Orbian Privacy Policy Introduction Orbian is a financial services company providing supply chain finance programs to corporate buyers of goods and services and their suppliers. We understand that you are aware of and care about your own personal privacy interests, and we take that seriously. This Privacy Policy describes Orbian’s policies and practices regarding its collection and use of your personal data, and sets forth your privacy rights. We recognize that information privacy is an ongoing responsibility, and so we will from time to time update this Privacy Policy as we undertake new personal data practices or adopt new privacy policies. For general legal policies including our underaged policy notice and Modern Slavery Act Statement, please see Legal Notices. Data Protection Officer Orbian is headquartered in California, in the United States and maintains offices in Munich, Germany and London, UK. Orbian has appointed an internal data protection officer for you to contact if you have any questions or concerns about Orbian’s personal data policies or practices. Orbian’s data protection officer’s name and contact information are as follows: James D. Houston Chief Legal Officer Orbian Worldwide 2175 Salk Avenue, Suite 160 Carlsbad, CA 92008 USA dpo@orbian.com +1-760-891-2300 How We Collect and Use (Process) Your Personal Information Orbian collects personal information about its customers. With a few exceptions, this information is limited to the kinds of information that can be found on a business card: first name, last name, job title, employer name, work address, work email, and work phone number. We use this information to provide customers with financial services and only those services for which our customers directly contract with us. We do not sell personal information to anyone and only share it with third parties who are facilitating the delivery of Orbian services for the same purposes. Personal Information You Give to Us: Customer When you become an Orbian customer, we collect information about you including (but not limited to) your name, your employer’s name, your work address (including your country location), and your email address. We may also collect your personal email address, a personal mailing address, and a mobile phone number, although this is not typical. We process your personal information for contract and payments administration, to deliver customer benefits to you, and to inform you of Orbian-related events, content and other benefits or opportunities associated with your Orbian account. Orbian may also use this information to help Orbian understand our customers’ needs and interests to better tailor our products and services to meet your needs. Live Events and Web Conferences Orbian hosts events throughout the year. These include in-person conferences as well as live web conferences (collectively “events”). If you register for one of our events and you are a customer, we will access the information in your customer account to provide you with information and services associated with the event. If you are not a customer and you register for one of our events, we will collect your name and contact information, which we will store in our database(s) and use to provide you with information and services associated with the event. We keep a record of your participation in Orbian events as an attendee. This information may be used to tell you about other events and publications. It may also be used to help Orbian understand our customers’ needs and interests to better tailor our products and services to meet your needs. Some of our events in the future may be sponsored. In this case, Orbian will provide an attendee list to sponsors, co-sponsors and exhibitors of our events. Orbian may also allow sponsors, co-sponsors and/or exhibitors to send you material by mail once per sponsored event, in which case Orbian will engage a third-party mailing house and does not share your mailing address directly with the sponsor/exhibitor. If you do not wish to have your information included in an attendee list or to receive information from sponsors, co-sponsors and/or exhibitors, you can express your preferences when you register for events or you may contact Orbian directly at dpo@orbian.com. Publications Orbian offers SCF-related content for our customers. In addition to producing original content, Orbian also subscribes to news feeds and blogs produced by others, which we may link to from an Orbian Website. This means you may find yourself on an Orbian Website or reading an email from the Orbian publications team and we will offer you a link to another organization’s website where you will find content on supply chain finance that we find relevant and useful to you. At these times, you will be leaving an Orbian Website. Orbian is not responsible or liable for content provided by these third-party websites or personal information they may happen to gather from you. You may wish to subscribe to Orbian’s publications without becoming a customer of Orbian. To receive Orbian news by email, you will need to create a “profile” with us which involves providing Orbian with at least your first name and last name, an email address, and the country in which you live. Orbian does not share this information with any third party other than to store the information in our cloud-hosted databases. You may manage your Orbian subscriptions by subscribing or unsubscribing at any time. Please note that if you have set your browser to block cookies, this may have an impact on your ability to unsubscribe. If you have any difficulties managing your email or other communication preferences with Orbian, please contact us at dpo@orbian.com. Orbian uses Google Analytics to track how often people gain access to or read our content. We use this information in the aggregate to understand what content our customers find useful or interesting, so we can produce the most valuable content to meet your needs. We also conduct surveys that we use to produce original research on the privacy profession. We do not track individuals but look at information in the aggregate only. Participation in surveys is voluntary. Training If you participate in an Orbian training, information session, Webex or the like, you may sign up directly in which case we collect your name and contact information directly from you. You may, alternatively, sign up for training – or be signed up for training – by or through a third party such as your own employer. Your personal information will be stored in our database (hosted by cloud service provider) and may also be shared with our trainers. Orbian’s trainers have agreed not to share your information with others and not to use your personal information other than to provide you with Orbian products and services. Your Correspondence with Orbian If you correspond with us by email, the postal service, or other form of communication, we may retain such correspondence and the information contained in it and use it to respond to your inquiry; to notify you of conferences, publications, or other services; or to keep a record of your complaint, accommodation request, and the like. As always, if you wish to have Orbian “erase” your personal information or otherwise refrain from communicating with you, please contact us at dpo@orbian.com. Note: if you ask Orbian not to contact you by email at a certain email address, Orbian will retain a copy of that email address on its “master do not send” list in order to comply with your no-contact request. Purposes for Processing Your Data As explained above, Orbian processes your data to provide you with the goods or services you have requested and for which you have contracted with us. We use this information to refine our goods and services to better tailor them to your needs and to communicate with you about other services Orbian offers that may assist you in your career or otherwise help you do your job relative to your company’s supply chain finance program or participation as a vendor therein. Personal Information We Get from Third Parties From time to time, Orbian receives personal information about individuals from third parties. This may happen if your employer is a corporate customer of Orbian and signs you up as an account manager for training. What Happens If You Don’t Give Us Your Data You can enjoy much of Orbian’s web content without giving us your personal data. Much of the information on the Orbian websites is available even to those who are not customers. You can even enter only the minimal amount of information (name and contact information) to access information. Some personal information is necessary so that Orbian can supply you with the services you requested and contracted, and to authenticate you so that we know it is you and not someone else. You may manage your account subscriptions and you may opt-out of receiving marketing communication at any time. Use of Orbian Websites Orbian websites include orbian.com, orbiansupplier.com and orbianclient.com (the “Orbian Websites”). If any websites are added in the future, this notice will apply to any such websites. As is true of most other websites, the Orbian Websites collect certain information automatically and store it in log files. The information may include internet protocol (IP) addresses, the region or general location where your computer or device is accessing the internet, browser type, operating system, and other usage information about the use of the Orbian Websites, including a history of the pages you view. We use this information to help us design our sites to better suit our users’ needs. We may also use your IP address to help diagnose problems with our server and to administer our website, analyze trends, track visitor movements, and gather broad demographic information that assists us in identifying visitor preferences. The Orbian Websites also use session cookies, and persistent cookies related to analytics. The Orbian Websites do not track users when they cross to third party websites, do not provide targeted advertising to them, and therefore do not respond to Do Not Track (DNT) signals. Cookie Notice The Orbian Websites use cookies to improve the user experience and ensure that they are functioning effectively. To provide you with a more personalized and responsive service we need to remember and store information about how you use the Orbian Websites. This is done using small text files called cookies. Cookies contain small amounts of information and are downloaded to your computer or other device by a server for the Orbian Websites. Your web browser then sends these cookies back to the Orbian Websites on each subsequent visit so that it can recognize you and remember things like your user preferences. You can find more detailed information about cookies and how they work at http://www.aboutcookies.org/. Whenever you use the Orbian Websites, cookies and other technologies may collect information. By using the Orbian Websites you agree to our use of cookies as described in this Cookie Notice. What Cookies Do We Use and Why? Some of the cookies we use are necessary to enable you to move around the Orbian Websites and use their features such as accessing secure areas that may contain content for registered users. We also use functional cookies to record information about the choices you have made and to allow us to tailor the Orbian Websites to our users. This information is usually anonymized and is not used for any purpose unrelated to the Orbian Websites. We or our service providers also use analytic services to help us understand how effective our content is, what interests our users have, and to improve how the Orbian Websites work. The Orbian Websites do not use targeting cookies to deliver targeted advertising on the Orbian Websites. Please contact us by emailing dpo@orbian.com if you would like more detailed information on the cookies we use. How to Control Cookies? By using the Orbian Websites you agree that we can place cookies on your computer or device as explained above. However, you can control and manage cookies in various ways. Please bear in mind that removing or blocking cookies can impact on your user experience and parts of the Orbian Websites may no longer be fully accessible. Do Not Track and Browser Controls Current “Do Not Track” initiatives are not recognized by the Orbian Websites; however, most browsers will allow you to see what cookies you have and delete them on an individual basis or block cookies from particular or all websites. Be aware that any preference you have set will be lost if you delete all cookies, including your preference to opt-out from cookies as this itself requires an opt-out cookie to have been set. For more information on how to modify your browser settings to block or filter cookies, see http://www.aboutcookies.org/ or http://www.cookiecentral.com/faq/. Managing Analytics Cookies You can opt-out of having your anonymized browsing activity within websites recorded by analytics cookies. We use the following service providers and you can learn more about their privacy policies and how to opt-out of their cookies by clicking on following link: Google Analytics: http://www.google.com/analytics/learn/privacy.html Do Not Track Orbian does not track its customers when they cross to third party websites, does not provide targeted advertising to them, and therefore does not respond to Do Not Track (DNT) signals. Privacy Policy This Cookie Notice is part of our Privacy Policy. When and How We Share Information with Others Information you provide to open an Orbian account is maintained in association with your Orbian customer account. The personal information Orbian collects from you is stored in one or more databases hosted by third parties located in the United States and the United Kingdom. These third parties do not use or have access to your personal information for any purpose other than cloud storage and retrieval. We do not otherwise reveal your personal data to third-parties for their independent use unless: (1) you request or authorize it; (2) it’s in connection with Orbian hosted events described above; (3) the information is provided to comply with the law (for example, to comply with a search warrant, subpoena or court order), enforce an agreement we have with you, or to protect our rights, property or safety, or the rights, property or safety of our employees or others; (4) the information is provided to our agents, vendors or service providers who perform functions on our behalf; (5) to address emergencies or acts of God; or (6) to address disputes, claims, or to persons demonstrating legal authority to act on your behalf. We may also gather aggregated data about our customers and Site visitors and disclose the results of such aggregated (but not personally identifiable) information to our partners, service providers, advertisers and/or other third parties for marketing or promotional purposes. Transferring Personal Data from the EU to the US Orbian has its headquarters in the United States. Information we collect from you will be processed in the United States. The United States has not sought nor received a finding of “adequacy” from the European Union under Article 45 of the GDPR. Orbian relies on derogations for specific situations as set forth in Article 49 of the GDPR. In particular, Orbian collects and transfers to the U.S. personal data only: with your consent; to perform a contract with you; or to fulfill a compelling legitimate interest of Orbian in a manner that does not outweigh your rights and freedoms. Orbian endeavors to apply suitable safeguards to protect the privacy and security of your personal data and to use it only consistent with your relationship with Orbian and the practices described in this Privacy Policy. Orbian also minimizes the risk to your rights and freedoms by not collecting or storing sensitive information about you. Data Subject Rights This Privacy Policy is intended to provide you with information about what personal data Orbian collects about you and how it is used. If you have any questions, please contact us at dpo@orbian.com. If you wish to confirm that Orbian is processing your personal data, or to have access to the personal data Orbian may have about you, please contact us at dpo@orbian.com. The European Union’s General Data Protection Regulation and other countries’ privacy laws provide certain rights for data subjects. A good explanation of them (in English) is available on the website of the United Kingdom’s Information Commissioner’s Office. If you wish to confirm that Orbian is processing your personal data, or to have access to the personal data Orbian may have about you, please contact us at dpo@orbian.com. You may also request information about: the purpose of the processing; the categories of personal data concerned; who else outside Orbian might have received the data from Orbian; what the source of the information was (if you didn’t provide it directly to Orbian); and how long it will be stored. You have a right to correct (rectify) the record of your personal data maintained by Orbian if it is inaccurate. You may request that Orbian erase that data or cease processing it, subject to certain exceptions. You may also request that Orbian cease using your data for direct marketing purposes. In many countries, you have a right to lodge a complaint with the appropriate data protection authority if you have concerns about how Orbian processes your personal data. When technically feasible, Orbian will—at your request—provide your personal data to you or transmit it directly to another controller. Reasonable access to your personal data will be provided at no cost to Orbian customers, conference attendees and others upon request made to Orbian at dpo@orbian.com. If access cannot be provided within a reasonable time frame, Orbian will provide you with a date when the information will be provided. If for some reason access is denied, Orbian will provide an explanation as to why access has been denied. Security of Your Information To help protect the privacy of data and personally identifiable information you transmit to us, we maintain physical, technical, and administrative safeguards. We update and test our security technology on an ongoing basis. We restrict access to your personal data to only those employees who need to know that information to provide our services to you. In addition, we train our employees about the importance of confidentiality and maintaining the privacy and security of your information. We commit to taking appropriate disciplinary measures to enforce our employees’ privacy responsibilities. Data Storage and Retention Your personal data is stored by Orbian on its servers, and on the servers of the cloud-based database management services Orbian engages located in the United States and in the United Kingdom. Orbian retains data for the duration of the customer’s business relationship with Orbian. For more information on where and how long your personal data is stored, and for more information on your rights of erasure and portability, please contact Orbian’s data protection officer at dpo@orbian.com. Changes and Updates to the Privacy Policy As Orbian and its services change from time to time, this Privacy Policy is expected to change as well. We reserve the right to amend the Privacy Policy at any time, for any reason, without notice to you, other than the posting of the amended Privacy Policy at this Site. We may email periodic reminders of our notices and terms and conditions and will email Orbian customers of material changes thereto, but you should check Orbian Websites frequently to see the current Privacy Policy that is in effect and any changes that may have been made to it. The provisions contained herein supersede all previous notices or statements regarding our privacy practices. Questions, Concerns or Complaints Please contact Orbian’s data protection officer: James D. Houston Chief Legal Officer Orbian Worldwide 2175 Salk Avenue, Suite 160 Carlsbad, CA 92008 dpo@orbian.com +1-760-891-2300 SITEMAP OUR SOLUTION KEY DIFFERENTIATORS TRANSACTIONS IMPLEMENTATION SUPPLIER ENGAGEMENT COMPANY OVERVIEW ORBIAN’S HISTORY AWARDS RESOURCES CONTACT US AMERICAS 2175 Salk Ave, Suite 160 Carlsbad, CA 92008 USA +1 (760) 891-2300 GERMANY Residenzstr. 7 80333 Munich +49 89 215 474 929 EUROPE 2nd Floor, 34-37 Liverpool Street London EC2M 7PP UK +44 (0) 208 051 8890 Orbian offers a collaborative, flexible solution for working capital management to meet the financial demands of an agile global supply chain. © Orbian 2021 All rights reserved. Orbian Privacy Policy Orbian Legal Notices Contact Us