Privacy Policy

Sustainment Technologies, Inc. Privacy Policy

Sustainment is a manufacturing market community that is designed to help buyers and suppliers of manufacturing services, and those that support them, collectively referred to as our "Community", build better relationships and work more efficiently together. As a Public Benefit Corporation, we are committed to your privacy and to the security of your data.

This privacy policy (the "Privacy Policy") explains how Sustainment Technologies, Inc. ("Sustainment", "we", "our", or "us") handles your personal information and data. We value your trust, so we've strived to present this policy in clear, plain language.

This Privacy Policy applies to all the products, services and websites offered by Sustainment including, without limitation, the Sustainment SRM Software, Sustainment Supplier Sourcing AI, Sustainment Market Network, the "CompanyWeek" website and related US Manufacturing Report. We refer to those products, services and websites collectively as the "services" in this policy.

The Privacy Policy is incorporated by reference into our General Terms of Use Agreement, currently available at http://www.sustainment.com/terms-of-use (the "Terms of Use"). Any terms used herein and not defined will have the meanings given to them in the Terms of Use. By using the services, you hereby warrant and represent that you have read, understand and agree to this Privacy Policy and the Terms of Use and that you are over 18 years of age. PLEASE DO NOT USE, INSTALL OR ACCESS THE SERVICES IF YOU DO NOT AGREE TO THIS PRIVACY POLICY.

What do we mean by Personal Information?

For purposes of this Privacy Policy, "Personal Information" means any information from or about a person that either identifies that person directly or that makes that person identifiable when it is combined with other information from or about that person from any source.

What information does Sustainment collect?

When you use Sustainment, we collect information relating to you and your use of our services from a variety of sources, including, without limitation, the following information that may, alone or in combination with other data, constitute Personal Information:

a. Information you provide. When you respond to a "Contact Us" page, we collect your email address and whatever other information you provide to us. When using our hosted services for Buyers, Suppliers, and third parties (collectively, the "Site"), you may provide Sustainment with Your Consent, as further described in the Terms of Use. We may process such information and other Personal Information you provide us through our services and through our AI Functions but we process this data only on your behalf as a User. When you create a profile or claim a profile on the Site, you control what information is added to, removed from, or modified in that profile. Buyers and Suppliers and other users of the Services are hereinafter referred to as "Users".

b. Usage data. We may collect usage data about you whenever you interact with our services. This may include, but is not limited to, the webpages you visit, what you click on, when you performed those actions, your search terms. Additionally, like most websites today, our web servers keep log files that record data each time a device accesses those servers. The log files contain data about the nature of each access, including originating IP addresses.

c. Device data. We may collect data from the device and application you use to access our services, such as (but not limited to) your IP address and browser type. We may also infer your geographic location based on your IP address.

d. Referral data. If you arrive at a Sustainment website from an external source (such as a link on another website or in an email), we may record information about the source that referred you to us.

e. Information from page tags. We may use third party tracking services that employ cookies and page tags (also known as web beacons) to collect aggregated and anonymized data about visitors to our websites. This data includes, but is not limited to, usage and User statistics.

f. Network and internet data. We may collect information including, but not limited to, URLs, Internet Protocol addresses, bounce rates, use of spoofing, active (TCP/IP) ports, number of sessions initiated, click streams, location information and network/Wi-Fi access points.

g. Contact Information. If you contact us, a record of such correspondence may be kept.

h. Cookie Information. Information we collect on the use of the Site via cookies: please see the "Cookies" section below for more information.

i. Information for AI Functions. As you use our services, you may include in Your Content that is uploaded or provided for use with the AI Functions personal data you have collected from yourself, your users, employees, customers, prospective customers or other individuals. We process this data only on your behalf as our customer. Specifically in connection with AI Functions, we process data you provide as a data processor or service provider acting on your instructions. We do not sell or share Personal Information submitted through AI Functions with third parties for their own commercial purposes. AI outputs generated from your data are returned to you and are not retained by Sustainment for use outside your account beyond the period necessary to provide the Services, unless otherwise required by law or agreed in your service agreement. We have no direct relationship with any person other than you, and for that reason, you are responsible for making sure you have the appropriate permission and legal basis for us to collect and process information about yourself and those individuals.

j. Metadata. This metadata, includes, but is not limited to, metadata and other data that may be extracted by our AI Functions.

Additionally, if another User refers you to us by providing us with your e-mail address, we may send you a message. However, we will use your e-mail address only to send such other User's message unless you otherwise affirmatively provide your information to us.

We ask that you not provide or disclose to us (directly or through any third party e-mail accounts that you connect to the services) any sensitive personal data (e.g., social security numbers, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background or union membership) on or through the services or otherwise. You are responsible for making sure that you do not provide or disclose to us any sensitive personal data about your Contacts on or through the services, within any User Submitted Content or otherwise.

k. AI Processing. We use artificial intelligence and machine learning technologies to power the AI Functions in our Services, including supplier matching, sourcing recommendations, market analysis, and related features. In providing these AI Functions, we may process Personal Information and other data you provide, as described in this Privacy Policy. Our current AI service providers include OpenAI, Anthropic, and we access these models either directly through their application programming interfaces (APIs) or through cloud infrastructure providers such as Amazon Web Services. We may add or change AI service providers over time, which may include additional model providers such as Google and Meta. We require our AI service providers to process data only as directed by us and in accordance with applicable data protection law. We do not use Your Content to train third-party general-purpose AI models. Sustainment may use de-identified, aggregated data derived from platform usage to improve the accuracy and performance of our own AI models. Where Sustainment uses your Personal Information in connection with AI Functions that result in automated outputs, we do so based on our legitimate interests in providing and improving the Services, or on your consent where required by applicable law.

Information You Post on the Site

The services may provide chat, forum or bulletin board tools to Users and the ability to create an "avatar" or other customized profile and Account information. Information that you provide through the use of these tools may be available to other Users. Sustainment has no obligation to keep private any information that you choose to disclose to other Users using these functions. You should exercise caution when deciding to disclose Personal Information through the use of these tools or functions. We strongly recommend that you do not post any information through the Site that you otherwise do not want to share with the public.

Information You Share on Third Party Websites or through Social Media Services

The Services may include links to third party websites and social media services where you will be able to post comments, stories, reviews, or other information. Your use of these third-party websites and social media services may result in the collection or sharing of information about you by these third-party websites and social media services. We encourage you to review the privacy policies and settings on the third-party websites and social media services with which you interact to make sure you understand the information that may be collected, used, and shared by those third-party websites and social media services.

Links to Other Websites

We frequently make content or services from other websites available to you from links located on the Site. We may present links in a format that enables us to keep track of whether these links have been followed. In addition, you may opt to link your Account to your social media account or other accounts, such as Google, in accordance with your Account settings (which you may change at any time) and respective policies of these third parties. This Privacy Policy applies only to the Site and the Services. We do not exercise control over third party services or other websites that provide information, or links from within the Site or the services. Your interactions with these third party services are governed by the privacy policy of the company providing it. These other sites and services may place their own cookies or other files on your computer's browser, collect data or solicit Personal Information from you. Other websites and services follow different rules regarding the use or disclosure of the Personal Information that you submit, and the collection and use of such information and access of any third party websites are subject to such third party's privacy policy. We encourage you to read the privacy policies and other terms of such third parties before using their services.

Cookies

We may use cookies on our websites and our advertisers may use cookies. These include third-party analytics and advertising cookies, such as Google Analytics, Google Ads, and the LinkedIn Insight Tag, which enable interest-based (cross-context behavioral) advertising. You can decline them by selecting "Deny" on our cookie banner and opt out further as described in the "Online Tracking and Interest-Based Advertising" section below. Cookies are small bits of data stored on the device you use to access services so repeat Users can be recognized. Each cookie expires after a certain period of time, depending on its purpose. We use cookies for several reasons:

a. To make our Site easier to use. If you use the "remember me" feature when you sign into your account, we may store your username in a cookie to make it quicker for you to sign in whenever you return to Sustainment.

b. For security reasons. We may use cookies to authenticate your identity, such as confirming whether you are currently logged into Sustainment.

c. To provide you with personalized content. We may store User preferences in cookies to personalize the content you see.

d. To improve our services. We may use cookies to measure your usage of our websites and track referral data, as well as to occasionally display different versions of content to you. This information helps us to develop and improve our services and optimize the content we display to Users. We don't believe cookies are sinister, but you can still choose to remove or disable cookies via your browser. Refer to your web browser's configuration documentation to learn how to do this. Please note that doing this may adversely impact your ability to use our services. Enabling cookies ensures a smoother experience when using our websites. By using our websites and agreeing to this Privacy Policy, you expressly consent to the use of cookies as described in this policy.

The following sets out how we may use different categories of cookies and your options for managing cookie settings:

‍

We and our service providers may also use "pixel tags," "web beacons," "clear GIFs," or similar means in connection with the services and HTML-formatted email messages to, among other things, track the actions of Users, to determine the success of marketing campaigns and to compile aggregate statistics about Site usage and response rates.

How does Sustainment use the information we collect?

We treat your data as information that is private to you, but we use your data for our own purposes in the limited circumstances described herein or if we have your express consent. We do not sell your data for monetary consideration, but we do share certain data for interest-based (cross-context behavioral) advertising as described in the "Certain Rights of California Residents" and "Online Tracking and Interest-Based Advertising" sections below.

Generally, we use the information we collect from you in connection with providing our services to you. Specific ways we use this information include the following:

a. Provision to our Community including Potential Customers and Suppliers. We provide, display, publish and make Your Content available to our Community including potential customers, Buyers and/or Suppliers that use our Site and services to connect to potential customers, clients, vendors, and suppliers.

b. Customer support. This includes providing you with customer support, which requires us to access your information to assist you.

c. Monitor and improve our services and features. We internally perform statistical and other analysis on information we collect (including usage data, device data, referral data, and information from page tags) to analyze and measure user behavior and trends, to understand how people use our services, and to monitor, troubleshoot and improve our services. We also use information to assist the enforcement of our Terms of Use and Our Community Guidelines, and to prevent potentially illegal activities and screen for undesirable or abusive activity

d. Provide current services and create new services, features or content (public data and metadata only). To further our legitimate interests in providing the services, including without limitation to collect and remit payment for paid features and using or processing your information through the AI Functions. We may use information to create and provide new services, features or content. When we do this, the individual Users will not be identified or identifiable unless we have obtained their permission.

e. Contact you about your service. We may occasionally send you communications of a transactional nature (e.g. service-related announcements, changes to our services or policies). You can't opt out of these communications since they are required to provide our services to you.

f. Contact you for marketing purposes (if you opt in). We will only do this if you have given us your express permission to contact you for this purpose.

g. Additional purposes. Additionally we use the information to (i) administer your use of the services and any Accounts you may have with us, (ii) to personalize your experience, (iii) to perform tasks on behalf of and according to instructions of a third party, such as payment processors, third party-service providers or our advertising partners, (iv) to enforce our Terms of Use, (v) to resolve any disputes between Users of the Site or between such Users and us, (vi) comply with a legal requirement or process, including, but not limited to, civil and criminal subpoenas, court orders or other compulsory disclosures; and (vii) to further our legitimate interest in protecting our rights, property, or safety and the rights, property and safety of the services, our Users or the public.

Which third parties do we share with or disclose your information to? We don't sell your data for money (though we do share certain data for interest-based advertising – see the "Certain Rights for California Residents" and "Online Tracking and Interest-Based Advertising" sections). When might we disclose your data to third parties?

Provision to our Community. We provide, display, publish and make Your Content available to our Community including potential Customers and/or Suppliers that use our Site and services to connect to potential customers, clients, vendors, and suppliers. This is done primarily to help connect Buyers and Suppliers and assist Suppliers listed on our Site in connecting with potential Buyers in existing and new markets and industries. All information within your profile is shared with the rest of our Community except for your contact email and phone number, which are shared only with your connections.

Manufacturing Support Organizations: Sustainment partners with local Manufacturing Extension Partnership ("MEP") centers in many states and other manufacturing support organizations and may share information from supplier profiles, including Your Content, with those partners for the purposes of manufacturing industry research. This sharing is limited to general company information - as well as aggregated and anonymized usage data. We do not share any Personal Information about any manufacturers' supply chain or supply chain activity.

Your Suppliers: The vendors you add to your Connections and Lists within your profile are strictly confidential. We do not share information about the vendors you manage with other Community members or any external individuals or organizations. Your Notes and other Supplier Management activities within your profile are completely confidential as well.

Your Projects: We do not share the details about your Projects, the vendors you invite to participate in your Projects, or the disposition of those Projects with other Community members or outside agencies. All messages and shared files exchanged within a Project are strictly private between you and your vendors. If you list a Community Project, only the project details will be listed and for only other registered Community members to see.

Your Files and Messages: We do not have access to the files you upload and share. You control who you share files with and you may revoke privileges or remove files you've shared with others at your discretion. The contents of all your messages are strictly private; even our team at Sustainment cannot access them.

Our Subsidiaries and Affiliates: Our subsidiaries and affiliates; or a subsequent owner, co-owner or operator of the Site and/or the services and their advisors in connection with a corporate merger, consolidation, restructuring, the sale of substantially all of our stock and/or assets, or in connection with bankruptcy proceedings, or other corporate reorganization, in accordance with this Privacy Policy.

Our Service Providers: In some cases, we also share your information with our service providers who help us to provide our services to you. This may include payment processors or similar vendors that may handle information not intended for public dissemination on our Site or in connection with our services. In these cases, we contractually bind these service providers to keep your information confidential and to use it only for the purpose of providing their services to us. For example, we use payment processors who help us to process credit card transactions. By using our services, you authorize Sustainment to sub-contract in this manner on your behalf. Rare circumstances include when we need to share information if required by law, or in a corporate restructuring or acquisition context (see below for more details). Ways we may share your information include the following:

a. Aggregated information to third parties to improve or promote our services. We do not share information about how you use our applications or features or how often you use them. From time to time, we may use aggregated, de-identified activity information to measure and improve performance or to develop new features, but this data will not be attributable to you. No individuals can be identified or linked to any part of the information we share with third parties to improve or promote our services. Where we use or disclose de-identified information, we will maintain and use it only in de-identified form, will not attempt to re-identify it (except as permitted by law to test that the information cannot be re-identified), and will contractually obligate any recipients to comply with the same restrictions, consistent with the CCPA.

b. Your information if required or permitted by law. We may disclose your information as required or permitted by law, or when we believe that disclosure is necessary to protect our rights, and/or to comply with a judicial proceeding, court order, subpoena, or other legal process served on us.

c. Your information if there's a change in business ownership or structure. If ownership of all or substantially all of our business changes, or we undertake a corporate reorganization (including a merger or consolidation) or any other action or transfer between Sustainment entities, you expressly consent to Sustainment transferring your information to the new owner or successor entity so that we can continue providing our services. If required, Sustainment will notify the applicable data protection agency in each jurisdiction of such a transfer in accordance with the notification procedures under applicable data protection laws.

d. Information you expressly consent to be shared. For example, we may provide your contact details to third parties for various purposes, including to allow those third parties to contact you for marketing purposes. (You may later revoke your permission, but if you wish to stop receiving communications from a third party to which we provided your information with your permission, you will need to contact that third party directly.)

What are your rights to your information?

We take steps to help ensure that you are able to exercise your rights with respect to the Personal Information we collect and maintain about you, which may vary depending on your location and in accordance with applicable law (including, but not limited to, as set forth in the sections below). For individuals whose state of residence does not afford these rights, we may offer them voluntarily and at our discretion, and we reserve the right to limit or revoke any such rights at any time, as may be permitted by applicable laws. To exercise your rights, you can:

a. Download/backup your data. We may provide you with the ability to export, share and publish your data in a variety of formats. This allows you to create your own backups or conduct offline data analysis.

b. Correct or delete your data. Deleting data in the ways described on this page will not permanently delete data immediately. As long as you maintain an account with us, we retain your deleted data in case you delete something by accident and need to restore it (which you can request by contacting customer support). To the extent permitted by law, and as further described below, we will permanently delete your data if you request to cancel your account.

c. Cancel your account. To cancel and delete your account, please contact support@sustainment.com. Deleting your account will cause all the data in the account to be permanently deleted, as permitted by law, and will disable your access to any other services that require a Sustainment account. We will promptly fulfill requests to delete personal data, subject to the below.

For how long do we retain your data? If you cancel your account or request us to delete your information, we will limit our access to Personal Information to perform what is requested by you. We generally retain your data for as long as you have an account with us, or as needed to fulfill the purposes for which it was collected, to provide our services, to comply with our legal obligations, to deal with possible legal claims or resolve disputes, to comply with our business interests, to enforce our agreements and/or to abide by all applicable laws. Thereafter, we either delete Personal Information about you or de-identify it. Please note that even if you request the deletion of Personal Information about you, we may be required (by law or otherwise) to retain the Personal Information and not delete it. Data that is deleted from our servers may remain as residual copies on offsite backup media for up to approximately 12 months afterward. However, once those requirements are removed, we will delete Personal Information about you in accordance with your request. We retain each category of Personal Information only for as long as reasonably necessary for the purposes for which it was collected, applying the following criteria: account, profile, and Your Content information is retained while your account is active and thereafter as needed for the purposes described above; usage, device, and network data is retained for the period necessary for analytics, security, and service improvement; billing and transaction records are retained for the period required by applicable tax, accounting, and legal obligations; and de-identified or aggregated information may be retained indefinitely. After the applicable period, we delete or de-identify the Personal Information.

You may submit a request to access, delete, or correct your Personal Information, obtain a copy of your account data, or exercise any of your applicable privacy rights, by emailing us at support@sustainment.com or contacting us through Get in Touch | Sustainment Contact.

User Vetting

In Sustainment's sole discretion, Users may be subject to a vetting process before they can register for and during their use of the Site, including but not limited to a verification of identity through third-party services, including role-based access control, single sign-on, and multifactor authentication, as appropriate ("Identity Checks"). Although Sustainment may perform Identity Checks, Sustainment is not required to do so and cannot confirm that each User is who they claim to be. Sustainment cannot and does not assume any responsibility for the accuracy or reliability of Identity Check information or any information provided through the Site. Sustainment has discretion to include or exclude potential Users based off of vetting process results.

When interacting with other Users, you should exercise caution and common sense to protect your personal safety, data, and property, just as you would when interacting with other persons whom you don't know. Sustainment will not be liable for any false or misleading statements made by Users of the Site. NEITHER SUSTAINMENT NOR ITS AFFILIATES, INCLUDING THEIR RESPECTIVE DIRECTORS, OFFICERS, SHAREHOLDERS, AGENTS, INVESTORS, SUBSIDIARIES, ATTORNEYS, REPRESENTATIVES, LICENSORS, INSURERS, EMPLOYEES, SUCCESSORS AND ASSIGNS (HEREINAFTER REFERRED TO COLLECTIVELY AS "SUSTAINMENT AND AFFILIATES") IS RESPONSIBLE FOR THE CONDUCT, ACTS, OR OMISSIONS, WHETHER ONLINE OR OFFLINE, OF ANY USER OF THE SITE AND YOU HEREBY RELEASE SUSTAINMENT AND AFFILIATES FROM ANY AND ALL LIABILITY, CLAIMS, DEMANDS, OR DAMAGES OF EVERY KIND AND NATURE, KNOWN AND UNKNOWN, SUSPECTED AND UNSUSPECTED, DISCLOSED AND UNDISCLOSED, ARISING OUT OF OR IN ANY WAY CONNECTED WITH THE SITE.

Licenses

Suppliers alone are responsible for identifying and obtaining any required licenses, permits, or registrations before offering services and undertaking services. Indeed, certain types of services may be prohibited altogether, and it is the responsibility of Supplier to avoid such prohibited services. Penalties may include fines or other enforcement. If you have questions about how local laws apply to a service, you can and should first seek separate legal guidance.

Because Sustainment does not oversee, monitor or supervise the posting, scoping or performance of Services, Buyers must determine for themselves whether a Supplier is qualified to perform the specific service at hand. Buyers may wish to consult their state/provincial/territorial or local requirements to determine whether certain services are required to be performed by a licensed professional.

International Privacy Laws

If you are using or visiting our services from outside the United States, including those that fall under the scope of the European General Data Protection Regulation ("GDPR"), please be aware that you are sending information (including Personal Information) to the United States where our servers are located. In addition, we may work with third-party service providers in the U.S. and in other countries to support our business activities. Thus, Personal Information may be transferred to, stored on servers in, and accessed from the United States and countries other than the country in which the Personal Information was initially collected. In all such instances, we use, transfer, and disclose Personal Information solely for the purposes described in this Privacy Notice and in compliance with applicable laws.

GDPR gives you rights with respect to your Personal Information (as defined in the GDPR), subject to any exemptions provided by the law, including the rights to:

• Request access to your Personal Information;
• Request correction or deletion of your Personal Information;
• Object to our use and processing of your Personal Information;
• Request that we limit our use and processing of your Personal Information; and
• Request portability of your Personal Information.

We will keep your Personal Information only for the period required to provide you our services or as stated in the "For how long do we retain your data?" section above.

You can usually access, correct, or delete your Personal Information using your account settings and tools that we offer, but if you aren't able to do that, or you would like to contact us about one of these or other rights, please contact us: support@sustainment.com and give us details of your inquiry.

EU individuals also have the right to make a complaint to a government supervisory authority.

The information about you that we process when you use the services in the EU may be used, stored, and/or accessed by individuals operating outside the European Economic Area (EEA) who work for us, other members of our group of companies, or third parties as described above in "Our Service Providers". When providing your Personal Information to our service providers outside the EEA, we will take appropriate measures to ensure that the recipient protects your Personal Information adequately in accordance with this Privacy Policy as required by applicable law. These measures include:

• In the case of US-based entities, we rely on one or more of the following transfer mechanisms as appropriate: (i) the EU-U.S. Data Privacy Framework (DPF), adopted by the European Commission on July 10, 2023, for transfers to DPF-certified entities; or (ii) European Commission Standard Contractual Clauses (SCCs) where the DPF is unavailable or inapplicable; or (iii) another applicable adequacy mechanism recognized under GDPR Chapter V. You can request information about the transfer mechanisms we use by contacting us at support@sustainment.com; or
• In the case of entities based in other countries outside the EEA, entering into European Commission approved standard contractual arrangements with them.

You can ask us for more information about the steps we take to protect your Personal Information when transferring it from the EU.

Certain Rights for California Residents

California Civil Code Section 1798.83 requires certain businesses that share customer Personal Information with third parties for the third parties' direct marketing purposes to respond to requests from California customers asking about the businesses' practices related to such information-sharing. We currently do not share or disclose your Personal Information to third parties for the third parties' direct marketing purposes. If we change our practices in the future, we will implement an opt-out policy as required under California laws.

Furthermore, subject to certain exemptions, the CCPA provides California residents with specific rights regarding their Personal Information that we may have collected about them. This section describes your CCPA rights and explains how to exercise those rights:

• Notice at Collection: At or before the point at which we collect Personal Information, this Privacy Policy serves as our notice at collection. It identifies the categories of Personal Information we collect (see "What information does Sustainment collect?" and the categories described below); the business and commercial purposes for which each category is used (see "How does Sustainment use the information we collect?"); whether each category is sold or shared (we do not sell Personal Information but do share certain categories for interest-based advertising; you may opt out via the cookie banner "Deny" control or the Global Privacy Control); the length of time we retain each category (see "For how long do we retain your data?"); and how you may exercise your privacy rights (described in this section).
• Right to Know: You have the right to request what Personal Information about you we collect, use, disclose, and/or sell, as applicable, over the past 12 months as follows:
  • The categories of Personal Information we collected and used about you;
  • The categories of sources from which we collected the Personal Information about you;
  • Our business or commercial purpose for collecting or selling, as applicable, that Personal Information;
  • The categories of third parties with whom we share that Personal Information;
  • The specific pieces of Personal Information we collected about you; and
  • If we disclosed your Personal Information for a business purpose or otherwise sold it, information regarding such disclosures, identifying the Personal Information categories that each category of recipient obtained as well as the categories of third parties to whom the Personal Information was sold.

Categories of Personal Information We Collect

California law requires businesses that collect Personal Information about California residents to disclose the categories of Personal Information collected, the sources, the purposes, and the categories of third parties to whom it is disclosed. In the preceding 12 months, we have collected the following categories of Personal Information:

• Identifiers, including name, email address, phone number, business or postal address, account ID, and online identifiers such as IP address.
• Customer Records, including billing address and payment information (such as credit or debit card or bank account information processed through our third-party payment processors), which may include Personal Information.
• Commercial or Transaction Information, including records of paid features, subscriptions, or services purchased, obtained, or considered, and related transaction history.
• Professional or Employment-Related Information, including your company, role, business capabilities, products, offerings, and certifications.
• "Your Content" and AI Inputs, including profiles, files, messages, project details, and other data you upload or provide for use with our AI Functions, which may contain Personal Information.
• Internet or Other Electronic Network Activity, including usage and clickstream data, search terms, pages viewed, and interactions with our Site, emails, or communications, collected through cookies and page tags.
• Audio or Visual Information, including profile images or avatars you choose to upload.
• Approximate Location Data, inferred from your IP address.
• Inferences drawn from the above, including supplier match scores, rankings, and recommendations generated by our AI Functions.

Sources. We collect these categories from the sources described in "What information does Sustainment collect?" above, primarily directly from you, automatically from your device and use of the Services (including cookies), and from referrals.

Purposes. We use each category for the business and commercial purposes described in "How does Sustainment use the information we collect?" above.

Disclosures. We disclose the categories above to the categories of recipients described in "Which third parties do we share with or disclose your information to?" above. For example, service providers and contractors, other members of the Community (per your profile settings), Manufacturing Extension Partnership and similar partners (on a general or aggregated basis only), and our affiliates.

Sale or Sharing. We do not sell Personal Information for monetary consideration. We do share the following categories for cross-context behavioral (interest-based) advertising: identifiers and internet or other electronic network activity information, which we disclose to advertising networks and analytics providers (currently Google and LinkedIn). You may opt out by selecting "Deny" on our cookie banner, by enabling the Global Privacy Control (GPC), or as described in "Right to Opt Out of the Sale or Sharing of Personal Information" and "Online Tracking and Interest-Based Advertising" below.

• Right to Delete: You have the right to request the deletion of your Personal Information that is collected or maintained by us. If we receive and confirm your verifiable consumer request, we shall delete (and direct our service providers to delete) your Personal Information from our records, unless an exception applies or as otherwise required or authorized by law.
• Right to Correct. You have the right to request that we correct inaccurate Personal Information that we maintain about you. Upon receipt of a verifiable consumer request, we will use commercially reasonable efforts to correct the inaccurate Personal Information as directed, taking into account the nature of the Personal Information and the purposes of processing it, unless an exception applies or as otherwise permitted by law.
• Right to Limit Use of Sensitive Personal Information. "Sensitive Personal Information" under the CCPA includes your government identifiers (such as Social Security, driver's license, or passport number), financial account log-in or account and access credentials, precise geolocation, racial or ethnic origin, the contents of your mail, email, and text messages not directed to us, genetic data, biometric information used to uniquely identify you, and information concerning your health, sex life, or sexual orientation. We do not collect Sensitive Personal Information for the purpose of inferring characteristics about you, and we use any Sensitive Personal Information you provide only for the purposes permitted by the CCPA, such as providing the services you request. Where we use Sensitive Personal Information for purposes beyond those the CCPA treats as exempt, you have the right to direct us to limit our use and disclosure of that information, and we will provide a "Limit the Use of My Sensitive Personal Information" mechanism.

Right to Non-Discrimination: You have the right not to receive discriminatory treatment by us for the exercise of the privacy rights described above. Unless permitted by the CCPA, we will not:

• Deny you goods or services;
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
• Provide you a different level or quality of goods or services; or
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

We do not sell Personal Information for monetary consideration. We do, however, use third-party advertising and analytics technologies, including Google Analytics, Google Ads, and the LinkedIn Insight Tag, that involve the use and disclosure of identifiers and internet or other electronic network activity information for interest-based advertising. This is "cross-context behavioral advertising," and under the CCPA it constitutes "sharing." The categories of Personal Information we share for this purpose are identifiers and internet or other electronic network activity information, and the categories of recipients are advertising networks and analytics providers (currently Google and LinkedIn). You have the right to opt out of this sharing at any time. You may do so by: (i) selecting "Deny" on the cookie banner presented on our Site (or otherwise declining advertising cookies through the cookie controls we provide); (ii) enabling an opt-out preference signal such as the Global Privacy Control (GPC), which we honor for the browser or device that sends it; (iii) using the industry and platform opt-out tools described in the "Online Tracking and Interest-Based Advertising" section below; or (iv) emailing us at support@sustainment.com. We do not knowingly sell or share the Personal Information of consumers under 16 years of age. We continue to disclose Personal Information to our service providers and contractors for business purposes as described above, which is not a "sale" or "sharing".

Right to Opt Out of Automated Decisionmaking Technology (ADMT)

Where Sustainment uses Automated Decisionmaking Technology (as defined under applicable California law, "ADMT") to make or materially contribute to significant decisions about you, you have the right to opt out of such processing. You also have the right to request access to information about how ADMT is used in connection with decisions affecting you, including information about the logic involved and how the output is used. To exercise this right, submit a request to support@sustainment.com. These rights become effective January 1, 2027 for ADMT opt-out and are subject to applicable exemptions under California law. Under California law, a "significant decision" means a decision that results in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services. Our supplier-matching, scoring, and recommendation features support decisions about business relationships and do not make significant decisions about you as an individual; accordingly, the ADMT opt-out described above applies only where and to the extent we use ADMT to make a significant decision concerning you.

Right to Appeal. Where you believe an automated decision has adversely affected you, you have the right to request human review of that decision. Sustainment will respond to such requests within 45 days.

Right to Opt Out of the Sale or Sharing of Personal Information

We use and share Personal Information as set forth herein and do not sell Personal Information. However, you have a right to opt out of any sale of Personal Information. You may, at any time, direct us to not sell Personal Information about you to third parties. If you exercise your right to opt out of the sale of Personal Information about you, we will not sell Personal Information about you. Any Personal Information collected in connection with your request to opt-out of the sale of Personal Information about you will be used only to facilitate that request. You may submit opt-out requests by emailing us at support@sustainment.com. We share Personal Information for cross-context behavioral (interest-based) advertising, and you may opt out at any time by selecting "Deny" on our cookie banner, by enabling an opt-out preference signal such as the Global Privacy Control (GPC), by using the industry and platform opt-out tools described in the "Online Tracking and Interest-Based Advertising" section below, or by emailing us at support@sustainment.com. We will not require you to create an account to opt out, and once you opt out we will wait at least 12 months before asking you to opt back in.

Methods for Submitting Consumer Requests and Our Response to Requests

To exercise any applicable CCPA rights described above, please submit a verifiable consumer request to us by either:

• Emailing us at support@sustainment.com.
• Sending postal mail to: the contact information provided under "Questions?" below.

The delivery of our response may take place electronically or by mail.

The above rights are subject to our being able to reasonably verify your identity and authority to make these requests. Upon receipt of a request, we may ask you for additional information to verify your identity. Any additional information you provide will be used only to verify your identity and not for any other purpose. Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your Personal Information. You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

The above rights are also subject to various exclusions and exceptions under the law. Under certain circumstances, we may be unable to implement your request, pursuant to applicable law. We will advise you of any reason for denying or restricting a request to the extent permitted by law.

We will acknowledge the receipt of your request within 10 days of receipt. Subject to our ability to verify your identity, we will respond to your request within 45 days of receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. In order to protect your privacy and the security of Personal Information about you, we verify your request by role-based access control, single sign-on and multifactor authentication.

Our disclosures will generally cover the 12-month period preceding our receipt of your verifiable consumer request. For Personal Information collected on or after January 1, 2022, you may also request that we disclose information beyond the 12-month period, and we will do so unless doing so proves impossible or would involve a disproportionate effort. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Authorized Agents

You may designate an authorized agent to make requests on your behalf. You must provide an authorized agent written permission to submit a request on your behalf, and we may require that you verify your identity directly with us. Alternatively, an authorized agent that has been provided power of attorney pursuant to Probate Code sections 4000-4465 may submit a request on your behalf.

Miscellaneous

Changes to this Privacy Policy. We may modify this Privacy Policy at any time, but if we do so, we will notify you by publishing the changes on this website. If we determine the changes are material, we will provide you with additional, prominent notice as is appropriate under the circumstances, such as via email. For any changes to this Privacy Policy for which you are required to provide prior consent, we will provide you with reasonable notice of such changes before they become effective and provide you with the opportunity to consent to those changes. If you do not cancel your subscription and continue to use our services beyond the advance-notice period, you will be considered as having expressly consented to the changes in our Privacy Policy. If you disagree with the terms of this Privacy Policy or any updated Privacy Policy, you may close your account at any time.

Security. We are committed to handling your Personal Information and data with integrity and care.

As a contractor to the U.S. Department of Defense, we endeavor to employ strong security features that protect your information and to take measures to detect and automatically block security threats. Many of our security features are deployed to federal and DoD standards, and we have additionally been audited for compliance with the SOC 2 framework.

Sustainment's file sharing protocol is run on infrastructure with baseline security controls that are compliant with standards set by regulated environments like SOC 2 Type II and FedRAMP Moderate.

However, regardless of the security protections and precautions we undertake, there is always a risk that your personal data may be viewed and used by unauthorized third parties as a result of collecting and transmitting your data through the internet.

Online Tracking and Interest-Based Advertising. We and our advertising partners use cookies, pixels, and similar technologies, including Google Analytics, Google Ads, and the LinkedIn Insight Tag, to understand your activity on our Site and to deliver interest-based (cross-context behavioral) advertising to you on other websites and services. Under the CCPA, this constitutes "sharing." You can opt out in the following ways: (i) select "Deny" on the cookie consent banner presented on our Site (or change your choice through the cookie controls we provide), which declines advertising and analytics cookies; (ii) enable an opt-out preference signal such as the Global Privacy Control (GPC), which we honor for the browser or device that sends it; (iii) use the industry opt-out tools offered by the Digital Advertising Alliance (optout.aboutads.info, or aboutads.info/appchoices for mobile apps) and the Network Advertising Initiative (optout.networkadvertising.org); and (iv) use the platforms' own controls, including the Google Analytics Opt-Out Browser Add-On (tools.google.com/dlpage/gaoptout), Google Ads Settings (adssettings.google.com), and LinkedIn's ad preferences. Opting out does not mean you will no longer see ads; it means the ads you see should not be based on your activity across other sites. Because these tools are browser- and device-specific, you will need to opt out on each browser and device you use. We do not respond to legacy Do Not Track (DNT) browser signals, which are separate from the Global Privacy Control.

However, some third party sites do keep track of your browsing activities when they serve you content, which enables them to tailor what they present to you. The Site may contain links (such as hyperlinks) to third-party websites. Such links do not constitute endorsement by Sustainment or association with those websites, their content or their operators. Such links (including without limitation external websites that are framed by the Site as well as any advertisements displayed in connection therewith) are provided as an information service, for reference and convenience only. Sustainment does not control any such websites, and is not responsible for their (i) availability or accuracy, or (ii) content, advertising, products, or services. It is your responsibility to evaluate the content and usefulness of the information obtained from other websites. You acknowledge and agree that Sustainment is not involved in the creation or development of third-party websites and disclaims any responsibility for third-party websites, and cannot be liable for claims arising out of or relating to third-party websites. Further, you acknowledge and agree that Sustainment has no obligation to monitor, review, or remove links to third-party websites, but reserves the right to limit or remove links to third-party websites on the Site at its sole discretion.

The use of any website controlled, owned or operated by third parties is governed by the terms and conditions of use and privacy policies for those websites. You access such third-party websites at your own risk. Sustainment expressly disclaims any liability arising in connection with your use and/or viewing of any websites or other material associated with links that may appear on the Site. You hereby agree to hold Sustainment harmless from any liability that may result from the use of links that may appear on the Site.

Safety of Minors and COPPA. Our services are not intended for and may not be used by minors. "Minors" are individuals under the age of majority in their place of residence. Sustainment does not knowingly collect personal data from minors or allow them to register. If it comes to our attention that we have collected personal data from a minor, we may delete this information without notice. If you have reason to believe that this has occurred, please contact us at support@sustainment.com.

AI-Generated Content. Where Sustainment uses AI to generate content that is presented to you as part of the Services (such as market summaries, supplier capability narratives, or automated recommendations), we will endeavor to label or otherwise indicate that such content is AI-generated. You should independently verify any AI-generated information before relying upon it. Sustainment is not responsible for inaccuracies in AI-generated content that you elect to use or share beyond the Services.

Questions? For questions regarding our Privacy Policy or practices, contact Sustainment by email at support@sustainment.com or by mail at:

Sustainment Technologies, Inc.
912 S Capital of Texas Hwy Suite 190
Austin, TX 78746
Attn: Privacy Officer

‍