Mechanical Simulation Corporation Data Protection and Privacy Policy(“Data Protection and Privacy Policy” or “Policy”)
Introduction
Mechanical Simulation Corporation – a Michigan corporation (“MSC” or “we”) is committed torespecting your online privacy and recognizes your need for appropriate handling of any Personal
Data you share with us in connection with our website at “*.carsim.com” or “carsim.com”(collectively, the “Site”). “Personal Data” means information relating to an identified or
identifiable individual, which includes, but is not limited to, your name, user name, password, I.D.
number, physical address or other location data, email address, phone number, fax number, mobile
number, company name, and position at your company. We respect your right to keep your
Personal Data private, and thus we strive to protect your Personal Data in accordance with thisData Protection and Privacy Policy.
This Policy applies to information we collect:•••

On the Site.
In email, text, and other electronic messages between you and the Site.
Through desktop applications you download from the Site, which provide dedicated nonbrowser-based interaction between you and the Site.

This Policy does not apply to information collected by:••

Us offline or through any other means, including on any other website operated byCompany or any third party; or
Any third party, including through any application or content (including advertising) that
may link to or be accessible from or on the Site.

Please read this Policy carefully to understand our policies and practices regarding Personal Dataand how we will treat it. If you do not agree with our policies and practices, your choice is not touse our Site. By accessing or using the Site, you agree to this Data Protection and Privacy Policy.
This Policy may change from time to time. Your continued use of the Site after we make changes
is deemed to be acceptance of those changes, so please check the Policy periodically for updates.
Personal Data We Collect and How We Collect It
We collect several types of information from and about users of our Site, including information:•

By which you may be personally identified, such as name, postal address, e-mail address,
telephone number, and any other identifier by which you may be contacted online oroffline;•About your internet connection, the equipment you use to access our Site, and usage
details;•

Records and copies of your correspondence (including email addresses).

•

Details of transactions you carry out and of the fulfillment of your orders.

34984264.5/088888.04584

We collect this information:•

Directly from you when you provide it to us;•

From third parties, for example, our business partners and agents.

How We Use Your Information
We use Personal Data that we collect about you or that you provide to us:•

To present our Site and its contents to you;•

To fulfill or meet the reason you provided the information. For example, if you share yourname and contact information to request a price quote or ask a question about our products
or services, we will use that Personal Data to respond to your inquiry. If you provide your
Personal Data to purchase a product or service, we will use that information to process yourpayment and facilitate delivery. We may also save your information to facilitate new
product orders or process returns;•

To provide you with information, products, or services that you request from us;•

To fulfill any other purpose for which you provide it;•

To carry out our obligations and enforce our rights arising from any contracts entered into
between you and us, including for billing and collection;•

To notify you about changes to our Site or any products or services we offer or provide
though it;•

In any other way we may describe when you provide the information;•

To evaluate or conduct a merger, restructuring, dissolution, or any sale or transfer of someor all of our assets, including Personal Data we hold;•For any other purpose with your consent.

With Whom Do We Share Personal Data and for what Purpose
If you choose to submit Personal Data to us, MSC may share that Personal Data with:•Its distributors, sales representatives, dealers, value added resellers, and other third-parties
in MSC’s distribution channels for their purposes of marketing and supporting our
products;•

Third-party service providers under contract to perform functions on our behalf, such as
customer support for MSC products and sending postal mail or emails to carry outtransactions (the foregoing in (a) and (b) hereafter referred to as “Processors”). We will
refrain from using your Personal Data for any other purpose unless we notify you first andobtain your affirmative consent with respect to its use outside of these above-statedpurposes. Likewise, our Processors may have access to and use your Personal Data only asnecessary to perform their functions described above; and•Any buyer or other successor in case of a merger, restructuring, dissolution, or any sale ortransfer of some or all of our assets, including Personal Data we hold. That buyer or

34984264.5/088888.04584

successor will possess the Personal Data collected by us and will assume the rights andobligations regarding your Personal Data as described in this Data Protection and Privacy
Policy.
Anonymous Information
MSC may also share with its Processors and advertisers, business partners, and other third-parties
Anonymous Data in aggregated form about its Site visitors. MSC will have the right to use
Anonymous Information for any purpose and in any manner. “Anonymous Information” means
information that is not associated with or linked to your Personal Data; Anonymous Information
does not, by itself, permit the identification of individual persons. Anonymous Information
includes non-personally identifiable data we create from Personal Data by excluding informationthat makes such data personally identifiable.
How Long Do We Keep Personal Data?
MSC will keep Personal Data only as long as it is necessary to accomplish the purpose for which
it was originally collected; thereafter MSC will store it for as long as it is necessary to defend
intellectual property rights of MSC. From time-to-time, MSC may purge or delete some or all of
the Personal Data it keeps in its database in compliance with the foregoing.
Measures Employed by MSC to Protect Your Personal Data in our Possession
In addition to sharing Personal Data with Processors as described above, Personal Data will beshared within MSC on a “need to know” basis. We have commercially reasonable security
measures in place to help protect against loss, misuse, and alteration of your Personal Data in ourpossession. No method of transmission over the Internet, or method of electronic storage, is 100%
secure, however. Therefore, while MSC uses reasonable efforts to protect your Personal Data,
MSC cannot guarantee its absolute security. MSC will contractually require each Processor orother third-party with whom it shares Personal Data to use reasonable measures to protect that
Personal Data. However, MSC cannot monitor these Processors and other third-parties to ensurethat they comply.
Third-party Links and Services
The Site provides links to third-party web sites and services. These links are provided for yourreference only. We do not control, operate or endorse in any respect information, products, orservices on such third-party sites or services and are not responsible for their content. Many thirdparty sites and services have their own terms of use and privacy policies that differ from ours. This
Data Protection and Privacy Policy only applies to our Site and the information obtained from orprovided by you through the Site for the purposes of accessing or using content controlled andowned by us. This Data Protection and Privacy Policy does not apply to any other site or service.
Our lead collection partners may collect Personal Data from you when you visit the Site. MSC is
not responsible for the collection, use, and disclosure of such Personal Data by those leadcollection partners. Such collection, use, and disclosure is governed by those lead collection
partners’ terms of use and privacy policies, and not by this Data Protection and Privacy Policy.
34984264.5/088888.04584

Children Under the Age of 13
Our Site is not intended for children under 13 years of age. No one under age 13 may provide any
information, whether Personal Data or otherwise, to or on the Site. We do not knowingly collect
Personal Data from children under 13. If you are under 13, do not use or provide any informationon this Site or on or through any of its features/register on the Site, make any purchases throughthe Site, use any of the interactive or public comment features of this Site or provide any
information about yourself to us, including your name, address, telephone number, email address,
or any screen name or user name you may use. If we learn we have collected or received Personal
Data from a child under 13 without verification of parental consent, we will delete that information.
If you believe we might have any information from or about a child under the age of 13, pleasecontact the MSC Data Privacy Officer as specified in the Contact Information section.
Processing Personal Data According to the GDPR
Additionally, if the processing of your Personal Data falls within the scope of the Regulation (EU)2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection ofnatural persons with regard to the processing of Personal Data and on the free movement of suchdata, known as the General Data Protection Regulation (“GDPR”), then such processing shall also
be performed in accordance with GDPR requirements. Therefore, in addition to the above terms,
MSC provides you with the following information:(a)
The contact information for the MSC Data Privacy Officer is provided in the lastparagraph below (Contacting MSC);(b)
Personal Data is processed only for the express purposes set forth in this Data
Protection and Privacy Policy;(c)Personal Data may be transferred to processors located around the world;(d)

You are entitled to:

•
•
•

•

Request access to your Personal Data. This enables you to receive a copy of the
Personal Data we hold about you and to check that we are lawfully processing it;
Request correction of the Personal Data that we hold about you. This enables you
to have any incomplete or inaccurate Personal Data we hold about you corrected,
though we may need to verify the accuracy of the new data you provide to us;
Request erasure of your Personal Data. This enables you to ask us to delete or
remove Personal Data where there is no good reason for us continuing to process it.
You also have the right to ask us to delete or remove your Personal Data where you
have successfully exercised your right to object to processing, where we may haveprocessed your information unlawfully or where we are required to erase your
Personal Data to comply with local law. Note, however, that we may not always beable to comply with your request of erasure for specific legal reasons which will be
notified to you, if applicable, at the time of your request;
Object to processing of your Personal Data where we are relying on a legitimate
interest (or those of a third party) and there is something about your particular

34984264.5/088888.04584

•

•

•

situation which makes you want to object to processing on this ground as you feel
it impacts on your fundamental rights and freedoms. You also have the right toobject where we are processing your Personal Data for direct marketing purposes.
In some cases, we may demonstrate that we have compelling legitimate grounds toprocess your information which override your rights and freedoms;
Request restriction of processing of your Personal Data. This enables you to ask
us to suspend the processing of your Personal Data in the following scenarios: (a) if
you want us to establish the data's accuracy; (b) where our use of the data is unlawful
but you do not want us to erase it; (c) where you need us to hold the data even if we
no longer require it as you need it to establish, exercise or defend legal claims; or(d) you have objected to our use of your data but we need to verify whether we haveoverriding legitimate grounds to use it;
Request the transfer of your Personal Data to you or to a third party. We will
provide to you, or a third party you have chosen, your Personal Data in a structured,commonly used, machine-readable format. Note that this right only applies toautomated information which you initially provided consent for us to use or where
we used the information to perform a contract with you;
Withdraw consent at any time where we are relying on consent to process your
Personal Data. However, this will not affect the lawfulness of any processing
carried out before you withdraw your consent. If you withdraw your consent, we
may not be able to provide certain products or services to you. We will advise you
if this is the case at the time you withdraw your consent.

(e)
You will not have to pay a fee to access your Personal Data (or to exercise any of
the other rights). However, we may charge a reasonable fee if your request is clearly unfounded,
repetitive or excessive. Alternatively, we may refuse to comply with your request in thesecircumstances.
(f)
You may at any time lodge a complaint with a supervisory authority located in theEuropean Union having jurisdiction over processing; and(g)

MSC does not perform automated decision-making, including profiling.

Privacy Notice for California Residents According to the CCPA
This Privacy Notice for California Residents applies solely to all visitors, users, and others who
reside in the State of California ("consumers" or "you"). We have adopted this notice to comply
with the California Consumer Privacy Act of 2018 (“CCPA”) and any terms defined in the CCPA
have the same meaning when used in this Section of Data Protection and Privacy Policy.
Information We Collect
We collect information that identifies, relates to, describes, references, is reasonably capable ofbeing associated with, or could reasonably be linked, directly or indirectly, with a particularconsumer, household, or device ("Personal Information"). Personal Information does notinclude:•Publicly available information from government records.

34984264.5/088888.04584

•

Deidentified or aggregated consumer information.

•

Information excluded from the CCPA's scope, like:•health or medical information covered by the Health Insurance Portability andAccountability Act of 1996 (HIPAA) and the California Confidentiality of Medical
Information Act (CMIA) or clinical trial data;•

Personal Information covered by certain sector-specific privacy laws, including theFair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or
California Financial Information Privacy Act (FIPA), and the Driver's Privacy
Protection Act of 1994.

In particular, we have collected the following categories of Personal Information from its
consumers within the last twelve (12) months:
Category

ExamplesCollected

A. Identifiers.

A real name, alias, postal address, unique personal
identifier, online identifier, Internet Protocol address,
email address, account name, Social Security number,driver's license number, passport number, or othersimilar identifiers.

Yes (except forSocial Security
number, driver's
license number
and passportnumber).

B. Personal
Information
categories listed
in the California
Customer
Records statute(Cal. Civ. Code§ 1798.80(e)).

A name, signature, Social Security number, physicalcharacteristics or description, address, telephone
number, passport number, driver's license or state
identification card number, insurance policy number,
education, employment, employment history, bankaccount number, credit card number, debit card number,or any other financial information, medical information,or health insurance information.

Yes (but only
limited to name,address andtelephonenumber).

Some personal information included in this category
may overlap with other categories.
C. Protectedclassification
characteristics
under California
or federal law.

Age (40 years or older), race, color, ancestry, national No.
origin, citizenship, religion or creed, marital status,
medical condition, physical or mental disability, sex(including gender, gender identity, gender expression,
pregnancy or childbirth and related medical conditions),
sexual orientation, veteran or military status, genetic
information (including familial genetic information).

D. Commercial
information.

Records of personal property, products or services No.
purchased, obtained, or considered, or other purchasingor consuming histories or tendencies.

E. Biometric
information.

Genetic, physiological, behavioral, and biological No.
characteristics, or activity patterns used to extract atemplate or other identifier or identifying information,such as, fingerprints, faceprints, and voiceprints, iris or

34984264.5/088888.04584

retina scans, keystroke, gait, or other physical patterns,
and sleep, health, or exercise data.
F. Internet orother similar
network activity.

Browsing history, search history, information on a No.
consumer's interaction with a website, application, or
advertisement.

G. Geolocationdata.

Physical location or movements.

H. Sensory data.

Audio, electronic, visual, thermal, olfactory, or similar No.
information.

I. Professional or Current or past job history or performance evaluations.
employmentrelated
information.

No.

No.

J. Non-public
education
information (perthe Family
Educational
Rights andPrivacy Act (20
U.S.C. Section
1232g, 34 C.F.R.
Part 99)).

Education records directly related to a student No.
maintained by an educational institution or party acting
on its behalf, such as grades, transcripts, class lists,
student schedules, student identification codes, student
financial information, or student disciplinary records.

K. Inferences
drawn fromother Personal
Information.

Profile reflecting a person's preferences, characteristics, No.
psychological trends, predispositions, behavior,
attitudes, intelligence, abilities, and aptitudes.

Use of Personal Information
We may use, or disclose Personal Information we collect for one or more of the following
purposes:•

To present our Site and its contents to you;•

To fulfill or meet the reason you provided the information. For example, if you share yourname and contact information to request a price quote or ask a question about our products
or services, we will use that Personal Information to respond to your inquiry. If you provide
your Personal Information to purchase a product or service, we will use that information toprocess your payment and facilitate delivery. We may also save your information tofacilitate new product orders or process returns;•

To provide you with information, products, or services that you request from us;•

To fulfill any other purpose for which you provide it;•

To carry out our obligations and enforce our rights arising from any contracts entered into
between you and us, including for billing and collection;

34984264.5/088888.04584

•

To notify you about changes to our Site or any products or services we offer or provide
though it;•

In any other way we may describe when you provide the information;•

To evaluate or conduct a merger, restructuring, dissolution, or any sale or transfer ofsome or all of our assets, including Personal Data we hold;•For any other purpose with your consent.

We will not collect additional categories of Personal Information or use Personal Information wecollected for materially different, unrelated, or incompatible purposes without providing you
notice.
Sharing Personal Information
We may disclose your Personal Information to a third party for a business purpose. When we
disclose Personal Information for a business purpose, we enter a contract that describes the purpose
and requires the recipient to both keep that Personal Information confidential and not use it for any
purpose except performing the contract.
Disclosures of Personal Information for a Business Purpose
In the preceding twelve (12) months, Company has disclosed Personal Information for a businesspurpose to the following third parties:
Personal Information Category

Business Purpose Disclosures

A. Identifiers.

Distributors;
Sales Representatives;
Dealers;
Value Added Resellers;
Other Third Parties in Company’s distribution channels.

B. Personal Information categories
listed in the California Customer
Records statute (Cal. Civ. Code §1798.80(e)). Please, be advised that
this category is limited to name,address and telephone number.

Distributors;

C. Protected classification
characteristics under California orfederal law.

N/A

D. Commercial information.

N/A

E. Biometric information.

N/A

34984264.5/088888.04584

Sales Representatives;
Dealers;
Value Added Resellers;
Other Third Parties in Company’s distribution channels.

F. Internet or other similar network
activity.

N/A

G. Geolocation data.

N/A

H. Sensory data.

N/A

I. Professional or employmentrelated information.

N/A

J. Non-public education
information (per the Family
Educational Rights and Privacy Act(20 U.S.C. Section 1232g, 34
C.F.R. Part 99)).

N/A

K. Inferences drawn from other
Personal Information.

N/A

Sales of Personal Information
In the preceding twelve (12) months, Company has not sold Personal Information.
Your Rights and Choices
The CCPA provides consumers (California residents) with specific rights regarding their Personal
Information. This section describes your CCPA rights and explains how to exercise those rights.
Access to Specific Information and Data Portability Rights
You have the right to request that we disclose certain information to you about our collection anduse of your Personal Information over the past 12 months. Once we receive and confirm yourverifiable consumer request, we will disclose to you:•

The categories of Personal Information we collected about you.

•

The categories of sources for Personal Information we collected about you.

•

Our business or commercial purpose for collecting or selling that Personal Information.

•

The categories of third parties with whom we share that Personal Information.

•

The specific pieces of Personal Information we collected about you (also called a data
portability request).

•

If we sold or disclosed your Personal Information for a business purpose, two separate lists
disclosing:•sales, identifying the Personal Information categories that each category of recipientpurchased; and•disclosures for a business purpose, identifying the Personal Information categories thateach category of recipient obtained.

Deletion Request Rights

34984264.5/088888.04584

You have the right to request that we delete any of your Personal Information that we collectedfrom you and retained, subject to certain exceptions. Once we receive and confirm your verifiableconsumer request, we will delete (and direct our service providers to delete) your Personal
Information from our records, unless an exception applies.
We may deny your deletion request if retaining the information is necessary for us or our service
provider(s) to:1.

Complete the transaction for which we collected the Personal Information, provide a goodor service that you requested, take actions reasonably anticipated within the context of ourongoing business relationship with you, fulfill the terms of a written warranty or productrecall conducted in accordance with federal law, or otherwise perform our contract with
you.

2.

Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal
activity, or prosecute those responsible for such activities.

3.

Debug products to identify and repair errors that impair existing intended functionality.

4.

Exercise free speech, ensure the right of another consumer to exercise their free speechrights, or exercise another right provided for by law.

5.

Comply with the California Electronic Communications Privacy Act (Cal. Penal Code §1546 et. seq.).

6.

Engage in public or peer-reviewed scientific, historical, or statistical research in the public
interest that adheres to all other applicable ethics and privacy laws, when the information's
deletion may likely render impossible or seriously impair the research's achievement, if
you previously provided informed consent.

7.

Enable solely internal uses that are reasonably aligned with consumer expectations basedon your relationship with us.

8.

Comply with a legal obligation.

9.

Make other internal and lawful uses of that information that are compatible with the context
in which you provided it.

Exercising Access, Data Portability, and Deletion Rights
To exercise the access, data portability, and deletion rights described above, please submit averifiable consumer request, as specified in the Contact Information section.
Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer
request related to your Personal Information. You may also make a verifiable consumer request
on behalf of your minor child.
You may only make a verifiable consumer request for access or data portability twice within a 12month period. The verifiable consumer request must:•

Provide sufficient information that allows us to reasonably verify you are the person about
whom we collected Personal Information or an authorized representative;•

Describe your request with sufficient detail that allows us to properly understand, evaluate,
and respond to it.

34984264.5/088888.04584

We cannot respond to your request or provide you with Personal Information if we cannot verify
your identity or authority to make the request and confirm the Personal Information relates to you.
Making a verifiable consumer request does not require you to create an account with us.
We will only use Personal Information provided in a verifiable consumer request to verify therequestor's identity or authority to make the request.
For instructions on exercising sale opt-out rights.
Response Timing and Format
We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt.
If we require more time (up to ninety (90) days), we will inform you of the reason and extension
period in writing.
If you have an account with us, we will deliver our written response to that account. If you do nothave an account with us, we will deliver our written response by mail or electronically, at youroption.
Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer
request's receipt. The response we provide will also explain the reasons we cannot comply with arequest, if applicable. For data portability requests, we will select a format to provide your Personal
Information that is readily useable and should allow you to transmit the information from one
entity to another entity without hindrance.
We do not charge a fee to process or respond to your verifiable consumer request unless it isexcessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, wewill tell you why we made that decision and provide you with a cost estimate before completingyour request.
Non-Discrimination
We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by
the CCPA, we will not:•Deny you goods or services.

•

Charge you different prices or rates for goods or services, including through granting
discounts or other benefits, or imposing penalties.

•

Provide you a different level or quality of goods or services.

•

Suggest that you may receive a different price or rate for goods or services or a different
level or quality of goods or services.

However, we may offer you certain financial incentives permitted by the CCPA that can result indifferent prices, rates, or quality levels. Any CCPA-permitted financial incentive we offer willreasonably relate to your Personal Information's value and contain written terms that describe theprogram's material aspects. Participation in a financial incentive program requires your prior opt
in consent, which you may revoke at any time.
Privacy Notice for Nevada Residents
Nevada residents, who wish to exercise their sale opt-out rights under Nevada Revised Statutes
Chapter 603A may submit a request to the MSC Data Privacy Officer as specified in the Contact

34984264.5/088888.04584

Information section. However, please know we do not currently sell Personal Data triggering thatstatute's opt-out requirements.
Contact Information
We welcome your comments or questions regarding this Data Protection and Privacy Policy.
Please email us at dataprivacy@carsim.com or contact us at the following address:
Mechanical Simulation Corporation
Attn: MSC Privacy Policy Officer
755 Phoenix Drive
Ann Arbor MI 48108
Changes to this Data Protection and Privacy Policy
MSC reserves the right to amend this Data Protection and Privacy Policy at any time. Should we
make material changes to this Data Protection and Privacy Policy, we intend to take reasonable
steps to notify you of such changes by posting a prominent notice on our Site for a reasonable
period of time. Any changes to this Data Protection and Privacy Policy will be effective
immediately for new users of our Site; otherwise these changes will be effective thirty (30)
calendar days following our posting of such notice. Continued use of our Site following noticeof such changes shall indicate your acknowledgement of, and agreement to be bound by, suchchanges.

34984264.5/088888.04584