Advarra is based in the United States and we process and store information in the U.S. Therefore, we and our service providers will store and access your Personal Information in the U.S.  The U.S. may not provide equivalent levels of data protection as regulated in your home jurisdiction. In such instances, whenever your Personal Information is transferred to countries outside of the EAA, UK or Switzerland, we will ensure that at least one of the following safeguards is in place: The country is one that the European Commission have approved as providing an adequate level of protection for Personal Information; The transfer is subject to a specific derogation in the GDPR or national laws; Through the use the standard contractual clauses as the transfer mechanism when a case-by-case analysis has been performed; or Where we use certain service providers, we may use specific contracts or codes of conduct or certification mechanisms approved by the European Commission which give Personal Information substantially similar protection as in the UE, EEA or UK. Through compliance with the Data Protection Framework (see below). Data Protection Framework Advarra complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Advarra has also certified to the US Department of Commerce that it adheres to EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Advarra has also certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. Advarra’s commitments under the Data Privacy Framework are subject to the investigatory and enforcement powers of the United States Federal Trade Commission. To learn more about the Data Privacy Framework program, and to view our certification, please visit https://www.dataprivacyframework.gov/s/. As set out above Advarra uses a limited number of third-party service providers to assist us in providing our services to our users and business customers. These third parties may access, process, or store personal data in the course of providing their services.  Advarra maintains contracts with these third parties restricting their access, use and disclosure of personal data in compliance with our Data Privacy Framework obligations, including the onward transfer provisions. DPF Mediation and Arbitration In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Advarra commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to JAMS, an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit https://www.jamsadr.com/dpf-dispute-resolution for more information or to file a complaint.  The services of JAMS are provided at no cost to you. In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, you have the possibility, under certain conditions, to invoke binding arbitration for complaints regarding DPF compliance not resolved by any of the other DPF mechanisms. For more information please see Q11 Invoke Arbitration and ANNEX-I-introduction on the DPF website. DPF Notice of Liability for Onward Transfers Even in the case of an onward transfer of your personal information, Advarra has responsibility for the processing of personal information it receives under the DPF Principles and subsequently transfers to a third party acting as an agent on its behalf. Advarra shall remain liable under the DPF Principles if its agent processes such personal information in a manner inconsistent with the DPF Principles, unless Advarra proves that it is not responsible for the event giving rise to the damage. For more information please see FAQs – Privacy Policy (11–12) on the DPF website. Your Rights In the United States As described in the sections above, we collect and use information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, to you or your devices when you visit our Websites, provide us with information, or have a contractual or business relationship with us or any of our customers, (“Personal Information”). We collect and share Personal Information as described and for the purposes identified in the sections above. If you reside in the United States, you may have certain rights related to your Personal Information under state privacy laws. Depending on your state of residence, these rights may include the right to request information about the collection, sale, or disclosure of your Personal Information by us, including Categories of Personal Information collected about you, and sources from which collected; Our purpose for collecting Personal Information; Categories of third parties with which the Personal Information was shared; and Specific pieces of Personal Information collected about consumers. Categories of your Personal Information sold in the preceding 12 months; Categories of third parties to whom your Personal Information has been disclosed; and Categories of Personal Information that we disclosed about consumers for a business purpose. If this Policy does not answer your questions, then you have the right to contact us and request further information on each of these topics. Depending on your state of residence, these rights may also include: The right to access your Personal Information in a portable format; The right to ask us to correct your Personal Information; The right to opt-out of sharing, disclosure, or sale of your Personal Information; and The right to request that we delete the Personal Information we have about you. However, we are not required to delete information if it is necessary to retain your information to: Complete the transaction for which the Personal Information was collected, provide a good or Service requested by you, or a transaction reasonably anticipated within the context of our or one of our affiliate’s ongoing business relationship with you, or to otherwise perform a contract we have with you; Detect security incidents, protect against malicious, deceptive, fraudulent or illegal activity or prosecute those responsible for that activity; Debug to identify and repair errors that impair existing intended functionality; Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law; Facilitate solely internal uses that are reasonably aligned with your expectations based on your relationship with us or one of our affiliates; Comply with a legal obligation; or Otherwise use the Personal Information, internally, in a lawful manner that is compatible with the context in which it was provided. You can contact us with questions about this Privacy Notice or to exercise your rights as described above by emailing privacy@advarra.com with “Request for California Privacy Information” in the body and subject line of the email. Additionally, you may have the right to appeal the denial of any of these rights by submitting a form that will be provided to you if we deny a data request. Certain Services may be limited or unavailable if information is deleted or processing is stopped. To ensure the security of your Personal Information, we will generally ask you to verify your requests under these rights. In these arrangements, the use of the Personal Information we share is limited by policies, contracts, or similar restrictions. Certain information we collect may be exempt from some state privacy laws because it is considered public information or it is covered by a federal privacy law, such as the Health Insurance Portability and Accountability Act. For Residents of Other Jurisdictions If the laws of your country or other jurisdiction are not mentioned above, you may also have rights under your home jurisdiction’s laws to access, erase, correct, and move your Personal Information. For more information, please contact us at privacy@advarra.com if you wish to exercise your rights. You may have rights to file a complaint with a regulator in your jurisdiction if we do not adequately address your requests or concerns. Below is a non-exhaustive list of various data protection authorities who you may contact about enforcing your data rights: Australia: Information on how to file a complaint is available here https://www.oaic.gov.au/privacy/privacy-complaints/ Canada: Information on how to file a complaint is available here https://www.priv.gc.ca/en/report-a-concern/file-a-formal-privacy-complaint/