Effective date: September 14, 2023

Sonoma Technology, Inc. (“STI”, “we”, “us”, or “our”) respects your privacy and is committed to protecting it as set forth in this privacy notice (“Privacy Notice”). This Privacy Notice applies to personal data collected on our websites located at http://www.sonomatech.com/, https://exactaq.com/, http://esims.sonomatech.com/, https://esims.sonomatechdata.com/, https://kidsmakingsense.org/, and http://maps.kidsmakingsense.org/ (collectively, the “Websites”) and any other personal data we may process in connection with our products, services, or otherwise (collectively, together with the Websites, the “Services”). This Privacy Notice describes our privacy practices in connection with our Services, including the personal data we collect, how we use personal data and our legal basis for such use, who we may disclose personal data to, and certain rights you may have regarding your personal data. By using the term “personal data” in this Privacy Notice, we mean any information that can be used to identify you.

For information regarding the collection, use, and disclosure of children’s personal data, please see our Children’s Privacy Notice below.

Changes to Our Privacy Notice

STI may change this Privacy Notice at any time. The most recent version of the Privacy Notice is reflected by the effective date at the top of this Privacy Notice. All amendments to this Privacy Notice will be effective immediately upon providing notice thereof, which we may give by any means, including by posting a revised version of the Privacy Notice on the Websites.

Personal Data Collection

STI collects the following categories of personal data directly from you:

• Name;
• Email address;
• Address;
• Username and password;
• Employment information; and
• Any other personal data you may choose to provide to us.

In connection with Kids Making Sense®, in addition to the categories of personal data listed above, STI may also collect geolocation data and photographs that may identify an individual.

We may collect the above categories of personal data when you:

• Request a demo;
• Use our Services;
• Subscribe to marketing communications;
• Contact us via our Services (or otherwise); or
• Register for a new account or log into an existing account.

STI may also collect certain internet or other electronic activity information (which may constitute personal data) automatically from you when you access and use the Websites. For more details on this information, please see the “Cookies” section of this Privacy Notice.

Cookies

When you visit our Websites, STI and our third-party service providers may use cookies. A “cookie” is a text file that websites send to a visitor’s device to uniquely identify the visitor’s device or to store information or settings in the visitor’s device. Through using cookies, we may collect information about how you interact with the Websites. This may include information such as the dates and times you visit the Websites, referring and exiting URLS, how you interact with the Websites, your browser type, and the domain name of your internet service provider. We may also collect information about the devices you use to access the Websites, including your device make and model, IP address, geolocation data, operating system, and other unique device identifiers.

If you choose not to accept certain cookies, you may not have access to certain features of the Websites. Your browser may be configured to reject cookies or notify you when a cookie is set. Certain state laws require that we indicate whether we honor “Do Not Track” settings in your browser concerning online tracking. We adhere to the standards set out in this Privacy Notice and do not monitor or follow any “Do Not Track” browser requests.

STI uses Google Analytics, a web analysis service provided by Google, to better understand your use of the Websites. Google Analytics uses cookies to collect certain information such as how often you visit our Websites, how you interact with our Websites, and what other websites you used prior to coming to our Websites. For more information about Google Analytics, including how to opt-out of Google Analytics, please see more information here. Please find Google’s privacy policy here.

Purpose of Personal Data Processing and Legal Basis

STI uses the personal data we collect for the purposes set out in the table below. We have also set out our “legal basis” for each of these uses.

Personal Data Disclosure

STI may disclose all the categories of your personal data that we collect to the following categories of recipients:

• with our affiliates, which includes other businesses that are under common control with us or under our control;
• with our business partners and service providers to provide business services for the purposes set out above, which include our customer relationship management platform and our analytics providers;
• with professional advisors such as lawyers, auditors, bankers, and insurers, in the course of the professional services that they render to us;
• where required by law with law enforcement agencies, regulators, courts, other government authorities, or other third parties where we believe necessary to comply with a legal or regulatory obligation, or otherwise to protect our rights or the rights of any third party; or
• in the context of a transaction with potential transaction partners, service providers, advisors, and other third parties, such as in connection with a merger, asset sale, financing, liquidation, bankruptcy, or dissolution.

Personal Data Transfer

STI is based in the United States, where we provide our Services from. Where we provide our Services to organizations based outside of the United States, we and our business partners and service providers take commercially reasonable efforts to put in place appropriate safeguards to personal data (such as contractual commitments) in accordance with applicable legal requirements to provide adequate protection for any transferred personal data.

Personal Data Rights

Depending on where you reside, you may have certain rights under applicable data privacy law. These may include the:

• Right to access or know: You may have the right to know what personal data we process about you.
• Right to delete or erase: You may have the right to delete your personal data in certain circumstances.
• Right to correct/rectify/update: You may have the right to correct personal data that we hold about you.
• Right to data portability: You may have the right to receive your personal data in a machine-readable or portable format.
• Right to restrict processing: Under some circumstances, you may request to restrict our use of your personal data.
• Right to withdraw consent: If your personal data is processed by us on the legal basis of consent, you may withdraw your consent. Withdrawing your consent will not affect the lawfulness of processing we conducted prior to such withdrawal, nor will it affect the processing of your personal data conducted in reliance of a legal basis other than consent.
• Right to lodge a complaint: If you have a complaint about how we use your personal data, we hope that you will contact us according to the below. However, you can always file a complaint with the data protection authority in your jurisdiction. For more information, please contact your local data protection authority (contact details for data protection authorities in the European Economic Area are available at https://edpb.europa.eu/about-edpb/board/members_en. Contact details for the data protection authority in the United Kingdom is available at https://ico.org.uk/.

If you would like to exercise any of these rights, please send us an email at solutions@sonomatech.com. Please note that we may require additional information from you to verify your request or that you are authorized to act on behalf of another, which may consist of identifiers or service history already known to or collected by us.

Sonoma Technology, Inc. is the “controller” responsible for the personal data we process. We do not engage in automatic decision-making.

Personal Data Safeguards

STI takes commercially reasonable measures to protect the personal data we collect from you from unauthorized or illegal access, modification, use, or destruction. We restrict access to such personal data to employees, contractors, and agents who need to know such information and only to third parties as described in the “Personal Data Disclosure” section of this Privacy Notice. Nevertheless, no security system or website is impenetrable. We cannot guarantee that your personal data will be secure.

Personal Data Retention

STI will only keep your personal data for so long as we have a legitimate business purpose for retaining that personal data. When deciding how long to keep your personal data after our relationship has ended, we may retain some personal data for limited purposes, such as our legal compliance or to enforce or defend our legal rights.

Children’s Privacy Notice

STI takes special precautions to protect the privacy of children, described further in this section of our Privacy Notice (the “Children’s Privacy Notice”). In accordance with the Children’s Online Privacy Protection Act (“COPPA”), STI does not knowingly collect personal data from children without verifiable consent of a school, parent, or guardian, and our Services are intended to be used by a child only with the consent of a school, parent, or guardian.

If STI learns that we have inadvertently collected personal data of a child without the consent of a school, parent, or guardian as required by law, we will take appropriate steps to delete this information. If you are a school, parent, or guardian and discover that a child is using our Services without your consent, please alert us immediately by emailing solutions@sonomatech.com.

By enabling a child to create an account and/or permitting a child to use the Services, including when STI provides our Services to schools, you expressly agree to the practices described in this Children’s Privacy Notice and you consent to the collection, use, and disclosure of a child’s personal data as described herein.

• Setting up a Child Account: If a parent or guardian wishes to for a child to use our Services, we request the parent provide verifiable consent when required by COPPA. When STI provides our Services to schools, the school will set up a child’s account. The child will then be able to participate in most aspects of the Services. In some instances, our Services are intended to be carried by children. By providing the Services to a child, you consent to such child’s use of our Services and further consent as a school, parent, or guardian to enable and permit STI’s processing of the personal data from the Services as stated in this Children’s Privacy Notice.
• Personal Data We Collect About Children: The personal data that we collect about children includes username, password, IP address, geolocation data, and photographs that may identify an individual.
• Children’s Personal Data Use: We may use personal data collected from children for the following purposes: (a) operating, providing, and improving the Services; and (b) complying with our legal and regulatory obligations.
• Children’s Personal Data Disclosure: We may disclose personal data collected from children according to the “Personal Data Disclosure” section of our Privacy Notice above.
• Contact Us Regarding a Child’s Account or Personal Data: A child’s parent or legal guardian has a right to review or have deleted the child’s personal data, and may withdraw consent for our Services to collect any further personal data from the child. Please contact us at solutions@sonomatech.comto request to review and/or delete any personal data we may have collected from the child, or to withdraw permission for STI to collect any additional personal data from the child. We will require the parent or guardian to provide us with sufficient identification before acting upon such request. To the extent our Services are used by a school in an educational setting, please see the “Our Practices Involving Schools” section of this Children’s Privacy Notice below.
• Our Practices Involving Schools: When STI provides our Services to schools, our collection, use, and disclosure of children’s personal data is governed by our terms of service and/or any other agreement with the school, COPPA, and other applicable laws that may relate to the collection, use, and disclosure of personal data about students. When our Services are used by a school in an educational setting, the school may authorize STI to collect personal data from a child. We will process such requests promptly as directed by the school.

Contact Us

If you have any questions regarding this Privacy Notice or our privacy practices or wish to exercise any of your rights described above, please contact us at solutions@sonomatech.com.