APLOS Privacy Policy

1. Personal Information We Collect

Personal Login Information: If you are a Customer accessing and using the Services or a Customer's end user who has created an Aplos account, you may be prompted to provide Aplos your name, email address and other personal information. We will not disclose your Personal Login Information outside of Aplos except as described in this Privacy Notice.

Aplos, and third party service providers we hire to perform business functions on our behalf ("Service Providers") may collect, receive and use various categories of personally identifiable information ("PII") about you. PII is any information that relates to an identified or identifiable individual. Different pieces of information, which, when combined, can lead to the identification of a particular person, is also considered personal PII. The type of PII we collect about you depends on the nature of your interactions with us and the purposes for which you are using the Services or Website. For example, if you are one of our Customers, we collect Personal Information necessary to maintain your organization's account with us. If you are a donor using our platform to make a donation ("Donor") we collect information necessary to facilitate your donation to the entities you have selected. If you are a consumer who has visited our website, we may not need to collect as much information from you, however, if you are a consumer who visited our website and signed up for marketing information, then more information may be required. Such PII for the above may include the following:

Other Information: We collect information when you register or open an account, sign in, pay a bill, contact us for support, or provide us feedback. Also, we collect information that you may provide or create when you interact with our Website. We may also automatically collect certain usage information when you access our Website ("Usage Data"), such as Internet Protocol ("IP") addresses, log files, click stream data, unique device identifiers, pages viewed, browser type, any links you click on to leave or interact with our Website, and other usage information collected from cookies and other tracking technologies. For example, we collect IP addresses to track and aggregate non-personal information, such as using IP addresses to monitor the regions from which users navigate to our Website. We also collect IP addresses from users when they log into the Website as part of our log-in and security features.

Our Website may change over time and we may introduce new features that may collect new or different types of information.

2. How We Use Your Information

We may use your information, including your PII, for the following purposes:

3. Disclosure of Your Information

We do not rent or sell your personal information (such as name, address and telephone number) to third parties for their marketing purposes. We may share your information with third parties to provide products and services you have requested, when we have your consent (if required by law), or as described in this Privacy Statement.

We may disclose aggregated information about users of our Website and Services, and information that does not identify any individual, without restriction.

We may disclose personal information that we collect or you provide as described in this Privacy Statement:

• To contractors, service providers and other third parties we use to support our business or perform analytics and ad measurement services on our behalf (Aplos obtains customer consent for such use where legally required), and who are bound by contractual obligations to keep personal information confidential and use it only for the purposes for which we disclose it to them.
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation or similar proceeding, in which personal information held by us about our Website users is among the assets transferred.
• Aplos uses Plaid Technologies, Inc. ("Plaid") and other data processors such as Finicity to gather end user's data from financial institutions. By using our Website, you grant Aplos and Plaid the right, power, and authority to act on your behalf to access and transmit your personal and financial information from the relevant financial institution. You further agree to your personal and financial information being transferred, stored, and processed by Plaid in accordance with the Plaid Privacy Statement, which can be found at: https://plaid.com/legal.

To fulfill the purpose for which you provide it.

For any other purpose disclosed by us when you provide the information.

With your consent, if required by law.

We may also disclose your personal information:

• To comply with any court order, law or legal process, including to respond to any government or regulatory request.
• To respond to authorized information requests of governmental authorities or where required by law. Aplos reserves the right to use or disclose personal information provided to Aplos in response to a lawful request by public authorities, including to meet national security or law enforcement requirements, or if Aplos reasonably believes that use or disclosure is necessary to protect Aplos's rights and/or to comply with a judicial proceeding, court order, or legal process. In exceptionally rare circumstances where national, state, or company security is at issue, Aplos reserves the right to share our entire database of visitors and clients with appropriate government authorities.
• To enforce or apply our terms of use or terms of sale and other agreements, including for billing and collection purposes.
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Aplos, our customers or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.

Aplos's accountability for personal data that it receives in the United States under the Privacy Shield and subsequently transfers to a third party is described in the Privacy Shield Principles section below. In particular, Aplos remains responsible and liable under the Privacy Shield Principles if third-party agents that it engages to process personal data on its behalf do so in a manner inconsistent with the Principles, unless Aplos proves that it is not responsible for the event giving rise to the damage.

Reporting to Credit Bureaus

Late payments, missed payments, or other defaults on your account may be reflected in your credit report and consumer report. We may also share your information with other companies, lawyers, credit bureaus, agents, government agencies, and card associations in connection with issues related to fraud, credit, or debt collection.

Choices About How We Use and Disclose Your Information

We strive to ensure you have choices regarding the personal information you provide to us. We have created mechanisms to provide you with the following control over your information to the extent you may have these rights under applicable law:

We will provide an individual opt-out choice, or opt-in for sensitive data where required by law, before we share your data with third parties other than our agents or others as disclosed in this Privacy Statement, or before we use it for a purpose other than which it was originally collected or subsequently authorized. To request to limit the use and disclosure of your personal information, please submit a written request to privacy@aplos.com.

4. Cross Border Transmission:

Aplos primarily stores and processes the PII we collect in the United States. Depending on the location of a Customer, Consumer or Donor Aplos may transfer and access information from different places around the world. If you operate outside of the United States, transfer of your data is necessary for you to use our Services, access our Website, or request information from us.

By registering for our Website or otherwise accessing the Services, or by communicating with us by email, you acknowledge and expressly consent to our cross border transfer of your PII. Each time you email us, register with us, or use our Website or Services you are giving your express consent to the collection, use, retention, transfer and disclosure, including cross-border disclosure, of your information as described in this Privacy Statement. If you wish to opt out and withdraw your consent, you may do so at any time by contacting us at: privacy@aplos.com. In addition, if you wish to correct, update, amend, receive a copy of, or delete your personal information that Aplos controls, to the extent you may have such rights under applicable law, you may contact us by emailing to privacy@aplos.com.

5. Tracking Technologies and Advertising

You can set your browser to refuse all or some browser cookies, or to alert you when cookies are being sent. If you disable or refuse cookies, please note that some parts of this Website or our Services may then be inaccessible or not function properly.

6. Do Not Track

Like most other companies, our Website and Services are not currently configured to respond to browsers' "Do Not Track" signals.

7. Promotional Offers from Aplos

If you do not wish to have your email address/contact information used by Aplos to promote its products or services, you can opt-out by clicking on the Unsubscribe link at the bottom of every email. This opt out does not apply to information provided to Aplos as a result of a subscription purchase, service experience or other transactions (which are not marketing related emails).

8. Data Retention

In accordance with and as permitted by applicable law and regulations, we will retain your information as long as necessary to serve you, to maintain your account, or as otherwise needed to operate our business. When you close your account, we may continue to communicate with you about our Services, give you important business updates that may affect you, and let you know about products and services that may interest you, unless you have opted out of receiving marketing communications. We may also continue to use some of your information for business purposes and to improve our offerings or in some cases to develop new ones. We will retain and use your information as required by applicable regulations and Aplos' records and information management policies to comply with our legal and reporting obligations, resolve disputes, enforce our agreements, complete any outstanding transactions and for the detection and prevention of fraud.

9. Data Subject Rights and Requests

Instructions for submitting requests for the handling of your PII. There are many laws and regulations protecting and enabling individuals' privacy rights in effect around the world which give individuals rights regarding their personal data such as the ability to request access, erasure, and restriction of processing. While laws may define personal data differently, this is generally any information relating to an identified or identifiable natural person. If an organization holds and/or processes your personal data, you may request that the organization take an action on your data as allowed by the relevant law. We refer to this request as a Data Subject Request or DSR.

When making a DSR it is important to understand that most laws require you to make the request directly to the organization that has primary control over your data; referred to as the Data Controller. While Aplos does process PII, we are often acting as a data processor; collecting and processing your data on behalf of our Customers who are the data controller. For this reason, we strongly recommend that you contact the data controller directly for the fastest response to your request.

When Aplos is the data controller, such as when we are sending you marketing related information or with regard to your Aplos account, you may make the request by mail or email at the addresses noted below. Please note that we will only fulfil your Data Subject Request if you are granted the applicable rights to make such requests under your applicable laws.

Information to provide us with when we are the data controller and you are making a data subject request:

• First Name
• Last Name
• Email address (if different than that used to send request)
• The action you would like us to take regarding your information

We will respond to your request within the timeframe allowed under the applicable law.

Please note that in cases where we are not the data controller and you provide the same information listed above, we will:

• Attempt to verify your request and identify the data controller (this may require we contact you for additional information).
• If we are able to identify the data controller, we will inform the data controller of your request so that they may communicate with you directly.

Please communicate your request to us at:

Aplos Software, LLC
ATTN: Privacy Officer
484 W Shaw Ave.
Fresno CA 93704

privacy@aplos.com

1 (888) 674-5923

10. Security of Your Information

Keeping your Information safe is important to us. We provide reasonable and appropriate security measures in connection with securing Personal Information we collect.

11. Privacy Shield Policy

Aplos complies with the EU-U.S. Privacy Shield Framework as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information from European Union member countries and the United Kingdom transferred to the United States pursuant to Privacy Shield. Aplos has certified that it adheres to the Privacy Shield Principles with respect to such data. If there is any conflict between the policies in this Privacy Statement and data subject rights under the Privacy Shield Principles, the Privacy Shield Principles shall govern. To learn more about the Privacy Shield program, and to view our certification page, please visit https://www.privacyshield.gov/ps/.

The United States Federal Trade Commission (FTC) is the enforcement authority with jurisdiction over this compliance with the Privacy Shield.

Aplos has further committed to refer unresolved privacy complaints under the Privacy Shield Principles to an independent dispute resolution mechanism, the BBB EU PRIVACY SHIELD. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://www.bbb.org/EU-privacy-shield/for-eu-consumers for more information and to file a complaint. This service is provided free of charge to you.

Aplos Software, LLC
ATTN: Privacy Officer
484 W Shaw Ave.
Fresno CA 93704

If your Privacy Shield complaint cannot be resolved through the above channels, under certain conditions, you may invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See Privacy Shield Annex 1 at https://www.privacyshield.gov/ps/article?id=ANNEX-I-introduction.

12. Privacy Rights of California Consumers

The California Consumer Privacy Act affords California consumers certain rights over their personal information (subject to certain exceptions). If you are a California resident, please review our California Consumer Privacy Act Notice for information on your rights.

13. Children Under the Age of 13

Our Website is not intended for children under 13 years of age. No one under age 13 is permitted to provide any personal information to the Website. We do not knowingly collect personal information from children under 13. If you are under 13, do not use or provide any information on this Website or on or through any of its features, register on the Website, make any donations, purchases or transactions through the Website, or provide any information about yourself to us, including your name, address, telephone number, e-mail address or any screen name or username you may use.

If we learn we have collected or received personal information from a child under 13 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 13, please contact us at privacy@aplos.com.

14. Changes to this Privacy Statement

This Privacy Statement may change from time to time. If we make any changes to this Privacy Statement, we will post any changes on this page. Where we make any material changes to this Privacy Statement, we will make a more prominent notice in compliance with applicable laws. Your continued use of our Sites or Services following such posts or notices will signal that you have read and understand such changes. Please refer to the "Revised/Updated" date above to see when this Privacy Statement was last updated.

Contact Information

To ask questions or comment about this privacy policy and our privacy practices, contact us at: privacy@aplos.com.