SolidProfessor Privacy Notice

SP Applications Holdings DBA SolidProfessor Privacy Notice Version 01.07.2024

In force effective July 1, 2024

1. Who we are and about this Privacy Notice

   This Privacy Notice gives you information about how SolidProfessor collects and uses your personal data. This includes when you use our website, as a customer when you purchase a product from us, as a reseller, or in other business capacities. It includes any data you may provide when you register with us or a product account is created, either directly, via a reseller, or where your company/business employer or an educational establishment has subscribed and arranges a subscription or access for you to the SolidProfessor application.

   This website is not intended for those aged under 18, unless you are affiliated with an educational establishment.

   Where minors under the age of 18 have an account with us created through an educational establishment with a subscription to the SolidProfessor application, we do not collect or process personal identifiable information about such minors. To ensure they are not personally identifiable we integrate with 1EdTech’s Learning Tools Interoperability protocol (LTI), which is designed to provide anonymized student access, or by applying a pseudonymization processes so that individual minors cannot be identified by us.

   If you are under age 18 and not affiliated with an educational establishment, please leave this website now.

   Country specific addenda set out specific requirements for residents in the EU/EEA, California, Colorado, Connecticut, Oregon, Texas, Utah, Virginia, and Australia. If there is any conflict between this Privacy Notice and the country specific addendum, the addendum shall prevail. This website is not intended for residents beyond the U.S. and the above countries/states.

   This Privacy Notice is for information only and is not intended to, nor shall it have effect, as a contract between SolidProfessor and any third party. If you create a user account, this is subject to the Terms of Use which may be accessed here https://solidprofessor.com/terms-and-conditions/.

   Data Controller

   SP Applications Holdings, LLC, a Delaware limited liability company, DBA SolidProfessor, of 555 Clyde Avenue, Suite 16000 Mountain View, CA 94043 is the controller and responsible for your personal data (and referred to as “we”, “us” or “our” in this Privacy Notice).

   We have appointed a data protection officer (“DPO“) who is responsible for overseeing questions in relation to this Privacy Notice. If you have any questions about this Privacy Notice, please contact the DPO using the information set out in the contact details section 10.

2. The types of personal data we collect about you

   Personal data means any information about an individual from which that person can be identified. We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

   • Identity Data includes name, account and username, title, job function, date of birth.
   • Contact Data includes billing address, delivery address, email address, social media handle/profile, job title and employer, educational establishment, telephone numbers.
   • Financial Data includes bank account and payment card details.
   • Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us or have access to.
   • Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform, device ID and other technology on the devices you use to access this website.
   • Profile Data includes your username and password, subscriptions, purchases or orders, your interests, preferences, feedback and survey responses, and test results.
   • Usage Data includes information about how you interact with and use our website and our products.
   • Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

   We also collect, use and share aggregated data such as statistical or demographic data which is not personal data as it does not directly (or indirectly) reveal your identity. We do not process special category personal information.

3. How is your personal data collected?

   We use different methods to collect data from and about you including through:

   • Your interactions with us. You may give us your personal data by filling in online forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you
     • subscribe for our products (either directly, via a reseller, your employer or an educational establishment);
     • request a product demonstration, product or marketing material;
     • create a user account on our website or to active a product;
     • subscribe to publications;
     • request marketing to be sent to you;
     • enter a competition, promotion or survey;
     • give us feedback or contact us; or.
     • undertaking a skills test.
   • Automated technologies or interactions. As you interact with our website, we will automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. Please see section 4 below for further details. We do not otherwise use automated decision taking technology.
   • Third parties or publicly available sources. We will receive personal data about you from various third parties and public sources as set out below:
     • Technical Data is collected from the following parties:
     • analytics providers such as Google and Amplitude;
     • advertising networks such as Google AdSense and LinkedIn Ads; and
     • search information providers such as Google AdWords.
     • Contact, Financial and Transaction Data is collected from providers of technical, payment and delivery services such as Visa/Mastercard and other electronic payment services.
     • Identity and Contact Data is collected from publicly available sources such as your personal or company’s website, LinkedIn, or other social media. In some cases if you purchase or subscribe for a product through a third party reseller, they will provide your personal data to us to process your order/subscription. If your employer or an educational establishment subscribes for a product, your data may be passed on to us by them by an account admin.
4. How we use your personal data

   Legal basis

   We are required to have a legal basis for collecting and using your personal data. We rely on one or more of the following legal bases:

   • Performance of a contract with you: Where we need to perform the contract we are about to enter into or have entered into with you.
   • Legitimate interests: We may use your personal data where it is necessary to conduct our business and pursue our legitimate interests, for example to allow you access to a product where your employer or educational establishment has subscribed, to prevent and detect fraud and enable us to give you the best and most secure customer experience. We make sure we consider and balance any potential impact on you and your rights (both positive and negative) before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law).
   • Legal obligation: We may use your personal data where it is necessary for compliance with a legal obligation that we are subject to. We will identify the relevant legal obligation when we rely on this legal basis.
   • Consent: We rely on consent only where we have obtained your active agreement to use your personal data for a specified purpose, for example if you subscribe to an email newsletter.

   Purposes for which we will use your personal data

   We have set out below, in a table format, a description of all the ways we plan to use the various categories of your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

   Purpose/Use	Type of data	Legal basis and retention period
   To register you as a new user.	(a) Identity (b) Contact	Consent if you register with us direct. Performance of a contract with you. Legitimate interest where your employer or educational establishment has subscribed for a product and to which you have access. We will retain this data for as long as you retain an account with us or for as long as the subscription is valid (whichever is the longer). Where a subscription has lapsed and an account is inactive for 12 months, we will delete personal data at the end of that period unless required by law to retain it for longer.
   To process and deliver your order/subscription including: (a) Manage payments, fees and charges. (b) Collect and recover money owed to us.	(a) Identity (b) Contact (c) Financial (d) Transaction (e) Marketing and Communications	(a) Performance of a contract with you. (b) Legitimate interest where your employer or educational establishment has subscribed for a product and to which you have access or necessary for our legitimate interests (to recover debts due to us). Where a subscription has lapsed and an account is inactive for 12 months, we will delete personal data after six years unless required by law to retain it for longer.
   To manage our relationship with you which will include: (a) Notifying you about changes to our terms or Privacy Notice. (b) Dealing with your requests, complaints, queries and renewals. (c) Providing information about you and your user activity to a reseller.	To manage our relationship with you which will include: (a) Notifying you about changes to our terms or Privacy Notice. (b) Dealing with your requests, complaints, queries and renewals. (c) Providing information about you and your user activity to a reseller.	(a) Performance of a contract with you. (b) Necessary to comply with a legal obligation. (c) Legitimate interest where your employer or educational establishment has subscribed for a product and to which you have access or necessary for our legitimate interests (to keep our records updated and manage our relationship with you directly or via a reseller including providing contact and usage information about to you to a reseller if necessary). We will retain this data for as long as you retain an account with us or for as long as the subscription is valid (whichever is the longer). Where a subscription has lapsed and an account is inactive for 12 months, we will delete personal data at the end of that period unless required by law to retain it for longer.
   To enable you to participate in a prize draw, competition or complete a survey.	(a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications	(a) Performance of a contract with you. (b) Necessary for our legitimate interests (to study how customers use our products/services, to develop them and grow our business). We will retain this data for as long as you retain an account with us or for as long as the subscription is valid (whichever is the longer). Where a subscription has lapsed and an account is inactive for 12 months, we will delete personal data at the end of that period unless required by law to retain it for longer.
   To administer and protect our business and our website and applications (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data, cloud computing, database, data visualization, and web hosting infrastructure, data pipeline component: data transfer, cloud-based data warehouse, that provides the infrastructure, storage and processing engine to power data reporting and analysis, authentication).	(a) Identity (b) Contact (c) Technical	(a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise). (b) Necessary to comply with a legal obligation. We will retain this data for as long as you retain an account with us or for as long as the subscription is valid (whichever is the longer). Where a subscription has lapsed and an account is inactive for 12 months, we will delete personal data at the end of that period unless required by law to retain it for longer.
   To deliver relevant website content and online advertisements to you and measure or understand the effectiveness of the advertising we serve to you, customer success services, email communication, surveys.	(a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications (f) Technical	Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy). We will retain this data for as long as you retain an account with us or for as long as the subscription is valid (whichever is the longer). Where a subscription has lapsed and an account is inactive for 12 months, we will delete personal data at the end of that period unless required by law to retain it for longer.
   To use data analytics to improve our website, products/services, customer relationships and experiences and to measure the effectiveness of our communications and marketing, customer relationship management.	(a) Technical (b) Usage	Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy). We will retain this data for as long as you retain an account with us or for as long as the subscription is valid (whichever is the longer). Where a subscription has lapsed and an account is inactive for 12 months, we will delete personal data at the end of that period unless required by law to retain it for longer.
   To send you relevant marketing communications and make personalised suggestions and recommendations to you about goods or services that may be of interest to you based on your Profile Data.	(a) Identity (b) Contact (c) Technical (d) Usage (e) Profile (f) Marketing and Communications	Consent, having obtained your prior consent to receiving direct marketing communications. We will retain this data for as long as you retain an account with us or for as long as the subscription is valid (whichever is the longer). Where a subscription has lapsed and an account is inactive for 12 months, we will delete personal data at the end of that period unless required by law to retain it for longer.
   To carry out market research through your voluntary participation in surveys.		Necessary for our legitimate interests (to study how customers use our products/services and to help us improve and develop our products and services). We will retain this data for as long as you retain an account with us or for as long as the subscription is valid (whichever is the longer). Where a subscription has lapsed and an account is inactive for 12 months, we will delete personal data at the end of that period unless required by law to retain it for longer.

   Direct marketing

   During the process on our website or when creating a user account when your personal data is collected, you will be asked to indicate your preferences for receiving direct marketing communications from us via email. We may also analyse your Identity, Contact, Technical, Usage and Profile Data to form a view which products, services and offers may be of interest to you so that we can then send you relevant marketing communications.

   Third-party marketing

   We will get your express consent before we share your personal data with any third party for their own direct marketing purposes. Consent for this is managed via an opt-in option in the account creation process. You can opt-out at any time by changing your preference in your account settings.

   Opting out of marketing from us

   You can ask us to stop sending you marketing communications at any time by logging into the website or your user account and adjust your marketing preferences or by following the opt-out links within any marketing communication sent to you or by contacting us. Even if you opt-out of receiving marketing communications, you will still receive service-related communications that are essential for administrative or customer service purposes for example relating to order confirmations, updates to our Terms of Use, responding to customer service related queries.

   Cookies

   When you visit our website, we use cookies in combination with pixels, local storage objects and similar devices, and technologies (collectively “Cookies”) that we or our permitted service providers may use in connection with your interaction with our website to enable the effective, efficient operation of our website. Some of these may be set or placed by third parties.

   Cookies are in tracking technologies that interact with the browser of your device when accessing online content and by which it is possible to recognise that device when it interacts with or returns to our website. Cookies help us to provide a better experience by enabling us to monitor the online content you find useful and by gathering and remembering information about your preferences.

   There are different categories of Cookies as set out below. The table below sets out the different categories of Cookies, how they function, which Cookies we use and the reason why we use them. The different categories of Cookies are:

   • Essential/Necessary cookies are strictly necessary for the operation of our website, such as enabling contact forms to operate. Without these Cookies we cannot provide the requested services. We also use these Cookies for security purposes. We do not require your consent to use Essential Cookies.
   • Analytics/Statistical cookies are non-essential Cookies. These Cookies collect information on how you use our website. We use this information with your consent to measure the number of visitors like you to our website, determine whether specific content or communications have been viewed and to help us improve our website and communications.
   • Functional/preference cookies are non-essential Cookies. These Cookies allow us, with your consent, to remember choices or changes you have made (such as your choices regarding the use of Cookies). You have the right to decide whether to accept or reject non-essential Cookies. You can exercise your Cookie preferences when you first arrive at our website where you will see a notice about our use of technology such as Cookies, providing you with the opportunity to learn more and to choose which categories of Cookies you wish to allow to access your device before confirming and proceeding. You can also change these settings at any later point by going to your Cookie settings. The effect of disabling non-essential Cookies depends on which Cookies you disable, but our website might not operate properly if all the non- essential Cookies are switched off.
   • Optional/Marketing cookies are non-essential Cookies. These Cookies with your consent are used to track visitors across our websites. The intention is to display ads that are relevant and engaging for the individual user and thereby more valuable for publishers and third party advertisers.

   To view the Cookies we use please refer to our Cookies page at https://solidprofessor.com/cookie-declaration/. This changes from time to time so please check it regularly. You can change your preferences at any time by using the cookie manager link on our website at https://solidprofessor.com which also sets out the third parties.

5. Disclosures of your personal data

   We may share your personal data where necessary with the parties set out below for the purposes set out in the table above at section 4.

   • Specific external third parties as follows:
     

     Sub-processor	Subject matter	Nature
     AWS	Cloud computing, database, data visualization, and web hosting infrastructure	Make SolidProfessor’s services, including web applications, accessible online. Provide cloud-based infrastructure conforming to industry standard security measures. Provide reporting and data visualization services.
     Airbyte	Data pipeline component: data transfer	Transfer data from source databases to the data warehouse.
     Snowflake	Cloud-based data warehouse, that provides the infrastructure, storage and processing engine to power data reporting and analysis.	Collect, store, and process data to enable access to the Data Processor’s Application Services.
     Segment	Data pipeline component: data transfer	Transfer data from source databases and event streams to the data warehouse and other sub-processors including ChurnZero and Salesforce.
     ChurnZero	Customer success services, email communication, surveys	Collect, store, and process data to facilitate delivery of Customer Success staff services.
     Salesforce	Customer relationship management	Collect, store and process data to facilitate marketing, sales, and management of customer accounts by SolidProfessor staff.
     Google	Data Analytics Services, Authentication	Collect, store, and process data to inform SolidProfessor product and marketing teams about service usage, effectiveness, and optimization. Authentication for single sing on support.
     Amplitude	Data Analytics Services, User Experience Tools	Collect, store, and process data to inform SolidProfessor product teams about service usage, effectiveness, and optimization.
     HotJar	Data Analytics Services, User Experience Tools, User Surveys	Collect, store, and process data to inform SolidProfessor product teams about service usage, effectiveness, and optimization.
     SendGrid	Email delivery	Deliver email communication to users.

   • To third party professional advisers (such as accountants, auditors, bankers, and legal advisers) shareholders and group companies.
   • To third party reseller partners and an account admin (if your subscription is managed by an employer or educational establishment).
   • Third parties to whom we may choose to sell, transfer or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this Privacy Notice.
   • As required by law.

   We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

6. International transfers

   If you are resident in EU/EEA, California, Colorado, Connecticut, Oregon, Texas, Utah, Virginia, or Australia please refer to the country specific addendum. In addition, if you are resident in EU/EEA and we receive your personal data via a reseller or other third party (e.g., your employer or educational establishment has subscribed) we use:

   • specific standard contractual terms which give the transferred personal data the same protection as it has in the EU/EEA in some instances;
   • a derogation under article 49 GDPR in that personal data is transferred because it is necessary for the performance of a contract between the data subject and the controller or the implementation of pre-contractual measures taken at the data subject’s request; or
   • a derogation under article 49 GDPR in that the transfer is necessary for the conclusion or performance of a contract concluded in the interest of the data subject between the controller and another natural or legal person (e.g., your employer or educational establishment).

   We may also transfer your personal data to service providers that carry out certain functions on our behalf. This may involve transferring personal data outside the U.S. to countries which have laws that do not provide the same level of data protection If this occurs we always ensure that a similar degree of protection is afforded by ensuring that safeguards are implemented by using data processing agreements.

7. Data security

   We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

   We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

8. Data retention

   How long will you use my personal data for?

   Details of retention periods for different aspects of your personal data are set out above table. Personal data is only retained for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

   To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

   In some circumstances if you are EU/EEA resident you can ask us to delete your data. Please refer to section 9 below and the country specific addendum for further information.

9. Your legal rights – EU/EEA, California, Colorado, Connecticut, Oregon, Texas, Utah, Virginia, and Australia residents only

   Please refer to the applicable country specific addendum.

10. Contact details

    If you have any questions about this Privacy Notice or about the use of your personal data or you want to exercise your privacy rights, please contact our DPO at email address: privacy@solidprofessor.com.

11. Complaints

    If you are resident in the EU/EEA, California, Colorado, Connecticut, Oregon, Texas, Utah, Virginia, or Australia you have the right to make a complaint at any time to the applicable supervisory or regulatory authority and please refer to the applicable country specific addendum. We would, however, appreciate the chance to deal with your concerns so please contact us in the first instance.

12. Changes to the Privacy Notice and your duty to inform us of changes

    We keep our Privacy Notice under regular review. We may change it any time without prior notice to you unless it would diminish any of your rights. Please keep us informed if your personal data changes during your relationship with us, for example a new address or email address.

13. Third-party links

    This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the Privacy Notice of every website you visit.

EU/EEA Addendum

1. About

   This Privacy Policy (“Policy”) applies to the processing of personal data of residents in the EU and European Economic Area (“EEA”) in compliance with the General Data Protection Regulation (GDPR). This Policy supplements the Privacy Notice.

   At SolidProfessor, we recognize that privacy is important. This Policy applies to all of the products, services, and websites offered by SP Applications Holdings, LLC, DBA SolidProfessor or its subsidiaries or affiliated companies (collectively, “SolidProfessor’s services” or “services”).

   If you have any questions about this Policy, please feel free to contact us through our website at: https://www.solidprofessor.com/contact-us/ or by email: privacy@solidprofessor.com.

2. Information we collect and how we use it:

   We offer a number of services that do not require you to register for an account or provide any personal information to us. In order to provide our full range of services, we may collect the following types of information:

   • Information you provide – When you sign up for a SolidProfessor Account or other SolidProfessor service or promotion that requires registration, we ask you for personal information (such as your name, email address and an account password). For certain services, we also request credit card or other payment account information which we maintain in encrypted form on secure servers. We may combine the information you submit under your account with information from other SolidProfessor services or third parties in order to provide you with a better experience and to improve the quality of our services. For certain services, we may give you the opportunity to give consent or opt out of combining such information.
   • SolidProfessor cookies – Further information on the cookies used can be found in the Privacy Notice and/or in the cookie banner on the website.
   • User communications – When you send email or other communication to SolidProfessor, we may retain those communications in order to process your inquiries, respond to your requests, and improve our services.
   • Affiliated sites – We offer some of our services in connection with other websites. Personal information that you provide to those sites may be sent to SolidProfessor in order to deliver the service. We process such information in accordance with this Policy and applicable data protection regulations. The affiliated sites may have different privacy practices, and we encourage you to read their privacy policies.
   • Links – SolidProfessor may present links in a format that enables us to keep track of whether these links have been followed.
   • Other sites – This Privacy Policy applies to websites and services that are owned and operated by SolidProfessor. We do not exercise control over the sites displayed as search results or links from within our various services. These other sites may place their own cookies or other files on your computer, collect data, or solicit personal information from you.
3. Choices for personal information

   When you sign up for a particular service that requires registration, we ask you to provide personal information. SolidProfessor may use the personal information you provide us for a variety of purposes, including registration, authentication, and marketing purposes. In compliance with the applicable law, we may use the information to inform you of special offers, upgrades, and other products and services that may be of interest to you.

   If we propose to use personal information for any purposes other than those described in this Policy and/or in the specific service notices, we will ask you for giving consent or offer you an effective way to opt out of the use of personal information for those other purposes if the processing of personal data is based on legitimate interest. We will not collect or use sensitive information for purposes other than those described in this Policy and/or in the specific service notices, unless we have obtained your prior consent.

   You can decline or revoke to submit personal information to any of our services, in which case SolidProfessor may not be able to provide those services to you.

4. Information sharing

   SolidProfessor does not share personal information with other companies except our 3rd party vendors when required and in compliance with data protection regulations. The information made available to SolidProfessor includes: information voluntarily supplied by visitors to the website, tracking information recorded as visitors navigate through the website, and vendor-supplied information obtained with your permission. We provide opt-out options within all electronic communications.

   We provide such information to our subsidiaries, affiliated companies, or other trusted businesses or persons for the purpose of processing personal information on our behalf. We require that these parties agree to process such information based on our instructions and in compliance with this Policy, and any other appropriate confidentiality and security measures.

   We have a good faith belief that access, use, preservation, or disclosure of such information is reasonably necessary to (a) satisfy any applicable law, regulation, legal process, or enforceable governmental request, (b) enforce applicable Terms and Conditions, including investigation of potential violations thereof, (c) detect, prevent, or otherwise address fraud, security, or technical issues, or (d) protect against imminent harm to the rights, property, or safety of SolidProfessor, its users, or the public as required or permitted by law.

   We may share with third Parties certain pieces of aggregated, non-personal information, such as the number of users who searched for a particular term, or how many users clicked on a particular advertisement. Such information does not identify you individually.

   Please contact us for any additional questions about the management or use of personal data at: https://www.solidprofessor.com/contact-us/.

5. Data integrity

   SolidProfessor processes personal information only for the purposes for which it was collected, and in accordance with this Policy or any applicable service-specific privacy notice. We review our data collection, storage, and processing practices to ensure that we only collect, store, and process the personal information needed to provide or improve our services. We take reasonable steps to ensure that the personal information we process is accurate, complete, and current, but we depend on our users to update or correct their personal information whenever necessary.

6. Accessing and updating personal information

   When you use SolidProfessor services, we make good faith efforts to provide you with access to your personal information, either to correct this data if it is inaccurate or to delete such data at your request if it is not otherwise required to be retained by law or for legitimate business purposes. We ask individual users to identify themselves and the information requested to be accessed, corrected, or removed before processing such requests.

7. Duration

   We will delete your personal data as soon as their storage is no longer required or you request us to delete them; in the case of statutory retention obligations, we restrict the processing of the stored data accordingly.

8. Your rights

   You have the following statutory data protection rights under the respective legal requirements: right of access, right to erasure, right to rectification, right to restriction of processing, right to data portability, right to lodge a complaint with a data protection supervisory authority, right to withdraw consent and the right to object to certain data processing measures. If you wish to assert your data protection rights, you can contact us at https://www.solidprofessor.com/contact-us/ at any time or email privacy@solidprofessor.com

9. Enforcement

   SolidProfessor regularly reviews its compliance with this Policy. Please feel free to direct any questions or concerns regarding this Policy or SolidProfessor’s treatment of personal information by contacting us at: https://www.solidprofessor.com/contact-us/. We will cooperate with the appropriate regulatory authorities, including local data protection authorities, to resolve any complaints regarding the transfer of personal data that cannot be resolved between SolidProfessor and an individual.

10. Changes to this policy

    Please note that this Privacy Policy may change from time to time. We will not reduce your rights under this Policy without your explicit consent. Regardless, we will post any Policy changes on this page and, if the changes are significant, we will provide a more prominent notice (including, for certain services, email notification of Policy changes).

Australia Addendum

1. The collection, use, disclosure, storage and handling personal data (personal information)

1.1 By using our services, and providing your personal data (information) to us, including where you:

1. purchase a product from us, either directly, as a reseller, or in other business capacities;
2. register with us (on our website) or a product account is created, either directly, via a reseller, or where your company/business employer or an educational establishment has subscribed and arranges a subscription or access for you to the SolidProfessor application; or
3. you otherwise subscribe to, or access, the SolidProfessor application,
4. you agree and consent to us collecting, using, storing, disclosing or otherwise handing your personal data in accordance with this Privacy Notice. If you do not agree with the terms of this Privacy Notice, please do not use our website, use our services or provide us with your personal data.

1.2 We may change this Privacy Notice from time to time, by publishing changes on our website. The revised Privacy Notice will be effective on the date it is published. The date of the current version is at the top of this Privacy Notice. By continuing to use our website and our services (including in the manner set out in clause 1.1 of this addenda), you agree to the terms of the revised Privacy Notice.

1.3 If any material changes are made to this Privacy Notice, we will use reasonable endeavours to inform you in advance of those changes by using your email address or notice on our website. We will communicate any material changes to you and give you an appropriate amount of time for you to consider and understand those changes before they become effective. By continuing to use our website and our services, you agree to the terms of the revised Privacy Notice. If you do not agree with the terms of the revised Privacy Notice, please do not continue to use our website or use our services.

1.4 If you have already provided your personal data to us, you may withdraw your consent at any time in writing by contacting our DPO using the information set out in the contact details section 10 of the Privacy Notice. However, the withdrawal of your consent may affect our ability to provide our services to you.

2. Cross-border disclosure or transfer of personal data

2.1 In relation to paragraphs 5 and 6 of the Privacy Notice (above), we may disclose or transfer your personal data to third-party service providers that assist us in providing our services (including the purposes for which we use your personal data, as set out in the table above at section 4 of the Privacy Notice). Some of these third-party service providers may be located in jurisdictions outside Australia, including the United States, please see paragraphs 5 and 6 of the Privacy Notice (above) which references this.

3. Access to and correction of your personal data

3.1 We will endeavour to ensure that the personal data collected from you is up to date, accurate, and complete.

3.2 You may request access to, or correction of, the personal data we hold about you at any time by contacting our DPO using the information set out in the contact details section 10 of the Privacy Notice. We will need to verify your identity before responding to your request. Subject to any applicable exceptions or requirements, we will provide you with access to the personal data you request within a reasonable time and usually within 28 days. If we decide to refuse your request, we will tell you why in writing.

4. Complaints

4.1 You can make a complaint in writing to our DPO using the information set out in the contact details section 10 of the Privacy Notice. We will respond to you within a reasonable period of time to acknowledge your complaint and inform you of the next steps we will take in dealing with your complaint.

4.2 If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (“OAIC”) via the OAIC website, www.oaic.gov.au.

California Addendum

Privacy Policy for California Residents

This Privacy Policy for California Residents (“CCPA Privacy Policy”) applies to SP Applications Holdings, LLC, a Delaware limited liability company, DBA SolidProfessor (collectively, (“SolidProfessor,” “we,” “us,” or “our”) processing of personal information of California residents to the extent the information is subject to the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (“CCPA”). For example, this Privacy Policy does not apply to personal information collected pursuant to various exemptions including for (i) information collected subject to the federal Gramm-Leach-Bliley Act and its implementing regulations or the California Financial Information Privacy Act, (ii) medical and health information covered by HIPAA, and (iii) de-identified or publicly available information.

Personal Information We Collect, Use, Disclose, Share, or Sell

Categories of Personal Information We Collect, Categories of Sources of Personal Information, Business or Commercial Purposes for Which Personal Information Will Be Used, and Third Parties with Whom Personal Information is Sold, Shared, or Disclosed.

We collect information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“personal information”). The chart below includes information collected for various types of individuals, such as our customers, employees, and others. As a result, not all of the categories of collected personal information described below may be applicable to you. Within the last twelve (12) months, we may have collected the following categories of personal information from the sources identified below for the business and commercial purposes indicated, and disclosed, shared, or sold (as indicated) such categories of personal information with the specified categories of third parties:

Information about our Personal Information Processing Activities

Additional details of how we process personal information is set forth in the chart above.

We do not sell or share (for purposes of cross-context behavioral advertising) the personal information of minors under 16 years of age.

We do not use or disclose sensitive personal information for purposes other than the following:

1. To perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services.
2. To prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information,
3. To resist malicious, deceptive, fraudulent, or illegal actions directed at the business and to prosecute those responsible for those actions.
4. To ensure the physical safety of natural persons.
5. For short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumer’s current interaction with the business, provided that the personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumer’s experience outside the current interaction with the business.
6. To perform services on behalf of the business.
7. To verify or maintain the quality or safety of a product, service, or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured by, manufactured for, or controlled by the business.
8. To collect or process sensitive personal information where such collection or processing is not for the purpose of inferring characteristics about a consumer.

Your Privacy Rights

Right to Notice

You have the right to receive notice at or before the point of collection about our collection and retention practices. Please review our notice at collection linked https://solidprofessor.com/notice-at-collection/ for more information.

Submitting Consumer Requests

You may submit a consumer request to us by email to privacy@solidprofessor.com, or by phone at (619) 269-8684 to make a consumer request. You may make up to two disclosure requests in any 12 month period. Please review the consumer request forms below.

• Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.
• Making a verifiable consumer request does not require you to create an account with us.
• When you submit a verifiable consumer request, we will take steps to verify your request by email or telephone call. In some cases, we may request additional information in order to verify your request or where necessary to process your request. If we are unable to adequately verify a request, we will notify the requestor. Authorized agents will be required to provide proof of their authorization and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent.
• We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.
• We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you.

Right to Know and Access Your Information

You have the right to request that we disclose to you certain descriptions and categories of the personal information we collect, use, disclose, share, or sell about you. For example, you may request the following through a consumer request:

1. The categories of personal information we have collected about you.
2. The categories of sources from which the personal information is collected.
3. The business or commercial purpose for collecting, selling, or sharing personal information.
4. The categories of third parties to whom we disclose the personal information.
5. The specific pieces of personal information we have collected about you.

You may make up to two disclosure requests in any 12 month period. See above for additional details on making a consumer request.

Right to Request Deletion

You have the right to request that we delete your personal information. See above for additional details about how to submit a consumer request.

You should be aware, however, that California law allows us to retain your personal information under certain conditions, even if you have asked us to delete it, such as when retaining your personal information is necessary for us to complete a transaction with you or provide you with a good or service you have requested. We will notify you of any denial of your deletion request and the reason for such denial.

Right to Request Correction

You have the right to request that we correct your personal information. See above for additional details about how to submit a consumer request.

Right to Opt-Out of the Sharing or Sale of Personal Information

We may share personal information we collect about you with third parties for purposes of cross-context behavioral advertising. We may sell personal information we collect about you, as the term “Sale” is defined by the CCPA. You may opt out of the sale or sharing (for purposes of cross-context behavioral advertising) of your personal data by signaling an opt-out preference by making an opt-out request.

To submit a request under the Right to Opt-Out, please provide the information necessary to identify the consumer to whom the request should be applied and reasonable identifying information that you are authorized to make the request and submit an email requesting your “Right to Opt-Out” to privacy@solidprofessor.com, or by phone at (619) 269-8684.

• Once you make an opt-out request, we will wait at least twelve (12) months before asking you to reauthorize personal information sales. However, you may change your mind and opt back in to personal information sharing or sale at any time by contacting us by email at privacy@solidprofessor.com, or by phone at (619) 269-8684.
• Authorized agents will be required to provide proof of their authorization to submit opt-out requests and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent in limited circumstances.

Right to Non-Discrimination for Exercise of Consumer Privacy Rights

We will not discriminate against you because you have chosen to exercise any of your privacy rights provided by the CCPA.

Using an Authorized Agent

You may use an authorized agent to submit a consumer request. To use an authorized agent, you will need to (i) provide written instruction to your agent, and verify your identity to us, or (ii) provide a power of attorney pursuant to California Probate Code Sections 4000 to 4465.

Contact Us

Please read this Policy carefully to understand our practices regarding how we process CCPA personal information. If you should have any questions regarding this Privacy Policy please contact us at contacting us by email at privacy@solidprofessor.com, or by phone at (619) 269-8684.

If you would like to contact us with a general question, please review our web site here: https://solidprofessor.com/contact-us/.

US State Privacy Addendum

PRIVACY NOTICE FOR COLORADO, CONNECTICUT, OREGON, TEXAS, UTAH, AND VIRGINIA RESIDENTS

This Privacy Notice applies to SP Applications Holdings, LLC, a Delaware limited liability company, DBA SolidProfessor (collectively, (“SolidProfessor,” “we,” “us,” or “our”) processing of information that is linked or reasonably linkable to an identified or identifiable natural person (“Personal Data”) of Colorado residents to the extent the information is subject to the Colorado Privacy Act (CPA), of Connecticut residents to the extent the information is subject to the Connecticut Data Privacy Act (CTDPA), of Oregon Residents to the extent the information is subject to the Oregon Consumer Privacy Act (OCPA), of Texas Residents to the extent the information is subject to the Texas Data Privacy and Security Act (TDPSA), of Utah residents to the extent the information is subject to the Utah Consumer Privacy Act (UTCPA), and of Virginia residents to the extent the information is subject to the Virginia Consumer Data Protection Act (VCDPA). This Privacy Notice does not apply to Personal Data collected pursuant to various exemptions including for (i) information collected subject to the federal Gramm-Leach-Bliley Act and its implementing regulations, (ii) medical and health information covered by HIPAA, (iii) information related to an individual acting in a commercial or employment context, and (iv) de-identified or publicly available information.

How we process Personal Data

Please review the below chart for information about the categories of Personal Data we process; the purpose for processing Personal Data; the categories of Personal Data that we share with third parties, if any; and the categories of third parties, if any, with whom we share Personal Data.