PRIVACY STATEMENT

Personal information generally means information that can be used to identify you or that can be easily linked to you (for example, your name, address, telephone number, email address, social security number and date of birth). The privacy laws in some jurisdictions include unique elements in what they consider to be the personal information of the consumers or data subjects they protect. If those laws apply to us, as in the case of the California Consumer Privacy Act (“CCPA”) or European General Data Protection Regulation (“GDPR”), our use of the phrase “personal information” includes the unique elements required by such laws.

The categories of information we collect from each of these groups, and the ways in which we use it, differs. As you may have noticed, it’s possible that the same person could fall into more than one group. Most of this statement addresses our processing and sharing of personal information collected from visitors to and users of our online and mobile resources and our customers.

Nonetheless, we collect and retain the types of professional or employment related personal information you would expect an employer to have about its existing and former workforce and new job applicants. We provide legally required notices of collection and describe our use and sharing of the personal information of our workforce and applicants in greater detail in confidential internal human resource manuals and documents accessible to members of our workforce, or by publication on the proprietary

workforce/applicant portals and apps we operate. In some cases, such portals and apps may be operated by third parties who transfer the personal information to us. In those situations, the legal responsibility to provide notice usually rests with the third party, not us.

In addition, like all corporate enterprises, we buy goods and services, lease equipment and office space and attend industry events. In doing so, we interact with many existing and potential vendors and business partners from whom we necessarily collect certain personal information in connection with our contractual and business relationships. As with our customers, this information is typically limited to minimum business contact information. We use and share personal information collected from our vendors and business partners to manage, administer and perform under our contracts with them, or share information about our products. We describe our use of vendor and business partner personal information in greater detail in our confidential contracts with those parties or on the internal vendor management portals we operate.

online and mobile resources. Moreover, you can opt out of certain activities like

newsletters and announcements. Residents of California and data subjects whose

personal information was obtained while they were in the GDPR Jurisdictions have

certain additional rights.

GDPR Jurisdictions means the countries composed of the European Economic Area

(including Iceland, Lichtenstein, and Norway) and the following countries: Austria,

Belgium, Bulgaria, Croatia, Cyprus, Czech Republic, Denmark, Estonia, Finland, France,

Germany, Greece, Hungary, Ireland, Italy, Latvia, Lithuania, Luxembourg, Malta, the

Netherlands, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, and Sweden.

Furthermore, Andorra, Argentina, Canada (only commercial organizations), Faroe

Islands, Guernsey, Israel, Isle of Man, Jersey, New Zealand, Switzerland, Uruguay and

Japan have received an “adequacy decision” from the European Commission, adheres to

the material terms of the GDPR. Switzerland also has its own data protection via its

Federal Act of Data Protection (“DPA”).

GDPR longer has jurisdiction over The United Kingdom. Since the United Kingdom

(“UK”) has now formally left the European Union, it is no longer regulated domestically

by the material terms of the GDPR. The United Kingdom General Data Protection

Regulation (“UK-GDPR”) is the UK's data privacy law that governs the processing of

personal data domestically.

If we are using personal information you provided to us in order to enable us to send you

materials, such as newsletters or product alerts via text or email, and you decide you

don’t want to receive such materials, you may opt out by following the opt-out

instructions in the email or other communication (e.g., by responding to the text with

“STOP”), or by contacting us using the contact information below. When we receive

your request, we will take reasonable steps to remove your name from our distribution

lists. You need to understand it may take a period to remove your name from our lists

after your request and due to such latency, you may still receive materials for a period of

time after you opt out. In addition to opting out, you have the ability to access, amend,

and delete your personal information by contacting us using the contact information

below.

Some browsers have a “do not track” feature that lets you tell websites that you do not

want to have your online activities tracked. At this time, we do not specifically respond

to browser “do not track” signals.

provided to our online and mobile resources. We have adopted a security program that

includes technical, organizational, administrative, and other security measures designed

to protect, in a manner consistent with accepted industry standards and applicable law,

against anticipated or actual threats to the security of personal information (the “Security

Program”). We cannot, however, guarantee that your information, whether during

transmission or while stored on our systems or otherwise in our care, will be free from

unauthorized access or that loss, misuse, destruction, or alteration will not occur. Except

for our duty to maintain the Security Program under applicable law, we disclaim any

other liability for any such theft or loss of, unauthorized access or damage to, or

interception of any data or communications including personal information. We have

every reason to believe our Security Program is reasonable and appropriate for our

business and the nature of foreseeable risks to the personal information we collect. We

further periodically review and update our Security Program, including as required by

applicable law.

Nonetheless, as part of our Security Program, we have specific incident response and

management procedures that are activated whenever we become aware that your personal

information was likely to have been compromised. We further require, as part of our

vendor and business partner oversight procedures, that such parties notify us immediately

if they have any reason to believe that an incident adversely affecting personal

information, we provided to them has occurred.

GDPR Jurisdictions. We fulfill our GDPR obligations with respect to our workforce/job

applicants, our customers (and their own end-clients), and our vendors and business

partners through a series of separate notices, contracts or other terms provided to them at

the time, and in the manner and form, GDPR and local law within each GDPR

Jurisdiction requires.

We describe, in the immediately following section of this statement, how we comply

with the GDPR for personal information collected from visitors to and users of our online

and mobile resources while they were in a GDPR Jurisdiction. Thus, for purposes of that

section, the words “you” and “your” mean only such GDPR Jurisdiction-based visitors

and users.

We collect from you the categories of personal information already described. The lawful

basis on which we rely for such collection, later use and disclosure, is what the GDPR

refers to as legitimate interest. As stated elsewhere in this statement, we do not sell any

of your personal information to third parties nor do we use it for automated decision

making.

If we transfer personal information from the GDPR Jurisdictions to a location that has

not been deemed by the European Commission to have adequate privacy protections, we

do so in the manner the GDPR permits.

While we attempt to allow all visitors and users of our online and mobile resources to

exercise a degree of control over their personal information, under the GDPR we have a

legal obligation to do so for you. More specifically, with respect to personal information

collected from you while you were in a GDPR Jurisdiction, you have these rights:

transparency, access, correction and deletion, portability, who, what, why and where, and

restriction/objection (for more information click here).

If you would like to exercise any of these rights, please contact

support@queenwarriors.com. Your ability to exercise these rights is subject to certain

conditions and exemptions that you can read about in Articles 12 through 23 of the

GDPR. Among those conditions is our right to decline part or all of a request if we

9

cannot satisfy our reasonable doubts and concerns about your identity in a manner that

helps us minimize the risk that unauthorized persons might use a GDPR right to access

your personal information. We will respond to all requests without undue delay, and in

accordance with the time frames, if any, prescribed by the GDPR. If you are not satisfied

with how we use your personal information or respond to your requests, you have the

right to complain to your data protection regulator. Contact information for the EU data

protection regulators can be found here.