Privacy Policy Page 1 of 7 Impact Montana Inc – Privacy Policy This Privacy Policy is edited by Impact Montana Inc (“Impact Montana”), a 501c3 having its registered office at 2728 Colonial Drive, Helena, MT 59601 and registered with the Montana Secretary of State’s Office under the number D245180 (hereafter, the “Data Controller”). The Data Controller offers a platform for community connection, education, strategy, and action for addressing health and wellness needs of our Montana service members, veterans, first responders, and their families (hereafter, the “Platform”) to its users which have subscribed on the Platform and as such have a user account (hereafter, the “Users”). The Platform is available at the following url address https://community.impactmontana.org/. The Data Controller uses a solution called “Hivebrite”, which enables the import and export of user lists and data, the management of content and events, the organization of emailing campaigns and opportunity research and sharing as well as the management of funds and contributions of any kind. In this regard, the Data Controller collects and processes User’s personal data in accordance with the Privacy and Cookie policy. The Data Controller is particularly aware and sensitive with regards to the respect of its Users privacy and personal data protection. The Data Controller commits to ensure the compliance of the processing it carries out as data controller in accordance with the Data Protection Law. Data Protection Law is the Ex: Act n°78-17 dated January 6, 1978, on Information Technology, Data Files and Civil Liberties] and [If applicable : Ex: the EU Regulation n°2016/679 regarding data protection dated April 27, 2016 named General Data Protection Regulation or “GDPR”. The Data Controller has put in place an appropriate privacy and cookie policy to be fully transparent on how the personal data of Users are processed within the use of the Platform and services provided. This privacy policy is intended for the Users of the Platform of the Data Controller. Date of last update: June 2023. ARTICLE 1. COLLECTED PERSONAL DATA 1.1 When subscribing on the Platform When subscribing to the Platform, the User is informed that its following personal data is collected for the purpose of creating a user account: Mandatory data - First name; - Last name; Privacy Policy Page 2 of 7 - Email address; Optional data: - Service Information - Information regarding professional work and experiences - Information regarding education, degrees, and certificates - Information regarding applicable fit for User to join the Platform The User is informed that it is not possible to access the Platform without providing the mandatory data strictly necessary to create an account and authenticate the User. 1.2 During the use of the Platform The User may validly publish, at its own initiative, any content on the Platform which shall be kept by the Company: - Posts - Forums - Private Messages The User is aware that when using the Platform, the User may decide to provide « sensitive data » within the meaning of Data Protection Law, for example, data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, concerning sexual orientation, etc. By providing such sensitive data, the User agrees to their processing by the Platform in the conditions set forth in this Privacy Policy. ARTICLE 2. THE PURPOSE OF THE DATA PROCESSING The Data Controller and its subcontractors process personal data that are freely transferred by the User when accessing the services proposed by the Platform for the following purpose: Purpose Legal basis Creation and management of a user account; 1. the data subject has given consent to the processing of his or her personal data for one or more specific purposes; 2. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to Providing the User with all functionalities of the Platform, meaning: ● Sending invitations for events organized by Data Controller or other Users, if the User has accepted to Privacy Policy Page 3 of 7 receive such invitations; ● Sending information about jobs and opportunities from the Data Controller or its partners if the User has accepted to receive such offers ● Aid Users in connecting with one another and using the Platform to organize in line with the purpose, values, and agreements of the platform ● Provide educational opportunities for the User entering into a contract; 3. processing is necessary for compliance with a legal obligation to which the controller is subject; 4. processing is necessary in order to protect the vital interests of the data subject or of another natural person; 5. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; 6. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. Management of data subjects rights according to the Personal Data Legislation. Storage of User personal data; Management of financial transactions through the Platform Management of complaints or other issues brought to the Data Controller by Users If applicable: [Management of prospection operations: ● Sending email prospect campaigns in the Name of Impact Montana and/or its community partners ● Sending newsletters in the Name of Impact Montana and/or its community partners Making statistics in order: ● to improve the quality of the services proposed by the Platform; ● improve the usage functionalities of the Platform; Privacy Policy Page 4 of 7 Making statistics regarding the effective use of the Platform; Making statistics regarding the different levels of activity on the Platform. Enable the synchronization of the User’s LinkedIn profile; ARTICLE 3. DATA RETENTION PERIOD The Data Controller informs the User that the personal data related to the User Account is retained only during the length of the User’s subscription on the Platform. Following the termination of said subscription, the data collected upon the subscription as well as the content published by the User on the Platform shall be deleted after a period of one (1) months. ARTICLE 4. COMMITMENT OF THE DATA CONTROLLER The Data Controller commits to process User’s personal data in compliance with the Data Protection Law and undertake to, notably, respect the following principles: - Process User’s personal data lawfully, fairly, and in a transparent manner; - Only collect and process the Users’ data for the strict purpose as described under article 2 of the present privacy policy; - Ensure that the personal data processed are adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed; - Do the best efforts to ensure that the personal data processed are accurate and, if necessary, kept up to date and take all reasonable steps to ensure that personal data that are inaccurate, having regard to the purposes for which they are processed, are erased or rectified without delay; - Keep personal User’s data for no longer than is necessary for the purposes for which they are processed; - Put in place all necessary technical and organizational appropriate measures in order to ensure the security, confidentiality, integrity, availability and the resilience of the process systems and services; - Limit the access to the Users’ data to the persons duly authorized to this effect; - Guarantee to the Users their rights under the Data Protection Law in relation to the processing of their data and make the best efforts to satisfy any request, where this is possible. Privacy Policy Page 5 of 7 ARTICLE 5. EXERCISE OF THE USERS’ RIGHTS The User is duly informed that it disposes at any time, depending on the legal basis of the processing, a right to access, to rectification, to erasure, to restriction of processing, to data portability, and to object. When processing is based on User’s consent, the right to withdraw consent at any time, without affecting the lawfulness of the processing based on consent before its withdrawal. The User can exercise its rights by sending an email to the following address [email protected] provided that the User justifies his/her identity. ARTICLE 6. COOKIES The Data Controller informs the User that Hivebrite, as well as its subcontractors, uses a tracking technology on its terminal such as cookies whenever the User navigates on the Platform subject to the conditions described in the Data Controller Cookie Policy as described in the Hivebrite article: https://support.hivebrite.com/hc/en-us/articles/360008364659- Customize-your-cookie-agreement. ARTICLE 7. RECIPIENT AND PERSONS AUTHORIZED TO ACCESS THE USERS’ DATA Only authorized persons working for the Data Controller and, in some cases, its subsidiaries, can access your personal data. The Data Controller makes its best effort to ensure that these groups of people remain as small as possible and maintain the confidentiality and security of User’s personal data. The Data Controller also uses trusted service providers to carry out a set of operations on his behalf for hosting and payment services. The Data Controller can also use service providers in the tech industry, editors of specific tools integrated in the Platform for technical purposes. The Data Controller only provides service providers with the information they need to perform the service and ask them not to use your personal data for any other purpose. The Data Controller does his best to ensure that all these trusted service providers only process the personal data on our documented instructions and provide sufficient guarantees, in particular in terms of confidentiality, expert knowledge, reliability and resources, to implement technical and organizational measures which will meet the requirements of the applicable legislation, including for the security of processing. The Data Controller may be required to disclose or share your personal data to comply with a legal obligation, or to enforce or apply our terms of use/sale or any other conditions you have accepted; or to protect the rights, safety or property of Impact Montana, its customers or employees. Privacy Policy Page 6 of 7 List of the main service providers: Service Provider Service You can consult the privacy policy by clicking on the following link: KIT UNITED 44 rue la fayette 75009 Paris France HIVEBRITE solution https://hivebrite.com/privacy -policy Stripe 510 Townsend Street San Francisco CA 94103, Payment Service https://stripe.com/fr/privacy Paypal 21 rue Banque 75002 Paris, France Payment Service https://www.paypal.com/us/ webapps/mpp/ua/privacyfull Google Cloud Platform Gordon House, 4 Barrow St Dublin, Ireland Hosting of all data and content produced and provided by the User, as well as images, profile pictures, and backups https://cloud.google.com/se curity/privacy/ Amazon AWS 38 Ave John F. Kennedy L-1855, Luxembourg https://aws.amazon.com/co mpliance/gdpr-center/ Sentry 132 Hawthorne St San Francisco, CA 94107 Production and storage of error logs enabling our developers to correct the code https://sentry.io/privacy/ Sendgrid 375 Beale St, STE 300 Sending of emails from the Platform https://api.sendgrid.com/priv acy.html Privacy Policy Page 7 of 7 San Francisco, CA 94105 Hivebrite, Inc 16 Nassau St New York, NY 10038 Customer support for the Platform https://hivebrite.com/privacy -policy