Privacy Policy

PRIVACY POLICY
VERSION 1.0
Effective Date: November 1st 2025

This Privacy Policy describes how Klaay, ApS and its affiliates (“Klaay,” “we,” or “us”) collects, uses, shares, and secures your Personal Information when you access our Website use our Services (defined below), or otherwise interact with us. This Privacy Policy contains an explanation of your rights regarding Klaay's use of your Personal Information and how we communicate with you.

Klaay attaches great importance to ensuring that your Personal Information is collected, used, stored, and erased in accordance with the current applicable regulations as stipulated by local, state, national, federal, and other data protection legislation. Protecting your data is a matter of great importance to our company. If you have requests concerning your personal information or any questions, please contact us at privacy@klaay.com.

Klaay makes available this Privacy Policy in compliance with its role as a data controller, as that role is defined by relevant legislation. This means that it applies to when Klaay collects, uses, shares, and processes data.

Klaay complies with applicable international data protection regulations, including the EU General Data Protection Regulation (GDPR), the UK Data Protection Act 2018, and Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), where applicable. In addition, we comply with the California Consumer Privacy Act of 2018, as amended (“CCPA”) and other state and federal data protection laws. In the event of a conflict between such laws, the strictest standard under which a data subject may be regulated will apply.

We act as both a data processor and a data controller. For example, we act as a data processor when the Services are used to perform under a contract with our Customers. In these cases, we do not own, control, or make decisions about the Personal Information contained in such data and we process it only in accordance with our Customers’ instructions as they are the data controllers and are responsible for deciding what Personal Information is collected from the data subject and how such Personal Information should be processed. In the situations when we act in the capacity of a data processor, we comply with our data processors’ obligations. When Klaay acts as a data processor, the Customer is responsible for providing all required notices and obtaining any necessary consents. When Klaay acts as a data controller, we independently determine the purposes and means of processing and ensure transparency in accordance with applicable data protection laws. In order to ensure that personal data is processed in accordance with the strictest data protection standards, we offer for conclusion a data processing agreement (the “DPA”). This Privacy Policy is primarily provided for the purposes where we act as a data controller, meaning we determine what data is collected, how it is used, and how it is processed and by whom.

1. Definitions

For purposes of this Privacy Policy the following definitions are applied:

References to “Customer” means that Customer (as defined in our Terms of Service.)

References to a “Data Subject” mean a User on whom we have collected, used, processed, shared, or otherwise received and handled Personal Information.

References to “Personal Information” mean any data that could, directly or indirectly, be used to identify a User as Personal Information, personal information, or personally identifiable data or information may be defined by relevant law.

References to the “Services” means those Services to which a Customer subscribes (as defined by our General Terms and Conditions.)

References to “us,” “we,” “our,” and/or “Klaay,” refers to Klaay, ApS, and its affiliated companies, including Klaay Inc.

References to the “Website” means the website www.klaay.com.

References to “you,” and/or “User,” mean a user of the Website, representative of a Customer, or an individual who has interacted with Klaay, such as by signing up for our mailing list or emailing Klaay.

2. Agreement to be Bound

By accessing the Website, engaging us for our Services, or otherwise interacting with us, you represent that you have read and understood the Privacy Policy and that you agree to be bound by it.

This Privacy Policy may be additionally subject to our General Terms and Conditions.

3. Modifications and Changes to the Privacy Policy

We may modify, add to, suspend, or delete the Privacy Policy, in whole or in part, at our sole discretion at any time, with such modifications, additions, or deletions being effective thirty (30) calendar days following their posting to the Website and emailing of a notice to Users for whom we have an email address. Your access of the Website or continued interaction with us after such modification, addition, or deletion of the Privacy Policy shall be deemed to constitute acceptance by you of such changes.

4. The Personal Information We Collect: Purpose of Collection; Data Collected; & Our Lawful Basis for Processing

We collect both personally identifiable data and non-personally identifiable data. Often, you choose what information to provide to us, but, sometimes, we may require certain information for you to use and for us to provide the Services, the Website, the content you have requested from us, or to otherwise interact with us. We collect Personal Information directly from Users, from our Customers, automatically from Users (such as through interactions with our Website,) and from lead sources (where allowed by relevant law). More details can be found below on the source of Personal Information, why Personal Information is collected, what is collected, and our basis for processing Personal Information.

We believe in the principle of data minimization and so always try to collect the minimal amount of Personal Information necessary to make our Services, Website, and business function.

A. Personal Information You Provide to Us

We collect the Personal Information you directly provide to us and use it in the following ways:

Purpose	Data Collected	Lawful Basis for Processing
Marketing Communications	Name, Job Title, Company Email, Company Phone Number, Company Address, Affiliated Customer Organization, Other information you may provide to us, such as that which may be found in your corporate email signature (such as a picture or gender).	Klaay's and our Customers’ legitimate interests: Collection and processing of Users’ Personal Information is necessary to communicate with our Customers and their designated representatives regarding company and other marketing related news. Consent: Collection and processing of Users’ Personal Information may also be based on consent, when such consent is explicitly requested by us and where required by law.
Provision of the Services	Name, Job Title, Photograph, Company Email, Company Phone Number, Company Address, Affiliated Customer Organization, Other information you may provide to us, such as that which may be found in your corporate email signature (such as a picture or gender).	Klaay's and our Customers’ legitimate interests: Collection and processing of Users’ Personal Information is necessary for the provision of the Services.
Invoicing and financial transactions	Name, Job Title, Company Email, Company Phone Number, Company Address, Affiliated Customer Organization.	Klaay's and our Customers’ legitimate interests: Collection and processing of Users’ Personal Information is necessary for the invoicing and other financial transactions related to the Services.

B. Personal Information We Collect in Connection with Our Services

We collect Personal Information in connection with our Services and use such Personal Information in the below ways. Klaay does not offer its Services to consumers, and, therefore, to the extent that it collects a User’s or third parties’ Personal Information from a Customer or a representative of a Customer, Klaay relies on the representations of the Customer that the Customer has the lawful authority to have collected and provided such Personal Information to Klaay.

Purpose	Data Collected	Lawful Basis for Processing
Customer Onboarding & Account Management	Name, Job Title, Company Email, Company Phone Number, Company Address, Affiliated Customer Organization	Klaay's and our Customers’ legitimate interests: Collection and processing of Users’ Personal Information is necessary for the provision of onboarding and account management. Contract: We collect and process Personal Information for the purpose of onboarding Customers as required under our contractual obligation.
Legal & Compliance	Name, Job Title, Company Email, Company Phone Number, Company Address, Affiliated Customer Organization, Other information you may provide to us, such as that which may be found in your corporate email signature (such as a photo or gender).	Klaay's and our Customers’ legitimate interests: Collection and processing of Users’ Personal Information is necessary for the administration of contracts. Contract: We collect and process Personal Information for the purpose of administering our Customer contracts insofar as providing the Services.
Cookies and First-Party Tracking	Cookies and cookieless tracking technologies	Klaay's and our Customers’ legitimate interests: Collection and processing of Users’ Personal Information via some first-party cookies is necessary for the functioning of the Services, e.g., sign-in. Consent: Collection and processing of Users’ Personal Information is based on User consent, where required by law.

C. Personal Information We Automatically Collect from Users of Our Website

We collect Personal Information automatically from Users of our Website. We use this Personal Information in the below ways:

Purpose	Data Collected	Lawful Basis for Processing
Cookies and First-Party and Third-Party Tracking Technologies	Cookies and cookieless tracking technologies; Heatmaps; Analytics	Consent: Collection and processing of Users’ Personal Information is based on User consent, where required by law. Klaay's and User’s legitimate interests, unless prohibited by law: Collection and processing of Users’ Personal Information is used by Klaay to obtain analytics regarding usage of our Website and tailor our Website to Users’ preferences as well as to ensure the Website runs smoothly and without interruption.
Metadata	Links a User interacts with, Text a User copies, Time spent within a Feature, Features or content accessed, and other similar contextual information regarding usage.	Consent: Collection and processing of Users’ Personal Information is based on User consent, where required by law. Klaay's legitimate interests: Collection and processing of Users’ Personal Information is used by Klaay to obtain contextual information regarding usage of our Website.
Log Data	IP address, Address of websites visited before using the Website, Browser type and settings, Data and time of access, Browser configurations and plugins, Language preferences.	Consent: Collection and processing of Users’ Personal Information is based on User consent, where required by law. Klaay's and Customer’s legitimate interests, unless prohibited by law: Collection and processing of Users’ Personal Information is used by Klaay for security, analytics, and troubleshooting.
Device Information	Type of device, Operating system used, Device settings, Application IDs, Unique device identifiers, Crash data.	Consent: Collection and processing of Users’ Personal Information is based on User consent, where required by law. Klaay's and Customer’s legitimate interests, unless prohibited by law: Collection and processing of Users’ Personal Information is used by Klaay for security, analytics, and troubleshooting.
Location Information	Company address, IP address, Browser information (including referrers), Device information (such as iOS IDFA, IDFV for limited, non-advertising purposes).	Consent: Collection and processing of Users’ Personal Information is based on User consent, where required by law. Klaay's and Customer’s legitimate interests, unless prohibited by law: Collection and processing of Users’ Personal Information is used by Klaay for localization, compliance, and security.

D. Personal Information We Collect from Third Parties

We may collect Personal Information regarding Users from third parties and other websites, depending on local rules and regulations regarding collection of Personal Information from third parties. Depending on the jurisdiction where a User is located, the following may or may not be applicable as we seek to ensure compliance with all relevant regulations that affect our Users. We use this Personal Information in the below ways:

Purpose	Data Collected	Lawful Basis for Processing
Customers may provide us with Users’ Personal Information as a designated point of contact for a Customer or for Legal and Compliance.	Name, Job Title, Company Email, Company Phone Number, Company Address, Affiliated Customer Organization, Other information the Customer may provide to us.	Consent: Collection and processing of Users’ Personal Information is based on User consent, where required by law. Klaay's and User’s legitimate interests, unless prohibited by law: Collection and processing of Users’ Personal Information is used by Klaay to obtain analytics regarding usage of our Website and tailor our Website to Users’ preferences as well as to ensure the Website runs smoothly and without interruption.
Sales; Marketing	Name, Job Title, Company Email, Company Phone Number, Company Address, Affiliated Customer Organization, and other information that may be provided to us by third-party lead services.	Klaay's legitimate interests, unless prohibited by law: Collection and processing of Users’ Personal Information is used by Klaay to connect with prospective Customers for sales and marketing purposes.
Provision of the Services	Name, Job Title, Company Email, Company Phone Number, Company Address, Affiliated Customer Organization	Klaay's and its Customers’ legitimate interests: We may collect and process such data received by third parties, services providers, and other third parties with whom we have SSO or data sharing agreements for the purposes of providing and bettering our Services.
Identity Verification	Name, Email, Profile Picture, Contacts, Other Data Shared by a User via their Account Setting regarding Data Sharing on the Applicable Method for Identity Verification	Klaay's legitimate interests, unless prohibited by law: Collection and processing of Users’ Personal Information is used by Klaay to verify User identities.

5. The Personal Information We DO NOT Collect

Klaay does not collect any special category or sensitive data on consumers or Users. For example, we do not collect health data, financial data, racial identity data, religious data, or any other data attributable to a single User that may be considered sensitive unless it is provided by a Customer, in which event it is processed solely for purpose of the provision of the Services and based on the lawful basis of contract with the Customer.

6. With Whom We Share Your Personal Information

Klaay may share your Personal Information with third parties in the ways described below. We will never sell Personal Information of our Users.

When you have given us consent	We may share your Personal Information where you have given us consent to share it. For example, data may be shared with other Users within a Customer where directed by a Customer or User.
To our third-party vendors and services providers	As a business, we engage third-party vendors and data processors to process data on our behalf. Where required, we have in place contracts with these third parties that limit the processing of the Personal Information to the extent necessary to provide the services and which include reasonable assurances regarding appropriately safeguarding the Personal Information.
For legal and compliance purposes	We may share Personal Information if we believe we are compelled to do so by applicable law, regulation, process, or a government request. Where we are legally permitted to do so, Users will be notified in advance of disclosure and given any legally permitted time to object to such a disclosure. To the extent permitted by applicable law, we may also share Personal Information to enforce our own agreements or policies, to protect the integrity of our Services, to protect ourselves, Customers, Users, or the public from harm or illegality, or to respond to an emergency where we believe a vital interest requires us to do so.
Corporate matters	In the event of a corporate sale, merger, dissolution, reorganization, change in control, or similar corporate event, we may transfer Personal Information in a way that constitutes a sale of Personal Information. We will endeavor to notify Users ahead of such a sale, where possible.

7. Your Rights and How to Exercise Them

You have certain rights regarding your Personal Information, depending on your country of residence. Below is a summary of those rights. California Users are directed to Klaay's Statement at Collection for a summary of their rights under state law, which may differ from those set forth below.

Sometimes, your rights may be limited, such as when honoring a request would reveal information about another person or if you request, we delete Personal Information that we are permitted that we are permitted by law or our legitimate interests to keep.

We are required to verify the identity of any User exercising a Personal Information right. This identification process may require providing us with a signed declaration confirming your identity. If a request is made on behalf of a User by a third party, we require a certification from the User that we can provide such third party the User’s Personal Information. We reserve the right to deny any request where we do not reasonably believe the identity of the User or authorization for such a request has been provided to us.

We will respond to any request in a timely manner, which in most instances will be thirty (30) days. The time to respond to requests is set out in relevant law and may differ, depending on where the User resides.

1. Right to be Informed. You have the right to be informed about Klaay's data collection processes. We fulfill this right by providing you with this Privacy Policy, including at the time of Personal Information collection.
2. Right of Access. You have the right to access what Personal Information Klaay has collected about you. You can exercise this right by making a Data Subject Access Request via email at privacy@klaay.com.
3. Right to Rectification. You have the right to ask Klaay to correct any Personal Information it holds about you so as to ensure your Personal Information is accurate. You also have the right to ask Klaay complete incomplete Personal Information held about you. You can correct any incorrect Personal Information by emailing us at privacy@klaay.com.
4. Right to Restrict Processing. You have the right to restrict Klaay's processing of your Personal Information where: you have contested the accuracy of the Personal Information; you have objected to the processing and Klaay is considering whether it has a legitimate ground which overrides this objection; the processing is unlawful; or Klaay no longer requires the Personal Information but you require that Klaay does not delete it so as to establish, exercise or defend a legal claim you may have. To exercise your right to restrict processing, please email us at privacy@klaay.com. A User may also contact the User’s relevant Customer, where User is a representative of a Customer, to discuss the User’s desire to restrict processing where such processing relates to Personal Information provided by said Customer or processed on the basis of contract with said Customer.
5. Right to Erasure. In some circumstances, you have the right to ask that your Personal Information be deleted: your Personal Information is no longer necessary in relation to the purpose for which it was collected/processed by Klaay; you withdraw your consent or object to the processing and there is no overriding legitimate interest to continue processing; you object to the processing and there are no overriding legitimate grounds for the processing; you object to the processing and your Personal Information was processed for direct marketing purposes; or your Personal Information was unlawfully processed or should be erased to comply with a legal obligation. Please note, that Klaay may refuse your request to delete your Personal Information if an exception applies: to comply with a legal obligation or for the performance of a task of public interest; for the exercise or defense of legal claims; or for purposes relating to public health, archiving in the public interest, scientific/historic research or statistics. If your Personal Information has been disclosed to a third party, Klaay will ask it to erase that data, unless this proves impossible or involves disproportionate effort or was agreed to you as part of our data sharing provisions of our General Terms and Conditions. You may ask who those third parties are by making a Data Subject Access Request by emailing us at privacy@klaay.com, and Klaay or the relevant Customer, as applicable, will inform you accordingly. A User who is a Customer representative may also contact the User’s relevant Customer to discuss the User’s desire to be forgotten where such processing relates to Personal Information provided by said Customer or processed on the basis of contract with said Customer.
6. Right to Data Portability. You have the right to move, copy, or transfer your Personal Information from one IT environment to another in a safe and secure way, without hindrance to usability. This enables you to obtain and reuse your Personal Information across different services. This being noted, due to the nature of the Services Klaay provides and the types of data it collects, the right to data portability, although it exists, any Personal Information we provide to you in response to your exercise of this right may be limited in its utility. This right applies to Personal Information that you have personally provided to Klaay (see above section “The Personal Information You Provide to Us”); where our processing is based on consent or the performance of a contract; and where processing is carried out by automated means. You may make a request for data portability by making a Data Subject Access Request by emailing us at privacy@klaay.com.
7. Right to Object. You have the right to object to Klaay's processing of your Personal Information in certain circumstances. You also have the right to stop your Personal Information being used for direct marketing. You can also object to Klaay's processing of your Personal Information if the processing is for: a task carried out in the public interest; is done in the exercise of an official authority vested in Klaay; or is done for Klaay's legitimate interests (or those of a third party). However, in these circumstances the right to object is not absolute, and you must give specific reasons why you are objecting to the processing of your Personal Information. Even if an objection is made, Klaay will continue to process your Personal Information if: Klaay can demonstrate compelling legitimate grounds for the processing, which override the interests, rights and freedoms of the objecting User; or the processing is for the establishment, exercise or defense of legal claims. To exercise your right to object to processing, please email us at privacy@klaay.com. A User who is a representative of a Customer may also contact the User’s relevant Customer to discuss the User’s objection where such processing relates to Personal Information provided by said Customer or processed on the basis of contract with said Customer.
8. Right Not to Be Subject to Automated Decision Making or Profiling. You have the right not to be subject to fully automatic decisions (those without human intervention in the decision-making process) that may have legal effects or which would significantly affect you. You also have the right not to be profiled, which is any form of automated processing of your Personal Information consisting of the use of Personal Information to evaluate certain personal aspects relating to you, in particular to analyze or predicts aspects concerning your performance at work, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements. At present, Klaay does not use any fully automated decision making or profiling systems, and, therefore, this right cannot be exercised. However, Klaay may use such automated decision-making in the following circumstances: where we have notified you of the decision and given you 21 days to request a reconsideration; or where it is necessary to perform the contract and appropriate measures are in place to safeguard your rights. Should Klaay adopt any automated decision-making technologies in the future, we will update this Privacy Policy in advance and ensure transparency, explainability, and human oversight.

8. Revoking Consent

Where we collect or process your Personal Information based upon consent, you may revoke consent. Please note, if you revoke your consent for the processing of Personal Information, we may no longer be able to provide Services.

9. Communications from Klaay

You may control the receipt of certain types of communications from Klaay. Klaay may contact you by phone or email about the Services. Some of these communications are required, such as transactional communications or legal notices. Other communications are not required, such as newsletters and direct marketing, as discussed below. We will never share your email with a third party for its own marketing purposes, unless you have given us your consent to do so.

10. Our Newsletter and How to Opt-Out

We operate an email newsletter program, used to inform subscribers about products and services supplied by us or our third-party affiliates, news that may affect our Customers and Users, and upcoming event announcements. Subscription to our newsletter is opt-in. Users can opt-out of receiving our newsletter at any time by following the unsubscribe link contained in the footer of any newsletter or by emailing us at privacy@klaay.com. Please note that for representatives of current Customers, your consent to receive direct marketing from Klaay is assumed; however, you may opt- out of receiving such direct marketing at any time, and such opt-out will be respected.

Email marketing campaigns published by us may contain tracking facilities within the actual email. Subscriber activity is tracked and stored in a database for future analysis and evaluation. Such tracked activity may include the opening of emails, forwarding of emails, the clicking of links within the email content, times, dates, and frequency of activity. This information is used for Klaay's and the User’s legitimate interest to refine future email campaigns and supply the User with more relevant content based around the User’s activity. If you do not agree with the use of such tracking, please unsubscribe from our newsletter or otherwise withdraw consent using one of the methods set out in this Privacy Policy.

11. Do Not Track (DNT) Disclosure

Please note that while you may have the opportunity to opt-out of our marketing email list as discussed in the “How to Opt-Out” section above, and you may be able to control the use of cookies through your Web browser as described in the “Use of Cookies” section below, some Web browsers may also give you the ability to enable a “do not track” setting. This setting sends a special signal to the websites you encounter while Web browsing. This “do not track” signal is different from disabling certain forms of tracking by declining cookies in your browser settings, as browsers with the “do not track” setting enabled still have the ability to accept cookies. We do not respond to Web browser “do not track” signals at this time. If we do so in the future, we will describe how we do so in this Privacy Policy. For more information about “do not track,” visit http://www.allaboutdnt.org/.

12. Other Web Sites

Our Website may contain links to other websites, including third parties with whom we have data sharing agreements, which are outside our control and are not covered by this Privacy Policy. If you access other websites using the links provided, the operators of these websites may collect Personal Information from you, which will be used by them in accordance with their privacy policies. These policies may differ from ours.

13. Cookies and Other Tracking Technologies

To enhance your online experience, we may use “cookies” or similar technologies. For more information, please see our Cookie Policy.

14. Privacy Protection for Children Using the Internet; Notice to Minors

Protecting children's privacy is important to us. For that reason, we do not collect or maintain Personal Information of those persons we actually know are under the age of thirteen (13) nor is any part of the Website, or our Services targeted to attract anyone under the age of thirteen (13). We request that all users of the Website and our Services who are under the age of thirteen (13) not disclose or provide any Personal Information. If we discover that a child under thirteen (13) has provided us with Personal Information, we will delete that child’s Personal Information from our records. You are responsible for any and all account activity conducted by a minor under your account.

In addition to protecting the privacy of children under the age of thirteen (13), we are committed to protecting the privacy of minors. Though our Website and Services are not targeted to minors, nor are they it intended to be used by minors, if for any reason a minor has shared Personal Information with us, said minor may request and obtain removal of such information by contacting us at privacy@klaay.com.

15. Retention

Klaay will retain your Personal Information only for as long as is necessary for the purposes set out in this Privacy Policy or to the extent allowed by law. This may include for the term of your use of our Services where you are a designated representative of a Customer, for those other purposes as described in this Privacy Policy, or in alignment with our regulatory obligations. If you no longer want Klaay to use your Personal Information, you may exercise your right of deletion; however, as provision of the Services are conducted in accordance with our contract with a Customer, Users who wish to be removed as Customer representatives should first speak with the relevant Customer regarding their desires to be removed as a Customer point of contact for the Services, marketing, legal, and/or compliance purposes. Klaay will retain and use your information to the extent necessary to comply with our legal obligations (for example, if we are required to retain your information to comply with applicable tax/revenue laws), resolve disputes, and enforce our agreements. The period for which are required to retain Personal Information for these purposes is set by law and is jurisdictionally dependent. We also retain log files for internal analysis purposes. These log files are generally retained for a brief period of time, except in cases where they are used for the safety and security of our Website, to improve the functionality of our Website or we are legally obligated to retain them for longer time periods.

16. Data Security

We take steps to maintain the security of the Personal Information that we collect in accordance with industry-standard practices. We also closely evaluate our third-party vendors and those companies with whom we share Personal Information to ensure compliance with relevant data processing laws.

Please note that no service is completely secure. While we strive to protect your Personal Information, we cannot guarantee that unauthorized access, hacking, data loss, or a data breach will never occur. In the event of a data breach affecting your Personal Information, Klaay will notify affected Customers and, where required, individuals within seventy-two (72) hours of becoming aware of the breach, in accordance with applicable law. If we are required by law to inform you of a breach to your information, we may notify you electronically, in writing, or by telephone. For Users who are Customer authorized contact points, such notification may come from the relevant Customer.

17. International Data Transfers

Data may be transferred internationally, relying on appropriate safeguards to ensure Personal Information remains protected and otherwise comply with relevant data transfer regulations. Where data is transferred outside your jurisdiction, we rely on recognized transfer mechanisms such as the EU Standard Contractual Clauses (SCCs), UK International Data Transfer Agreement (IDTA), or other legally approved instruments ensuring adequate protection.

19. Right to Non-Discrimination

We will not discriminate against individuals who exercise their privacy rights under applicable law. However, the exercise of some rights may result in our inability to provide a User with access to the or to otherwise continue rendering Services.

20. Accessibility.

This Privacy Policy can be accessed using your browser’s audio reader capabilities.

21. Testimonials, Feedback, Case Studies.

We may display personal testimonials from satisfied Customers who have given us their permission to do so and other endorsements on our Website. If you are the authorized representative of a Customer, where a Customer has given us permission, we may post a User’s photograph, name, and title together with a testimonial. Where we do so, we base our processing on the representation from our Customers that they have your consent to do so and have given us this consent. If you wish us to update or delete your testimonial, please contact us at privacy@klaay.com.

We consider answers to surveys, comments, ideas, and suggestions to be non-personal and do not classify them as Personal Information. Except as otherwise provided by applicable contracts with our Customers or a third party, we are free to disclose and use such data or information without any obligation.

22. How to Contact Us

If you have any questions or concerns about our Privacy Policy or its implementation you may contact Klaay’s Data Protection Officer (DPO) at privacy@klaay.com or by mail at Klaay, ApS, Attn: Data Protection Officer, Borupvang 3, 2750 Ballerup, Denmark. Residents of the United States may alternatively write to us by mail at Klaay, Inc., Attn: Data Protection Officer, 4275 Executive Square, Suite 200 #1092, San Diego, CA 92037.

23. Key Changes

Kay changes and updates to this Privacy Policy will be set out here.

24. U.S. CCPA & State Privacy Notice - Notice at Collection

We provide the following U.S. CCPA & State Privacy Notice – Notice at Collection for Users located in California and other states which may have privacy regulations. To the extent of a disagreement between the main terms of the forgoing Privacy Policy and this Notice at Collection, this Notice at Collection will control.

We adhere to the requirements of state privacy law, including the California Consumer Privacy Act of 2018 (“CCPA,”) which became effective on January 1, 2020, and its November 2020 amendment, effective January 1, 2023. In addition to the CCPA, we adhere to the requirements of other state privacy laws, including Virginia, Colorado, Connecticut, and Utah. We provide this U.S. CCPA & State Law Privacy Notice in compliance with those state laws. Please note that some states have not yet finalized their implementation rules; however, in an effort to be fully transparent and compliant, we make this privacy notice at this time and will update it as required when the rules are finalized.

Klaay's U.S. CCPA & State Privacy Notice is based on the principles of:

• Accountability so that you know Klaay holds itself accountable to its Customers and Users who entrust it with Personal Information
• Transparency so that you know what Personal Information we collect, use, disclose, share, and sell
• Control so that you can contract how your Personal Information is accessed, corrected, and deleted

Introduction

“Personal Information” is information that identifies, relates to, or could reasonably be linked directly or indirectly with a particular resident and includes certain categories of Personal Information set out in this Notice at Collection. Personal Information can also include “Sensitive Personal Information.”

Klaay takes data protection seriously and has implemented various physical, technical, electronic, procedural, and organizational safeguards and security measures to protect Personal Information against unlawful, accidental, and unauthorized destruction, loss, alteration, disclosure, or access.

The Personal Information We Collect; How We Collect Personal Information; Our Purpose of Collection; and With Whom We Share Personal Information

Individuals should know what Personal Information companies collect, use, process, and sell their Personal Information as well as the reason for such collection, use, and processing. We detail below the categories of Personal Information we collect, where we get that data, why we process it, and who we give the data to.

General Personal Information Collected, used, and Processed

Category of Personal Information	Sources of Personal Information	Purpose of Processing	Recipients
A. User Identifiers: Name, Title, Company Email, Company Address, Company Phone Number, Affiliated Customer Organization, IP address	Prospect leads; Customers; Interactions with affected Users	Marketing: Communicate with our Customers and Users regarding company, Services, and other marketing related news	Service providers
B. Customer Records: Name, Signature, Company Address, Company Phone Number	Prospect leads; Customers; Interactions with affected Users	Marketing: Communicate with our Customers and Users regarding company, Services, and other marketing related news;Legal and compliance: Administration of contracts and Klaay and Customers’ legal compliance	Service providers
C. Characteristics of Protected Classifications Under California or Federal Law: Gender identity if provided in a Users’ email signature	Interactions with affected Users	Klaay does not categorize or make use of this Personal Information.	Email provider
D. Commercial Information: Use of Services the services of our third party service providers	Customers and Users	Finance: Invoicing to the Customer contact, where applicable	Service providers
E. Biometric Data: Klaay does not collect biometric data for identity verification	N/A	N/A	N/A
F. Internet or other Electric Network Activity Information: Information regarding Users’ use of the Klaay Website and Services; Cookies and cookieless tracking technologies	Users’ interactions with the Website and within our Services	Personalization: Provision and personalization of use of the Website and the ServicesProduct improvement and development: Improvement of the Klaay Service offerings	Service providers
G. Geolocation Data: IP address	Users’ interactions with the Website	Personalization: Provision and personalization of use of the Website	Service providers
H. Audio, electronic, visual, thermal, olfactory, or similar information: Audio and video	Interactions with affected Users	Marketing: Recording of webinars for general marketing purposesCustomer Communications: Calls with Customers for information gathering and customer support purposes	Service providers
I. Professional or Employment-Related Information: Name, Title, Company Email, Company Address, Company Phone Number, Affiliated Customer Organization	Prospect leads; Customers; Interactions with affected Users	Marketing: Communicate with our Customers and Users regarding company, Services, and other marketing related news Finance: Invoicing to the Customer contact, where applicable Legal and compliance: Administration of contracts and Klaay and Customers’ legal compliance	Service providers
J. Education Information: Not collected	N/A	N/A	N/A
K. Inferences: Not collected	N/A	N/A	N/A
Sensitive Personal Information Collected, Used, and Processed

Category of Sensitive Personal Information	Sources of Sensitive Personal Information		Purpose of Processing	Recipients
Account Log-In, Financial Account, Debit or Credit Card Number, and the Means to Access the Account (Security or Access Code, Password, Credentials, etc.): Account log-in information; Credentials	Customers and Users		Services: Provision of Services	Service providers
Precise Geo-Location Information: IP Address	Users’ interactions with the Website		Services: Provision of Services Personalization: Provision and personalization of use of the Website	Service providers
Is any sensitive data processed?	No, unless it is provided by a Customer		No, unless it is provided by a Customer	No.
Racial or Ethnic Origin, Religious or Philosophical Beliefs, or Union Membership: Not collected	N/A		N/A	N/A
Medical or Mental Health, Sex Life, or Sexual Orientation: Not collected	N/A		N/A	N/A
Biometric Data: Klaay does not collect biometric data for identity verification	N/A		N/A	N/A
Contents of your Mail, Email, or Text Messages (where Klaay is not the intended recipient of the communication): Not collected	N/A		N/A	N/A
Personal Information Collected from a Known Child Under 13 Years of Age: Not collected	N/A		N/A	N/A

We may also use your Personal Information for the following purposes:

• As necessary or appropriate to protect the rights, property or safety of us, our Customers, Users, or others;
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations; or
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.

We will not collect additional categories of Personal Information or use the Personal Information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

Sharing of Personal Information

Users have the right to know if their Personal Information is shared with third parties. We may share with or otherwise disclose your Personal Information for the business purposes outlined in this notice. When we disclose Personal Information to third parties, we do so under a contract with the third party that describes the purposes of the sharing of the data and the requirements for keeping Personal Information confidential and limited.

In the preceding twelve (12) months, we have disclosed the following categories of data for a business purpose:

• Category A: User Identifiers
• Category B: Customer Records
• Category C: Characteristics of Protected Classifications Under California or Federal Law
• Category D: Commercial Information
• Category F: Internet or other Electric Network Activity Information
• Category G: Geolocation Data
• Category I: Professional or Employment-Related Information

Disclosures to our Service Providers. We may provide Personal Information to our vendors and data processors so that they can perform services for us as specified in our contracts with such third parties and for the purposes outlined above.

Disclosures to our Corporate Entities. We may share your Personal Information with our related corporate entities and corporate affiliates.

Disclosures for Other Purposes. In addition, we may disclose personal information to third parties for other notified purposes, as permitted by relevant data privacy laws.

"Sharing" and Personalized Advertising. We do not share Personal Information with third parties for personalized advertising purposes, as defined under applicable privacy laws.

We Do Not Sell Your Personal Information

Users have the right to know if their Personal Information is being sold. Personal Information is sold when it is provided to a third party for monetary or other valuable consideration for a purpose that is not considered a business purpose as defined by the relevant state law. This does not include where Klaay may share Personal Information where permitted by law or at a User’s or Customer’s direction. Klaay does not sell Personal Information.

In the preceding twelve (12) months, we have not sold any Personal Information.

Right to Opt-out of “Sale” or “Sharing"

Klaay does not sell or share your personal information as that is defined by relevant law. Therefore, we do not offer an opt out.

User Rights Under State Law

If you are a covered User under relevant state law, you have the following rights:

1. Receive this Notice at Collection at or before collection of Personal Information.

2. Request that we disclose to you the following information covering a twelve (12) – month period prior to your request. Such disclosure is free of charge to you:

• The categories of Personal Information we have collected about you;
• The categories of the sources from which the Personal Information was collected;
• The Categories of third parties to whom we disclosed your Personal Information; the categories of Personal Information that were disclosed; and the purpose for disclosing the Personal Information; and
• The Personal Information we collected about you.

3. Request that we correct any Personal Information that we hold that is inaccurate.

4. Request that we delete Personal Information unless a state law exception to deletion applies (e.g. for our own tax reporting obligations).

5. Be free from unlawful discrimination where you may exercise your rights.

How to Exercise Your Rights Under State Law

Users can exercise their rights under state law by submitting a request to us by emailing us at privacy@klaay.com.

We must be able to verify your identity. Please note that requests for specific pieces of Personal Information may require additional information for this verification. Individuals or Customers who submit a request on behalf of another person must provide us with proof of authorization and verification directly from the person to whom the request relates.

We may not be able to honor all requests, in some circumstances. For example, if we cannot verify a requestor’s identity or authorization. We also will not honor requests where an exception applies. Where we cannot honor a request, we will advise you.

We process all requests within forty-five (45) days for California residents. If we need additional time, up to forty-five (45) additional days, we will provide you with an explanation for the delay.

Questions or Concerns

You may contact us with questions or concerns about this Notice at Collection and our state law data collection practices by:

1. Writing us at: Klaay, Inc., 4275 Executive Square, Suite 200 #1092
   San Diego, CA 92037
2. Calling us at: +1 858-251-6858
3. Emailing us at privacy@klaay.com

Changes to this U.S. CCPA & State Privacy Notice - Notice at Collection

We may change or update this Notice at Collection from time to time by posting a notice to this page and by emailing registered Users at the email address we have on file.

Where to Find the Notice of Collection

You can find this Notice of Collection at www.klaay.com/privacy-policy.