Privacy Policy

Transparency, control, and accountability are the core principles that influence Magnet Forensics Inc.’s (“MFI”) and its affiliates’ (collectively, “Magnet Forensics”) approach to personal information. From time to time, the nature of our business dictates that we may collect personal information from our customers and partners. Because we are committed to protecting your privacy rights and the information you provide to us, we have developed this Privacy Policy (“Policy”). This Policy sets forth how Magnet Forensics collects, uses, and discloses personal information through our products and services, including our website (https://www.magnetforensics.com/), email, and any offerings where we may collect personal information, either online or offline (together, our “Services”).

Please read this Policy and our Terms and Conditions (“Terms”) carefully before using our Services. By using our Services or otherwise providing personal information to us, you acknowledge and agree to our Terms and consent to our collection, use, and disclosure practices as described in this Policy. If you do not agree, please discontinue use of our Services.

I. Personal Information We Collect
“Personal information” (or “personal data”) generally means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly with you or your household. Personal information does not include data that is publicly available, de-identified, or aggregated. We may combine your personal information with data we obtain from our Services, other users, or other parties. We reserve the right to convert, or permit others to convert, your personal information into
deidentified, anonymized, aggregated, or pseudonymized data, as permitted by law.

What personal information we collect may differ depending on how you interact with us and the functionalities you use, but our primary reason for collecting personal information is to provide Services to our customers.

We may collect the following categories of personal information:

CATEGORY OF PERSONAL INFORMATION EXAMPLES PURPOSE(S) FOR COLLECTION
Contact Information and Identifiers Real name, account name, username, unique personal identifier, online identifier,

IP address, email address, phone number, or other similar identifiers

To allow you to participate in the features we offer

To maintain your accounts with us

To communicate with you, including about our products, updates to our terms and policies, and to obtain your feedback

To send you marketing materials and advertisements

To recognize you when you use our Services

To show you relevant ads while you browse the internet or use social media

To send you relevant coupons, discounts, or promotions

Auditing, research and analysis, to maintain and improve our Services, and for any other internal business purposes

To detect and prevent fraud against you and/or us

For potential litigation and other legal or regulatory requirements

Commercial Information Records of products or services purchased, obtained, or considered, or other purchasing

or consuming histories or

tendencies

To allow you to participate in the features

we offerTo provide you with appropriate products and

recommendations

To help you find relevant products more quickly

To tailor our communications to you

To provide customer service and support

To send you relevant coupons, discounts, or
promotions

To improve our Services, and our products,
marketing and advertising

Auditing, research and analysis, to maintain and improve our Services, and for any other internal business purposes

To detect and prevent fraud against you and/or us

Demographic Information Age and birth date To allow you to participate in the features

we offerTo send you relevant marketing materials and

advertisements

To tailor our communications to you
To improve our Services, and our products,
marketing and advertising

Auditing, research and analysis, to maintain and improve our Services, and for any other internal business purposes

To detect and prevent fraud against you and/or us

For potential litigation and other legal and regulatory requirements

Internet or Other Electronic

Network Activity Information

Internet or other similar activity,

browsing history, search history,

information on a consumer’s

interaction with a website,

application logs, device data

and registration, social media

account information

To allow you to participate in the features

we offer

To provide you with appropriate products and recommendations

To help you find relevant products more quickly

To tailor our communications to you
To provide customer service and support

To send you relevant coupons, discounts, or
promotions

To improve our Services and our products,
marketing, and advertising

Auditing, research and analysis, to maintain and improve our Services, and for any other internal business purposes

To detect and prevent fraud against you and/or us

Geolocation Data Your physical location based on

information you provide directly

or inferred from your IP address

To allow you to participate in the features

we offer

To send you relevant coupons, discounts, or
promotions

Auditing, research and analysis, to maintain and improve the Service, and for any other internal business purposes

Audio Visual Information Audio recordings of customer

care calls, video, or similar

information

To provide you with customer service

To improve our products and Services

For litigation and other legal and regulatory
requirements

Communications with Us The contents of your

communications with us via

phone, email, text message,

chat, or other means (such as

survey responses, product

reviews, and comments on our

blog and social media pages

To communicate with you

about our products and

Services, your orders,

and to provide customer

service and support

To improve our websites,

apps, products, and

marketing

To allow you to

participate in our

promotions, sweepstakes,

contests, and loyalty

programs

To detect and prevent

fraud against you and/or

us

For litigation and other

legal and regulatory

requirements

Inferences About You from

Any Other Category of

Information We Collect

Information reflecting your

preferences, characteristics,

trends, or attitudes

To provide you with

appropriate products and

recommendations

To improve our Services,

and our products,

marketing and advertising

To provide you with a

better website or app

experience

Auditing, research and

analysis, to maintain and

improve our Services,

6

and for any other internal

business purposes

To detect and prevent

fraud against you and/or us

Biometric Information Fingerprints, facial recognition data,

voiceprints, or other biometric

identifiers

This information is limited

to certain products and

services for identity

verification purposes.

We may also obtain personal information about you from other sources, including our vendors, subsidiaries, and affiliates. In some circumstances, we may obtain personal information about you from other parties, including business partners, resellers, and data brokers, some of which may sell the information to us. To understand your rights and choices regarding personal information collected by other companies, please consult the privacy policies of the businesses that you interact with.

If you are a job applicant, employee, contractor, or otherwise affiliated with Magnet Forensics in a professional context, please see our Job Applicant and Employee Privacy Notice for information about how we process your personal information in that context.

II. Sources From Which We Collect Personal Information
Generally, we may collect the categories of personal information described above from the following categories of sources:
• directly from you, when you:
o visit our offices or contact us;
o request information about our Services;
o purchase and use our Services;
o respond to surveys, request whitepapers/newsletters/access to blogs; and
o attend Magnet Forensics’ events and/or Magnet Forensics’ booth at
tradeshows.
• through the use of tracking technologies on our online Services
• other companies we do business with, which may include your employer
• service providers that help us to run our business
• advertising networks
• social networks
• internet service providers
• data analytics providers
• third-party data suppliers
• other third parties, including your personal contacts or customers
• derived from other information we collect or otherwise created by us

III. Why We Disclose Personal Information

We may disclose your personal information for any purposes not inconsistent with this Policy, our written statements at the point of collection, or applicable law. In general, we may disclose personal information as follows:

• Within our group of companies including with our affiliates, subsidiaries, locations,

etc.

• With our agents, vendors, consultants, and other business providers for them to provide their services to us. For example, we may disclose your personal information to provide and improve customer service, operate and improve our business and our Services, help run our promotions, process payments, perform auditing and quality control, communicate with you, and otherwise operate our business.

• With our advertising partners for the purposes of ad targeting, remarketing, and customized advertising content.

• As necessary, for the following purposes: (a) to comply with any legal process; (b)

to respond to requests from public and government authorities; (c) to enforce our

Terms; (d) to protect our operations and our rights, privacy, safety, or property,

and/or that of you or others; and (e) to allow us to pursue available remedies or limit

the damages that we may sustain.

• With our insurers and professional advisers for the purposes of managing risks,

obtaining professional advice, exercising or defending against legal claims, etc.

• With other businesses in connection with or during negotiations of any

reorganization, acquisition, merger, sale, joint venture, assignment, transfer or

other disposition of all or any portion of our business, assets, or stock (including in

connection with any bankruptcy or similar proceeding).

IV. Cookies and Tracking Technologies

We may use cookies and other tracking technologies (such as web beacons and pixels) to collect and store information about your interactions with our website, including information about your browsing behavior. Our website also supports third-party tracking technologies through which our service providers and third parties, such as advertising partners, can collect and use information regarding your interactions with our websites as further detailed below. Information collected through cookies is processed in accordance with this Policy. Please see Cookie Policy for more information about the cookies we may use.

V. Opt-Out Preference Signals
Our website recognizes the Global Privacy Control (“GPC”) signal. If you are using a browser setting or a plug-in that sends an opt-out preference signal to each website you visit, we will treat that as a valid request to opt out. To download and use a browser supporting the GPC browser signal, click here: https://globalprivacycontrol.org. If you choose to use the GPC signal, you will need to turn it on for each supported browser or browser extension you use.

Some internet browsers incorporate a “Do Not Track” feature that signals to websites you visit that you do not want to have your online activity tracked. Given that there is not a uniform way that browsers communicate the “Do Not Track” signal, our website does not currently interpret, respond to or alter its practices when it receives “Do Not Track” signals sent by browsers, mobile devices, or other mechanisms.

VI. Storage Location of the Personal Information We Collect
Your personal data is processed, hosted, and/or stored by us in Ontario, Canada. For certain business practices, third‐party providers may have access to your data. These third-party providers are typically vendors of cloud services or other IT hosting services located in Canada or USA. We also may provide your personal data to such third-party providers or our partners as part of the sales cycle. This can include both pre‐sales
activities such as lead generation and activities related to processing orders. When using third‐party providers and partners, as required by applicable law, Magnet Forensics will enter into a data processing agreement to safeguard your privacy rights. When third‐party providers and partners are located outside the EU, Magnet Forensics ensures legal grounds for such international transfers by relying on cross-border transfer agreements or using the EU Model Clauses.

VII. How Long We Store the Data We Collect
Depending on the purposes for collection, your personal information may be retained for as long as one of the following apply:
• Retention is reasonably necessary to manage our operations, to manage your
relationship with us, or to satisfy another purpose for which we collected the
personal information;
• Retention is reasonably necessary to carry out a disclosed purpose that is
reasonably compatible with the context in which the personal information was
collected;
• Retention is reasonably required to protect or defend our rights or property (which
will generally relate to applicable laws that limit actions in a particular case); or
• We are otherwise required or permitted to keep your personal information by
applicable laws or regulations.

Where personal information is used for more than one purpose, it will be retained at least as long as the latest period provides. Under some circumstances, we may maintain personal information indefinitely according to legal or regulatory requirements, including applicable legal holds, or for data backup or recovery purposes.

VIII. California Privacy Rights
The California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 (“CCPA”) defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly , with a particular California resident. This section of the Privacy Policy is intended solely for California residents. Targeted Advertising, Sales, and Sharing of Personal Information Although we do not sell personal information in exchange for money, some of the ways in which we share personal information for targeted advertising may be considered “sales” or
“sharing” under US state privacy laws. The following is a list of categories of personal information that we sold or shared to third parties in the 12 months preceding the effective date of this Privacy Policy and the
categories of third parties to whom we sold or shared such personal information:

Personal Information Categories of Third Parties
Identifiers Service Providers, Business Partners, Affiliates and
Subsidiaries, Advertising and Marketing Partners,
Professional Advisors, Data Analytics Providers,
Event Partners, Third-party Integrations
Unique Identifiers Service Providers, Affiliates and Subsidiaries,
Advertising and Marketing Partners, Professional
Advisors, Data Analytics Providers, Third-Party
Integrations, Event Partners
Internet Activity Service Providers, Business Partners, Affiliates and
Subsidiaries, Advertising and Marketing Partners,
Professional Advisors, Data Analytics Providers,
Event Partners, Third-party Integrations
Geolocation Data Service Providers, Business Partners, Affiliates and
Subsidiaries, Advertising and Marketing Partners,
Professional Advisors, Data Analytics Providers,
Event Partners, Third-party Integrations
Commercial Information Service Providers, Business Partners, Affiliates and
Subsidiaries, Advertising and Marketing Partners,
Professional Advisors, Data Analytics Providers,
Event Partners, Third-party Integrations

The purposes for which we sell/share this information include showing you relevant ads while you browse the internet or use social media, certain types of analytics, and similar purposes. We do not have actual knowledge that we sell or share the personal information of consumers under sixteen (16) years of age. If you would like to opt out, please see the information below for your state of residence.

The following is a list of categories of personal information that we disclosed for a business purpose in the 12 months preceding the effective date of this Privacy Policy and the categories of recipients to whom we disclosed such personal information.

Personal Information Categories of Recipients
Identifiers Service Providers, Business Partners, Affiliates
and Subsidiaries, Advertising and Marketing
Partners, Professional Advisors, Data Analytics
Providers, Event Partners, Third-party Integrations
Unique Identifiers Service Providers, Affiliates and Subsidiaries,
Advertising and Marketing Partners, Professional
Advisors, Data Analytics Providers, Third-Party
Integrations, Event Partners
Internet Activity Service Providers, Business Partners, Affiliates
and Subsidiaries, Advertising and Marketing
Partners, Professional Advisors, Data Analytics
Providers, Event Partners, Third-party Integrations
Geolocation Data Service Providers, Business Partners, Affiliates
and Subsidiaries, Advertising and Marketing
Partners, Professional Advisors, Data Analytics
Providers, Event Partners, Third-party Integrations
Commercial Information Service Providers, Business Partners, Affiliates
and Subsidiaries, Advertising and Marketing
Partners, Professional Advisors, Data Analytics
Providers, Event Partners, Third-party Integrations

The purposes for which we disclose this information include: providing the services and/or
products to you, for protection and security, and to advertise or market to you.
Your Rights
Under the California Consumer Privacy Act (“CCPA”) and its regulations, California
residents have the following rights. Please note that the disclosures within this Privacy
Policy are not intended to apply to employees or job applicants. If you are a California
employee, please see our employee privacy notice for more information. If you are a
California job applicant, please see our Employee and Job Applicant Privacy Notice.
Right to Know. You have the right to know what personal information we have collected
about you, which includes:

• The categories of personal information we have collected about you, including:
o The categories of sources from which we collected your personal information
o The business or commercial purposes for our collecting, selling, or sharing
personal information
o The categories of recipients to which we disclose personal information
o The categories of personal information that we sold, and for each category
identified, the categories of third parties to which we sold that particular
category of personal information
o The categories of personal information that we disclosed for a business
purpose, and for each category identified, the categories of recipients to
which we disclosed that particular category of personal information
• The specific pieces of personal information we have collected about you.
Right to Correct. If you believe personal information we maintain about you is inaccurate,
you have the right to request we correct that personal information.
Right to Delete. You have the right to request that we delete personal information we
collected from you, subject to certain exceptions. Where we use deidentification to satisfy
a deletion request, we commit to maintaining and using the information in deidentified form
and will not attempt to reidentify the information.
Right to Opt-Out of Sales and Sharing of Personal Information. We do not sell your
data, but you may request that we do not share your personal information for crosscontext behavioral advertising. To opt-out, please email dpo@magnetforensics.com.
Right to Non-Discrimination for the Exercise of Your Privacy Rights. If you choose to
exercise any of your privacy rights under the CCPA, you also have the right not to receive
discriminatory treatment by us.
Submitting CCPA Rights Requests. The rights described above are subject to certain
exemptions and exceptions as well as certain steps that must be taken to verify your
identity. To submit a privacy rights request, please call us toll-free at 1-844-638-7884 or
email us at dpo@magnetforensics.com. Please note that if you submit a request to know,
request to delete, or request to correct, you will be asked to provide two-to-three (2-3)
pieces of personal information that we will match against our records to verify your identity.
You may designate an authorized agent to make a request on your behalf; however, you
will still need to verify your identity directly with us before your request can be processed.
An authorized agent may submit a request on your behalf using the webform or toll-free
number listed above.
12
California Shine the Light
We do not share personal information with third parties or affiliates for those parties own
direct marketing. If you have questions about how we comply with California’s Shine the
Light law, please contact us at dpo@magnetforensics.com.
II. International Data Transfers
If you are using our Services from outside the United States, please be aware that
information we obtain about you will be processed in the United States or in other
jurisdictions and may be accessed by the courts, law enforcement, and national security
authorities in those jurisdictions. By using our Service, you acknowledge and consent to
the international transfer and processing of your personal information as described in
thisPrivacy Policy. Please be aware that the data protection laws and regulations that
apply to your personal information transferred to the United States or other countries may
be different from the laws in your country of residence.
III. Privacy Rights for Residents of Canada
If you would like to submit a request to access, correct, erase, or obtain a copy of personal
information we maintain about you, or if you would like to receive written information about
our policies and practices regarding service providers outside of Canada, please email us
at dpo@magnetforensics.com We may require specific information from you to help us
verify your identity prior to processing your request. Applicable law may require or permit
us to decline your request. If we decline your request, we will tell you why, subject to any
legal restrictions on disclosing this information.
IV. Supplemental Disclosures for Persons in the EU, EEA, and UK
As a supplement to the information provided throughout this Policy, we provide the
following information for persons in the European Union (“EU”), the European Economic
Area (“EEA”), and the United Kingdom (“UK”).
Magnet Forensics, Inc. is the data controller for personal information collected through our
Services.
Personal data of German data subjects collected for purposes of: (i) administering an
employment relationship; (ii) facilitating the sale, license, and/or support of our products;
or (iii) marketing and/or demand generation of our products and services, is subject to the
joint controllership of Magnet Forensics Inc. and Magnet Forensics GmbH, as set out in
an Agreement pursuant to Article 26(1) of the GDPR.
Our Legal Bases for Personal Information. Your personal information is processed
under the following legal bases:
• The processing is necessary for us to provide you with our Services. When you
13
make a purchase, transact business with us, or contact us with an inquiry, we
require certain pieces of personal information to be able to provide our Services to
you or perform our contractual obligations to you.
• We have a legal obligation to process your personal information, such as
compliance with applicable laws, regulations, or court orders.
• We process personal information to achieve our legitimate interests of providing,
improving and personalizing the experiences of users of our Services. We also
process personal information to help ensure the security and integrity of our
Services. When we rely on our legitimate interests, we take into account the effects
14
that these actions might have on you. If you have questions about our decisions
regarding our legitimate interests, you may contact us.
• You have consented to our processing of your personal information. For example,
we may rely on consent to use non-essential cookies to provide you with marketing
communications or if we need to collect sensitive personal information from you.
When you consent, you may change your mind and withdraw your consent at any
time by emailing us at dpo@magnetforensics.com.
Your Privacy Rights. You have the right to access, correct, erase, and obtain a copy of
personal information we maintain about you. You also have the right to object to or restrict
our processing of your personal information. You may submit these requests by emailing
us at dpo@magnetforensics.com. We may require specific information from you to help
us verify your identity prior to processing your request. Applicable law may require or
permit us to decline your request. If we decline your request, we will tell you why, subject
to any legal restrictions on disclosing this information.
Submitting a Complaint. If you are not satisfied with how we manage your personal
information, you may contact us or submit a complaint to your local data protection
authority. If you reside in the EU or EEA, you can find information about your data
protection authority here. If you reside in the UK, you may file complaints with the
Information Commissioner’s Office here.
V. Links to Other Sites
The Services may include links to websites that are not owned or controlled by us. Please
be aware that we are not responsible for the privacy practices of such other websites. We
encourage you to be aware when you leave our Service and to read the privacy statements
of each and every website you visit. This Policy applies only to information collected by
our Services.
VI. Security
The security of your personal information is important to us. We follow generally accepted
industry standards to protect the personal information submitted to us, both during
transmission and once we receive it. While we attempt to protect the information in our
possession, no security system is perfect, and we cannot promise that information about
you will remain secure in all circumstances.
VII. Services Not for Children
Our Services are not intended for children, and we do not knowingly collect personal
information from anyone under the age of majority in their jurisdiction. If we become aware
that we have collected personal information from a child, we will delete it in accordance
with applicable law.
VIII. Changes to this Privacy Policy
15
We may update this Privacy Policy to reflect changes to our information practices. If we
make any changes, we will update the effective date. Changes are effective when they are
posted. We encourage you to periodically review this page for the latest information on our
privacy practices.
IX. Contact Information
If you have any questions, you may contact us by email at dpo@magnetforensics.com.