PRIVACY NOTICE

This privacy notice (“Notice”) explains how Togai Inc. or any of its affiliates or subsidiaries. (“We”, “Us”, “Our”, “Togai”) processes Personal Data collected from natural persons as specified in the section “How We Collect, Use and Share Your Personal Data” (“You”).

Terms not specifically defined herein shall have the meaning ascribed thereto in the Terms.

1. “Controller” means the natural or legal person, public authority, agency, or other body which alone or jointly with others, determines the purposes and means of the processing of Personal Data.
2. “End-User” means any person or entity with whom the User interacts using the Service(s).
3. “Personal Data” means any information relating to an identified or identifiable natural person; an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
4. “Processor” means a natural or legal person, public authority, agency, or other body which processes Personal Data on behalf of the Controller.
5. “Service(s)” shall have the meaning ascribed to it in the Terms.
6. “Subscriber” means the natural or legal person that has subscribed to the Service(s) by agreeing to the Terms or signing any other agreement for the subscription and use of the Service(s).
7. “Terms” means the Terms of Service at togai.com/terms.
8. “Website(s)” means the websites owned and operated by Us including togai.com.

If You provide Us with any Personal Data relating to other individuals, You represent that You have the authority to do so, and where required, have obtained the necessary consent, and acknowledge that it may be used in accordance with this Privacy Notice.

In addition to the details provided in the table above, We may also share Your Personal Data with

1. Our group entities and the companies that We will acquire in the future when they are made a part of Our group entities to provide and improve Our Services
2. Third Parties involved in a Corporate Transaction: If We become involved in a merger, acquisition, or any form of sale of some or all its assets, then, in accordance with applicable laws, We will use reasonable efforts to notify You of any transfer of Personal Data to an unaffiliated third party.
3. Law enforcement authorities, government authorities, courts, dispute resolution bodies, regulators, auditors, and any party appointed or requested by applicable regulators to carry out investigations or audits of Our activities.
4. Professional advisors who advise and assist Us in enforcing Our contracts and policies, handling Our claims, effective management of Our company and in relation to any disputes We may become involved in.

• If You are a data subject from the European Economic Area, Our legal basis for collecting and using the Personal Data described above will depend on the Personal Data concerned and the specific context in which We collect it.
• We will normally collect Personal Data from You only where it needs it to perform a contract with You, where the processing is in Our legitimate interests and not overridden by Your data protection interests or fundamental rights and freedoms, or where We have Your consent. In some cases, We may also have a legal obligation to collect Personal Data from You. If We process Personal Data with reliance on Your consent, You may withdraw Your consent at any time.
• If You have questions or need further information concerning the legal basis on which We collect and use Your Personal Data, please contact Us using the contact details provided under clause 12.

• We mainly process Personal Data in the United States. However, We may transfer Personal Data outside the United States for the purposes referred to in Section 4. We will ensure that the recipient of Your Personal Data offers an adequate level of protection that is at least comparable to that which is provided under applicable data protection laws.
• If You are a resident of the European Economic Area and when Your Personal Data is processed outside EEA, We will ensure that the recipient of Your Personal Data offers an adequate level of protection, for instance by entering into standard contractual clauses for the transfer of Personal Data as approved by the European Commission (Article 46 General Data Privacy Regulation, 2016), or We will ask You for Your prior consent to such international data transfers.

We retain the Personal Data collected where an ongoing legitimate business requires retention of such Personal Data.

• In the absence of a need to retain Personal Data under Section 5.1. above, We will either delete it or aggregate it, or, if this is not possible then We will securely store Your Personal Data and isolate it from any further processing until deletion is possible.

You are entitled to the following rights:

1. You can request Us for access and correction of Your Personal Data.
2. If We have collected and processed Your Personal Data with Your consent, then You can withdraw your consent at any time. Withdrawing Your consent will not affect the lawfulness of any processing We have conducted prior to Your withdrawal, nor will it affect processing of Your Personal Data conducted in reliance on lawful processing grounds other than consent.
3. You have the right to complain to a data protection authority about Our collection and use of Your Personal Data. For more information, please contact Your local data protection authority.
4. You have the right to opt-out of marketing communications We send You at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing emails We send You. To opt-out of other forms of marketing (such as postal marketing or telemarketing), please Contact Us.
5. If You are a resident of the EEA, UK, or Switzerland, You are also entitled to the following rights:
   • You can request Us for deletion and erasure of Your Personal Data.
   • You can object to the processing of Your Personal Data, ask Us to restrict processing of Your Personal Data or request portability of Your Personal Data.
6. If You seek to exercise Your rights under this clause, please contact Us at the details provided in clause 12. We will verify any requests before acting on the request and respond to all requests We receive from individuals wishing to exercise their data protection rights within a reasonable timeframe in accordance with applicable data protection laws.

1. Cookies are text files that are placed on Your computer to collect standard internet log information and visitor behaviour information by Us. When You visit the Website(s), We may collect Personal Data automatically from You through cookies or similar technology. We also set cookies to collect information that is used either in aggregate form to help Us understand how Our Website(s) is being used or how effective Our marketing campaigns are, to help customise the Website(s) for You or to make advertising messages more relevant to You.
2. Essential Cookies: We set essential cookies that enable core functionality such as security, network management, and accessibility. You may not opt-out of these cookies. However, You may disable these by changing Your browser settings, but this may affect how the Website(s) functions.
3. Analytics, Customisation and Advertising Cookies: We set these cookies to help Us improve Our Website(s) by collecting and reporting information on how You use it. The cookies collect information in a way that does not directly identify anyone.
   • When You visit the Website(s), a cookie banner will be displayed providing additional information about cookies and options to opt out of non-essential cookies as required by applicable laws.

This clause applies only to California residents and the Personal Information We collect as Business. “CCPA” means the California Consumer Privacy Act of 2018 as amended by the CPRA. “CPRA” means the California Privacy Rights Act. For the purposes of this section, the terms “Business”, “Business Purpose”, “Consumer” “Personal Information”, “Sale/Sell”, “Service Provider” and “Sensitive Personal Information” and “Share” shall have the meaning given to them under the CCPA.

The categories of Personal Information We have collected in the twelve (12) months prior to the Effective Date and that We may collect include:

1. Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, social security number, passport number, or other similar identifiers;
2. Signature, physical characteristics or description, telephone number, state identification card number, insurance policy number, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information;
3. Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet Website, application, or advertisement;
4. Geolocation data;
5. Audio, electronic, visual, thermal, olfactory, or similar information.

Disclosure of Personal Information. We have disclosed the categories of Personal Information listed in clause 9.2 above for a business purpose in the twelve (12) months prior to the Effective Date and may disclose such Personal Information to service providers or contractors or to any other third parties who support our business provided (a) they do not Sell or Share such Personal Information or (b) retain, use or disclose such information for any purpose other than for the specific purpose of performing the services specified in our contract with them or (c) combine such information with any other information received directly by them. We do not Sell or Share (as the terms are defined in the CPRA) the Personal Information We collect without providing You a right to opt out. We do not Sell or Share Personal Information of minors of at least the age of thirteen (13) but less than sixteen (16) years without receiving such minor’s consent or the consent of the minor’s guardian if the minor is less than thirteen (13) years. We have not Sold or Shared any Personal Information in the twelve (12) months prior to the Effective Date. We shall not disclose further the Personal Information collected for verification of a consumer’s request or retain it longer than it is necessary for the purpose of verification.

You are entitled to the following rights under the CCPA:

1. You can request Us to disclose details and categories of Your Personal Information collected by Us.
2. You can request Us to disclose Your Personal Information collected twelve (12) months prior to the Effective Date, this right shall apply only to personal information collected after January 1, 2022.
3. You can request Us to disclose (a) Your Personal Information Sold or Shared and (b) the service provider or contractor, or a third-party (as defined in the CPRA) to whom such information is Sold or Shared.
4. You can request Us to correct Your inaccurate Personal Information.
5. You have the right to request the deletion of your personal information held by Us or by Our service provider, contractor, or any other third party to whom We have disclosed personal information to. We shall hold a confidential record of all deletion requests for the purpose of preventing the selling of such personal information for which You have submitted a deletion request.
6. You have the right to opt out of any Sale or Sharing of Your Personal Information if any such sale or sharing occurs.
7. You can request us to limit the use of Your Sensitive Personal Information.
8. You can request the transfer of specific pieces of Your Personal Information to any other entity.
9. You have the right to not be discriminated against for exercising Your rights under CCPA.

California Consumers may make a request pursuant to their rights under the CCPA by contacting Us at the details provided in clause 12. Requests must include “California Privacy Rights Request” in the first line of the description and include your name, street address, city, state, and ZIP code We will verify any requests before acting on the request and respond to all requests We receive from individuals wishing to exercise their data protection rights within a reasonable timeframe in accordance with the CCPA. Consumers may also designate an authorised agent to exercise these rights on their behalf.

We recognize the importance of children's safety and privacy. We do not request, or knowingly collect, any Personal Data from children under the age of 18. If a parent or guardian becomes aware that his or her child has provided Us with Personal Data, they should write to us at the email address provided in clause 12.

1. Other than the Personal Data collected for the purposes set forth in clause 2 for which We shall act as the Controller, for any other processing of Personal Data collected from or transmitted by a Subscriber, We will only act as a Processor of Personal Data and such processing will be governed by the terms and conditions of the agreement with the Subscriber. Where the Services are made available to an End-User through a Subscriber, that enterprise is the Controller of the End-User’s Personal Data. In such a case, the End-User’s data privacy questions and requests should be submitted to the Subscriber in its capacity as the End-User’s Controller. If the End-User is an individual who interacts with a Subscriber using Our Services, the End-User will be directed to contact Our Subscriber for assistance with any requests or questions relating to their Personal Data. We are not responsible for Subscribers’ privacy or security practices which may be different from this notice. Subscribers to Our Services are solely responsible for establishing policies for and ensuring compliance with all applicable laws and regulations, as well as any and all privacy policies, agreements, or other obligations, relating to the collection of Personal Data in connection with the use of Our Services by End-Users.
2. Our Website(s) contain links to other websites. Our Notice applies only to our Website(s), so if You click on a link to another website, You should read their privacy notice. We encourage You to review the privacy statements of any such other websites to understand their Personal Data practices.

You may contact Our privacy officer if You have any enquiries or feedback on Our personal data protection policies and procedures, or if You wish to make any request, in the following manner:

Kind Attention: Aravind Sriraman

Email Address: privacy@togai.com

Address: 1007, N Orange Street, 4th Floor, 1285 Wilmington 19801 Delaware U.S.A.