Effective Date: September 26, 2024

PRIVACY POLICY

Transparency, control, and accountability are the core principles that influence Magnet Forensics Inc.’s (“MFI”) and its affiliates’ (collectively, “Magnet Forensics”) approach to personal information. From time to time, the nature of our business dictates that we may collect personal information from our customers and partners. Because we are committed to protecting your privacy rights and the information you provide to us, we have developed this Privacy Policy (“Policy”). This Policy sets forth how Magnet Forensics collects, uses, and discloses personal information through our products and services, including our website (https://www.magnetforensics.com/), email, and any offerings where we may collect personal information, either online or offline (together, our “Services”).

Please read this Policy and our Terms and Conditions (“Terms”) carefully before using our Services. By using our Services or otherwise providing personal information to us, you acknowledge and agree to our Terms and consent to our collection, use, and disclosure practices as described in this Policy. If you do not agree, please discontinue use of our Services.

I.               Personal Information We Collect

“Personal information” (or “personal data”) generally means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly with you or your household. Personal information does not include data that is publicly available, de-identified, or aggregated. We may combine your personal information with data we obtain from our Services, other users, or other parties. We reserve the right to convert, or permit others to convert, your personal information into deidentified, anonymized, aggregated, or pseudonymized data, as permitted by law.

What personal information we collect may differ depending on how you interact with us and the functionalities you use, but our primary reason for collecting personal information is to provide Services to our customers.

We may collect the following categories of personal information:

We may also obtain personal information about you from other sources, including our vendors, subsidiaries, and affiliates. In some circumstances, we may obtain personal information about you from other parties, including business partners, resellers, and data brokers, some of which may sell the information to us. To understand your rights and choices regarding personal information collected by other companies, please consult the privacy policies of the businesses that you interact with.

If you are a job applicant, employee, contractor, or otherwise affiliated with Magnet Forensics in a professional context, please see our Job Applicant and Employee Privacy Notice for information about how we process your personal information in that context.

II.             Sources From Which We Collect Personal Information

Generally, we may collect the categories of personal information described above from the following categories of sources:

• directly from you, when you:
  • visit our offices or contact us;
  • request information about our Services;
  • purchase and use our Services;
  • respond to surveys, request whitepapers/newsletters/access to blogs; and
  • attend Magnet Forensics’ events and/or Magnet Forensics’ booth at
• through the use of tracking technologies on our online Services
• other companies we do business with, which may include your employer
• service providers that help us to run our business
• advertising networks
• social networks
• internet service providers
• data analytics providers
• third-party data suppliers

• other third parties, including your personal contacts or customers
• derived from other information we collect or otherwise created by us

III.            Why We Disclose Personal Information

We may disclose your personal information for any purposes not inconsistent with this Policy, our written statements at the point of collection, or applicable law. In general, we may disclose personal information as follows:

• Within our group of companies including with our affiliates, subsidiaries, locations,

• With our agents, vendors, consultants, and other business providers for them to provide their services to us. For example, we may disclose your personal information to provide and improve customer service, operate and improve our business and our Services, help run our promotions, process payments, perform auditing and quality control, communicate with you, and otherwise operate our

• With our advertising partners for the purposes of ad targeting, remarketing, and customized advertising content.

• As necessary, for the following purposes: (a) to comply with any legal process; (b) to respond to requests from public and government authorities; (c) to enforce our Terms; (d) to protect our operations and our rights, privacy, safety, or property, and/or that of you or others; and (e) to allow us to pursue available remedies or limit the damages that we may sustain.

• With our insurers and professional advisers for the purposes of managing risks, obtaining professional advice, exercising or defending against legal claims, etc.

• With other businesses in connection with or during negotiations of any reorganization, acquisition, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceeding).

IV.           Cookies and Tracking Technologies

We may use cookies and other tracking technologies (such as web beacons and pixels) to collect and store information about your interactions with our website, including information about your browsing behavior. Our website also supports third-party tracking technologies through which our service providers and third parties, such as advertising partners, can collect and use information regarding your interactions with our websites as further detailed below. Information collected through cookies is processed in accordance with this Policy. Please see Cookie Policy for more information about the cookies we may use.

V.             Opt-Out Preference Signals

Our website recognizes the Global Privacy Control (“GPC”) signal. If you are using a browser setting or a plug-in that sends an opt-out preference signal to each website you visit, we will treat that as a valid request to opt out. To download and use a browser supporting the GPC browser signal, click here: https://globalprivacycontrol.org. If you choose to use the GPC signal, you will need to turn it on for each supported browser or browser extension you use.

Some internet browsers incorporate a “Do Not Track” feature that signals to websites you visit that you do not want to have your online activity tracked. Given that there is not a uniform way that browsers communicate the “Do Not Track” signal, our website does not currently interpret, respond to or alter its practices when it receives “Do Not Track” signals sent by browsers, mobile devices, or other mechanisms.

VI.           Storage Location of the Personal Information We Collect

Your personal data is processed, hosted, and/or stored by us in Ontario, Canada. For certain business practices, third‐party providers may have access to your data. These third-party providers are typically vendors of cloud services or other IT hosting services located in Canada or USA. We also may provide your personal data to such third-party providers or our partners as part of the sales cycle. This can include both pre‐sales activities such as lead generation and activities related to processing orders. When using third‐party providers and partners, as required by applicable law, Magnet Forensics will enter into a data processing agreement to safeguard your privacy rights. When third‐party providers and partners are located outside the EU, Magnet Forensics ensures legal grounds for such international transfers by relying on cross-border transfer agreements or using the EU Model Clauses.

VII.         How Long We Store the Data We Collect

Depending on the purposes for collection, your personal information may be retained for as long as one of the following apply:

• Retention is reasonably necessary to manage our operations, to manage your relationship with us, or to satisfy another purpose for which we collected the personal information;

• Retention is reasonably necessary to carry out a disclosed purpose that is reasonably compatible with the context in which the personal information was collected;

• Retention is reasonably required to protect or defend our rights or property (which will generally relate to applicable laws that limit actions in a particular case); or

• We are otherwise required or permitted to keep your personal information by applicable laws or regulations.

Where personal information is used for more than one purpose, it will be retained at least as long as the latest period provides. Under some circumstances, we may maintain personal information indefinitely according to legal or regulatory requirements, including applicable legal holds, or for data backup or recovery purposes.

VIII.        California Privacy Rights

The California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 (“CCPA”) defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly , with a particular California resident. This section of the Privacy Policy is intended solely for California residents.

Targeted Advertising, Sales, and Sharing of Personal Information

Although we do not sell personal information in exchange for money, some of the ways in which we share personal information for targeted advertising may be considered “sales” or “sharing” under US state privacy laws.

The following is a list of categories of personal information that we sold or shared to third parties in the 12 months preceding the effective date of this Privacy Policy and the categories of third parties to whom we sold or shared such personal information:

The purposes for which we sell/share this information include showing you relevant ads

while you browse the internet or use social media, certain types of analytics, and similar purposes. We do not have actual knowledge that we sell or share the personal information of consumers under sixteen (16) years of age. If you would like to opt out, please see the information below for your state of residence.

The following is a list of categories of personal information that we disclosed for a business purpose in the 12 months preceding the effective date of this Privacy Policy and the categories of recipients to whom we disclosed such personal information.

The purposes for which we disclose this information include: providing the services and/or products to you, for protection and security, and to advertise or market to you.

Your Rights

Under the California Consumer Privacy Act (“CCPA”) and its regulations, California residents have the following rights. Please note that the disclosures within this Privacy Policy are not intended to apply to employees or job applicants. If you are a California employee, please see our employee privacy notice for more information. If you are a California job applicant, please see our Employee and Job Applicant Privacy Notice.

Right to Know. You have the right to know what personal information we have collected about you, which includes:

• The categories of personal information we have collected about you, including:

• The categories of sources from which we collected your personal information

• The business or commercial purposes for our collecting, selling, or sharing personal information

• The categories of recipients to which we disclose personal information
• The categories of personal information that we sold, and for each category identified, the categories of third parties to which we sold that particular category of personal information
• The categories of personal information that we disclosed for a business purpose, and for each category identified, the categories of recipients to which we disclosed that particular category of personal information

• The specific pieces of personal information we have collected about

Right to Correct. If you believe personal information we maintain about you is inaccurate, you have the right to request we correct that personal information.

Right to Delete. You have the right to request that we delete personal information we collected from you, subject to certain exceptions. Where we use deidentification to satisfy a deletion request, we commit to maintaining and using the information in deidentified form and will not attempt to reidentify the information.

Right to Opt-Out of Sales and Sharing of Personal Information. We do not sell your data, but you may request that we do not share your personal information for cross- context behavioral advertising. To opt-out, please email [email protected].

Right to Non-Discrimination for the Exercise of Your Privacy Rights. If you choose to exercise any of your privacy rights under the CCPA, you also have the right not to receive discriminatory treatment by us.

Submitting CCPA Rights Requests. The rights described above are subject to certain exemptions and exceptions as well as certain steps that must be taken to verify your identity. To submit a privacy rights request, please call us toll-free at 1-844-638-7884 or email us at [email protected]. Please note that if you submit a request to know, request to delete, or request to correct, you will be asked to provide two-to-three (2-3) pieces of personal information that we will match against our records to verify your identity. You may designate an authorized agent to make a request on your behalf; however, you will still need to verify your identity directly with us before your request can be processed. An authorized agent may submit a request on your behalf using the webform or toll-free number listed above.

California Shine the Light

We do not share personal information with third parties or affiliates for those parties own direct marketing. If you have questions about how we comply with California’s Shine the Light law, please contact us at [email protected].

II.             International Data Transfers

If you are using our Services from outside the United States, please be aware that information we obtain about you will be processed in the United States or in other jurisdictions and may be accessed by the courts, law enforcement, and national security authorities in those jurisdictions. By using our Service, you acknowledge and consent to the international transfer and processing of your personal information as described in thisPrivacy Policy. Please be aware that the data protection laws and regulations that apply to your personal information transferred to the United States or other countries may be different from the laws in your country of residence.

III.            Privacy Rights for Residents of Canada

If you would like to submit a request to access, correct, erase, or obtain a copy of personal information we maintain about you, or if you would like to receive written information about our policies and practices regarding service providers outside of Canada, please email us at [email protected] We may require specific information from you to help us verify your identity prior to processing your request. Applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to any legal restrictions on disclosing this information.

IV.           Supplemental Disclosures for Persons in the EU, EEA, and UK

As a supplement to the information provided throughout this Policy, we provide the following information for persons in the European Union (“EU”), the European Economic Area (“EEA”), and the United Kingdom (“UK”).

Magnet Forensics, Inc. is the data controller for personal information collected through our Services.

Personal data of German data subjects collected for purposes of: (i) administering an employment relationship; (ii) facilitating the sale, license, and/or support of our products; or (iii) marketing and/or demand generation of our products and services, is subject to the joint controllership of Magnet Forensics Inc. and Magnet Forensics GmbH, as set out in an Agreement pursuant to Article 26(1) of the GDPR.

Our Legal Bases for Personal Information. Your personal information is processed under the following legal bases:

• The processing is necessary for us to provide you with our Services. When you

make a purchase, transact business with us, or contact us with an inquiry, we require certain pieces of personal information to be able to provide our Services to you or perform our contractual obligations to you.

• We have a legal obligation to process your personal information, such as compliance with applicable laws, regulations, or court orders.

• We process personal information to achieve our legitimate interests of providing, improving and personalizing the experiences of users of our Services. We also process personal information to help ensure the security and integrity of our Services. When we rely on our legitimate interests, we take into account the effects

that these actions might have on you. If you have questions about our decisions regarding our legitimate interests, you may contact us.

• You have consented to our processing of your personal For example, we may rely on consent to use non-essential cookies to provide you with marketing communications or if we need to collect sensitive personal information from you. When you consent, you may change your mind and withdraw your consent at any time by emailing us at [email protected].

Your Privacy Rights. You have the right to access, correct, erase, and obtain a copy of personal information we maintain about you. You also have the right to object to or restrict our processing of your personal information. You may submit these requests by emailing us at [email protected]. We may require specific information from you to help us verify your identity prior to processing your request. Applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to any legal restrictions on disclosing this information.

Submitting a Complaint. If you are not satisfied with how we manage your personal information, you may contact us or submit a complaint to your local data protection authority. If you reside in the EU or EEA, you can find information about your data protection authority here. If you reside in the UK, you may file complaints with the Information Commissioner’s Office here.

V.             Links to Other Sites

The Services may include links to websites that are not owned or controlled by us. Please be aware that we are not responsible for the privacy practices of such other websites. We encourage you to be aware when you leave our Service and to read the privacy statements of each and every website you visit. This Policy applies only to information collected by our Services.

VI.           Security

The security of your personal information is important to us. We follow generally accepted industry standards to protect the personal information submitted to us, both during transmission and once we receive it. While we attempt to protect the information in our possession, no security system is perfect, and we cannot promise that information about you will remain secure in all circumstances.

VII.         Services Not for Children

Our Services are not intended for children, and we do not knowingly collect personal information from anyone under the age of majority in their jurisdiction. If we become aware that we have collected personal information from a child, we will delete it in accordance with applicable law.

VIII.        Changes to this Privacy Policy

We may update this Privacy Policy to reflect changes to our information practices. If we make any changes, we will update the effective date. Changes are effective when they are posted. We encourage you to periodically review this page for the latest information on our privacy practices.

IX.           Contact Information

If you have any questions, you m