Effective date May 1, 2023

GDMServices, Inc. d/b/a Bidmind is committed to respecting and protecting the privacy of personal information of identifiable individuals. This Privacy Policy explains how we (“Bidmind”, “we”, “us” or “our”) collect, use, protect, disclose information (including “personal information” or “personal data” as defined by applicable law) of individuals who visit the website bidmind.com (the “Site”) and use the services available or offered thereon (the “Services”) (“Clients”).

We respect your privacy and are committed to protecting it through our compliance with this policy. Please read this policy carefully to understand our policies and practices regarding your information and how we will treat it.

Please note that this policy does not cover our advertising platform operations, which has its own privacy policy available at https://bidmind.com/privacy-policy

If you do not agree with our policies and practices, do not use the Site. Accessing or using the Site, you agree to this Privacy Policy. This policy may change from time to time. Your continued use of or access to the Site after we make changes is deemed to be acceptance of those changes, so please check this page periodically for updates.

INFORMATION WE COLLECT THROUGH THE SITE

When you use certain features of our Site or visit our Site, or register and log in to our Services we may collect certain information from you:

• Your email address;

• Full name (First and Last name);

• Phone number;

• Company name and address;

• Device info including the device model and IP address;

• UI activity events, in particular, information about your interactions with the Site such as your search queries or clicked on active buttons/ elements of the Site (including the date and time of any requests you make);

• Inferences drawn about your interests and preferences based on your usage of the Site;

• Certain technical data, which may include URL information and online identifiers including cookie data and IP addresses;

• information about the types of devices you are using such as unique device IDs, network and device performance, browser type, language, information enabling digital rights management, operating system;

• your non-precise location, which may be derived or inferred from certain technical data (e.g., your IP address, language setting of your device).

You voluntarily consent to the collection, use and disclosure of such personal information by providing personal information to us and by continuing to use the Site. Without limiting the aforesaid, if appropriate, you may be asked to provide your consent when we collect, use, or disclose your personal information in particular circumstances. Take into account, occasionally, your consent will be implicit through your conduct with us in the case the purpose of the collection, use or disclosure is clear and voluntarily provided by you.

AGGREGATED DATA

From time to time, we may use your personal information to generate Aggregated Data for internal use and for sharing with others on a selective basis. “Aggregated Data” means records which have been stripped of information potentially identifying customers, landing pages or end-users, and which have been manipulated or combined to provide generalized, anonymous information. Note: that any such aggregated data will not include any personal information, and we will never make it available to third parties to use for their own purposes.

COOKIES

We automatically collect certain information when you visit, use or navigate the Site. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Site and other technical information. This information is primarily needed to maintain the security and operation of our Site, and for our internal analytics and reporting purposes.

Additionally, we may use third-party software to serve ads on the Site, implement email marketing campaigns, and manage other interactive marketing initiatives. This third-party software may use cookies or similar tracking technology to help manage and optimize your online experience with us.

Note: that certain cookies are necessary to enable the Site to operate and refusing or disabling some or all cookies may limit your ability to make use of the Site.

HOW WE USE THE INFORMATION WE COLLECT

We use the data collected through the Sites for a variety of purposes, including to:

• Prevent fraud and improve the security and integrity of our Site;
• Customize the content you see on our Site;
• Provide you information about Bidmind’s products and services;
• Perform services on behalf of a business, such providing our products and services, customer service, processing or fulfilling orders, and processing payments;
• Deliver marketing and advertising;
• Internal research, analytics, and development – e.g., user-preference analytics;
• Protect and enforce our agreements and property rights;
• Comply with court orders, legal processes, or respond to regulatory or other similar requests.

OPT-OUT FROM MARKETING EMAILS

We may periodically communicate with you via email address you provide for us regarding to your transactions, orders, our products, services, updates, news, events, etc. We may communicate with you electronically regarding security, privacy, and administrative issues relating to your use of the Site. If you receive an unwanted email from us, you can use the unsubscribe link found at the bottom of the email to opt-out of receiving future emails or you can communicate with us and tell us not to communicate this information to you. We will process your request within a reasonable time after receipt.

Note: that you will continue to receive transaction-related emails regarding the Site you have requested, including information specific to your account, planned Services suspensions and outages, updates to our Terms or this Policy. We will attempt to minimize this type of communication to you.

INFORMATION WE DISCLOSE TO THIRD PARTIES

We may share the following categories of information with third parties that provide services to us:

• Identifiers, such as your name and email address (when voluntarily provided to us), online identifiers, and email address;
• Commercial information, including services obtained from Bidmind;
• Professional or employment information (when voluntarily provided to us);
• Internet or other electronic network activity information – including history of Bidmind web pages visited and videos viewed on such pages;
• Location Information.

CATEGORIES OF THE THIRD PARTIES TO WHOM WE MAY DISCLOSE YOUR PERSONAL DATA

We may disclose aggregated information about our Clients, and information that does not identify any individual or device, without restriction.

Furthermore, we do not share, distribute, sell, trade, rent or otherwise transfer to outside parties your personally identifiable information without first receiving your permission or as permitted in this Privacy Policy. We will only share your information with third parties in accordance with your instructions or as necessary to provide you with a specific service or to trusted third parties who assist us in operating our Site, conducting our business, or servicing you, so long as those parties agree to keep this information confidential.

The following personal data will only be shared with the categories of recipients outlined below if:

you choose to make use of a specific Site feature where sharing of particular personal data is required for the proper use of the Site feature; or

you grant us your permission to share the personal data, e.g. by selecting the appropriate setting in the Services or authorizing Bidmind through a presented consent mechanism.

In addition, we may disclose personal information for the following categories of recipients and for the following reasons:

• Service providers

We work with service providers that work on our behalf which may need access to certain personal data in order to provide their services to us. These companies include those we’ve hired to provide customer service support, operate the technical infrastructure that we need to provide the Services, assist in protecting and securing our systems and services, and help market own products and services as well as partner products, services, events, and co-branded promotions in which we involved. This information may be used to, among other things, analyze and track data, determine the popularity of certain content and better understand online activity

• Our partners

Depending on how you access the Site (e.g. through a third-party service or a mobile provider), we may share your information as necessary. We may also share personal data with that third party about your use of the Site.

• Affiliates

We may share your information with our affiliates, in which case we will require those affiliates to honor this privacy policy. Affiliates include our parent company and any subsidiaries, joint venture partners or other companies that we control or that are under common control with us

• Law enforcement and data protection authorities

We may share your personal data when we in good faith believe it is necessary for us to do so in order to comply with a legal obligation under applicable law, or respond to valid legal process, such as a search warrant, a court order, or a subpoena. We also may share your personal data where we in good faith believe that it is necessary for the purpose of our own, or a third party’s legitimate interest relating to national security to a lawful request by public authorities (including to meet national security) or law enforcement requirements, law enforcement, litigation, criminal investigation, protecting the safety of any person, or to prevent death or imminent bodily harm, provided that we deem that such interest is not overridden by your interests or fundamental rights and freedoms requiring the protection of your personal data.

• Business Transfers

We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.

If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Bidmind, our Clients, users, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.

DATA STORAGE AND RETENTION

Data we collect through the Site may be processed and stored in the United States, or in other countries where we or our affiliates or service providers process data. We take steps to ensure that data is processed according to this Policy and to the requirements of applicable law of your country and of the additional countries where the data is subsequently processed.

We keep any information we collect through these websites as long as we need it for business, tax, or legal purposes. After that, we destroy it by making it unreadable or indecipherable.

SECURITY OF YOUR DATA

We have implemented appropriate technical and organizational security measures designed to protect the security of any personal information we process which included:

• using secure shell protocol (SSH);

• multi-factor authentication;

• access control (physical and technical);

• link encryption.

The protection of your personal information is important to us. However, please also remember that we cannot guarantee that the internet itself is 100% secure. Although we will do our best to protect your personal information, transmission of personal information to and from our Sites is at your own risk. You should only access the services within a secure environment.

AGE OF CONSENT AND CHILDREN’S PRIVACY

We do not knowingly collect, maintain, or use personal information from individuals under the age of consent (18 years of age). If you have reason to believe that anyone under the age of consent has provided us with personal information, you may contact us immediately. If we become aware that we have collected any personal information from individuals under the age of consent we will promptly take steps to remove and permanently delete such information.

Bidmind adheres to the Children’s Online Privacy Protection Act. We do not create nor use any behavioral advertising segments of children under 16 as part of our Services. Our Site is not directed at children under the age of 16. If we are made aware that we have received personally identifiable information from someone under 16, we will use reasonable efforts to remove that information from our records.

LINKS TO OTHER WEBSITES

These websites contain links to other websites and servers. These other websites are not subject to this Privacy Policy, and Bidmind has no control over how such websites may use the personally identifiable information collected on those websites. We recommend that you review the privacy policy at each such website to determine how that site protects your privacy.

INFORMATION FOR OUR CALIFORNIA, VIRGINIA, COLORADO AND CONNECTICUT RESIDENTS

CALIFORNIA CONSUMER PRIVACY RIGHTS

Beginning January 1, 2020, the California Consumer Privacy Act (“CCPA”) (as augmented and amended by the California Privacy Rights Act, or “CPRA”(California Civil Code Section 1798.100 et seq.)) gives California residents certain rights with respect to the processing of personal data. Under CCPA, “Personal Information” is defined as information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with California consumers or households.

This supplement provides additional privacy disclosures and details additional rights and should be read in conjunction with our Privacy Policy.

The California Code of Regulations defines a “resident” as:

(1) every individual who is in the State of California for other than a temporary or transitory purpose, and

(2) every individual who is domiciled in the State of California who is outside the State of California for a temporary or transitory purpose

All other individuals are defined as “non-residents.”

For employee related personal data related requests, such as requests regarding job applications, benefits and HR, please direct your requests to the Bidmind HR Department.

Please note that if you wish to exercise any of your rights with any of Bidmind’s Clients, you must make your request directly to those Bidmind Clients, based on information and procedures that they supply.

Information We Have Sold Or Shared

We may have “shared” (as those terms are defined by the CPRA) the following categories of your personal information:

• Identifiers, such as your name and email address
• Online identifiers – IP address, device IDs, or other similar identifiers
• Internet, or other electronic network activity information – such as Bidmind web pages visited
• Location Information

We may have “shared” each of the categories of personal information listed immediately above to the following categories of third parties:

• Analytics and measurement providers
• Companies involved in marketing and advertising
• Bidmind affiliates.

Please note that Bidmind has never “sold” and is not going to “sell” any personal information (including, sensitive) obtained from you.

Rights Of California Residents

If you are a California resident (as defined above), you have the right to:

1. Right to Access. Under the CCPA, you have a right to request information about our collection, use, and disclosure of your personal information over the prior 12 months or for the all time, and ask that we provide you with the following information:

• Categories of and specific pieces of personal information we have collected about you;

• Categories of sources from which we collect personal information;

• Purposes for collecting personal information;

• Categories of third parties with which we share personal information;

• Categories of personal information disclosed about you for a business purpose.

If applicable, categories of personal information sold about you and the categories of third parties to which the personal information was sold, by category or categories of personal information for each third party to which the personal information was sold.

2. Right to Correct Inaccurate Personal Information. If you have reason to believe that Bidmind maintains inaccurate personal information, you have the right to request Bidmind to correct your inaccurate personal information. To do this, you need to make a verifiable consumer request through communication channels mentioned below.

3. Right to be Forgotten. You have the right to request that Bidmind delete any personal information it has collected or maintains about you, subject to certain exceptions for business purposes outlined in the applicable law. Once Bidmind receives and confirms your verifiable consumer request, Bidmind will delete your personal information from its records, unless an exception applies.

4. Right to Non-Discrimination. You have the right to non-discrimination if you exercise any of your rights under the CCPA. If you exercise your rights under the CCPA, Bidmind, pertaining to its good and services, will not do any of the following: (a) deny you any goods or services; (b) charge you a different price or rate for goods or services, including through the use of discounts or other benefits or imposing penalties; (c) provide to you a different level or quality of goods or services; or (d) suggest to you that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

5. Right to Opt-Out. You have the right to direct Bidmind to not sell or share your personal information to third parties at any time.

Exercising Your Rights

How to exercise your rights please read in the section “REQUEST FOR EXERCISE OF RIGHTS” below.

Do Not Track Notice

We don’t currently respond to Do Not Track and similar signals. Please go to All About Do Not Track for more information or use this page.

The World Wide Web Consortium (W3C) has been attempting to develop a Do Not Track (DNT) standard, but it has not been finished. Currently, the standards regarding the DNT signals and appropriate responses are not well defined. Accordingly, we do not assign a meaning to DNT signals. If you’d like to opt-out from Bidmind, please click here. By opting out of Bidmind, you will continue to see advertising, although it will not be tailored to your interests by data provided by Bidmind.

Sensitive Personal Data Processing

The CPRA requires data controllers to obtain a consumer’s consent before processing their sensitive personal data. Please note that Bidmind does not generally collect sensitive personal data from California residents who visit our Site and will not process such data if it is inadvertently collected. Therefore, we will not request consent for processing of such sensitive personal data collected from the Site.

CALIFORNIA CONSUMERS UNDER 16 YEARS OLD.

As of the effective date of this policy, we do not have actual knowledge that we sell or use personal data of consumers under 16 years of age for targeted or cross-contextual behavioral advertising (“share”). If we collect personal data that we know is from a child under 16 years old in the future, we will not “sell” or “share” that information unless we receive affirmative permission, in compliance with applicable data protection laws, to do so. If a child is between 13 and 16 years of age, the child may provide that permission.

If you wish to request further information about our compliance with these requirements, or have questions or concerns about our privacy practices and policies, please use the Contact Us information provided below.

VIRGINIA, COLORADO AND CONNECTICUT CONSUMER PRIVACY RIGHTS

If you are a resident of the State of Virginia, Colorado or Connecticut subject to certain exceptions, you have certain data protection rights as defined by the Virginia Consumer Data Protection Act (“VCDPA”), Colorado Privacy Act (“CPA”) or The Connecticut Data Privacy Act (“CTDPA”) respectively. Bidmind aims to take reasonable steps to allow you to correct, amend, delete, or limit the use of your personal information.

Upon the request you may realize your following rights:

1. To confirm whether or not Bidmind is processing your personal data and to access such personal data;

2. To correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing;

3. To delete personal data provided by or obtained about you;

4. To obtain a copy of your personal data that the you previously provided to Bidmind in a portable and, to the extent technically feasible, readily usable format;

5. To opt out of the processing of the personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects for you.

Bidmind may use your personal data to facilitate the delivery of targeted advertising, as defined by the applicable privacy laws, to you. You can always opt-out of the serving of targeted advertising by Bidmind by clicking here.

Once we receive your request, use your personal data for targeted advertising, unless you later allow us to do so.

Residents of Virginia, Colorado and Connecticut have the right to opt-out of “sale” of its personal data as well as profiling done in furtherance of decisions that produce legal or similarly significant effects, as defined by the applicable privacy laws. As Bidmind does not conduct this type of “sale” and profiling, we do not offer such kind of opt-outs to Virginia, Colorado and Connecticut residents.

Sensitive Personal Data Processing

The VCDPA and CTDPA require data controllers to obtain a consumer’s consent before processing their sensitive personal data. Please note that Bidmind does not generally collect sensitive personal data from Virginia or Connecticut consumers who visit our website and will not process such data if it is inadvertently collected. Therefore, we will not request consent for processing of such sensitive personal data collected from the Site.

Exercising your Rights

How to exercise your rights please read in the section “REQUEST FOR EXERCISE OF RIGHTS” below. In addition to the general procedure, Virginia, Colorado and Connecticut consumers have the right to appeal the decision if Bidmind declines to take action regarding the consumer’s request. To exercise your right to appeal you may do the same as another privacy rights making an appropriate request according to the section “REQUEST FOR EXERCISE OF RIGHTS”.

If the appeal is also denied, under request, we may provide the consumer with an online mechanism, if available, or other method through which the consumer may contact the Attorney General to submit a complaint.

INFORMATION FOR RESIDENTS OF EUROPEAN COUNTRIES

If you are located in the European Economic Area, the United Kingdom, or Switzerland (the “European Countries”), you have certain rights and protections under applicable law regarding the processing of your “personal data” as defined under applicable law. Some of the information that Bidmind collects from you through its operation of the Site may constitute “personal data” under these laws.

Role of Bidmind as Controller

If you are located in one of the European Countries, Bidmind will act as a “controller” (as defined under applicable data protection laws) when processing your personal data collected through its operation of the Site.

Legal Basis for Processing

Bidmind’s legal basis for processing your personal data depends upon the specific context in which we collect or use it.

For personal data collected through the operation of the Site we normally rely on our legitimate interests, except where our interests are overridden by your data-protection interests or your fundamental rights and freedoms.

The legitimate reasons for which we use your personal data are described in greater detail in the “How We Use the Information We Collect” section of this policy. These legitimate interests include the operation of our websites and business, the promotion of our business, to undertake analytics on, and evaluation of, our business and our services, to contact you about our services or our websites and for any other purposes of which we notify you.

In addition, in some cases, we may rely on your consent as our legal basis for processing your personal data (for example, if we require your consent in order to store cookies on your browser). Where we rely on consent to process your personal data, we will obtain such consent in compliance with applicable laws. Where you have given your consent, you have the right to withdraw your consent at any time.

Additionally, in certain cases we may also be under a legal obligation to process your personal data.

What Data Protection Rights You Have

If you are located in one of the European Countries, you may be entitled to exercise certain data-subject rights available under applicable laws. Bidmind aims to take reasonable steps to allow you to correct, amend, delete, or limit the use of your personal information.

As available and except as limited under applicable law, the rights afforded to individuals are:

• Right of access – the right to be informed of, and request access to, the personal data we process about you;

• Right to rectification – the right to request that we amend or update your personal data where it is inaccurate or incomplete;

• Right to erasure – the right to request that we delete your personal data;

• Right to restrict – the right to request that we temporarily or permanently stop processing all or some of your personal data;

• Right to object – the right, at any time, to object to us processing your personal data on grounds relating to your particular situation; the right to object to your personal data being processed for direct marketing purposes;

• Right to data portability – the right to request a copy of your personal data in electronic format and the right to transmit that personal data for use in another party’s service; and

• Right not to be subject to automated decision-making – the right to not be subject to a decision based solely on automated decision-making, including profiling, where the decision would have a legal effect on you or produce a similarly significant effect.

We will process your requests to us within 30 days. We will also notify a relevant supervisory authority within 72 hours from a breach related to your personal information that we hold.

DATA TRANSFERS

Our servers are located in the USA. If you are accessing our Site from outside the USA, please be aware that your information may be transferred to, stored, and processed by us in our facilities and by those third parties with whom we may share your personal information in other countries. In such instances Bidmind shall ensure that the transfer of your personal data is carried out in accordance with applicable privacy laws and, in particular, that appropriate contractual, technical, and organizational measures are in place.

When Bidmind transfers your personal data to third-party service providers outside of the European Countries, we use appropriate legal mechanisms to help ensure all applicable laws, rights and regulations continue to protect your personal data. This may include the use of EU Commission approved standard contractual clauses. Where such standard contractual clauses are used, a copy is available on request.

REQUEST FOR EXERCISE OF RIGHTS

To exercise your rights to know, access, correct and be forgotten described above, please submit a verifiable consumer request to Bidmind by email dpo@bidmind.com.

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. These verification efforts require us to ask you to provide information so that we can match it with the information you have previously provided us. For instance, depending on the type of request you submit, we may ask you to provide certain information so that we can match the information you provide with the information we already have on file, or we may contact you through a communication method (e.g. phone or email) that you have previously provided to us. We may also use other verification methods as the circumstances dictate.

We will only use personal information provided in your request to verify your identity or authority to make the request. To the extent possible, we will avoid requesting additional information from you for the purposes of verification. If, however, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity, and for security or fraud-prevention purposes. We will delete such additionally provided information as soon as we finish verifying you.

HOUSEHOLD REQUESTS – We currently do not collect household data. If all the members of a household make a Right to Know or Right to Delete request, we will respond as if the requests are individual requests.

REQUESTS, GENERALLY – Please note, if you have not filled our Site’s forms we will not have enough information about you to verify your Right to Know, Right to Correct and Right to Delete requests, as we do not keep sufficient information necessary to reidentify and link you to a prior visit to the user services where data may have been collected. As such, we will be unable to verify and honor your requests. You may make a verifiable consumer request related to your personal information twice per 12-month period.

REQUESTS MADE THROUGH AGENTS – You may designate, in writing or through a power of attorney, an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require the agent to provide proof you have authorized it to act on your behalf, and we may need you to verify your identity directly with us.

QUESTIONS AND COMPLAINTS

We have assigned a Data Protection Officer (DPO) who may be reached via dpo@bidmind.com.

However, you can also contact and have the right to lodge a complaint with your local Data Protection Authority.

Our EU Representative – according to Art. 27 GDPR:

ePrivacy GmbH

represented by Prof. Dr. Christoph Bauer

Große Bleichen 2120354 Hamburg

Germany

https://www.eprivacy.eu