SOLUTIONS USE CASES CUSTOMERS DEVELOPERS PARTNERS RESOURCES COMPANY ENGLISH REQUEST A DEMO IMPORTANT SUMMARY THE INFORMATION WE COLLECT TRACKING TECHNOLOGIES ADVERTISING HOW WE MAY SHARE YOUR INFORMATION CHILDREN’S PRIVACY THIRD PARTY WEBSITE HOW WE SAFEGUARD YOUR INFORMATION YOUR CALIFORNIA PRIVACY RIGHTS ADDITIONAL DISCLOSURES FOR CALIFORNIA RESIDENTS USE OF THE WEBSITES FROM OUTSIDE THE UNITED STATES CHANGES TO OUR PRIVACY POLICY PRIVACY QUESTIONS AND CONTACTING US EFFECTIVE DATE This Privacy Policy describes the information practices, policies and procedures of websites and other public-facing online services owned and/or operated by Kyriba Corp. and our affiliates and subsidiaries, Kyriba SAS, Kyriba SEMEA SAS, Kyriba UK Ltd., Kyriba HK Limited, Kyriba (Chongqing) Software Development Ltd., Kyriba SEA PTE. Ltd., Kyriba Japan, Co., Ltd., Kyriba Middle East FZ-LLC, Kyriba Engineering Limited Liability Company, Rim Tec Inc., Fireapps GmbH, and Fireapps UK Ltd. (collectively “Kyriba” or “we” or “us” or “our”) including without limitation www.kyriba.com (collectively, the “Websites”). We understand your concerns about privacy and your interest in knowing how your information is used and safeguarded, and we want to provide you with more information on these topics. This Privacy Policy addresses the types of information we collect on the Websites, how we may use that information and with whom we may share it. Please note that this Privacy Policy applies only to our online information-gathering and dissemination practices via the Websites; it does not apply to any of our practices conducted offline, nor to any data or information collected from our customers via any of our products or services. IMPORTANT By visiting the Websites, you are accepting all of the practices, policies and procedures described herein, and you are further indicating that you agree to be bound by the terms of this Privacy Policy. If you do not agree, please do not visit or discontinue use of the Websites. SUMMARY The notifications provided by this Privacy Policy include: What personal information we collect from you through the Websites. How we use the information we collect. With whom the information may be shared. Information related to third-party websites. How we take steps designed to safeguard your information. What rights and choices you have regarding collection, use and distribution of your information. What rights you have if you are accessing the Websites from outside of the United States. How you can learn about changes to our privacy policies, practices and procedures. How you can contact us with privacy questions. THE INFORMATION WE COLLECT Personal Information You Provide And How It Is Used: Certain services, requests and features of our Websites do require that you voluntarily provide us with some personal information (including, but not limited to, name, postal address, email address) as more particularly described below; availing yourself of any of these services, requests and features is voluntary. You represent and warrant that you will only provide information and use the Websites acting in your capacity as an employee, owner, director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit or other legal entity, and that your communications and transactions with Kyriba occur solely within the context of Kyriba providing the Websites to the company, partnership, sole proprietorship, nonprofit or other legal entity that you represent. Personal information includes data that can be used to identify or contact you. Please note that we may use the personal information we collect through any of the services, requests and features listed below for our business purposes, such as providing content or information, products and services to you, and our marketing and advertising activities. Please do not send confidential information to us directly through the Websites, or by email to any of the contact email addresses listed on the Websites. Webinars: If you opt to view one of our webinars, we will ask you to provide certain personal information, including your first and last name, email address, country of origin and phone number. Blogs: We provide you the ability to comment on our blogs. In order to leave a comment on one of our blogs, you will be required to provide your name and email address. Events: We provide information related to events that we periodically host. If you are interested in attending one of Kyriba’s events, we will ask you to provide an email address and other contact information so that we can reserve your seat and follow up with you. Careers: We post certain career opportunities on the Websites. If you are interested in learning more about any of these opportunities, we provide you a link to email us, and our service provider will collect your email address and any other information required such as name, mailing address, and your resume and share that information with us. We use this information to contact you to review or pursue your candidacy. Email Newsletters/Updates: When you register to get access or take part in any of our resources, such as events or webinars, we may use the information that you provide us when you register to keep in touch and update you on upcoming events, new developments or other Kyriba-related or partner-related information. You may unsubscribe from receiving all or some these updates at any time by using the opt-out link provided in any subsequent email you receive from us, or by emailing your request to treasury@kyriba.com. Contact Us: If you contact us through the contact form option on the Websites, we will ask that you provide certain personal information, including your first and last name, email address and country of origin, and you will have the option to provide additional personal information. We will use the information you provide to contact you and to respond to any requests. Information We Collect by Automated Means And How We Use It: We or service providers on our behalf also collect certain information by automated means when you visit the Websites. One of the ways we collect this information is through the use of Google Analytics, a tracking service that collects such information. The information collected may include usage information, such as the numbers and frequency of users to the Websites, pages visited, social networking activities and similar data. We use this data in the aggregate and not in a manner that is intended to identify you personally. This type of information may be shared with third parties as further described in this Privacy Policy. In addition to the tracking services mentioned above, we also collect this information through various other means, including “cookies,” and other tracking technologies, as further explained below. You can opt-out of your data being used by Google Analytics through cookies by visiting https://tools.google.com/dlpage/gaoptout and downloading the Google Analytics Opt-out Browser Add-on. TRACKING TECHNOLOGIES Kyriba and its partners use cookies or similar tracking technologies to track website visitor’s activity to further enhance user experience, to track pages viewed, how long someone stays on a webpage, whether error messages were received, remember information you have provided in order to provide a more customized experience, and store username or related login credentials so that you do not have to provide this information every time you return to the websites. Passive Collection – When you visit and interact with the Websites, Kyriba and service providers with whom we have contracted to provide services for us may collect Internet Protocol addresses (each an “IP Address”), as well as browser type, Internet service provider (ISP), referring/exit pages, platform type, date/time stamp, and page navigation. An IP address is a unique identifier number that certain electronic devices use to identify and to communicate with each other on the Internet; your ISP automatically assigns an IP Address to the computer that you are using. We gather this information to track website visitor movement in the aggregate, and to gather broad demographic information for aggregate use. Our goal in gathering this information is to learn how our customers and the public are consuming our content and using our service. We may use this information to enhance the Websites or for other lawful purposes. Do Not Track – Every time your computer sends or receives information over the Web, the request begins with some short pieces of information called “headers.” These headers include information like what browser you are using, what language your computer is set to, and other details. The Do Not Track technology provides individual users with the ability to include a simple, machine-readable header indicating that they don’t want to be tracked, and sends a signal to websites visited requesting that the website disable either its tracking or cross-site user tracking of an individual user. Presently, there is no consensus on how Do Not Track should be interpreted, and no common or accepted industry standard for implementing. Consequently, please note that the Websites may or may not respond to a particular browser’s “Do Not Track” signals and while we make every effort to respect an individual’s choice in the matter, we cannot guarantee that no tracking will occur. ADVERTISING We partner with third parties to display advertising on our website or to manage our advertising on other sites. Our third party partners may use cookies or similar technologies in order to provide you advertising based upon your browsing activities and interests. If you wish to opt out of interest-based advertising click here https://optout.aboutads.info/ or if located in the European Union click here https://www.youronlinechoices.eu. Please note you will continue to receive generic ads. Some of the third parties that collect information from or about you on the Websites in order to provide more relevant advertising to you participate in the Digital Advertising Alliance (“DAA”) Self-Regulatory Program for Online Behavioral Advertising. This program offers a centralized location where users can make choices about the use of their information for online behavioral advertising. To learn more about the DAA and your opt-out options for their members, please visit (i) for website opt-out, https://www.aboutads.info/choices; and (ii) for mobile app opt-out, https://www.aboutads.info/appchoices. In addition, some of these third parties may be members of the Network Advertising Initiative (“NAI”). To learn more about the NAI and your opt-out options for their members, visit https://www.networkadvertising.org/choices/. Please note that if you opt-out of online behavioral advertising using any of these methods, the opt-out will only apply to the specific browser or device from which you opt-out. Further, opting-out only means that the selected members should no longer deliver certain interest-based advertising to you, but does not mean you will no longer receive any targeted content and/or ads (e.g., from other ad networks). We are not responsible for effectiveness of, or compliance with, any third parties’ opt-out options or programs or the accuracy of their statements regarding their programs. HOW WE MAY SHARE YOUR INFORMATION In certain situations, Kyriba may be required to disclose personal information (i) if it is required to do so by law, regulation or legal process (such as a court order or subpoena), (ii) in response to requests by government agencies, such as law enforcement or national security authorities, or (iii) when Kyriba believes disclosure is necessary or appropriate to prevent physical, financial or other harm, injury or loss or in connection with an investigation of suspected or actual illegal activity. Kyriba also reserves the right to transfer personal information in the event it sells or transfers all or a portion of its business or assets, or merges with another entity. Should such a sale, transfer or merger occur, Kyriba will use reasonable efforts to direct the transferee to use the personal information in a manner that is consistent with this Policy. We disclose information (described herein) that we collect, in accordance with our legitimate interests and business purposes as stated in this Privacy Policy including as set forth in this section. We share information, such as contact information, with our subsidiaries, affiliates and channel partners such as resellers and co-sellers for business purposes. Those business purposes include identifying prospects and facilitating the ability of those entities to share information with existing and potential business customers regarding Kyriba upcoming events and other new developments. Additionally, we share information we collect with service providers who perform activities on our behalf, such as payment processing, data analytics, marketing and promotional services, website hosting and technical support. We will not sell or rent your information to a third party without your permission, however, we may store your data on servers provided by third party hosting vendors or service providers with whom we have contracted. We do not disclose personal information about you to third parties for their independent use unless you expressly authorize Kyriba and direct Kyriba to do so. We also disclose personal information when: (1) it is necessary to allow Kyriba and its service providers to provide services on Kyriba’s behalf, (2) in order to provide products or services to you, (3) it is necessary in connection with a sale of all or substantially all of the assets of Kyriba or the merger of Kyriba into another entity or any consolidation, share exchange, combination, reorganization, or like transaction in which Kyriba is not the survivor, and (4) otherwise as Kyriba is required or permitted to do so for any or all of the following reasons: (i) to comply with a subpoena, legal process, government request or any other legal obligation, (ii) to prevent, investigate, detect, or prosecute criminal offenses or attacks on the technical integrity of the Websites or our network, and/or (iii) to protect the rights, privacy, property, business, or safety of Kyriba, their partners and employees, the visitors of the Websites, or the public. CHILDREN’S PRIVACY Kyriba’s Websites, products and services are intended for a general audience and are not directed to children under the age of sixteen (16). As such we do not knowingly collect, use, solicit or disclose personal information about visitors less than 16 years of age. If you are under the age of 16, we ask that you do not access the Websites. If you are the parent or guardian of a child under 16 years of age and believe that they have disclosed personal information to us, please contact us at privacy@kyriba.com. THIRD PARTY WEBSITE We also provide links to a variety of third-party social media sites and other websites as a service to you or in order to provide you additional information related to Kyriba or additional venues in which you can learn about and discuss Kyriba. Please note that we have no affiliation with these other parties, and cannot control and are not responsible for the information collection, use, and disclosure practices of such third parties; we encourage you to review and understand their privacy practices and policies, if any, before providing any information to them. We are not responsible for the content or information of these websites, any products or services that may be offered through advertisers or third parties, or any other use of the linked website. In some instances (such as when you are applying for a job) it may look as though you are still on www.kyriba.com, however you are on our third party service providers domain and their privacy policy applies to the collection and use of information. HOW WE SAFEGUARD YOUR INFORMATION We implement and maintain reasonable administrative, physical, and technical security safeguards to help protect information about you from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction. Nevertheless, transmission via the internet is not completely secure and we cannot guarantee the security of information about you. If you have any questions about the security of your information, you can contact us at privacy@kyriba.com. YOUR CALIFORNIA PRIVACY RIGHTS Customers in the state of California may request a list of categorized third parties and in some cases affiliates to whom we may have disclosed their personal information specifically for those third parties’ and/or affiliates’ own marketing purposes, as well as the type of personal information disclosed to those parties. Kyriba does not disclose your personal information to third parties or affiliates for those third parties’ or affiliates’ own marketing purposes. If you are a California resident and would like to more information about our compliance with this law, please submit a written request to privacy@kyriba.com. Requests must include “California Privacy Rights Request” in the first line of the description and include your name, street address, city, state, and ZIP code. Please note that we are not required to respond to requests made by means other than through the provided e-mail address. ADDITIONAL DISCLOSURES FOR CALIFORNIA RESIDENTS Right to Know and Delete. Consumers who are California residents (and not representatives of businesses, whether those businesses are our customers or others) have the right to know certain information about our data practices in the preceding 12 months. In particular, they have the right to request the following from us: The categories of personal information we have collected about them; The categories of sources from which the personal information was collected; The categories of personal information about them that we disclosed for a business purpose or sold; The categories of third parties to whom the personal information was disclosed for a business purpose or sold; and The business or commercial purpose for collecting or selling the personal information. In addition, in certain circumstances California consumers have the right to delete the personal information we have collected from them. To exercise any of these rights, California consumers should submit a request through our online form available at info.kyriba.com/ca-consumer-privacy-act-opt-out, call our toll free number at 844-845-7161. or email us at privacy@kyriba.com. In the request, please specify which right you are seeking to exercise and the scope of the request. We will confirm receipt of your request within 10 days. We may require specific information from you to help us verify your identity and process your request. If we are unable to verify your identity, we may deny your requests to know or delete. If personal information about you has been processed by us as a service provider on behalf of a customer and you wish to exercise any rights you have with such personal information, please inquire with our customer directly. If you wish to make your request directly to us, please provide the name of our customer on whose behalf we processed your personal information. We will refer your request to that customer, and will support them to the extent required by applicable law in responding to your request. Do Not Sell My Personal Information. To the extent Kyriba sells your personal information as the term “sell” is defined under the California Consumer Privacy Act, you have the right to opt-out of the sale of your personal information by us to third parties at any time. You may submit a request to opt-out by clicking Do Not Sell My Personal Information info.kyriba.com/ca-consumer-privacy-act-opt-out. You may also submit a request to opt-out by calling our toll-free number at 844-845-7161, or emailing us at privacy@kyriba.com. USE OF THE WEBSITES FROM OUTSIDE THE UNITED STATES International Transfers We do not represent or warrant that the Websites, or any part thereof, are appropriate or available for use in any particular geographic location. If you choose to access the Websites, you do so on your own initiative and at your own risk, and you are responsible for complying with all local laws, rules, and regulations applicable in your jurisdiction. Please note that the Websites are hosted in the United States and are governed by United States law. If you are visiting the Websites from outside the United States, please be aware that your information will be transferred to, stored and processed in the United States where our servers are located and our central database is operated. The data protection and other laws of the United States might not be as comprehensive as those in your country. By using the Websites, you consent to your information being transferred to our facilities and to the facilities of those third parties with whom we share it as described in this Privacy Policy. European Union Model Clauses and Privacy Shield We are committed to subjecting all personal data, whether received from the European Economic Area (EEA) or Switzerland, to the appropriate legal framework that applies to the personal data transfer. Kyriba and the affiliates and subsidiaries referenced in this Privacy Policy have entered into the European Union Model Clauses (also referred to as Standard Contractual Clauses) to ensure that transfers of personal data from the EEA to the rest of the world are made in compliance with EEA data protection laws. Kyriba, its affiliates, and its subsidiaries also participate in and have certified their compliance with the EU-U.S. Privacy Shield Framework and the Swiss-U.S. Privacy Shield Framework. Although the Privacy Shield Frameworks have been invalidated, we are committed to subjecting all personal data received from European Union (EU) member countries and Switzerland,to the applicable Privacy Shield Principles. To learn more about the Privacy Shield Frameworks, and to view our certification, visit the U.S. Department of Commerce’s Privacy Shield List, https://www.privacyshield.gov. Kyriba is responsible for the processing of personal data it receives, and that it subsequently transfers to a third party acting as an agent on its behalf. Kyriba complies with the Privacy Shield Principles of notice, choice, accountability for onward transfer, security, data integrity and purpose limitation, access, and recourse, enforcement and liability. With respect to personal data received or transferred pursuant to the Privacy Shield Frameworks, Kyriba is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission. Kyriba hereby affirms our commitment to be subject to the Privacy Shield Principles all personal data transferred from the European Union and Switzerland in reliance on Privacy Shield. This means that, in addition to our other obligations under the Privacy Shield Principles, we shall be liable to you for any third party agent to which we transfer your personal data and that processes such personal data in a manner that violates the Privacy Shield Principles, unless we can demonstrate that we are not responsible for the resulting damages. If you have an inquiry, dispute or unresolved questions that arise out of or relate to our compliance with Privacy Shield or the European Union Model Clauses, please contact us at privacy@kyriba.com. If we have not addressed your concerns satisfactorily, please contact our U.S.-based third party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request. Under certain conditions, more fully described on the Privacy Shield Website, you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted. To read more about how we treat information collected from the EU and Switzerland, please read our Kyriba Technology Platform Customer Privacy Notice here. Data Controller Data protection laws in Europe make a distinction between organizations that process personal data for their own purposes (known as “controllers”) and organizations that process personal data on behalf of other organizations (known as “processors”). Kyriba acts as a controller with respect to personal data collected as you interact with our Websites, emails, and advertisements. Lawful Basis for Processing Data protection laws in Europe require a “lawful basis” for processing personal data. Our lawful bases include where: (a) you have given consent to the processing for one or more specific purposes, either to us or to our service providers; (b) processing is necessary for the performance of a contract with you; (c) processing is necessary for compliance with a legal obligation; or (d) processing is necessary for the purposes of the legitimate interests pursued by us or a third party, and your interests and fundamental rights and freedoms do not override those interests. Your European Privacy Rights Upon request, Kyriba will provide you with information about whether or not we hold any of your personal data. To the extent required by law, we provide you with (i) reasonable access to the personal data you provide to us, (ii) the ability to review, correct and delete such personal data, (iii) the right to data portability, and (iv) the ability to restrict or object to our processing of personal data we collected about you. If you believe that any of the personal data that you have submitted through the Websites is no longer accurate, or you wish to make any updates or changes, or rights requests, you may do so by emailing us at privacy@kyriba.com. Upon appropriate request, we will endeavor to comply with your request as soon as reasonably practicable. However, we reserve the right to use any information previously obtained to verify your identity or take other actions that we believe are appropriate and lawful. We may decline to process requests that are unreasonably repetitive, require disproportionate technical effort, jeopardize the privacy of others, are impractical, or for which access is not otherwise required by local law. Please note we may need to retain certain information for record keeping purposes, and there may also be residual information that will remain within our databases and other records, which will not be removed from such locations. European Complaints If you have a complaint about our use of your personal data or response to your requests regarding your personal data, you may submit a complaint to the data protection regulator in your jurisdiction. We would, however, appreciate the opportunity to address your concerns before you approach a data protection regulator, and would welcome you directing an inquiry first to us at privacy@kyriba.com. CHANGES TO OUR PRIVACY POLICY We may update this Privacy Policy at any time to reflect changes to our information practices. If we make any material changes we will notify you by email (sent to the e-mail address specified in your account) or by means of a notice on this website prior to the change becoming effective. We encourage you to periodically review this page for the latest information on our privacy practices. PRIVACY QUESTIONS AND CONTACTING US If you have any questions or concerns about our Privacy Policy or data practices, or our compliance with applicable law please contact us by email at privacy@kyriba.com or by mail at: Kyriba Corp. 4435 Eastgate Mall, Suite 200 San Diego, CA 92121 EFFECTIVE DATE This Privacy Policy was last updated November 16, 2020. ALSO OF INTEREST Balance Sheet Exposure ManagementData VisualizationPayments