Ario CoreLens Privacy Policy

Information We Collect

We collect the following categories of personal information:

• Contact information, such as your name and email address.
• Account information, such as your panel login and the account you connect.
• Purchase and transaction information, such as the items you purchase, order dates, quantities, prices, discounts, payment method type, promotional codes, returns, and shipping details, obtained from the retail or merchant account you connect.
• Demographic information, such as age, gender, household income, education, marital status, and race or ethnicity.
• Information you provide in surveys, questionnaires, or other responses.
• Information collected automatically, such as IP address, device identifiers, browser characteristics, pages viewed, and clickstream data, through cookies and similar technologies.

How We Use Information

We use personal information to:

• Operate, maintain, and improve the Services and our data products, including organizing, categorizing, and enriching purchase data.
• Create and provide data products, analytics, and market intelligence to our business customers.
• Share and license information with our business customers, as described below.
• Provide advertising, including through our advertising partners.
• Administer panel participation and compensation, and communicate with you.
• Detect, prevent, and respond to fraud, abuse, and security issues.
• Comply with legal obligations and enforce our terms.

How We Share Information

We share personal information as follows:

• With our business customers. We share and license information, including purchase and transaction information and demographic information, with our business customers (such as brands, retailers, and other enterprises) for their research, analytics, and commercial purposes, under contract.
• With advertising partners. We allow certain partners to collect information through automated technologies and share information with advertising partners for advertising purposes.
• With service providers. We share information with vendors who perform services on our behalf, under contract.
• For legal and safety reasons. We disclose information where required by law or legal process, or to protect our rights, our users, and the public.
• In corporate transactions. We may transfer information in connection with a merger, acquisition, financing, or sale of assets.

Some of the sharing described above may be considered a "sale" or "sharing" of personal information under the CCPA and similar laws. You may opt out as described in "Your Choices and Rights."

Where we process de-identified or aggregated information, we maintain and use it in de-identified form and do not attempt to re-identify it, except as permitted by applicable law.

Cookies and Tracking

We and our partners use cookies and similar technologies to operate the Services, analyze usage, and support advertising, including cross-context behavioral advertising. You can manage cookies through your browser settings. We honor the Global Privacy Control (GPC).

Your Choices and Rights

• Opt out of sale or sharing. You may opt out of the sale or sharing of your personal information, including for cross-context behavioral advertising, through our opt-out request form or by emailing privacy@ariodata.com. We honor the Global Privacy Control.
• Withdraw from the panel. You may withdraw at any time. We will stop collecting new data, end future sharing of your information, and delete your individual records, subject to legal retention requirements.
• Access, correct, delete, and port. You may request access to, correction of, deletion of, or a portable copy of your personal information.
• Non-discrimination. We will not discriminate against you for exercising these rights.

To make a request, use our opt-out request form or contact privacy@ariodata.com. We respond within the time required by applicable law.

Retention

We will retain your personal information for the period reasonably necessary to achieve the purposes set out in this Privacy Policy (or any other notice provided at the time of collection) and our legal obligations, taking into account applicable statutes of limitation and records retention requirements under applicable law.

Security

We maintain administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit and at rest, role-based access controls, and multi-factor authentication. We do not store consumer credentials.

Children's Privacy

The Services are intended for a general audience and are not directed to children under 18. We do not knowingly collect personal information from anyone under 18.

State Privacy Rights

Residents of California and other states with comprehensive privacy laws have certain rights regarding their personal information, including the rights to access, correct, delete, and opt out of the sale or sharing of personal information and targeted advertising. California residents should also see the California Privacy Notice below. We honor authorized-agent requests and the Global Privacy Control. If we decline to act on your request, you may appeal that decision by contacting privacy@ariodata.com.

International Users

We process personal information in the United States. If you access the Services from outside the United States, your information will be transferred to and processed in the United States.

Third-Party Links

Our Services may contain links to websites or services we do not operate or control. We are not responsible for the privacy practices of those third parties, and we encourage you to review their privacy policies.

Changes to This Policy

We may update this Privacy Policy from time to time and without prior notice to you to reflect changes in our personal information practices. We will indicate at the top of the policy when it was most recently updated.

Contact

Categories of Personal Information We Collect

In the past 12 months, we have collected the following categories of personal information:

• Identifiers, such as name, email address, account identifiers, IP address, and device identifiers.
• Commercial information, such as purchase and transaction history.
• Internet or other electronic network activity, such as browsing and clickstream data.
• Protected classification characteristics, such as age, gender, marital status, and race or ethnicity.
• Inferences drawn from the above.

Sources of Personal Information

We collect personal information from you, from the accounts you connect, and from our audience and research partners.

Purposes for Collection

We use personal information for the business and commercial purposes described in "How We Use Information" in the Privacy Policy.

Categories We Sell or Share

In the past 12 months, we have sold or shared the following categories of personal information: identifiers, commercial information, internet or other electronic network activity, and protected classification characteristics. We sell or share these categories with our business customers and our advertising partners.

Categories We Disclose for a Business Purpose

We disclose the categories above to our service providers for business purposes.

Your California Rights

• Right to know and access the personal information we have collected, used, disclosed, and sold or shared.
• Right to delete personal information we have collected from you.
• Right to correct inaccurate personal information.
• Right to opt out of the sale or sharing of personal information, including for cross-context behavioral advertising.
• Right to non-discrimination for exercising your rights.

To exercise these rights, use our opt-out request form or contact privacy@ariodata.com. You may use an authorized agent to submit a request on your behalf. We honor the Global Privacy Control.

Shine the Light

California residents may request information about our disclosures of personal information to third parties for their own direct marketing purposes by contacting privacy@ariodata.com.

Contact

Collection, Use, and Sharing of Personal Data

We collect and process the categories of personal data described in this Privacy Policy for the purposes set out in "How We Use Information." We share personal data with our business customers and advertising partners, which may include the sale of personal data and the processing of personal data for targeted advertising. We do not knowingly process the personal data of anyone under 18, and we do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects concerning consumers.

Your Colorado Privacy Rights

Colorado residents have the right to:

• Access, correct, or delete their personal data.
• Obtain their personal data in a portable, readily usable format.
• Opt out of the processing of personal data for targeted advertising or the sale of personal data.

To submit an access, correction, portability, or deletion request, email privacy@ariodata.com. To opt out, use our opt-out request form or, for disclosures that involve automated technologies on the device and browser you are currently using, the Global Privacy Control. You may use an authorized agent to submit a request on your behalf. If we decline to act on your request, you may appeal by emailing privacy@ariodata.com with the subject line "Colorado Privacy Rights Appeal."

Legal Bases for Processing

Where Ario processes the personal data of EEA or UK residents, it relies on the following legal bases:

• Consent — for collecting, using, and sharing the purchase and demographic data you provide as a panelist, including any special-category data, and for advertising. You may withdraw your consent at any time.
• Legitimate interests — for operating, securing, evaluating, and improving the Services, and for performing analytics.
• Legal obligations — for protecting against fraud and complying with applicable law.

Your Rights

Subject to applicable law, you may:

• Request access to the personal data we hold about you.
• Request correction of incomplete or inaccurate personal data.
• Request erasure of your personal data.
• Object to processing where we rely on legitimate interests.
• Request restriction of processing in certain circumstances.
• Request the transfer of your personal data to you or another party.
• Withdraw consent where we rely on it.
• Lodge a complaint with a supervisory authority in the EEA or UK.

To exercise these rights, contact privacy@ariodata.com.

International Transfers

Personal data is processed in the United States. Where we transfer EEA or UK personal data, we rely on an adequacy decision, appropriate safeguards such as the EU Standard Contractual Clauses, or an applicable derogation.

Retention

We will retain your personal data for the period necessary to achieve the purposes outlined in this Statement and the Privacy Policy, taking into account applicable statutes of limitation and records retention requirements under applicable law.

Updates and Contact

We may update this GDPR Statement and will post the updated version with a new effective date. Questions about this Statement may be directed to privacy@ariodata.com.