Contents

• California Notice at Collection
• Introduction
• 1. What Information We Collect and Process
• 2. How We Use Personal Information
• 3. How We Share Personal Information
• 4. How We Transfer Personal Information Internationally
• 5. How We Store and Secure Personal Information
• 6. Cookies and Similar Technologies
• 7. Your Privacy Rights and Choices
• 8. California Privacy Rights
• 9. Contact Us
• 10. Other Important Privacy Information

California Notice at Collection

If you are a California resident, see Section 8.e (California Notice at Collection) for a summary of the categories of Personal Information we collect, purposes, sale/share status, retention practices, and your opt-out choices.

Introduction

Site Systems is a division of Pacific Digital Industries, Inc. which does business under the following names: Hail Agency, SweepstakesPros, Sweepstakes Monkey, Promotion Trust and Site Systems (collectively "Site Systems").

We at Site Systems are committed to protecting your privacy. This Privacy Policy applies to the personal information and data collected by Site Systems when you interact with our websites, products and services, and any other sites or services that link to this Privacy Policy.

This Privacy Policy describes how we collect, receive, use, store, share, transfer, and process your Personal Information. It also describes your choices and rights, including access and correction. "Personal Information" means any information relating to an identified or identifiable individual. By using our websites, products and services, you agree to this Privacy Policy. If you do not agree, do not use our websites, products or services, or other sites or services that link to this Privacy Policy.

In our operations, Site Systems may act as a controller/business for Personal Information we collect to manage our direct relationships (for example, our websites, marketing, billing, support). We may also act as a processor/service provider/contractor when we handle Personal Information on behalf of our clients via the Promotions Platform and services. For data we process on behalf of clients, we do so only on their documented instructions and as described in our agreements and DPA.

Site Systems and our customers may collect and manage Personal Information when using our products and services (the "Promotions Platform"). When you use the Promotions Platform or we provide services to our customers, we process Personal Information as a processor under the customer's direction. Customers, as controllers, are responsible for their own privacy notices and consents. See Section 1.b (Information We Process on Behalf of Customers) and Section 1.c (Information We Collect and Process When You Use the Promotions Platform).

We update this Privacy Policy from time to time and will post any changes on this page.

If you have questions about this Privacy Policy or wish to exercise the privacy rights and choices we offer, contact us:

• By email at ;
• By postal mail at Site Systems, P.O. Box 3222, Saratoga, CA 95070, USA, Attn: Privacy Department.

1. What Information We Collect and Process

a. Information You Provide to Site Systems

When You Visit Our Websites

We collect Personal Information when you submit web forms or interact with our websites (for example, subscribing to a Site Systems newsletter or blog, signing up for a webinar, subscribing to services, or requesting support). We may ask for your email address, first and last name, job title, phone number, address, billing information, account information, and similar business information. You may explore some of our websites without providing Personal Information.

Registration, Account and User Information

We collect Personal Information when you sign up for an account, create or modify user information, set preferences, or otherwise access or use the Promotions Platform or other products or services. This may include name, email address, phone number, mailing address, demographic information (such as age or gender), and billing/credit card information. Without Personal Information you cannot create a Promotions Platform account. We may store Personal Information in databases owned and maintained by our agents or service providers.

Payment Information

We collect payment and billing information when you register for paid products or services (for example, a billing address or billing contact). If you give us payment information, we use it solely as authorized by you in accordance with this Privacy Policy. We use secure third-party payment service providers to manage payment processing through a secure process.

Customer Testimonials

We may post customer testimonials and comments on our websites, which may contain Personal Information. We obtain each customer's consent before posting the customer's name and testimonial.

b. Information We Process on Behalf of Customers

Our products, services, and the Promotions Platform allow customers to run promotions (for example, sweepstakes, contests, games, social engagements, loyalty programs). Customers may collect Personal Information such as name, email address, physical address, phone number, or other information from online, mobile, and offline sources. We call this "Customer Data".

Winner tax documentation. For promotions requiring prize fulfillment and tax reporting, customers may collect government identifiers (for example, SSN/ITIN/TIN or non-U.S. equivalents) and supporting documentation from winners solely for eligibility verification, tax reporting/withholding, fraud prevention, and compliance with law. We process such data only on the customer's documented instructions. For California residents, these government identifiers are Sensitive Personal Information under the CPRA; we do not use them to infer characteristics.

Independent controller for limited tax subset. If SweepstakesPros is the payer/withholding agent under applicable tax law, we act as an independent controller for the limited subset of winner tax data necessary to meet our legal obligations (e.g., tax identification numbers and supporting ID). This does not expand the scope of use beyond legal compliance, fraud prevention, prize administration, and required recordkeeping.

We do not control customers' webpages or the types of Personal Information customers choose to collect using our products/services. We store customers' information on our service providers' servers but process it as a processor under customers' instructions, which prohibit us from using the information except as necessary to provide/improve services and as required by law.

Customers control and are responsible for correcting, deleting, or updating Customer Data and for complying with any regulations or laws that require notice or consent prior to transferring Personal Information to Site Systems for processing. For requests about data collected by our customers via our services or the Promotions Platform, contact the customer directly; we assist customers in fulfilling applicable requests.

Sub-processors (processor context). When acting as processor/service provider/contractor, we use vetted sub-processors to provide the Promotions Platform and related services. Our current list is maintained on our Sub-processors page and updated from time to time.

c. Information We Collect and Process When You Use the Promotions Platform

Usage Data

We collect usage data when you or your users use and interact with the Promotions Platform (for example, features used, object opens/closes, workflow triggers).

Like most websites and technology services delivered over the Internet, we may collect and store Personal Information and usage data when you visit our websites, use our products/services, use the Promotions Platform, or visit other sites that link to this Privacy Policy. This can include cookies, IP address, browser type, domain names, ISP, files viewed, operating system, access times, referring website addresses, and other statistics. We may collect and store this information:

• When a user logs into their account and accesses tools in the Promotions Platform;
• When an individual visits a customer's website hosted by the Promotions Platform; or
• When an individual visits a customer's self-hosted website using our scripts, plug-ins, or embedded content.

We may engage third-party providers to collect usage data. For more information about protections with these providers, see Section 3 (How We Share Personal Information).

Customer Data in the Promotions Platform

We host and process Customer Data on our systems and access it only as needed to provide, secure, support, or improve the Promotions Platform and our products/services, to prevent abuse or fraud, or to comply with law or client instructions. We do not sell or use Customer Data for our own marketing.

Email Data

When emails are sent by us or through the Promotions Platform, we may track bounces, opens, and link clicks for performance evaluation.

Mobile

When you access or use the Promotions Platform via mobile apps, we may automatically collect information such as device model/version, operating system, or device identifiers.

YouTube

Some promotions may display YouTube content and use YouTube API Services. When using YouTube with the Promotions Platform, we may cache or store desired YouTube video URLs. By using features that display or interact with YouTube content, you agree to the YouTube Terms of Service and Google Privacy Policy. You can revoke Site Systems access in your Google security settings.

d. Information We Collect from Other Sources

Site Systems Partners

We may receive information about you or other users of your Site Systems account from partners (for example, affiliates or lead registrations).

Third Parties

We may receive information from third-party service providers, related companies, and business/solution partners.

Personal Information from Other Sources

We may combine the personal information we collect from you with information from other sources (for example, business information providers and public sources like social media). This may include physical mail addresses, job titles, email addresses, phone numbers, IP addresses, and social media profiles.

Buttons, tools, and content from other companies

Our websites may include features and widgets (for example, share/like buttons or mini-programs) that may collect your IP address and set a cookie. These features are governed by the providers' policies, not this Privacy Policy.

We may implement Google reCAPTCHA, Cloudflare Turnstile, and/or Cloudflare Bot Management to prevent abuse. Learn more in Google's Privacy Policy and Cloudflare's Privacy Policy. See Google's Terms of Service and Cloudflare's Terms of Use.

2. How We Use Personal Information

a. To Communicate with You About our Product and Services

We use the Personal Information you provide to send transactional emails or in-app notifications (for example, billing, account management, legal and policy updates, and security incidents). We also use your information to provide customer support.

b. To Provide the Promotions Platform

We use Personal Information and Customer Data to provide our products and services (for example, create your account, process payments, authenticate logins, and support). Where instructed by customers, we also use winner information (including tax identification numbers where required) solely to administer prizes and comply with prize-related tax reporting.

c. To Improve and Develop Our Product and Services

We collect usage data to develop and improve products and services and may publish aggregated statistics that do not identify individuals.

d. To Secure and Protect our Products, Services and Promotions Platform Users

We use Personal Information to investigate and help prevent security incidents, meet legal requirements, verify accounts and new sign-ups, detect and prevent abuse, and enforce policies.

Bot/fraud controls and automated assessments. We use automated tools (for example, WAF/bot management, IP reputation, device and activity signals) to detect abuse, spam, and fraud. We do not make decisions that produce legal or similarly significant effects solely by automated means. Where state law grants additional rights related to profiling used for targeted advertising or automated decisions, see Section 7.f (U.S. state rights to opt out of targeted advertising, sale, and certain profiling) and Section 8 (California Privacy Rights).

e. To Market and Promote Site Systems

We use the information you provide to market and promote our offerings. You may opt out of promotional communications by following the instructions in each communication or by contacting us (see Section 9 (Contact Us)). If you unsubscribe from marketing, we will still send administrative messages.

f. For Corporate Events or Transfers

We may use your information in connection with a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of assets, including bankruptcy or similar proceedings.

g. Other Purposes if We Obtain Your Consent

We may share your data with third parties when you give us consent to do so.

h. Legal Basis for Processing Personal Information (EEA and UK visitors only)

If you are in the EEA or UK, Site Systems is the controller for Personal Information collected via our websites and our own marketing, billing, and support. When we handle Personal Information on behalf of a customer via the Promotions Platform, the customer is the controller and we are the processor/service provider/contractor.

We process Personal Information where a legal basis applies (for example, contract, legal obligation, legitimate interests, or consent). Examples of consent: non-essential cookies, certain marketing communications, call recording where required, and YouTube/Google API access you grant. Where we are the payer/withholding agent (see Section 1.b), our legal basis is legal obligation for the tax subset we control.

3. How We Share Personal Information

a. Service Providers

We share Personal Information with third-party service providers to support our websites, products, services, and the Promotions Platform (for example, data hosting, application development, identity/age verification, prize fulfillment/logistics, print/mail houses, security and fraud prevention, e-signature, marketing/sales support, payment processors, analytics, and customer support tools). These providers may use Personal Information only for these purposes and must keep it confidential.

b. Partners

We may share data with trusted partners to contact you based on your request, perform statistical analysis, provide sales support, or customer support. Partners may use Personal Information only for these purposes and must keep it confidential.

c. Business Transfers

We may share or transfer Personal Information in connection with, or during negotiations of, any merger, sale of assets, financing, bankruptcy, or acquisition.

d. Public Forums

Public posts on our sites (for example, message boards, blogs, forums) may be read, collected, and used by others. We may be able to correct or delete information you posted upon request (see Section 7 (Your Privacy Rights and Choices)); in some cases removal may not be possible.

e. Compelled Disclosure

We may use or disclose Personal Information if required by law or if necessary to protect rights, safety, investigate fraud, or comply with a law, court order, or legal process.

f. Tax Authorities and Required Intermediaries

Where we administer prize-related tax reporting on behalf of a customer or act as a payer/withholding agent, we disclose the minimum necessary winner information to the appropriate tax authorities and required intermediaries via secure transmission.

g. Sub-processor list (processor context)

Our current list, purposes, and locations are posted on our Sub-processors page. We provide advance notice before engaging a new sub-processor (no less than the minimum period stated in our DPA) and offer a reasonable, good-faith objection process as described there and in our DPA.

4. How We Transfer Personal Information Internationally

a. International Transfers within Site Systems and to Third Parties

Your Personal Information may be processed in the United States and other countries where we and our service providers operate. For EU/EEA, UK, and Swiss data, transfers are supported by the EU Standard Contractual Clauses (SCCs) (and, as applicable, the UK Addendum) as set out in our DPA; for U.S. transfers we may also rely on the EU-U.S./UK Extension/Swiss-U.S. Data Privacy Framework where applicable. We use recognized transfer mechanisms and safeguards (for example, DPF, SCCs, UK Addendum, adequacy decisions, or other lawful bases). We do not rely on your agreement to this Privacy Policy as the legal basis for transfers.

b. Data Privacy Framework Notice

Site Systems complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF). If there is any conflict between this Privacy Policy and the DPF Principles, the DPF Principles govern. Learn more at https://www.dataprivacyframework.gov/.

To exercise your DPF rights, contact us (see Section 9 (Contact Us)). We commit to resolve DPF-related complaints within 45 days and refer unresolved complaints to JAMS at https://www.jamsadr.com/dpf-dispute-resolution. Under certain conditions you may invoke binding arbitration. The U.S. Federal Trade Commission has jurisdiction over our DPF compliance. We remain liable for onward transfers to agents unless not responsible for the event giving rise to the damage. We may be required to disclose Personal Information in response to lawful requests by public authorities.

5. How We Store and Secure Personal Information

a. Data Storage and Security

We store Personal Information on secure systems and use commercially acceptable security technologies and procedures. For more on security at Site Systems, see our Site Systems Security Practices page. If we suffer a Client Personal Data Breach while acting as processor, we will notify the client without undue delay and provide reasonably necessary information and assistance under our DPA.

b. Retention of Personal Information

We retain Personal Information as needed for the purposes in this Privacy Policy (for example, providing services, complying with law, resolving disputes, enforcing agreements). After it is no longer needed, we delete or irreversibly anonymize it, or securely store and isolate it until deletion is possible.

For processor/service provider/contractor processing, retention is governed by our customer agreements. Winner tax documentation (including tax identifiers and supporting ID) is retained only as required by our retention policies and applicable laws and then deleted or irreversibly anonymized (with backups purged on the next regular cycle).For example, winner tax records (including tax identification numbers and required supporting ID) may be retained up to seven (7) years or such other period as applicable law requires, after which they are deleted or irreversibly anonymized (with backups purged on the next regular cycle).

6. Cookies and Similar Technologies

Until we enable optional cookies, we will not set analytics, advertising, or other non-essential cookies. If strictly necessary cookies are used to provide a service you request (for example, to keep you signed in), they do not require consent. When optional cookies are enabled, you will see a consent banner and a Cookie Settings control to manage choices at any time.

EU/UK visitors. Non-essential cookies and similar technologies (analytics/advertising) are off by default and set only with your consent. You can withdraw consent at any time via Cookie Settings; withdrawal does not affect the lawfulness of prior processing.

a. Cookies

When you visit our sites, use the Promotions Platform, visit customer sites using our technology, attend our virtual events, or request more information, we may collect information automatically via cookies and similar technologies. See our Site Systems Cookie Policy and Your Privacy Choices for details and preference controls. Until optional cookies are enabled, the Cookie Settings control may be unavailable or will reflect that non-essential cookies are off by default.

b. Advertising

We honor Global Privacy Control (GPC) signals as an opt-out of cross-context behavioral advertising where required and recognize applicable universal opt-out mechanisms. When advertising or retargeting cookies/pixels are enabled, our ad partners may process online identifiers to tailor ads; you can manage preferences via Cookie Settings, GPC, or industry tools at optout.networkadvertising.org and optout.aboutads.info (EU: youronlinechoices.eu). See also Section 7.f (U.S. state rights to opt out of targeted advertising, sale, and certain profiling).

7. Your Privacy Rights and Choices

a. Personal Information Requests

Rights include: access/correction/deletion, objection/restriction/portability, withdraw consent, and complaint to a data protection authority. To exercise these rights for Site Systems, contact us (see Section 9 (Contact Us)).

We may verify your identity and, where applicable, your authorized agent's authority. You may exercise rights free from discrimination.

If you interact with a Site Systems customer that uses our Promotions Platform and want to access/correct/delete your data controlled by that customer, contact the customer directly; we will assist them as appropriate.

b. Anti-Spam Policy

Use of our products/services to send unsolicited commercial email is prohibited. Every marketing email sent via the Promotions Platform must include an opt-out mechanism and required information.

c. To Unsubscribe from Our Communications

You can unsubscribe from our marketing communications via the methods in Section 9 (Contact Us). Transactional emails related to your account or the Promotions Platform are required.

d. To Unsubscribe from Our Customers' Communications

Our customers manage their own marketing communications; unsubscribe via the link in their emails or by contacting them directly.

e. Appeals (U.S. states outside California)

If we deny your privacy request, you may appeal by replying to our decision email with subject "Appeal". If denied again, you may contact your state Attorney General.

f. U.S. state rights to opt out of targeted advertising, sale, and certain profiling

Some states grant rights to opt out of targeted advertising, "sale" of Personal Information, and certain profiling. We do not sell Personal Information, but we may "share" Personal Information for cross-context behavioral advertising (see Section 8 (California Privacy Rights)). Exercise state opt-outs by using Your Privacy Choices, Cookie Settings, and by enabling a browser-based opt-out signal such as GPC.

8. California Privacy Rights

a. Applicability

This section applies only to California consumers. We do not sell Personal Information. We may "share" Personal Information for cross-context behavioral advertising as defined by the CPRA; opt out via GPC or Your Privacy Choices. We do not use or disclose Sensitive Personal Information beyond CPRA-permitted purposes. If you need this notice in an accessible format, contact us (see Section 9 (Contact Us)).

b. How We Collect, Use, and Share your Personal Information

We collect Personal Information as permitted by California law and as described in this Privacy Policy. For the definitive category-by-category summary, see Section 8.e (California Notice at Collection). If there is any inconsistency, Section 8.e controls.

c. Your California Rights

You have rights to access, delete, and correct Personal Information and to be free from discrimination for exercising your rights.

d. How to Exercise your California Rights

Exercise rights yourself or via an authorized agent; we will verify identity and, if applicable, agent authority. Use the contact details below or see Section 7.a (Personal Information Requests).

e. California Notice at Collection

We collect the categories of Personal Information (including Sensitive Personal Information) below for the business purposes in Section 2 (How We Use Personal Information). Sources, disclosures, retention criteria, and whether we "sell" or "share" (for cross-context behavioral advertising) are summarized here. We honor GPC and applicable universal opt-out mechanisms; see Section 7.f and Your Privacy Choices.

Note: Until optional cookies are enabled, any references in the table to cookie IDs, ad partners, "share," or GPC do not apply.

* "Share" means disclosure for cross-context behavioral advertising as defined by the CPRA. We limit "sharing" to online identifiers/IP/cookie IDs, browsing/usage data, and approximate location; we do not share names, postal addresses, payment data, or government identifiers or winner-validation documents for advertising. Manage preferences via Your Privacy Choices, Cookie Preferences, or a supported GPC signal.

f. Notice of Financial Incentive

From time to time, we may offer promotions such as sweepstakes, contests, or loyalty/referral programs that provide benefits in exchange for Personal Information. Participation is voluntary and subject to program rules. Categories collected are those reasonably necessary to administer the program (for example, identifiers/contact, eligibility, and, for winners, tax data collected under Section 1.b).

Opt in by submitting requested information and agreeing to program terms; withdraw at any time by contacting us (see Section 9 (Contact Us)).

g. Minors

We do not knowingly sell or share the Personal Information of consumers under 16. If we learn we have done so, we will cease such activity and honor opt-outs.

h. Right to limit Sensitive Personal Information (SPI)

We collect SPI from winners only for permitted purposes (for example, eligibility verification and tax reporting) and do not use it to infer characteristics. Because we do not use SPI beyond CPRA-permitted purposes, no separate "Limit the Use of My Sensitive Personal Information" control is required.

9. Contact Us

To exercise your rights, ask questions about this Privacy Policy, or request an accessible format, contact us:

• Privacy Officer: ;
• Toll-free: 1-888-900-4245
• By postal mail at Site Systems, P.O. Box 3222, Saratoga, CA 95070, USA, Attn: Privacy Department.
• Data Protection Officer (DPO): Not currently appointed. If we appoint a DPO, we will publish the DPO's contact details here before collection.

You may also manage advertising-related choices via Your Privacy Choices, Cookie Settings, and by enabling GPC in a supported browser (see Section 6 (Cookies and Similar Technologies) and Section 7.f (U.S. state rights to opt out of targeted advertising, sale, and certain profiling)).

10. Other Important Privacy Information

a. No Sale; Limited Sharing of Personal Information

We do not sell Personal Information. We may "share" Personal Information for cross-context behavioral advertising as described in Section 6 (Cookies and Similar Technologies) and Section 8 (California Privacy Rights); you may opt out at any time via Your Privacy Choices, Cookie Settings, or GPC.

b. Information About Children

Our websites, products and services are not intended for or targeted at children under 13, and we do not knowingly collect Personal Information from children under 13 without verified parental consent. If you believe your child provided Personal Information without consent, contact us (see Section 9 (Contact Us)). If we become aware of such collection, we will remove it.

c. Questions and Third-party Dispute Resolution

For questions about our compliance or the DPF, contact us (see Section 9 (Contact Us)). We will respond within forty-five (45) days. If unresolved, contact JAMS at https://www.jamsadr.com/dpf-dispute-resolution.

d. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the new Privacy Policy on this page and update the "Last Modified" date above. Changes are effective when posted.

e. Miscellaneous

Any claim under this Privacy Policy or otherwise related to Site Systems, our products and services, or the Promotions Platform by a general website visitor or end user shall be governed by California law and resolved exclusively in state or federal courts in Santa Clara County, California. Disputes with clients who have executed a Statement of Work are governed by the dispute resolution terms in their Master Services Agreement.

If any provision of this Policy is found illegal, void, or unenforceable, it will be modified to be enforceable to the maximum extent possible; the remaining provisions remain in full force.

f. Do Not Track

We do not respond to browser Do Not Track (DNT) signals. We honor GPC where required (see Section 6 (Cookies and Similar Technologies) and Section 7.f (U.S. state rights to opt out of targeted advertising, sale, and certain profiling)).

g. Jurisdiction-Specific Disclosures

Australia (Privacy Act/APPs). Our policy addresses APP 1 content, and you can complain to us (see Section 9). If unresolved, you may complain to the OAIC. We disclose overseas recipients/countries at a high level in Section 4 and on request.

Canada (PIPEDA & Québec Law 25). You may contact our Privacy Officer to access or correct your information and to raise complaints; cross-border processing is explained in Section 4. If we disclose personal information outside Québec in circumstances where Law 25 requires it, we will conduct a transfer/privacy impact assessment and implement appropriate contractual safeguards as required by law; you may contact us for information about safeguards relevant to your file.

EU/UK (GDPR/UK GDPR). Legal bases appear in Section 2.h. For non-essential cookies, we rely on consent (see Section 6). If our processing is subject to extraterritorial GDPR/UK GDPR and we are required to appoint an EU or UK Article 27 representative, we will designate and publish the representative's details before collection; until then, contact our Privacy Officer (see Section 9). International transfers are supported by the SCCs/UK Addendum as described in Section 4.a and our DPA.

India (DPDP Act 2023). If our processing is subject to India's Digital Personal Data Protection Act, 2023, we will publish a grievance redressal mechanism and contact details before collection, honor consent withdrawal and Data Principal requests as applicable, and provide information about any cross-border disclosures consistent with legal requirements.

Japan (APPI). If our processing is subject to Japan's Act on the Protection of Personal Information, we will provide required disclosures for overseas transfers (including the recipient country or region and safeguards) and obtain consent where required. On request, we will provide additional information about transfer measures. You may contact us using the methods in Section 9.

New Zealand (Privacy Act 2020). You may complain to us (Section 9) and, if unresolved, to the Office of the Privacy Commissioner. Notifiable breaches will be reported as soon as practicable under NZ requirements.

Philippines (Data Privacy Act). We follow the National Privacy Commission's guidance on layered notices and security measures. You may complain to the NPC if unresolved with us.

Singapore (PDPA). If our processing is subject to the PDPA's DPO designation requirement, we will designate and publish a DPO's business contact details before collection. In the interim, contact our Privacy Officer (see Section 9).

South Africa (POPIA). If our processing is subject to POPIA, we will designate and publish our Information Officer's contact details before collection (see Section 9). This policy provides the Section 18 collection notice particulars. You may complain to the Information Regulator if unresolved with us.

South Korea (PIPA). If we engage in overseas transfers subject to PIPA's enhanced overseas-transfer notice, we will provide the required details (recipient, country, items, purpose, retention, method, opt-out) and publish a Korean-language notice before collection. You may request the same information from our Privacy Officer.