please contact the ACCURIS Legal Department by using the contact information in Section 15 of this Policy.

In circumstances where there are reasonable grounds to believe that a Data Subject’s personal information has been accessed or acquired by an unauthorised person, ACCURIS may notify the Information Regulator and affected data subjects where required by law.

In the event that your personal information is transferred outside of South Africa to a third party in a foreign country, ACCURIS will ensure that your information is adequately protected.

You may contact the Information Regulator using the following contact details:

If you enter into a separate contractual relationship with ACCURIS which requires, or contemplates, collecting, using, or sharing information about you in a manner that is different than that which is described in this Privacy Policy, the terms of that agreement will apply.

This Privacy Policy does not apply to sites or applications offered by other companies or individuals, including third party products and services, that may be displayed as content in a search on our website. ACCURIS encourages you to read the privacy policy of any third-party site or applications before transmitting personal information.

If you have any questions or concerns related to this Privacy Policy, please contact the ACCURIS Legal Department:

ACCURIS

7979 E. Tufts Ave. Suite 300

Denver, CO 80237

Attn: ACCURIS Legal Department

privacy@accuristech.com

If ACCURIS needs, or is required, to contact you concerning any event that involves information about you, we may do so by email, telephone, or mail.

Updated April 23, 2024.