Operad Privacy Policy and Notice

1. WHICH INFORMATION MAY WE COLLECT?

Summary: we collect various categories of personal data in order to meet our contractual obligations, and also to meet various legitimate interests, such as fraud prevention and marketing.

Depending on how you interact with us, we may collect the following categories of Personal Data:

• Contact and business information, such as name, business email address, telephone number, company, job title, country and the content of your communications with us.
• Lead and inquiry information, including information you submit through our website, forms or third-party lead-generation tools, and information relating to your interest in our Services.
• Technical and usage information, such as IP address, device and browser information, cookie or similar identifiers, referring URLs, pages viewed, interactions with the website, approximate location derived from IP address, and similar analytics information.
• Customer and commercial information, such as business contact details, service requirements, proposals, contracts, billing and payment-related records, and communications regarding our relationship.

Our Services may also involve processing Personal Data made available to us by our customers. The nature of that information depends on the relevant customer and Service. Where Operad processes such information on behalf of the customer, that processing is governed by the applicable customer agreement and is not collected by Operad for its own independent purposes unless otherwise stated.

You are generally not legally required to provide Personal Data to us. However, certain information is necessary for us to respond to you, enter into or perform a contract, or provide particular Services. If you do not provide such information, we may not be able to respond to your request or provide the relevant Services.

2. HOW DO WE COLLECT PERSONAL DATA?

Summary: we collect Personal Data when you or your organization send it to us, or when a vendor, distributor or other business partner, sends it to us; we collect Personal Data through our website and Services, and through our interactions with you.

We collect Personal Data directly from you when you contact us, submit a form through our website, request information or a strategy call, communicate with us, enter into a business relationship with us, or apply for a position. We may also receive Personal Data from your organization, business partners, service providers, or other business contacts in connection with our relationship with you.

We also collect certain technical and usage information automatically when you visit or interact with our website, including through cookies, analytics technologies and similar tools, as further described below. In addition, we may obtain business contact information from publicly available professional or business sources where appropriate for legitimate B2B business development and outreach, subject to applicable law.

Our website and platforms may use or link to third-party services, such as forms or scheduling tools. Where you provide information through such services, the relevant third party may also process that information in accordance with its own privacy practices.

3. WHAT ARE THE PURPOSES OF PERSONAL DATA WE COLLECT?

Summary: we process Personal Data to meet our obligations, protect our rights, and manage our business.

We will use Personal Data to provide and improve our Services to our customers, users and others and meet our contractual, ethical and legal obligations. All Personal Data will remain accurate complete and relevant for the stated purposes for which it was processed, including for example:

Processing which is necessary for the performance of a contract to which you are a party or in order to take steps at your request prior to entering into a contract:

• responding to your requests and inquiries and provide information about our Services;
• preparing proposals and entering into agreements;
• providing, operating, managing and supporting the Services; and
• managing our relationship with you, including communications, billing and payments.

Processing which is necessary for the purposes of the legitimate interests pursued by Operad or by a third party of providing an efficient and wide-ranging service to users:

• managing and developing our relationships with customers, prospective customers, vendors and business partners;
• conducting B2B marketing and business development and communicating with you about Services that may be relevant to you, subject to applicable marketing laws;
• analyzing the use of our website and Services, measuring performance and improving our website, Services and business operations;
• protecting the security and integrity of our website, systems, Services and business, and preventing or investigating fraud, misuse and other unlawful activity;
• managing and improving our internal business operations; and
• establishing, exercising or defending legal claims and protecting our legal and commercial interests.

Processing which is necessary for compliance with a legal obligation to which Operad is subject:

• complying with applicable legal, regulatory, tax, accounting and audit requirements; and
• responding to lawful requests, court orders or requirements of governmental, regulatory or law-enforcement authorities.

4. SHARING DATA WITH THIRD PARTIES

Summary: we share Personal Data with our service providers, partners, and authorities where required.

We may share Personal Data with service providers that assist us in operating our business and providing the Services, including providers of cloud hosting and infrastructure, business software, CRM systems, analytics, advertising and marketing technologies, communications, forms and scheduling tools, security, professional services and AI or automation technologies.

We require service providers processing Personal Data on our behalf to process it only for appropriate purposes and subject to contractual and other safeguards required by applicable law.

We may also disclose Personal Data where required by law or legal process; to regulators, courts or law-enforcement authorities; to protect our rights, property, security or users; or in connection with a merger, acquisition, financing, reorganization, sale of assets or similar corporate transaction.

Selling or Sharing of Personal Information under the CCPA. We do not sell or share personal information for monetary consideration. Certain advertising, analytics or tracking technologies used on our website may, however, constitute "sharing" or "selling" under the CCPA's broader definitions. Where applicable, California residents may exercise the right to opt out of such activities through the cookie/privacy controls available on our website or by contacting us. We do not knowingly sell or share the personal information of consumers under 16 years of age.

For avoidance of doubt, we may transfer and disclose non-Personal Data to third parties at our own discretion.

5. WHERE DO WE STORE YOUR DATA?

Summary: we store your Personal Data across multiple locations globally

We store your Personal Data on servers owned or controlled by us, or processed by third parties on our behalf, by reputable cloud-service providers (see the following section regarding international transfers).

6. INTERNATIONAL DATA TRANSFERS

Summary: we transfer Personal Data within and to the EEA, USA, Israel and elsewhere, with appropriate safeguards in place.

Operad uses service providers and technologies that may process Personal Data in Israel, the United States, the European Economic Area and other jurisdictions. Accordingly, your Personal Data may be transferred to countries outside the country in which you are located.

Where the GDPR or UK GDPR applies, we use an appropriate lawful transfer mechanism where required. This may include an applicable adequacy decision, the EU Standard Contractual Clauses, or other safeguards permitted by applicable law. Transfers to Israel may rely on the European Commission's adequacy decision, where applicable. Transfers to eligible US organizations may also rely on the EU-U.S. Data Privacy Framework, where applicable.

For more information regarding the safeguards applicable to a particular transfer, you may contact us using the details below.

7. DATA RETENTION

Summary: we retain Personal Data according to our data retention policy, as required to meet our obligations, protect our rights, and manage our business.

We retain Personal Data for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Services, maintain our business relationship, comply with legal, tax, accounting and audit obligations, resolve disputes, enforce agreements and establish or defend legal claims.

Retention periods vary depending on the type of information, the nature of our relationship with you, legal requirements and operational needs. When Personal Data is no longer required, we will delete or anonymize it, subject to legitimate backup, archival and legal-retention requirements.

8. SERVICES AND WEBSITE DATA COLLECTION AND COOKIES

Summary: with your consent, we place cookies on your device. You control our use of cookies through a cookie management tool on our website, or through your device and browser.

We use cookies and similar technologies to operate the website, understand how it is used, measure performance and, where applicable, support marketing and advertising activities. These technologies may collect information such as IP address, device and browser information, website interactions and online identifiers.

Cookies may include: (i) strictly necessary cookies required for website operation and security; (ii) analytics and performance cookies used to understand website usage and improve performance; and (iii) advertising or targeting technologies used to measure campaigns or deliver relevant advertising.

Where required by applicable law, we obtain consent before using non-essential cookies. You can manage available cookie choices through the consent controls presented on the website and through your browser settings.

9. SECURITY AND STORAGE OF INFORMATION

Summary: we take data security very seriously, invest in security systems, and train our staff. In the event of a breach, we will notify the right people as required by law.

We use reasonable technical and organizational measures designed to protect Personal Data against unauthorized or unlawful access, use, disclosure, alteration, loss or destruction. These measures are selected based on the nature of the information and the risks involved and may include access controls, security policies, monitoring, employee confidentiality obligations and other safeguards.

No system or method of transmission is completely secure, and we cannot guarantee absolute security. If a security incident occurs, we will investigate and take appropriate remedial and notification steps as required by applicable law.

10. DATA SUBJECT RIGHTS

Summary: depending on the law that applies to your Personal Data, you may have various data subject rights, such as rights to access, erase, and correct Personal Data, and information rights. We will respect any lawful request to exercise those rights.

Depending on where you live and the law that applies, you may have rights regarding your Personal Data, including rights to request access, correction, deletion, restriction or portability of your information, to object to certain processing, to withdraw consent where processing is based on consent, and to opt out of certain marketing or data sharing activities. These rights are not absolute and may be subject to conditions, limitations and exemptions under applicable law. For example, we may retain information where necessary to comply with legal obligations, protect the rights of others, or establish or defend legal claims. We may also need to verify your identity before responding to a request.

To exercise an applicable privacy right or ask a privacy related question, please contact us at privacy@operad.com. If you receive marketing emails from us, you may also unsubscribe using the link included in the message

If your request relates to Personal Data that we process solely on behalf of one of our customers, we may refer your request to that customer or assist the customer in responding, as appropriate.

Data subjects in the EU have the right to lodge a complaint, with a data protection supervisory authority in the place of their habitual residence. If the supervisory authority fails to deal with a complaint, you may have the right to an effective judicial remedy.

11. GENERAL

Minors. Our website and Services are intended for business users and are not directed to children. We do not knowingly collect Personal Data directly from children through our website. If you believe a child has provided us with Personal Data through the website, please contact us so that we can take appropriate action.

Changes to this Privacy Policy. We may update this Privacy Policy from time to time to reflect changes in our practices, Services or legal requirements. The current version will be posted on our website with the updated "Last Revised" date. Where required by law, we will provide additional notice of material changes.

Operad aims to process only adequate, accurate and relevant data limited to the needs and purposes for which it is gathered. It also aims to store data for the time period necessary to fulfill the purpose for which the data is gathered. Operad only collects data in connection with a specific lawful purpose and only processes data in accordance with this Privacy Policy. Our policies and practices are constantly evolving and improving, and we invite any suggestions for improvements, questions, complaints or comments concerning this Privacy Policy, you are welcome to contact us (details below) and we will make an effort to reply within a reasonable timeframe.

Operad's data protection officer (DPO) is MyEDPO Ltd, available at: privacy@operad.co.il.