Main Exponent Privacy Policy

1. About this Privacy Policy.

Your privacy is important to us. This Privacy Policy sets out the basis on which we, BRAD Creative LLC, and our affiliates (collectively “Main Exponent”, “us”, or “we”), take care of your privacy.

This Privacy Policy explains how we collect, use, process, share, disclose, and store your Personal Information, collected through your interactions with us; including through our website www.mainxp.com (the ‘Site’), sales process, marketing activities, and other means, as further detailed on Section 3.

The aim of this Privacy Policy is to ensure that you understand the Personal Information we collect from you, the purposes for which we collect it, how we use it, and how we share it. In sum, to explain to you how we protect your privacy, and explain to you your rights in connection to the Personal Information we collect and process about you.

The Personal Information collected by us will be processed pursuant to: (i) the manner described herein and (ii) all requirements set forth by laws governing personal data applicable to the geographical area where you are located, provided they are also applicable to us.

To learn more about your privacy rights and how we comply with the particular laws that may be applicable to us according to the geographical area where you are located, please refer to Appendixes. In the event of any conflict or inconsistency between the general section of this Privacy Policy and any applicable Appendix, the terms of such Appendix shall prevail.

For further clarifications on this Privacy Policy, questions, or concerns, please do not hesitate to contact us (see Section 18).

2. About us.

BRAD Creative LLC is a Limited Liability Company headquartered in Texas.

For the purpose of this Privacy Policy, we are the data controller of your Personal Information as described in this document, unless expressly specified otherwise. More information about our global locations is available here: https://www.mainxp.com/contact-us/.

3. Personal Information we collect about you.

3.1. Personal Information we collect.

As used in this Privacy Policy, ‘Personal Information’ means any data relating to an identified or identifiable individual including, but not limited to: your name, last name, company name, email address, phone number, and date of birth, among others.

We collect Personal Information from you through our interactions with you and through our services. You provide some of this data directly, and we get some of it by collecting data about your interactions, use, and experiences with our products. The Personal Information we collect depends on the context of your interactions with us and the choices you make.

We collect your Personal Information when you:

• Register, complete, or submit information or forms on our Site.
• Download content on our Site.
• Register for webcasts, seminars, conferences, etc., sponsored by us, or a partner.
• Provide us with feedback and information via phone, email, social media, etc.
• Answer a survey.
• Subscribe to our newsletters or other content-related material.
• Use live chat and communicate with us. Our live chat is operated by a third-party service provider, who has access to such information and can use it in compliance with this Privacy Policy to provide customer service and improve the service. Telephone calls or chat conversations may be monitored or recorded for quality assurance purposes.
• Use forums or leave comments on our Site.
• Purchase or use our products and/or services.
• During in-person meetings or at our events, conferences, workshops, or gatherings.
• Online information about you may also originate from the use of cookies and similar technologies (for example, pixel tags and device identifiers) on our Site or sites of third parties. For more information on cookies and similar technologies, please see Section 6 below.

Please note that we do not control the content that you may post to our forums or social networks; in some cases, such content may be publicly available on the Internet. You should carefully consider whether you wish to submit Personal Information to these forums or social networks and whether you wish to make your profile available to other users.

3.2. Categories of Personal Information and specific pieces of Personal Information we collect from you.

We have collected within the last twelve (12) months and may collect in the future the following categories of Personal Information listed below from consumers, for commercial and/or business purposes:

1. Identifiers and registration contact information: such as name, e-mail address, postal address, telephone number, account name, online identifier, Internet Protocol (IP) address, or other similar identifiers.
2. Customer records information: such as name, signature, social security number, physical characteristics or description, address, telephone number, passport number, bank account number, credit or debit card number, or other financial information.
3. Characteristics of protected classifications under California or federal law: such as age, gender, etc.
4. Commercial information: such as delivery information and records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies and transactions made with us.
5. Internet or other electronic network activity information: device information and device identifiers, browser type and language, browsing history, search history, and information regarding a consumer’s interaction with an Internet website, application, or advertisement, and data connection and use, such as information you download.
6. Geolocation data: such as city, state, zip code, etc. related to your IP address.
7. Inferences on your preferences and characteristics.
8. Other information: such as any other information you choose to provide us directly in relation to the use of our services, surveys we send you, etc., customer information such as questions and other messages that you send us directly through online forms, chats, e-mail, phone, or post, summaries or voice recordings of your interactions with customer service.

3.3. Personal Information we collect automatically.

Our Site automatically collects certain information, through automatic data collection tools such as cookies, and beacons, among others. These tools automatically collect the following information:

• Technical information including, but not limited to, browser type, operating system, device information, online identifiers including cookie data and Internet Protocol address (IP), domain name, referral URL, time zone setting, and/or time-stamp for your visit, and information about your devices.
• Usage information including, but not limited to, geographic location information (such as your country and/or state), date and time you visited our Site, number and frequency of visitors to our Site, page views and search queries, clickstream behaviors, among others. Also, it may include details of your use of third-party applications in connection with our service.

3.4. Personal Information we collect from third parties.

We work closely with various third parties and may receive Personal Information from them. We protect the Personal Information obtained from them in accordance with the practices and policies described herein, plus any additional obligations imposed by the third-party source of your Personal Information. Third-party sources may vary due to context, but may include the following:

• Data brokers: from which we purchase data to complement the Personal Information we collect.
• Partners:
  • (i) authentication partners: if you register or log in into our services using third party credentials (e.g. Facebook) we will import your Personal Information from such third-party source to help you create an account on our Site;
  • (ii) technical services partners: that helps us with our technology, and may provide us with certain Personal Information (e.g. such as mapping IP address to location data) to help us provide our services,
  • (iii) advertising partners: that provide us with services on our Site (analytics, marketing, etc.) and may provide us with inferences about your preferences and interests to offer you a better service and customized offerings,
  • (iv) payment partners: if you choose to pay for a service and/or product, we may receive data from them, to enable us to send you invoices and process your payment, and
  • (v) resellers, distributors: that deliver the product and/or service you have contracted, and therefore may supply us with data to help us improve our services, among others.
  • Social media sites.

During the past 12 (twelve) months we have disclosed the categories of Personal Information about you listed above to our affiliates, group companies, and service providers for business and commercial purposes. We have not, however, sold your Personal Information to third parties.

4. How do we use your Personal Information.

We use your Personal Information for the following purposes:

We use your Personal Information to fulfill certain business/commercial purposes (collectively the “Purposes”). These purposes include:

1. To fulfill the purpose for which the Personal Information is provided.
2. To provide you with information, products, and/or services that you request from us.
3. To communicate and respond to your requests and inquiries to us.
4. To operate our business and provide you with our products and services: engage in transactions with clients, and process orders from our services.
5. To follow up with our products and/or services after delivering them (live chat, email, or phone inquiries).
6. To provide consumers with e-mail alerts, product announcements, software updates, upcoming events, event registrations, and other notices concerning our products and/or services, or events or news that might be of interest to the consumer.
7. To customize the content and advertising you see on our Site, personalizing your experience and allowing us to deliver the type of content and product offerings you are most interested in and to send periodic emails regarding our products and/or services.
8. To administer and improve the functionality of our Site and its technical and functional management and present its content to our clients or others.
9. To analyze, develop and improve the use and performance of our Site.
10. To modify, enhance, or improve our services and/or provision of such services to our clients and/or for quality assurance.
11. As necessary and appropriate to protect our rights or property, or those of our clients or others.
12. To carry our obligations and enforce our rights arising from any agreement entered by and between us and our clients or other contractual third party, including billing and collections.
13. For testing, research, analysis, and product and services development.
14. To manage the security of our Site.
15. To comply with applicable laws and regulations to operate our business.
16. To respond to law enforcement requests as required by applicable law, court order, or governmental regulations.
17. As described to the consumer when collecting their Personal Information.
18. To market our products and/or services and/or related products and services, and to tailor our marketing and sales activities to our clients interests.

We do not collect additional categories of Personal Information, nor process the collected Personal Information for a different purpose than the ones described in this Privacy Policy and Appendixes.

The Personal Information we collect allows us to keep you posted on our latest product announcements, software updates, and upcoming events. Also, to customize the content and advertising you see on our Site, personalizing your experience and allowing us to deliver the type of content and product offerings you are most interested in and to send periodic emails regarding our products and/or services. If you don’t want to be on our mailing list, you can opt-out anytime by contacting us at the following email address: legal@mainxp.com

5. Legal basis we follow to process your Personal Information.

We rely on the following legal bases to collect and process your Personal Information under applicable data protection laws:

• Consent: where you have provided your consent for the processing of your Personal Information for a specific purpose.
• Performance of a contract: where processing is necessary for the performance of a contract with you or taking steps prior to entering a contract with you.
• Legal obligation: where we have a legal obligation to process your Personal Information for example when responding to a public or governmental authority, courts, or regulators, according to a legal obligation under applicable law.
• Legitimate interest: to satisfy a legitimate interest, for example when it is not required by law but it clearly benefits you.

6. Cookies and other technologies.

To enable our systems to recognize your browser or device and to provide and improve our products and services, we use cookies and other technologies.

Cookies are small files that a site or its service provider transfers to your computer’s hard drive through your Web browser (if you allow it) that enable the site’s or service provider’s systems to recognize your browser and capture and remember certain information. For instance, we may use cookies to help us remember and process the items in your shopping cart. They are also used to help us understand your preferences based on previous or current site activity, which enables us to provide you with improved services. We also use cookies to help us compile aggregate data about site traffic and site interaction so that we can offer better site experiences and tools in the future.

6.1 Categories of Cookies.

We classify cookies in the following categories:

We use cookies to:

• Understand and save your preferences for future visits.
• Compile aggregate data about site traffic and site interactions in order to offer better site experiences and tools in the future. We may also use trusted third-party services that track this information on our behalf
• Personalize content and ads.

6.2 Web Beacons.

We may use web beacons (which are very small graphic images or objects embedded in our Site or e-mail) to collect information about your online actions, visits to our Site, and other activity. The information we obtain in this manner enables us to customize the services we offer to users of our Site, to deliver targeted advertisements, and to measure the overall effectiveness of our online advertising, content, programming, or other activities.

6.3 How to manage Cookies.

In your browser:Please be aware that you may modify or withdraw your consent for the use of cookies at any time. If you do not want to allow cookies anymore, you may use your web browser either to accept them or reject them. For such purposes, follow the instructions on your web browser. Please bear in mind, that if you set your browser to reject cookies, you may not be able to use all our functions on the web.In your device:In your mobile device, your operating system (OS) offers options for avoiding personalized advertising -both in IOS and Android- to limit the use of information with the use of apps to generate advertisements based on your interests and tastes. Please be aware that advertisers and our partners may also use their own cookies and beacons, and we do not hold control of the information they collect. You will need to refer to their Privacy Policies. These third parties may use the information collected to serve more relevant advertisements. To configure your cookie controls and reject advertising cookies, follow the instructions on your device.

7. Your rights as a Data Subject.

Under applicable laws, you are granted certain rights in relation to your Personal Information. Accordingly, we offer you security, transparency, control, and access to your Personal Information as available, and with the exceptions set forth in applicable laws. We recognize the following rights (which you can exercise in accordance with Section 8):

1. Right to know what information is being collected. Right to access personal information. You have the right to request us to disclose:

   1. The categories of Personal Information we have collected about you.
   2. The categories of sources from which the Personal Information was collected.
   3. The business or commercial purpose for which the Personal Information was collected, sold or shared.
   4. The categories of third parties to whom we disclose Personal Information.
   5. The specific pieces of your Personal Information we have collected.

   To make a verifiable consumer request for information about the Personal Information we have collected about you, please use our Contact Form or email us at legal@mainxp.com.

2. Right to delete your personal information. You have the right to request us to delete any Personal Information that we have collected from you subject to certain exceptions according to applicable law.

3. Right to no retaliation following opt-out or exercise of other rights. You have the right not to be discriminated against by us as a result of your exercise of any of your rights under applicable law. If you exercise any of your rights hereunder, we won’t deny you our goods or services, charge you a different price or rate for our goods or services, provide you a different level or quality of goods or services, or take any other retaliatory action against you.

4. Right to opt-out of the sale or sharing of your personal information. You have the right to opt-out of the sale or sharing of your Personal Information in accordance with Section 14.

5. Right to correct inaccurate personal information. You have the right to request us to correct any inaccurate Personal Information, taking into account the nature of the Personal Information and the purposes for which such Personal Information was collected, processed, or used.

6. Right to know what information is sold or shared and to whom. You have the right to request us to disclose:

   1. The categories of Personal Information that we sold or shared about you and the categories of third parties to whom the personal information was sold or shared.
   2. The categories of Personal Information that we have disclosed about you for a business purpose and the categories of persons to whom we have made such disclosure.

7. Right to limit use and disclosure of sensitive Personal Information. You have the right to request us to use your Sensitive Personal Information only to the extent that is necessary to perform the services or provide the goods, as would be reasonably expected by an average consumer who requests such goods or services.

   Under this Privacy Policy, Personal Information is considered sensitive if it reveals:

   1. Racial or ethnic origin.
   2. Political opinions.
   3. Religious or philosophical beliefs.
   4. Trade union membership.
   5. Genetic or biometric data for the purpose of uniquely identifying a natural person.
   6. Data concerning health or data concerning a natural person’s sex life or sexual orientation.

8. How to exercise your rights.

You might exercise any of your rights under this Privacy Policy by submitting your request through our Contact Form at the following link (https://www.mainxp.com/contact-us/), or by contacting us at the following e-mail address legal@mainxp.com.

When receiving a verifiable consumer request, we will confirm that the person making the request is the consumer about whom we have collected the Personal Information. We will generally avoid requesting additional information for such purpose. However, if we cannot verify the identity of the consumer from the information already maintained by us, we may request certain additional information that will be only used for the purposes of verifying the consumer’s identity.

We will address your verifiable consumer request in an appropriate manner, and we will respond to your request in the term that is applicable pursuant to the Appendixes set forth in this Private Policy or, if none is applicable, within 45 (forty-five) days from the date on which your request was received.

Provided you have a password-protected account with us, we may verify your identity, by authenticating you through that account.

However, please note that some of your rights may be subject to certain limitations or exemptions, as provided under applicable law.

8.1. Requests made through authorized agents.

Please note that you also may designate an authorized agent to make the request on your behalf and exercise your right to opt-out of the sale or sharing of your Personal Information. Before accepting your agent’s request, we will take all steps necessary to verify you have duly authorized such agent to act on your behalf, for which they must provide us a signed written authorization or a copy of a power of attorney.

Please note that the parents and/or legal guardians of a child may exercise the rights on behalf of such child.

9. How we share your Personal Information.

We may share your Personal Information globally with our affiliates and group companies to carry out our activities, as specified in this Privacy Policy. Also, we may share Personal Information with third parties located in different countries which may differ from your location or country of origin. Therefore, the Personal Information we collect may be collected, transferred to, processed, and/or stored, in the United States or anywhere where we, our affiliates, our partners, our vendors, agents, suppliers, or service providers maintain facilities. As such, your Personal Information may be subject to privacy laws from different countries.

In this regard, we may share your Personal Information with:

• Our affiliates: to provide our services and/or products.
• Our vendors, agents, suppliers, or service providers: that help us conduct our business and/or support our infrastructure (such as payment processors when you purchase our products and/or services, live chat services provider, etc.).
• Advertising partners.
• Channel partners.
• For business transfers: we share your Personal Information in those cases where we sell or negotiate to sell our business to a buyer or potential buyer, or in the event of a change in corporate structure by merger, consolidation, liquidation, transfer of substantial assets, or in the unlikely event of bankruptcy. In this case, we will continue to ensure the security and confidentiality of your Personal Information, and give you notice before your Personal Information is transferred to a buyer or becomes subject to a different privacy policy.
• Others: for example, to regulators or law enforcement authorities as required by applicable law, court order, or governmental regulations.

10. Advertising.

We may display advertisements from third parties and other content on our Site that may link you to third parties’ websites and/or apps. We cannot control nor be liable or be held responsible for such content and the third-party’s privacy policies. If you click and access a third-party advertisement or link, please understand that you are leaving our Site, and any personal information you provide thereunder will not be covered by this Privacy Policy.

Please refer to the third-party privacy policy to find out how they collect and process your personal information.

11. Data retention and deletion.

We will keep your Personal Information as long as necessary to fulfill the purposes described herein. Upon your request, we will delete your Personal Information, unless we are allowed or required to keep certain Personal Information, for example, to fulfill a legal obligation or to resolve a dispute, etc.

12. How secure is your Personal Information.

We design our systems with your security and privacy in mind. We are firmly committed to the security of your Personal Information. We will make our best efforts to protect your Personal Information by implementing adequate technical, physical, administrative, and organizational measures, in order to guarantee the security of your information. We have implemented several measures such as encryption, and pseudonymization, among others to protect your information. However, please be advised that no system is ever completely secure, and you can decide not to use our products and/or services.

We also encourage you to take all possible measures to secure your Personal Information by using a safe strong password that is not used on other online services, never sharing your password with others, signing off the account immediately after having used the account, being sure you have signed off when using a shared computer, among others.

13. Data Breaches.

Despite our best efforts to guarantee the maximum possible level of security of your information by adopting technical and organizational measures to contribute to the security of your data, there may be data breaches. Provided we suffer a data breach, we will take all necessary measures to reduce its effects and we will comply with applicable laws.

14. Right to opt-out of the sale/sharing of Personal Information.

You have the right to opt-out of the sale or sharing of your Personal Information as described in Section 7

We share information with third parties who work with us, as explained in Section 9, for the purposes described therein. Information about our customers is an important part of our business, and we do not sell information about you. We do not exchange information about you with third parties in exchange for money or other consideration. If you do not want us to share your Personal Information, or sell it in the future, please opt-out of the sharing and/or sale of your Personal Information by contacting us at legal@mainxp.com or by completing our Contact Form and typing ‘Do Not Share/Sell My Personal Information’ in the message box.

If you prefer for us not to sell your Personal Information, please access the following link, in order to opt-out of the future sale of your Personal Information or contact us at the following email address legal@mainxp.com.

Please be aware that if you choose to exercise your right to opt-out, we may not be able to provide you with some or all of our services and/or products.

15. Use of our services by children.

We protect children. Our services are not directed to individuals under the age of 18 years or the equivalent minimum age in the relevant jurisdiction. If you are underage, please do not use our services and do not provide us with any Personal Information.

We will not collect, use, process, share, store, or sell the Personal Information of underage users, if we have actual knowledge that a certain user is underage. Should we become aware that a user under the age of 13 has registered without verifiable parental consent, any such information will be deleted.

16. Where we store your Personal Information.

Your Personal Information will be stored in our databases or in secured servers.

17. Do Not Track settings.

Our Site does not recognize Do Not Track signals. Some third parties may collect aggregate information about the users’ online activities over time and across websites when they use the Site. While this information does not include personally identifiable information, certain processing activities that combine aggregate information with other information in possession of such third parties could result in the identification of users.

18. Update this Privacy Policy.

We may make changes to this Privacy Policy from time to time. We encourage you to review it regularly to learn how we are protecting your privacy. Unless stated otherwise, our Privacy Policy applies to all the Personal Information we have about you. We will post any changes to this policy on this page, and we may also contact you via your contact information, for example by email. Each version of this policy is identified at the bottom of the page by its effective date.

19. How to contact us.

Thanks for reading our Privacy Policy. If you have any questions, requests, comments, and/or concerns regarding this Privacy Policy, please contact us at the following e-mail: legal@mainxp.com.

Last updated: February [8]th, 2024.

Appendix I: General Data Protection Regulation 2016/679 (“GDPR”).

1. Scope. If you are a resident of the European Union (“EU”) and we process data about you that might be considered Personal Information under the GDPR, this Appendix shall apply.

2. Your rights as a Data Subject. You have the rights indicated in Section 7 in accordance with the provisions of the GDPR. You also have the following rights: a. Right to restriction of processing. You have the right to restrict us from processing all or some of your Personal Information, temporarily or permanently. b. Right to data portability. You have the right to request us a copy of your Personal Information in an electronic format, along with the right to transmit such data to another controller. c. Right to not be subject to automated decision-making. You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. d. Right to withdraw your consent. At any time, you have the right to withdraw the consent you have given us to carry out the processing of your Personal Information.

3. How to exercise your rights. We shall take all the appropriate measures to provide you with any information you have requested in a concise, transparent, intelligible, and easily accessible form, using clear and plain language, in particular for any information addressed specifically to a child. We shall answer your request within 1 month of the date on which it was received. Please bear in mind that –in certain situations (e.g. the complexity of your request)– we may extend the term by 2 additional months. In such case, we will inform you within the original 1-month term.

4. Restrictions to your rights. Please note that the exercise of your rights is subject to certain restrictions pursuant to the EU and/or EU Member’s local law, as indicated in Section 23 of GDPR. In addition, if we are not in a position to identify you, then we shall not facilitate the exercise of your rights. Please note that, if you exercise your right to withdraw your consent, such withdrawal will not affect the lawfulness of the processing carried out before you exercise this right.

5. Sensitive Personal Information. Under the GDPR, Personal Information is considered sensitive if it reveals:

   1. Racial or ethnic origin.
   2. Political opinions.
   3. Religious or philosophical beliefs.
   4. Trade union membership.
   5. Genetic or biometric data for the purpose of uniquely identifying a natural person.
   6. Data concerning health or data concerning a natural person’s sex life or sexual orientation. We will process your Sensitive Personal Information only if one of the conditions set forth under section 9 of the GDPR applies.

6. Use of our services by children. Under the GDPR, the processing of Personal Information related to a child is lawful if the child is at least 16 years old. If the child is under 16 years old, processing will only be lawful if the consent is given or authorized by the child’s holder of parental responsibility, and to the extent of such consent. That’s why, whenever possible, we try to make reasonable efforts to verify consent is given or authorized by the holder of parental responsibility over the child, as permitted by available technology.

7. How secure is your Personal Information. We design our systems with your security and privacy in mind. We are firmly committed to the security of your Personal Information. That is why we implement appropriate technical and organizational measures to protect your Personal Information. In case of a data breach, we will notify you without undue delay about it, in clear and plain language, pursuant to section 34 of the GDPR. We will inform you about the nature of the Personal Information affected and the security measures we have taken to tackle this breach. Please note that certain exceptions may apply (e.g.: we shall not inform you about the data breach if we implemented appropriate technical and organizational protection measures, and those measures were applied to the Personal Information affected by the data breach, in particular, those that render the personal data unintelligible to any person who is not authorized to access it, such as encryption; we shall not communicate you about the data breach if we have taken subsequent measures which ensure that the high risk to the rights and freedoms of data subjects is no longer likely to materialize, etc.).

Appendix II: California Privacy Rights Act (“CPRA”).

1. Scope. If you are a resident of California and we process data about you that might be considered Personal Information under the CPRA, this Appendix shall apply.

2. Your rights as a Data Subject. You have the rights indicated in Section 7 in accordance with the provisions of the CPRA.

3. How to exercise your rights. We shall take all the appropriate measures to provide you with any information you have requested. We shall answer your request within 45 days from the date on which your request was received. Please bear in mind that –in certain situations (e.g. the complexity of your request)– we may extend the term by 45 additional days. In such case, we will inform you within the original 45-day term, together with the reasons for the extension.

4. Restrictions to your rights. Please note that the exercise of your rights is subject to certain restrictions pursuant to the CPRA. (e.g. we shall not delete your personal information if it is necessary to: a) complete the transaction for which the personal information was collected; b) help to ensure security and integrity to the extent the use of the consumer’s personal information is reasonably necessary and proportionate for those purposes; c) to comply with a legal obligation, etc.; in case your request is manifestly unfounded or excessive, we may either charge you with a reasonable fee taking into account the administrative costs of providing the information or refuse to act on the request and notify you the reason for refusing your request, etc.).

5. Sensitive Personal Information. Under the CPRA, Personal Information is considered sensitive in the following cases: a. Personal Information that reveals: i. A consumer’s social security, driver’s license, state identification card, or passport number. ii. A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account. iii. A consumer’s precise geolocation. iv. A consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership. v. The contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication. vi. A consumer’s genetic data. b. The processing of biometric information for the purpose of uniquely identifying a consumer. c. Personal Information collected and analyzed concerning a consumer’s health. d. Personal Information collected and analyzed concerning a consumer’s sex life or sexual orientation.

6. Use of our services by children. Under the CPRA, a child is any natural person who is under 16 years old. Please note that, under the CPRA, the child’s parents and/or legal guardian may exercise the rights described above on behalf of the child. That’s why –in case we receive a request from a child’s parent and/or legal guardian–, we will both analyze and reply to it within the legal terms granted by the CPRA.

Appendix III: Virginia Consumer Data Privacy Act (“VCDPA”).

1. Scope. If you are a resident of the Commonwealth of Virginia and we process data about you that might be considered Personal Information under the VCDPA, this Appendix shall apply.

2. Your rights as a Data Subject. You have the rights indicated in Section 7 in accordance with the provisions of the VCDPA. You also have the following rights: a. Right to receive a copy of your personal information. You have the right to request a copy of the Personal Information we have collected about you in a portable and, to the extent technically feasible, readily usable format to allow you to transmit your Personal Information to another entity without hindrance if the processing is carried out by automated means. b. Right to opt-out of the processing of Personal Information for purposes of targeted advertising and profiling. Jointly with the right to opt-out of the sale or sharing of your Personal Information, you have the right to opt-out of the processing of your Personal Information for purposes of targeted advertising and profiling in furtherance of decisions that produce legal or similarly significant effects to you.

3. How to exercise your rights. We shall take all the appropriate measures to provide you with any information you have requested. We shall answer your request within 45 days from the date on which it was received. Please bear in mind that –in certain situations (e.g. the complexity of your request)– we may extend the term by 45 additional days. In such case, we will inform you within the initial 45-day term together with the reasons for the extension. In case we decline your request, we will inform you no later than 45 days from the date on which your request was received. If you want to appeal our decision, send your appeal request to the following address legal@mainxp.com with the header “Appeal to Denial of Request”. We will answer your appeal within 60 days from the date on which it was received, which will include a written explanation for the decision taken. If we deny your appeal, you may contact Virginia’s Attorney General to submit a complaint by visiting https://www.virginia.gov/agencies/office-of-the-attorney-general/.

4. Restrictions to your rights. Please note that the exercise of your rights is subject to certain restrictions pursuant to the VCDPA (e.g. if your request is manifestly unfounded, excessive, or repetitive, we may charge you a reasonable fee to cover up the costs of analyzing your request; if we are unable to authenticate your request by using reasonable commercial efforts, we shall not analyze it; we shall provide you the requested information free of charge up to twice annually, etc.).

5. Sensitive Personal Information. Under the VCDPA, Personal Information is considered sensitive in the following cases: a. Personal Information revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status. b. Genetic or biometric data processed for the purpose of uniquely identifying a natural person c. The Personal Information collected from a known child. d. Precise geolocation data. In case we process Sensitive Personal Information, we will only carry out such processing if you have given us your consent to do so.

6. Use of our services by children. Under the VCDPA, a child is any natural person under 13 years old. The processing of Personal Information related to a child is lawful if it is done in accordance with the provisions set forth in the Children’s Online Privacy Protection Act (“COPPA”). Please note that, under the VCDPA, the child’s parents and/or legal guardian may exercise the rights described above on behalf of the child. In case we receive a request from a child’s parent and/or legal guardian, we will both analyze and reply to it within the legal terms granted by the VCDPA.

7. How secure is your Personal Information. We design our systems with your security and privacy in mind. We are firmly committed to the security of your Personal Information. That’s why we implement administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of your Personal Information. In case of a data breach, please note that the Code of Virginia Title 18.2 Chapter 6, Article 5 Subsections 18.2-186.6 might apply.

Appendix IV: Colorado Privacy Act (“CPA”).

1. Scope. If you are a resident of the State of Colorado and we process data about you that might be considered Personal Information under the CPA, this Appendix shall apply.

2. Your rights as a Data Subject. You have the rights indicated in Section 7 in accordance with the provisions of the CPA. You also have the following right: a. Right to data portability. You have the right to obtain your Personal Information in a portable and, to the extent technically feasible, readily usable format to allow you to transmit your Personal Information to another entity without hindrance. b. Right to opt-out of the processing of Personal Information for purposes of targeted advertising and profiling. Jointly with the right to opt-out of the sale or sharing of your Personal Information, you have the right to opt-out of the processing of your Personal Information for purposes of targeted advertising and profiling in furtherance of decisions that produce legal or similarly significant effects to you.

3. How to exercise your rights. We shall take all the appropriate measures to provide you with any information you have requested. We shall answer your request within 45 days from the date on which it was received. Please bear in mind that –in certain situations (e.g. the complexity of your request)– we may extend the term by 45 additional days. In such case, we will inform you within the original 45-day term together with the reasons for the extension. In case we decline your request, we will inform you no later than 45 days from the date on which your request was received, together with the reasons that support our decision and the instructions to appeal. In case you want to appeal our decision, send your appeal request to the following address legal@mainxp.com with the header “Appeal to Denial of Request”. We will answer your appeal within 45 days from the date on which it was received. Please bear in mind that –in certain situations (e.g. the complexity of your request)– we may extend the term by 60 additional days. In such case, we will inform you within the original 45-day term, together with the reasons for the extension. If you have any concerns about our response to your appeal, you may contact Colorado’s Attorney General to submit a complaint by visiting https://coag.gov.

4. Restrictions to your rights. Please note that the exercise of your rights is subject to certain restrictions pursuant to the CPA (e.g. we shall not comply with your request if, after making reasonable commercial efforts, we cannot authenticate your request; we may charge you a reasonable fee to cover up the costs of answering your request if you have submitted a second or subsequent request within a 12-month period, etc.).

5. Sensitive Personal Information. Under CPA, Personal Information is considered sensitive in the following cases: a. Personal Information revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, sex life or sexual orientation, or citizenship or immigration status. b. Genetic or biometric data that may be processed for the purpose of uniquely identifying an individual. c. Personal Information from a known child. In case we process Sensitive Personal Information, we will only carry out such processing if you have given us your consent to do so.

6. Use of our services by children. Under the CPA, a child is any individual who is under 13 years old. The processing of Personal Information related to a child is lawful only if the child’s parents or legal guardian have given their consent.

7. How secure is your Personal Information. We design our systems with your security and privacy in mind. We are firmly committed to the security of your Personal Information. That’s why we implement reasonable measures to protect your Personal Information. In case of a security breach, we will notify you without undue delay, no later than 30 days after we become aware of the incident pursuant to Title 6, Article 1, Part 7 Section 6-1-716 of the 2022 Colorado Code. Please note that certain exceptions may apply (e.g. if our internal investigation determines that the misuse of your Personal Information has not occurred and is not reasonably likely to occur).

Appendix V: Connecticut Data Privacy Act (“CDPA”).

1. Scope. If you are a resident of the State of Connecticut and we process data about you that might be considered Personal Information under CDPA, this Appendix shall apply.

2. Your rights as a Data Subject. You have the rights indicated in Section 7 in accordance with the provisions of the CDPA. You also have the following rights. a. Right to obtain a copy of the personal information. You have the right to obtain your Personal Information in a portable and, to the extent technically feasible, readily usable format to allow you to transmit your Personal Information to another entity without hindrance where the processing is carried out by automated means. b. Right to opt-out of the processing of Personal Information for purposes of targeted advertising and profiling. Jointly with the right to opt-out of the sale or sharing of your Personal Information, you have the right to opt-out of the processing of your Personal Information for purposes of targeted advertising and profiling in furtherance of decisions that produce legal or similarly significant effects to you.

3. How to exercise your rights. We shall take all the appropriate measures to provide you with any information you have requested. We shall answer your request no later than 45 days from the date on which it was received. Please bear in mind that –in certain situations (e.g. complexity of your request/number of requests received)– we may extend the term by 45 additional days. In such case, we will inform you within the original 45-day term together with the reasons for the extension. In case we decline your request, we will inform you no later than 45 days from the date on which your request was received, together with the reasons that support our decision. If you want to appeal our decision, you must send your appeal request to the following address legal@mainxp.com with the header “Appeal to Denial of Request”. If you decide to appeal our decision, we will answer your appeal no later than 60 days from the date on which it was received. If we deny your appeal, you may contact Connecticut’s Attorney General to submit a complaint by visiting https://portal.ct.gov/AG.

4. Restrictions to your rights. Please note that the exercise of your rights is subject to certain restrictions pursuant to the CDPA (e.g. we shall not comply with your request if, after making reasonable commercial efforts, we cannot authenticate your request or identity or the identity of the agent acting on your behalf; we shall not comply with your opt-out request if we have a good faith, reasonable and documented belief that such request is fraudulent; if your request is manifestly unfounded, excessive, or repetitive, we may charge you with a reasonable fee to cover up the costs of analyzing your request; we may give you the data requested free of charge up to once during a 12-month-period; we shall not comply with your request if the confirmation or access to your Personal Information would require us to reveal a trade secret, we shall not comply with your right to obtain a copy if that would require us to reveal a trade secret, etc.).

5. Sensitive Personal Information. Under CDPA, Personal Information is considered sensitive in the following cases: a. Data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation or citizenship or immigration status. b. Genetic or biometric data processed only for the purpose of uniquely identifying an individual. c. Personal Information collected from a known child. d. Precise geolocation data. In case we process Sensitive Personal Information, we will only carry out such processing if you have given us your consent to do so.

6. Use of our services by children. Under the CDPA, a child is any individual who is under 13 years old. The processing of Personal Information related to a child is lawful if it is done in accordance with the provisions set forth in the Children’s Online Privacy Protection Act (“COPPA”). Please note that, under the CDPA, the child’s parents and/or legal guardian may exercise the rights described above on behalf of the child. In case we receive a request from a child’s parent and/or legal guardian, we will both analyze and reply to it within the legal terms granted by the CDPA.

Appendix VI: Argentine Personal Data Protection Act No. 25,326 (“PDPA”).

1. Scope. If you are a resident of Argentina and we process data about you that might be considered Personal Information under PDPA, this Appendix shall apply.

2. Your rights as a Data Subject. You have the rights indicated in Section 7 in accordance with the provisions of the PDPA. You also have the following rights: a. Right to update your personal information. You may request us to update the Personal Information we have collected about you. b. Right to request information. You have the right to request information to the supervisory authority about the existence of databases, the controller’s identity, and the purposes for which the Personal Information has been processed.

3. How to exercise your rights. If you exercise any of these rights, we will check your entitlement and respond to you within 10 (ten) calendar days from the date on which your request to access your Personal Information was received; or 5 (five) business days from the date on which (i) your request for any rectification, update, or deletion of your Personal Information was received; or (ii) we noticed a mistake on your Personal Information. To exercise your rights, please contact us at legal@mainxp.com. You represent and warrant that you have been duly informed that: “The data subject has the right to access your Personal Information at intervals of not less than six months free of charge unless there is a specified legitimate interest agreed upon by the interested party as established in section 14, paragraph 3 of Act 25,326, by submitting an email to the following email address: legal@mainxp.com. The AGENCY OF ACCESS TO PUBLIC INFORMATION, in its function of Controlling Entity of Act 25,326, has the attribution to attend any complaints or reports related to the infringement of personal data regulations”.

4. Restrictions to your rights. Please note that the exercise of your rights is subject to certain restrictions pursuant to Section 17 of the PDPA. For example, we have the right to not delete your Personal Information when we are required to retain such data based on a legal obligation or if such deletion affects a third party.

5. Sensitive Personal Information. Under PDPA, Personal Information is considered sensitive if it reveals: a. Racial or ethnic origin. b. Political opinions. c. Religious or philosophical beliefs. d. Trade union membership. e. Data concerning health or data concerning a natural person’s sex life or sexual orientation.

6. Use of our services by children. In Argentina, a child is a person under 18 years old. Pursuant to Criteria No. 5 of Annex I of the Resolution AAIP 4/2019, the processing of Personal Information of a child in Argentina will be lawful if: a) The child has given its consent based on the progressive autonomy principle, as set forth in Sections 26 and 639 of the Argentine Federal Civil and Commercial Code, taking into account the child’s psychophysical characteristics, aptitudes, and development; b) The consent has been given by the child´s holder of parental responsibility, parent and/or legal guardian when the child’s psychophysical characteristics, aptitudes, and development do not allow the child to give its consent.

7. How secure is your Personal Information. We design our systems with your security and privacy in mind. We are firmly committed to the security of your Personal Information. That’s why we implement administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of your Personal Information, in compliance with Sections 9 and 10 of the PDPA and Resolution AAIP 47/2018.

Appendix VII: Utah Consumer Privacy Act (“UCPA”).

1. Scope. If you are a resident of Utah and we process data about you that might be considered Personal Information under the UCPA, this Appendix shall apply, provided that the UCPA is in full force and effect.

2. Your Rights as a data subject. You have the rights indicated in Section 7 in accordance with the provisions of the UCPA. You also have the following rights:

   a. Right to obtain a copy of your personal information. You have the right to request a copy of the Personal Information you have previously provided to us in a portable and, to the extent technically feasible, readily usable format to allow you to transmit your Personal Information to another entity without impediment where the processing is carried out by automated means.

   b. Right to opt-out of the processing of Personal Information for purposes of targeted advertising and processing of Sensitive Personal Information. Jointly with the right to opt-out of the sale or sharing of your Personal Information, you have the right to opt-out of the processing of your Personal Information for purposes of targeted advertising, as well as to opt-out the processing of Sensitive Personal Information.

   c. Right to receive a clear notice prior to processing Sensitive Personal Information. You have the right to receive a clear notice about the processing of Sensitive Personal Information prior to the beginning of such processing.

   d. Right of no discrimination. You have the right to not be discriminated against (e.g. not to be denied any product or service; not to be charged with a different price or rate for any product or service; not to be provided with a different quality of a good or service) if you exercise your rights.

3. How to exercise your rights. We shall take all the appropriate measures to provide you with any information you have requested.

We shall answer your request no later than 45 days from the date on which it was received. Please bear in mind that –in certain situations (e.g. complexity of your request/volume of requests received)– we may extend the term by 45 additional days. In such case, we will inform you within the original 45-day term together with the reasons for the extension.

In case we decline your request, we will inform you no later than 45 days from the date on which your request was received, together with the reasons that support our decision.

Please note that if the consumer is subject to guardianship, conservatorship, or other protective arrangement pursuant to Title 75, Chapter 5 Protection of Persons Under Disability and Their Property, the guardian or conservator of the consumer shall exercise their rights on their behalf.

4. Restrictions to your rights. Please note that the exercise of your rights is subject to certain restrictions pursuant to the UCPA (e.g. we shall not comply with your request if it is excessive, repetitive, technically infeasible or manifestly unfounded; if we reasonably believe that the primary purpose for submitting the request was something other than exercising a right or if the request, individually or as part of an organized effort, harasses, disrupts or imposes undue burden on our business’ resources; we may charge you with a reasonable fee to cover up the administrative costs of complying your request; we may give you the data requested free of charge up to once during the same 12-month-period; we shall not comply with your request if, using commercially reasonable efforts, we are unable to authenticate your request; we may request additional information reasonably necessary to authenticate your request if we are unable to authenticate your request using commercially reasonable efforts; we shall not comply with your request if we suspect it is fraudulent and we are not able to authenticate the request before the 45-day-period expires, etc.).

5. Sensitive Personal Information. Under the UCPA, Personal Information is considered sensitive in the following cases: a. Data revealing racial or ethnic origin, religious beliefs, medical history, mental or physical health condition or diagnosis or medical treatment by a health care professional, sexual orientation or citizenship or immigration status. b. Genetic or biometric data, if the processing is for the purpose of identifying a specific individual. c. Specific geolocation data.

In case we process Sensitive Personal Information, we will only carry out such processing if you have given us your consent to do so.

6. Use of services by children. Under the UCPA, a child is any individual who is under 13 years old. The processing of Personal Information related to a child is lawful if it is done in accordance with the provisions set forth in the Children’s Online Privacy Protection Act (“COPPA”). Please note that, under the UCPA, the child’s parents and/or legal guardian may exercise the rights described above on behalf of the child. In case we receive a request from a child’s parent and/or legal guardian, we will both analyze and reply to it within the legal terms granted by the UCPA.

Appendix VIII: Texas Data Privacy and Security Act (“TDPSA”).

1. Scope. If you are a resident of Texas and we process data about you that might be considered Personal Information under the TDPSA, this Appendix shall apply, provided that the TDPSA is in full force and effect.

2. Your Rights as a data subject. You have the rights indicated in Section 7 in accordance with the provisions of the TDPSA. You also have the following rights: a. Right to obtain a copy of your personal information. If the data is available in a digital format, you have the right to obtain your Personal Information in a portable and, to the extent technically feasible, readily usable format to allow you to transmit your Personal Information to another controller without hindrance. b. Right to opt-out of the processing of Personal Information for purposes of targeted advertising and profiling. Jointly with the right to opt-out of the sale or sharing of your Personal Information, you have the right to opt-out of the processing of your Personal Information for purposes of targeted advertising or profiling in furtherance of a decision that produces a legal or similarly significant effect concerning yourself. c. Right of no discrimination. You have the right to not be discriminated (e.g. not to be denied any product or service; not to be charged with a different price or rate for any product or service; not to be provided with a different quality of goods or services) if you exercise your rights.

3. How to exercise your rights. We shall take all the appropriate measures to provide you with any information you have requested. We shall answer your request no later than 45 days from the date on which it was received. Please bear in mind that –in certain situations (e.g. complexity of your request/number of requests received)– we may extend the term by 45 additional days. In such case, we will inform you within the original 45-day term together with the reasons for the extension.

In case we decline your request, we will inform you no later than 45 days from the date on which your request was received, together with the reasons that support our decision. In case we decline your request, we will provide you with the instructions to appeal our decision.

If you decide to appeal our decision, we will answer your appeal no later than 60 days from the date on which it was received. If we deny your appeal, you may contact Texas’ Attorney General to submit a complaint by visiting https://www.texasattorneygeneral.gov/.

4. Restrictions to your rights. Please note that the exercise of your rights is subject to certain restrictions pursuant to the TDPSA (e.g. we shall not comply with your request if it is excessive, repetitive or manifestly unfounded or we may charge you with a reasonable fee to cover up the administrative costs of complying with your request; we may give you the data requested free of charge up to twice annually; we shall not comply with your request if, using commercially reasonable efforts, we are unable to authenticate your request; we may also request additional information reasonably necessary to authenticate your request; we shall not comply with an opt-out request received from an authorized agent if (i) the authorized agent does not communicate us the request in a clear and unambiguous manner, (ii) we are not able to verify, with commercially reasonable efforts, if you are a resident of Texas, (iii) we do not possess the ability to process the agent’s request, or (iv) if we do not possess similar or identical requests we receive from you for the purpose of complying with similar or identical laws or regulations of another state).

5. Sensitive Personal Information. Under TDPSA, Personal Information is considered sensitive in the following cases: a. Data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexuality, or citizenship or immigration status. b. Genetic or biometric data, if the processing is for the purpose of identifying an individual. c. Personal Information collected from a known child. d. Precise geolocation data.

In case we process Sensitive Personal Information, we will only carry out such processing if you have given us your consent to do so.

6. Use of services by children. Under the TDPSA, a child is any individual who is under 13 years old. The processing of Personal Information related to a child is lawful if it is done in accordance with the provisions set forth in the Children’s Online Privacy Protection Act (“COPPA”).

Please note that, under the TDPSA, the child’s parents and/or legal guardian may exercise the rights described above on behalf of the child. In case we receive a request from a child’s parent and/or legal guardian, we will both analyze and reply to it within the legal terms granted by the TDPSA.

Appendix IX: Oregon Consumer Privacy Act (“OCPA”).

1. Scope. If you are a resident of Oregon and we process data about you that might be considered Personal Information under the OCPA, this Appendix shall apply, provided that the OCPA is in full force and effect.

2. Your Rights as a data subject. You have the rights indicated in Section 7 in accordance with the provisions of the OCPA. You also have the following rights: a. Right to obtain a copy of the personal information. If the data is available in a digital format, you have the right to obtain your Personal Information in a portable and, to the extent technically feasible, readily usable format to allow you to transmit your Personal Information to another controller without hindrance. b. Right to opt-out of the processing of Personal Information for purposes of targeted advertising and profiling. Jointly with the right to opt-out of the sale or sharing of your Personal Information, you have the right to opt-out of the processing of your Personal Information for purposes of targeted advertising and profiling in furtherance of a decision that produces a legal or similarly significant effect concerning yourself.

Please note that you can designate another person to serve as your authorized agent to act on your behalf regarding this right to opt-out.

c. **Right of no discrimination.** 

You have the right to not be discriminated (e.g. not to be denied any product or service; not to be charged with a different price or rate for any product or service; not to be provided with a different quality of goods or services) if you exercise your rights.

3. How to exercise your rights. We shall take all the appropriate measures to provide you with any information you have requested. We shall answer your request no later than 45 days from the date on which it was received. Please bear in mind that –in certain situations (e.g. complexity of your request/number of requests received)– we may extend the term by 45 additional days. In such case, we will inform you within the original 45-day term together with the reasons for the extension.

In case we decline your request, we will inform you no later than 45 days from the date on which your request was received, together with the reasons that support our decision. In case we decline your request, we will provide you with the instructions to appeal our decision.

If you decide to appeal our decision, we will answer your appeal no later than 45 days from the date on which it was received. If we deny your appeal, you may contact Oregon’s Attorney General to submit a complaint by visiting https://www.doj.state.or.us/oregon-department-of-justice/contact-us/.

4. Restrictions to your rights. Please note that the exercise of your rights is subject to certain restrictions pursuant to the OCPA (e.g. we may give you the data requested free of charge up to once during any 12-month period unless the purpose of the second or subsequent request is to verify that we corrected inaccuracies in, or deleted your Personal Information in compliance with your request; we shall not comply with your request if, using commercially reasonable efforts, we are unable to authenticate your request without additional information from you unless you provide us the information necessary to authenticate your request; regarding your opt-out request, we may ask for additional information necessary to comply with such request, (e.g. information to identify you and your request); we may deny your request to opt-out if we have a good faith, reasonable and documented belief that your request is fraudulent, etc.).

5. Sensitive Personal Information. Under OCPA, Personal Information is considered sensitive in the following cases: a. Data revealing racial or ethnic background, national origin, religious beliefs, mental or physical condition or diagnosis, sexual orientation, status as transgender or non-binary, status as a victim of crime or citizenship or immigration status. b. Accurately identifies within a radius of 1750 feet a consumer’s present or past location, or the present or past location of a device that links or is linkable to a consumer by means of technology that includes, but is not limited to, a global positioning system that provides latitude and longitude coordinates. c. Genetic or biometric data. d. A child’s personal information.

In case we process Sensitive Personal Information, we will only carry out such processing if you have given us your consent to do so.

6. Use of services by children. Under the OCPA, a child is any individual who is under 13 years old. The processing of Personal Information related to a child is lawful if it is done in accordance with the provisions set forth in the Children’s Online Privacy Protection Act (“COPPA”).

Please note that, under the OCPA, the child’s parents and/or legal guardian may exercise the rights described above on behalf of the child or on behalf of a child for whom the guardian has legal responsibility. Moreover, a guardian or conservator may exercise the rights described herein on behalf of a consumer that is subject to a guardianship, conservatorship, or other protective agreement.

In case we receive a request from a child’s parent and/or legal guardian, or a consumer’s guardian or conservator, we will both analyze and reply to it within the legal terms granted by the OCPA.

Appendix X: Florida Digital Bill of Rights (“FDBR”).

1. Scope. If you are a resident of Florida and we process data about you that might be considered Personal Information under the FDBR, this Appendix shall apply, provided that the FDBR is in full force and effect.

2. Your Rights as a data subject. a. Right to obtain a copy of the personal information. You have the right to obtain your Personal Information in a portable and, to the extent technically feasible, readily usable format to allow you to transmit your Personal Information to another entity without hindrance where the processing is carried out by automated means. b. Right to opt-out of the processing of Personal Information for purposes of targeted advertising and profiling. Jointly with the right to opt-out of the processing sale or sharing of your Personal Information, you have the right to opt-out of the processing of your Personal Information for purposes of targeted advertising and profiling in furtherance of decisions that produce legal or similarly significant effects to you.

3. How to exercise your rights. We shall take all the appropriate measures to provide you with any information you have requested.

We shall answer your request within 45 days since we have received it. Please bear in mind that –in certain situations (e.g. the complexity of your request)– we may extend the term by 15 additional days. In case we need to extend the term, we will inform you within the original 45-day term, together with the reasons for the delay.

If the request is rejected, you will be informed of the reason for the rejection and the instructions to appeal the decision.

If you want to appeal our decision, you must send your appeal request to the following address legal@mainxp.com with the header “Appeal to Denial of Request.”

If you decide to appeal our decision, we will answer your appeal no later than 60 days from the date on which it was received, informing you in writing of any action taken or not taken in response to your appeal, including a written explanation of the reasons for the decisions.

We shall provide information or take action in response to your requests free of charge, twice per year, as long as such requests are not unfounded, excessive, or repetitive.

4. Restrictions to your rights. Please note that the exercise of your rights is subject to certain restrictions pursuant to the FDBR (e.g. we shall not comply with your request if, after making reasonable commercial efforts, we cannot authenticate your request; we may charge you a reasonable fee to cover up the costs of answering your request if you have submitted a third or subsequent request within a 12-month period, etc.).

5. Sensitive Personal Information. Under FDBR, Sensitive Data is considered one of the following.

   a. Personal information revealing an individual’s racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status. b. Genetic or biometric data processed for the purpose of uniquely identifying an individual. c. Personal information collected from a known child. d. Precise geolocation data.

In case we process Sensitive Data, we will only carry out such processing if you have given us your consent to do so.

6. Use of services by children Under the FDBR, a child is any individual who is under 18 years old. The processing of Personal Information related to a child is lawful if it is done in accordance with the provisions set forth in the Children’s Online Privacy Protection Act (“COPPA”).

Please note that, under the FDBR, the child’s parents and/or legal guardian may exercise the rights described above on behalf of the child. In case we receive a request from a child’s parent and/or legal guardian, we will both analyze and reply to it within the legal terms granted by the FDBR.

7. How secure is your Personal Information. We design our systems with your security and privacy in mind. We are firmly committed to the security of your Personal Information. That’s why we implement administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of your Personal Information. These measures are aimed at preventing, detecting, protecting against, or responding to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity, preserving the integrity or security of systems, or investigating, reporting, or prosecuting those responsible for any of these actions.

Appendix XI: Montana Consumer Data Privacy Act (“MCDPA”).

1. Scope. If you are a resident of Montana and we process data about you that might be considered Personal Information under the MCDPA, this Appendix shall apply, provided that the MCDPA is in full force and effect.

2. Your Rights as a data subject. You have the rights indicated in Section 7 in accordance with the provisions of the MCDPA. You also have the following rights: a. Right to obtain a copy of the personal information. You have the right to obtain your Personal Information in a portable and, to the extent technically feasible, readily usable format to allow you to transmit your Personal Information to another entity without hindrance where the processing is carried out by automated means.

   b. Right to opt-out of the processing of Personal Information for purposes of targeted advertising and profiling. Jointly with the right to opt-out of the processing sale or sharing of your Personal Information, you have the right to opt-out of the processing of your Personal Information for purposes of targeted advertising and profiling in furtherance of a decision that produces a legal or similarly significant effect to you.

3. How to exercise your rights. We shall take all the appropriate measures to provide you with any information you have requested.

We shall answer your request within 45 days since we have received it. Please bear in mind that –in certain situations (e.g. the complexity of your request)– we may extend the term by 45 additional days. In case we need to extend the term, we will inform you within the original 45-day term, together with the reasons for the delay.

If the request is rejected, you will be informed of the reason for the rejection and the instructions to appeal the decision.

If you want to appeal our decision, you must send your appeal request to the following address legal@mainxp.com with the header “Appeal to Denial of Request.”

If you decide to appeal our decision, we will answer your appeal no later than 60 days from the date on which it was received, informing you in writing of any action taken or not taken in response to your appeal, including a written explanation of the reasons for the decisions.

We shall provide information in response to your requests free of charge, once per 12-month period, as long as such requests are not unfounded, excessive, technically infeasible, or repetitive.

You may designate another person to serve as your authorized agent and act on your behalf to opt out of the processing of your personal information for the purposes already specified. You may designate an authorized agent by way of a technology, including but not limited to an internet link or a browser setting, browser extension, or global device setting indicating a customer’s intent to opt out of such processing.

On the other hand, the guardian or conservator of a consumer subject to a guardianship, conservatorship, or other protective arrangement, may exercise the rights of the consumer on their behalf regarding the processing of personal information.

4. Restrictions to your rights. Please note that the exercise of your rights is subject to certain restrictions pursuant to the MCDPA (e.g. we shall not comply with your request if, after making reasonable commercial efforts, we cannot authenticate your request; we may charge you a reasonable fee to cover up the costs of answering your request if you have submitted a second or subsequent request within a 12-month period, etc.).

5. Sensitive Information Under MCDPA, Sensitive Data is considered one of the following.

   a. Data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, information about a person’s sex life, sexual orientation, or citizenship or immigration status. b. The processing of genetic or biometric data for the purpose of uniquely identifying an individual. c. Personal information collected from a known child. d. Precise geolocation data.

In case we process Sensitive Data, we will only carry out such processing if you have given us your consent to do so.

6. Use of services by children. Under the MCDPA, a child is any individual who is under 13 years old. The processing of Personal Information related to a child is lawful if it is done in accordance with the provisions set forth in the Children’s Online Privacy Protection Act (“COPPA”).

Please note that, under the MCDPA, the child’s parents and/or legal guardian may exercise the rights described above on behalf of the child. In case we receive a request from a child’s parent and/or legal guardian, we will both analyze and reply to it within the legal terms granted by the MCDPA.

7. How secure is your Personal Information.

We design our systems with your security and privacy in mind. We are firmly committed to the security of your Personal Information. That’s why we implement administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of your Personal Information. These measures are aimed at preventing, detecting, protecting against, or responding to security incidents, identity theft, fraud, harassment, malicious or deceptive activities, or any illegal activity, preserving the integrity or security of systems, or investigating, reporting, or prosecuting those responsible for any of these actions.

In case of a security breach, we will notify you without undue delay, according to applicable state regulations.