If you are a California resident and the processing of personal information about you is subject to the California Consumer Privacy Act (“CCPA”), the following information also applies to you and supplements the information contained in this Privacy Statement.

Our Privacy Statement already describes the information we collect and the sources of information – see the above sections "The Information We Collect” and “How We Use Personal Information". This section organizes that information around the personal information categories set out in the CCPA.

In the past 12 months, we have collected the following information for the following purposes:

• Identifiers (such as your name, username, email address, and cookies). We obtain this information when you provide it to us or otherwise automatically in the course of your interactions with our Services.
• Business records (such as payment information). We obtain this information directly from you or otherwise automatically in the course of your interactions with our Services.
• Demographic information / Classification characteristics under California or federal law (such as age or date of birth). We obtain this information if you provide it to us.
• Commercial information (such as services purchased). We obtain this information directly from you or otherwise automatically in the course of your interactions with our Services.
• Internet or other electronic network activity information (such as search history and browser information). We obtain this information automatically in the course of your interactions with our Services.
• Geolocation data (such as your country location based on your IP address). We obtain this information when you provide it to us or otherwise automatically in the course of your interactions with our Services.
• Audio, video, and other electronic data (such as chat and any interaction that you may have with us, for example for customer service purposes). We obtain this information when you provide it to us or otherwise automatically in the course of your interactions with our Services.
• Professional or employment-related information (such as your job title). We obtain this information when you provide it to us.
• Profiles and inferences (such as inferences drawn from any of the information identified above to create a profile). We obtain this information automatically in the course of your interactions with our Website.

We do not share your personal information except as approved by you or as otherwise described in this Privacy Statement. In the preceding 12 months, we have disclosed the following categories of personal information described above for the business purposes described in this Privacy Statement:

• Identifiers such as those set forth above;
• Internet or other electronic network activity information;
• Demographic information / Classification characteristics;
• Commercial information;
• Geo-location data;
• Audio, video, and other electronic data;
• Professional or employment-related information; and
• Profiles and inferences.

Under the CCPA, a "sale" is defined very broadly and includes a wide array of data sharing. As the term is defined by the CCPA, we “sold” the following categories of personal information in the last 12 months: identifiers/contact information, Internet or other electronic network activity information, and inferences drawn from the above. We “sold” such information to advertising networks and data analytics providers. The business purposes of “selling” personal information is for third-party companies to perform services on our behalf, such as marketing, advertising, and audience measurement. We do not have any actual knowledge that we "sell" personal information of consumers under 16 years of age.

Most modern web browsers give you the option to send a Do Not Track signal to the sites you visit, indicating that you do not wish to be tracked. However, there is no accepted standard for how a site should respond to this signal, and we do not take any action in response to this signal.

If you are a California resident, our default cookie settings may constitute a sale of personal information. You can change your cookie settings using our cookie consent management tool.

If you are a California resident, you may have the following consumer privacy rights:

• Right to Know: You have a right to request that we disclose to you the personal information we have collected about you. You also have a right to request additional information about our collection, use, disclosure, or sale of such personal information in the past 12 months. Note that we have provided much of this information in this privacy statement. You may make such a “request to know” by contacting us through the MidFunnel Data Subject Rights Request Portal.
• Right to Request Deletion: You also have a right to request that we delete personal information under certain circumstances, subject to a number of exceptions. To make a request, please complete the form in the MidFunnel Data Subject Rights Request Portal.
• Right to Opt-Out: You have a right to opt-out from future “sales” of personal information. Note that the CCPA defines “sell” and “personal information” very broadly, and some of our data sharing described in this privacy statement may be considered a “sale” under those definitions as explained above. For more information, including how to opt-out, please see the “Cookies and Other Tracking Technologies” section of this statement. If you would like to request Do Not Sell/Share of your information, please inform us at hello@MidFunnel.com.
• Right to be Notified of Financial Incentives: You have the right to be notified of any financial incentive offers and their material terms, the right to opt-out of such incentives at any time, and may not be included in such incentives without your prior informed opt-in consent. We do not offer any such incentives at this time.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of these rights.

You may designate, in writing or through a power of attorney, an authorized agent to make requests on your behalf to exercise your rights under the CCPA. Before accepting such a request from an agent, we will require the agent to provide proof you have authorized it to act on your behalf, and we may need you to verify your identity directly with us.

Further, to provide or delete specific pieces of personal information we will need to verify your identity to the degree of certainty required by law.

For more information regarding data rights requests, refer to the Contacting Us section below.

MidFunnel will retain personal data we process about MidFunnel Users for as long as we have a legitimate business purpose to do so. If you wish to cancel your account or request that we no longer use your information to provide you Services, you may delete your account. Please note that MidFunnel may retain your personal data for longer where there is a legal, tax or accounting obligation, contractual, or legitimate interest, including resolving disputes and enforcing our agreements and rights. When we no longer have an ongoing legitimate business need to process your personal information, we will either delete or anonymize it or, if this is not possible (for example, because your information has been stored in backup archives), then we will securely store your information and isolate it from any further processing until deletion is possible.

Please note that MidFunnel will retain Client Data that we process on behalf of our Clients for as long as needed to provide services to our Clients and in accordance with our agreements with our Clients.

MidFunnel stresses its privacy and security standards. Although no one can guarantee absolute security, we regularly re-evaluate our privacy and security policies in order to adapt to new challenges. We follow generally accepted standards to protect the information submitted to us, both during transmission and once we receive it.

We may update this Privacy Statement from time to time. If we make a material change to this Privacy Statement, we will provide you with notice (for example, by email, a sign-in notification, or some other means) and obtain your consent if and where this is required by applicable data protection law prior to the change becoming effective. You can see when this Privacy Statement was last updated by checking the "last updated" date at the top of this Privacy Statement.

If you have any questions about our use of personal data, please contact us at hello@MidFunnel.com.

Although the EU-U.S. and Swiss-U.S. Privacy Shield Frameworks have been ruled invalid for the transfer of data from the EU and Switzerland to the U.S., while government discussions regarding possible replacement mechanisms proceed, we will continue to protect European data according to the standards of the Privacy Shield and applicable European law and will implement other methods for transferring data to the extent those are available (as explained under the “International Data Transfers” above). To learn more about the Privacy Shield Frameworks, visit the U.S. Department of Commerce’s Privacy Shield program site.

MidFunnel is responsible for the processing of personal data it receives, under the Privacy Shield Frameworks, and subsequently transfers to a third party acting as an agent on its behalf. MidFunnel complies with the Privacy Shield Principles for all onward transfers of personal data from the EEA, UK, or Switzerland, including the onward transfer liability provisions.

With respect to personal data received or transferred pursuant to the Privacy Shield Framework, MidFunnel is subject to the regulatory enforcement powers of the U.S. Federal Trade Commission. In certain situations, MidFunnel may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact our U.S.-based third-party dispute resolution provider (free of charge) at https://feedback-form.truste.com/watchdog/request.

Under certain conditions, more fully described on the Privacy Shield website, you may be entitled to invoke binding arbitration when other dispute resolution procedures have been exhausted.