September 7, 2023

Privacy Notice

We appreciate your interest in our services, our website (https://lokker.com/) and online communities (collectively, our “Websites”), and our Privacy Edge platform (“Platform”) (collectively referred to as “Services“). This privacy notice explains how we collect, use, transfer or otherwise process personal information. Lokker is generally responsible for and controls the processing of your personal information collected through our Services.

Wherever our customers use our Services to submit, manage, or otherwise use content relating to our customers’ end users (“Customer Data”) during the provision of our Service, we have contractually committed ourselves to only process such Customer Data on behalf of and under the instruction of our customer, who is the data controller.

Lokker, owned and operated by Apomaya, Inc. dba Lokker (“Lokker”, “us“, “our“), complies with the EU-U.S. Data Privacy Framework program (“EU-U.S. DPF”), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework program (“Swiss-U.S. DPF,” and together with the EU-US DPF and the UK Extension to the EU-U.S. DPF, the “Data Privacy Frameworks”) as set forth by the U.S. Department of Commerce. Lokker has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Lokker has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework program Principles (“Swiss-U.S. DPF Principles”) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

In compliance with the EU-U.S. DPF and the Swiss-U.S. DPF, Lokker commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of human resources data received in reliance on the EU-U.S. DPF and the Swiss-U.S. DPF in the context of the employment relationship.

With respect to personal data received or transferred pursuant to the Data Privacy Frameworks, Lokker is subject to the regulatory and enforcement powers of the U.S. Federal Trade Commission.

1. Information We Collect

In providing our Services, we may collect personal information about you including the following:

If you order Service from us, fill out the “contact us” form, or ask for a quote (via our Website, phone, email, or letter): This includes your name, company name, company address, billing contact, billing address, company email address, company phone number, job title, job function, industry, price and service information, and customer ID. When you order our services, we may also collect payment information such as your bank account and routing number or Automated Clearing House (“ACH”) payment information. Please note that we use third-party payment processors, including Stripe, to process payments made to us via credit card. The payment processor’s use of your personal information is governed by their privacy notice. To view Stripe’s privacy notice, visit: https://stripe.com/privacy. We may also process information (a) we need to contact you or otherwise communicate with you, (b) for order fulfillment and delivery of the requested Services, (c) maintenance and training associated with our Services, (d) to manage your account, (e) to enable the download or usage of Services, (f) on defects or erroneous Services, your feedback and complaints, quotes we offer you, and (g) for invoicing and payment follow-up.
If you apply for employment: We may collect your contact and demographic information, educational and work history, employment interests, information obtained during interviews, and any other information you choose to provide.
If you contact us via our Website, phone, email, or letter, (e.g., for a support request): We may collect your name, company name, company address, company email address, company phone number, and information on our communication with you, your interest in Lokker and its Services and any additional information you provide us.
If you participate in our events, such as webinars, and trade fairs, or if you download our white papers: You may collect name, company name, email address, phone number, address, position/job title, job function, job level and any information on the event or download.
If you are included in our marketing campaigns: We may send you marketing communication via mail, email, and social media channels. In this context, we may collect and process your name, email address, address, marketing campaign information such as the newsletter option you have selected, your reaction to our marketing, and your interest in our Services. You may unsubscribe to emails by using the unsubscribe link in the footer of the email.

2. How We Collect Your Information

The personal information is collected in many ways and may include:

The personal information you provide to us. Most of the personal information we receive comes to us voluntarily from our customers while registering for or using our Services and communicating with us in the process of requesting our Services, registering to attend a seminar, participating in a survey, interacting with us at trade shows, conventions or other events, asking to be included in an email or other communication list, or other product promotions. You are free to choose which personal information you provide to us or whether you want to provide us with any personal information at all. However, some personal information, such as your name, address, and information on your requested Services may be necessary for the performance of our contractual obligations. Unless you provide this personal information, you will not be able to use certain Services or enter into a contract with us.
Personal information collected via technology. As you use our Services, we may collect information about you automatically, such as log information and the use of cookies or other tracking technologies. See Section 6 below for more information.
Personal information we receive from others. We may receive personal information about you from publicly available databases or third parties such as social media sites, data providers, data analytics tools (to help us troubleshoot any bugs or issues with the Services), marketing consultants and partners, law enforcement agencies, or through transactions such as mergers and acquisitions.

3. How We Use Your Information

The reasons for using your personal information may differ depending on the purpose of the collection. Routinely, we use your personal information for the following purposes:

Providing our Services. If you use our Services or if you contact us to request our Services, we use your personal information to provide you with these Services and information.
Pursue our business interests. The usage of your personal information may also be necessary for our own business interests. For example, we may use some of your personal information to evaluate and review our business performance, create financial statements, improve our Services, provide advertising or identify potential cybersecurity threats. We may use your personal information for marketing purposes (for example, to send you relevant product updates), but we will not sell or share your contact information with any business partners. If necessary, we may also use your personal information to pursue or defend ourselves against legal claims.
Purpose for which consent has been provided. In some cases, we may ask you to grant us specific consent to use your personal information.
Comply with legal obligations. We are obligated to retain certain information because of legal requirements, for example, tax or commercial laws, or we may be required by law enforcement to provide personal information on request.

4. How We Share Your Information

As necessary and appropriate, we will share your personal information with the following third parties:

Lokker affiliated companies. To support our sales and marketing efforts, as well as in the performance of the Services, your personal information may be disclosed to affiliates of Lokker.
Service providers and advisors. We may use third-party vendors and other service providers to perform services on our behalf. Such services may include marketing campaigns, mail or email services, tax and accounting services, product fulfillment, payment processing, surveys or contests, customer service, data enhancement services, fraud prevention services, web hosting services or analytic services. These third parties include: Google, OKTA, Salesforce, and WordPress. Any service providers will be subject to data processing agreements and be bound to process the data only on Lokker’s behalf and under its instructions, unless such service providers act as their own controllers (e.g., in case we seek advice from lawyers and tax consultants).
Purchasers and third parties in connection with a business transaction. We may use third parties in connection with a Lokker-related transaction, such as a merger, sale of Lokker assets or shares, reorganization, financing, change in control or acquisition of all or a portion of our business, or in the event of a bankruptcy or similar proceedings.
Law enforcement, regulators, and other parties for legal reasons. We may use third parties as required by law or pursuant to a subpoena or if we reasonably believe that such action is necessary to (a) comply with the law and the reasonable requests of law enforcement; (b) to enforce our legal claims or to protect the security or integrity of our Services; or (c) to exercise or protect the rights, property, or personal safety of Lokker employees, our visitors, or others.
Otherwise with consent. We may disclose an individual’s personal information to certain other third parties with that individual’s consent.

5. Accountability for Onward Transfer

In cases of onward transfer to third parties of information relating to individuals in the EU, United Kingdom and/or Switzerland, Lokker will (i) transfer such data only for limited and specified purposes; (ii) ascertain that the processor is obligated to provide at least the same level of privacy protection as is required under the Data Privacy Frameworks; (iii) take reasonable and appropriate steps to ensure that the processor effectively processes the personal information transferred in a manner consistent with Lokker’s obligations under the Data Privacy Frameworks; (iv) require the processor to notify Lokker if it makes a determination that it can no longer meet its obligation to provide the same level of protection as is required by the Data Privacy Frameworks; (v) upon notice, including under (iv), take reasonable and appropriate steps to stop and remediate unauthorized processing by such processor; and (vi) provide a summary or a representative copy of the relevant privacy provisions of its contract with that processor to applicable regulators upon request. To the extent provided by the Data Privacy Frameworks, Lokker remains liable under Data Privacy Frameworks if a processor to whom it transfers personal information of individuals in the EU, United Kingdom and/or Switzerland as described above processes such personal information in a manner inconsistent with Data Privacy Frameworks, unless Lokker is not responsible for the event giving rise to the damage.

6. Information We Collect Automatically

When using our Services, we use various technologies to collect information about the device or browser you use to navigate our websites or from your use of our Services, including:

Cookies. When you use or visit our Services, we may send one or more cookies — small text files containing a string of alphanumeric characters — to your computer or device that allows us to uniquely identify your browser, computer, or device. A cookie may also convey other information to us, such as your Internet Protocol (IP) address; unique device identifiers; your browser settings and specification; and information about how you use the Service (e.g., the pages you view, the links you click, features and functionalities you utilize, how frequently you access the Service, and other actions you take on the Service). Cookies also allow us to track your usage of the Service over time. For specific cookie information and a list of cookies this website sets, please click the “Manage Consent” link on the bottom of our website.
Log Files. We may record log file information each time you access the Platform. This information may include your requests or actions; IP address; browser type; unique device identifiers; information about your computer or device; the number of clicks; how you interact with links, features, or functionalities on the Service; and other such information.
Clear Gifs. We may employ clear gifs (also known as web beacons or pixel tags) which collect information about you, your computer, or devices such as your requests or actions; IP address; unique device identifiers; browser type; information about your computer or device; how you interact with links, features, or functionalities of the Service; information about cookies; all of which can show your Service usage patterns.

We use or may use the data collected through these technologies to: (a) remember information so that you won’t have to re-enter it during your visit or the next time you visit the Platform; (b) identify you across multiple devices; (c) provide and monitor the effectiveness of our Services; (d) monitor aggregate metrics such as total number of visitors, traffic, usage, and demographic patterns on our Services; (e) diagnose or fix technology problems; and (f) otherwise to plan for and enhance our Services.

If you would prefer not to accept cookies, most browsers allow you to: (i) change your browser settings to notify you when you receive a cookie, which lets you choose whether to accept it; (ii) disable existing cookies; or (iii) set your browser to automatically reject cookies. Note that doing so may negatively impact your experience using the Service, as some features and services on our Services may not work properly. Depending on your device and operating system, you may not be able to delete or block all cookies. You may also set your e-mail options to prevent the automatic downloading of images that may contain technologies that would allow us to know whether you have accessed our e-mail and performed certain functions with it.

7. Links to Third-Party Websites and Services

Our Services may contain features of our business partners, advertisers and social media sites, links to and from their third-party websites, and our users may post links to third-party websites, such as LinkedIn, Twitter, YouTube, and Vimeo. If you follow a link to any of these websites or use these features, note that these websites and features are governed by the privacy notices of these third parties. We accept no responsibility or liability for their notices or privacy practices. We recommend that you read their privacy notices and terms of use to understand how they collect, use, process, and share personal information.

8. Children’s Privacy

We do not knowingly collect or solicit any personal information from anyone under the age of 16 (a child) on or through the Services. If we learn that we have inadvertently collected personal information from a child, we will delete that information as quickly as possible. If you believe that we have any information from a child, please contact us using the contact information in Section 11.

9. Your Rights and Options

We want you to understand your rights and options regarding how we may use your personal information. These rights and options may include the following:

Access, correction, and deletion. Upon written request, Lokker will advise you whether we hold any of your personal information. You may access, correct, and delete the personal information stored in your account using the account settings in your user profile. You may also contact us for any access, correction, and deletion request, using the contact information in Section 11 below. We will respond to your request within a reasonable timeframe.
Cookies settings and preferences. You may disable cookies and other tracking technologies through the settings in your browser. If you have provided consent to use cookies and similar tracking technology or would like to learn more about how to avoid tracking technology, see Section 6 above.
Marketing preferences. If you have consented to receive marketing communication (e.g., by signing up for our newsletters), you may withdraw your consent at any time. You can also opt out of receiving marketing communication if we do not rely on consent by using the link provided to you at the end of each promotional communication. You may also contact us using the information in Section 11 below to request that we remove you from a marketing list.
Deny or withdraw your consent. If you have granted us consent to use your personal information, we will use it only for the purposes for which you have granted consent. You are free to withdraw your consent at any time and the withdrawal will have no negative consequences for you. However, we may not be able to continue to provide you with the Services to which this consent relates. To withdraw your consent, please contact us using the contact information in Section 11 below.

10. Privacy Notice Updates

We make changes to our Privacy Notice from time to time without notice and will indicate these by changing the Last Updated date at the beginning of this Privacy Notice. Please review our Privacy Notice regularly, as the updated Privacy Notice will apply to your future use of our Services.

11. How to Contact Us

In compliance with the Data Privacy Frameworks, Lokker commits to resolve complaints about your privacy and our collection or use of your personal information transferred to the United States pursuant to the EU-U.S. DPF Principles, the UK Extension to the EU-U.S. DPF Principals and the Swiss-U.S. DPF Principles. European Union, United Kingdom, and Swiss individuals with inquiries or complaints should first contact us at:

Lokker Corporate HQ
PO Box 5545
Redwood City, CA 94063 USA

Lokker has further committed to refer unresolved privacy complaints under the Data Privacy Framework program to an independent dispute resolution mechanism, Data Privacy Framework Services, operated by BBB National Programs. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/programs/all-programs/dpf-consumers/ProcessForConsumers for more information and to file a complaint. This service is provided free of charge to you.

If your DPF complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/s/article/G-Arbitration-Procedures-dpf?tabset-35584=2

ADDITIONAL EUROPE-SPECIFIC DISCLOSURES

12. Scope of Disclosures

These additional Europe-specific disclosures supplement the information contained in our Privacy Notice above to comply with the requirements under applicable data protection laws in Europe, in particular the General Data Protection Regulation and the UK GDPR (“GDPR”). Unlike the generally applicable Sections 1-10 above of this Privacy Notice, these additional Europe-specific disclosures apply only to our collection and processing of personal information of individuals in Europe.

13. Legal Bases on Which We Collect and Use Your Personal Information

Routinely, we use your personal information based on the following legal grounds according to the GDPR:

Performance of our contractual Services or prior to entering into a contract with you. If you use Services from Lokker or if you contact us to request our Services, we use your personal information to provide these Services to you.
Justified by our legitimate interests. The use of your personal information may also be necessary for our own business interests. For example, we may use some of your personal information to evaluate and review our business performance, improve and optimize our Services, conduct research, provide advertising, and send technical notices, updates and security alters, or to identify potential cybersecurity threats. We may use your personal information for marketing purposes, for example, to send you relevant product updates and to qualify and manage the customer relationship. If necessary, we may also use your personal information to pursue or defend ourselves against legal claims. See Section 5 for further information regarding the use of cookies and other tracking technology.
Consent. In some cases, we may ask you to grant us separate consent to use your personal information. See Section 8 above regarding the rights and options you have in this respect.
Compliance with legal obligations. We are obligated to retain certain personal information because of legal requirements, for example, tax or commercial laws, or we may be required by law enforcement to provide personal information on request.

We do not use your personal information for automated individual decision-making.

14. International Data Transfers

As we are based in the United States, your personal information will be stored and processed in the United States which has not yet been approved as providing a data protection standard adequate to individuals within the European Union. We may transfer personal information about you to other entities outside Europe. Whenever we transfer your personal information outside of Europe, we rely on appropriate or suitable safeguards recognized under applicable law in Europe, including adequacy decisions, Standard Contractual Clauses that have been adopted by the European Commission and provide appropriate guarantees for the transfer of personal information.

You can request a copy of our Standard Contractual Clauses by contacting us using the contact information in Section 11 above.

We may also transfer personal information about you to countries that the European Commission has deemed to adequately safeguard personal information.

15. Data Storage

We store personal information for up to 5 years since your account’s last activity. We store your personal information for this length of time to fulfill the purposes for which we collected your personal information and in accordance with our legal obligations and legitimate business interests. You can delete your personal information at any time in the user control panel.

If you signed up for our promotional emails, we will delete your personal information if you unsubscribe from receiving our promotional emails. However, we will store your email address in a blacklist to ensure that you do not receive any further communication.

16. Europe-specific Rights

Subject to the applicable law in your jurisdiction, you have the following rights with respect to your personal information that we hold:

Right of access. The right to obtain access to your personal information.
Right to rectification. The right to obtain rectification of your personal information without undue delay where that personal information is inaccurate or incomplete.
Right to erasure. The right to obtain the erasure of your personal information without undue delay in certain circumstances, such as where the personal information is no longer necessary in relation to the purposes for which it was collected or processed.
Right to restriction. The right to obtain restriction of the processing undertaken by us on your personal information in certain circumstances, such as where you contest the accuracy of the personal information, for a period of time enabling us to verify the accuracy of that personal information.
Right to portability. The right to move, copy or transfer personal information easily from one organization to another.
Right to object. You have a right to object to any processing based on our legitimate interests where there are grounds relating to your situation. You can object to marketing activities for any reason whatsoever.

If you wish to exercise any of these rights, contact us by using the contact information in Section 11 above.

In addition to the foregoing rights, you also have the right to lodge a complaint with your local data protection authority. However, we encourage you to first reach out to us using the contact information in Section 11 above so we have an opportunity to address your concerns directly and find an acceptable solution before you lodge a complaint.

ADDITIONAL CALIFORNIA-SPECIFIC DISCLOSURES

17. Scope of Notice.

These additional California-specific disclosures (the “CA Notice”) supplement the information in the Privacy Notice Sections 1-10 above and apply solely to individual residents of the State of California (“consumers” or “you”). This CA Notice provides additional information about how we collect, use, disclose and otherwise process personal information of individual residents of the State of California, either online or offline, within the scope of the California Consumer Privacy Act of 2018 (“CCPA”).

Unless otherwise expressly stated, all terms in this CA Notice have the same meaning as defined in our Privacy Notice above or as otherwise defined in the CCPA.

18. Collection, disclosure, and sale of personal information.

In the last 12 months, except as described below, we have not sold personal information about you, but we have collected and disclosed for a business purpose the following categories and examples of specific pieces of personal information, which reference the personal information described in the “Our Collection of Personal Information” and “How We Share Your Personal Information” sections of our above privacy notice:

Category of Personal Information	Collected	Disclosed for Business Purpose	Sold*
Identifiers, including your name, email address, username and password	Yes	Yes	No Personal Information Sold
Commercial Information, including purchase history	Yes	Yes
Internet/Network Information, such as IP address, device and browser information, clickstream data, log data and analytics data	Yes	Yes
Professional/Employment Information, such as industry, current employer and job title.	Yes	Yes
Other Personal Information, such as personal information you provide us in relation to a question, request or inquiry, or information you post on our social media pages or otherwise provide to us	Yes	Yes
Inferences, including predictions about your interests and preferences	Yes	Yes

19. Sources of personal information.

As described in the “Our Collection of Personal Information” section of our Privacy Notice, we collect personal information directly from you when you provide it to us, automatically when you visit our websites and other online services, and from service providers and other third parties. For representatives of our clients, vendors, service providers and other third parties, we also collect personal information directly from you and from the entity you represent.

20. Purposes for collecting personal information.

We collect personal information about you for the purposes described in the “How We Use Your Personal Information” section of our above privacy notice. For representatives of our clients, vendors, service providers and other third parties, we also collect your personal information to maintain an ongoing relationship between us and the entity you represent and to contact you in connection with our relationship with the entity you represent.

21. Recipients of personal information.

As described in the “How We Share Your Personal Information” section of our above privacy notice, we share personal information within Lokker and with a variety of third parties. For representatives of our clients, vendors, service providers and other third parties, we also share your personal information with the entity you represent.

22. California-specific rights.

As a California resident, you may be able to exercise the following rights in relation to the personal information about you that we have collected (subject to certain legal limitations):

Right to know: The right to request the following information we have collected and disclosed about you in the last 12 months:
- The categories and specific pieces of personal information we have collected about you;
- The categories of sources of the personal information;
- The purposes for collecting or, if applicable, selling the personal information;
- The categories of personal information we have sold about you (if any), and the categories of third parties to whom this information was sold; and
- The categories of personal information we have disclosed for a business purpose and the categories of recipients.
Right to deletion. The right to request the deletion or erasure of personal information we have collected about you, subject to certain exceptions.
Right to opt-out. The right to direct us not to sell personal information we have collected about you to third parties now or in the future.
Right to opt-in. If you are under the age of 16: The right to authorize us, or have your parent or guardian authorize us, to sell personal information about you.
Non-discrimination. The right to be free from discrimination for exercising any of the rights described above. Please note, however, that if the exercise of the rights described above limits our ability to process personal information (such as in the case of a deletion request), we may not be able to provide our services and offerings to individuals who exercise these rights, or to otherwise engage with such individuals going forward.

23. How to exercise your California-specific rights.

To exercise your right to know or right to deletion. To exercise your right to know and/or right to deletion, please submit a request by:

Emailing us using the contact information in Section 11 above with the subject line “California Rights Request,”; or
Filling out the California Resident Rights Request Form and sending it to us using the contact information in Section 11 above.

Before processing your request, we will need to verify your identity and confirm you are a resident of the State of California. In order to verify your identity, we will generally require you to (1) log into your account if you have one, or (2) the matching of sufficient information you provide us to the information we maintain about you in our systems. This may require us to request additional personal information from you, including your email address, company, title, and/or date of last interaction with Lokker. We will only use personal information provided in connection with a Consumer Rights Request to review and comply with the request.

We may decline a request if we are unable to verify your identity or locate your personal information in our systems. If we are unable to comply with your request, we will explain the reason(s) to you.

You are permitted to use an authorized agent (as that term is defined by the CCPA) to submit requests on your behalf through the process set forth in this CA Notice where we can verify the authorized agent’s authority to act on your behalf. For requests to know or delete personal information, we must receive (a) a power of attorney valid under the laws of California from you or your authorized agent, or (b) sufficient evidence to show that you have (I) provided the authorized agent signed permission to act on your behalf, (ii) verified your own identity directly with us pursuant to the instructions set forth in this CA Notice, and (iii) directly confirmed with us that you provided the authorized agent permission to submit the request on your behalf. For requests to opt-out of personal information sales, we must receive signed permission from you demonstrating your authorized agent has been authorized by you to act on your behalf.

24. Additional California-specific information on children’s privacy.

We do not sell the personal information of consumers we know to be less than 16 years of age unless we receive affirmative authorization (the “Right to Opt-In”) from either the minor who is between 13 and 16 years of age or the parent or guardian of a minor less than 13 years of age. Please contact us using the contact information found in Section 11 above to inform us if you or your child are under the age of 16.

Annex 1 – Cookies

Please see our Privacy Notice for more information on how we use cookies and other tracking technologies.

Purpose	Description	Type & Expiry
Necessary:Performance	Our websites are built using industry standard web tools and services. These have built-in cookies which help compatibility issues (e.g., to identify your browser type) and improve performance (e.g., quicker loading of content).	SessionDeleted upon closing the browser
Necessary: Security	If you register for access to a restricted area, our cookies ensure that your device is logged for the duration of your visit. You will need your username and password to access the restricted areas.	SessionDeleted upon closing the browser
Necessary: Site Preferences	Our cookies may also remember your site preferences (e.g. language) or seek to enhance your experience (e.g. by personalizing a greeting or content). This will apply to areas where you have registered specifically for access or create an account.	SessionDeleted upon closing the browser
Analytics	We use several third-party analytics tools to help us understand how site visitors use ourwebsite. This allows us to improve the quality and content on Lokker.com for our visitors. The aggregated statistical data cover items such as total visits or page views, and referrers to our web sites. For further details on our use of Google Analytics, see below	PersistentDeleted automatically after 2 years if you don’t visit Lokker.com
Advertising	The videos we serve come from a third party website (YouTube). The YouTube service may include advertisements in the video stream.	SessionDeleted upon closing the browser