Gravy Pass Privacy Policy

This Privacy Policy and Notice at Collection ("Privacy Policy") explains how Gravy Pass, Inc ("Gravy Pass", "us", "our", and "we"), collects and uses Personal Information (as defined below) and outlines the basis on which we process the Personal Information we collect from or about you. This document aims to provide concise, transparent, intelligible, and easily accessible information about our data processing practices—please take the time to read it thoroughly.

This Privacy Policy applies to all users of Gravy Pass services accessed through gravypass.com and other associated Gravy Pass websites ("Gravy Pass Owned Sites"), as well as Gravy Pass technology integrated on third-party partner websites, apps, or mobile-device applications ("Partner Sites") (collectively, "Gravy Pass Sites"). This Privacy Policy also applies to individuals who interact with Gravy Pass in a professional capacity on behalf of their company or employer in transactions with Gravy Pass. However, this Privacy Policy does not apply in situations where Gravy Pass processes your Personal Information solely on behalf of our Partners to enable them to offer their services directly and not on behalf of other Advertisers. For information on how these Partners use your Personal Information, please consult their respective privacy policies or notices. Additionally, if you are an Gravy Pass employee or contractor, or if you apply for a job with Gravy Pass, the Personal Information collected in these contexts will be covered under separate privacy policies provided to you as appropriate.

Gravy Pass Services

Gravy Pass provides services to companies ("Partners") that allow you to receive offers, promotions, coupons, discounts, app download invitations, and calendar subscription invitations, and to interact with other marketing services (including during or after a transaction) (collectively, "Offers") from third-party advertisers ("Advertisers"), displayed on Gravy Pass Sites. Additionally, Gravy Pass provides a service called "Gravy Pass" that allows users to earn real cash through engaging with qualifying Offers.

Your Choices and Their Implications

There is no obligation for you to sign up to Offers. If you choose to engage with any Offers, we may share your Personal Information, where applicable, with the party identified in the Offer, enabling them to fulfill the Offers and provide you with further information related to such Offers, as elaborated below under 'Collection and Use of Personal Information'. Importantly, there are no negative consequences if you choose not to sign up to an Offer, nor will it prevent you from accessing future services from that company—no further action will be taken regarding that Offer.

SMS Messaging and Consent

Gravy Pass may offer the ability to receive SMS messages from us at the phone number (866) 377-1970. If you choose to opt in to SMS communications:

• You provide your express written consent to receive promotional, transactional, and informational text messages from Gravy Pass.
• Message frequency may vary depending on your activity and engagement with our services.
• Standard message and data rates may apply.
• You acknowledge that consent is not a condition of purchasing any goods or services.
• You can opt out at any time by texting STOP to (866) 377-1970 or by contacting privacy@gravypass.com.
• For help, text HELP to (866) 377-1970 or contact support@gravypass.com.

Your consent to receive SMS messages is separate from any other consents you may have provided. We will never automatically opt you into SMS messaging - this requires your explicit action and consent through our opt-in process. You will have the opportunity to confirm your phone number and consent before receiving marketing messages.

Phone numbers provided when opting-in to SMS alerts via the website form are used solely by Gravy Pass to send you information about your account and mission opportunities, and are not shared with third parties for their marketing purposes.

Commitment to Your Privacy

Your privacy is a top priority at Gravy Pass. We are committed to safeguarding your personal data and ensuring its confidentiality and security. We take comprehensive steps to protect the data entrusted to us by our partners and users. For more information on how we safeguard your data, see "Security Measures" below.

Definition of Personal Information

"Personal Information" or "Personal Data" is information about you which can: - Be used to identify, contact, or locate you; - Be combined with other information that is linked to you; - Is defined as "Personal Data" or "Personal Information" by applicable laws or regulations relating to the collection, use, storage, or disclosure of information about you.

Personal Information includes: - Contact information (e.g., email address, telephone number) - Online information (e.g., IP addresses, device identifiers) - Other data which can be used individually or in combination with other data to identify an individual (such as gender, marital status, age, or postcode).

Types of Personal Information We Collect

We collect and process various categories of Personal Information based on the legitimate interests of Gravy Pass and its Partners and Advertisers:

Our Basis for Processing

We process your Personal Information to provide a tailored experience and to manage our business needs effectively. Here are the legitimate business interests for processing:

Note: Depending on local data protection laws where you are located, you may have a right to object to processing on the above basis.

Information from one Gravy Passservice may be combined with information from other Gravy Passservices to offer a consistent and personalized experience across all interactions. We may also supplement the information we collect with data from third parties to enhance our services and improve the relevance of Offers.

Collection and Use of Personal Information

Gravy Pass's technology enables us to display Offers from Partners and Advertisers on Gravy Pass Sites, and allows you to opt in to receive communications regarding such Offers. Below, we detail how your Personal Information is utilized by Gravy Pass and the principles guiding our disclosure of information to Partners, Advertisers, and other third-party processors.

(i) Use of Personal Information by Gravy Pass

We use your Personal Information for the following purposes:

• Providing, maintaining, protecting, and improving our technology, products, and services: We aim to enhance the quality and functionality of our services, ensuring they meet your needs and expectations.
• Monitoring the effectiveness of our services: By analyzing how you use our services, we can improve and adapt them to better serve you.
• Targeted and personalized offers: We select, display, and provide Offers that are customized to your interests, attributes, preferences, and past experiences.
• Predictive targeting: We predict which Offers might be relevant and engaging to you based on your known characteristics.
• Information disclosure to Partners and Advertisers: As described in the subsequent section (ii), we share necessary information with our Partners and, where applicable, Advertisers to facilitate the provision of targeted Offers.
• Ease of use: Our technology is designed to minimize the need for you to repeatedly enter the same information, simplifying your interactions.
• Offer targeting and suppression: We use your information to target Offers effectively and suppress irrelevant ones, including through retargeting mechanisms.
• Communications related to Offers: We send confirmation messages, further details, and follow-up reminders for Offers you have signed up for, using the most appropriate communication methods including email, SMS, or phone calls (potentially using automatic dialing systems or pre-recorded messages).
• Marketing communications: If you have opted into receiving marketing materials via gravypass.com or verbally with our staff, we will send you promotional content that you have shown interest in.
• Record-keeping and compliance: We maintain legal and business records, comply with applicable laws and regulations, and conduct customer research to develop new services.
• Information validation and identity verification: We validate the information you provide and verify identities, particularly in relation to privacy requests.
• Protection of rights and safety: We use your information to protect the rights, property, or safety of our users, employees, or third parties, including Partners and Advertisers.
• Business-to-business interactions: When you engage with us on behalf of your business or employer, we use your Personal Information to manage and administer our relationship, including record-keeping, payments, communication, tracking outcomes, and verifying your eligibility and suitability.
• Gravy Pass administration: For users of our Gravy Pass service, we use your information to track offer engagement, calculate earnings, process payments, and manage your account.
• SMS communications: If you have expressly opted in to receive SMS communications, we use your phone number to send you messages as described in the SMS Messaging and Consent section.

We may specify additional purposes for collecting your Personal Information at the time of collection.

(ii) Sharing Personal Information with Partners and Advertisers

• Engaging with Offers: When you interact with Offers on a Partner's site, by actions such as swiping or clicking, we share the Personal Information you provide and information related to the Offer with the Partner.
• Accepting Advertiser Offers: If you accept Offers from Advertisers, we share your Personal Information, including details like your email address, segmentation data (e.g., gender, age/DOB, postcode, title), and other third-party provided data, with the Advertisers, even if such information is not directly displayed.

• Electronic Communications: When you opt to accept an Offer, including through electronic interaction, we disclose your Personal Information to the relevant Partner or Advertiser so they can fulfill the Offer and provide additional information via appropriate communication methods (email, SMS, phone calls), potentially using automatic dialing systems or pre-recorded messages. This data is managed by the recipient according to their privacy policy.

Further Disclosure of Personal Information

• To Third-Party Agents and Processors: We may disclose your Personal Information to third-party agents and processors, such as technology vendors, CRM platforms, data transmission companies, email service providers, data validation services, authentication services, data enrichment providers, online marketing, and segmentation providers, and ad-targeting companies, primarily based in the USA.
• During Promotions and Contests: Personal Information may be shared with Advertisers or Partners if you participate in a contest or promotion through their platforms.
• Within Gravy Pass: Your information may be shared within the Gravy Pass corporate family, including subsidiaries, their advisors, and other personnel.
• Legal Requirements: We disclose Personal Information as required by law, such as to comply with subpoenas or legal processes.
• Security and Legal Rights: To address fraud, security issues, or to protect our legal rights, including defending against legal claims.
• Business Transitions: In the case of a merger, acquisition, reorganization, asset sale, or similar corporate event, Personal Information may be part of the transferred assets.

We ensure that the use of your Personal Information aligns with the disclosures provided in this Privacy Policy and is subject to appropriate confidentiality and security measures.

International Transfers of Personal Information

Gravy Pass processes Personal Information on high-security servers that may be located outside the country where you reside. Our primary data centers are located in the USA. Before we transfer your Personal Information to an overseas recipient, we take necessary and reasonable steps to ensure that the recipient complies with privacy laws applicable to your Personal Information.

Locations of Data Processing

When disclosing your Personal Information to Advertisers and third-party processors, it is likely, though not guaranteed, that these entities will be located in one of the markets where we operate or maintain a presence. This includes the United States, Canada, Australia, Singapore, Japan, the European Union, the United Kingdom, New Zealand, and other countries as detailed on our website.

Data Transfer Mechanisms

For individuals in the European Economic Area (EEA), Gravy Pass takes additional measures when transferring Personal Information outside the EEA: - To Suppliers and Group Members: We may transfer data to suppliers or other entities within the Gravy Pass Group. - To Advertisers and Partners: When transferring data to Advertisers and Partners outside the EEA.

These transfers are conducted under conditions that are deemed to provide an adequate level of data protection according to the European Commission or involve appropriate safeguards such as: - Transfer to countries recognized by the European Commission as providing adequate protection. - Use of standard contractual clauses approved by the European Commission or binding corporate rules approved by a competent supervisory authority. - Occasional transfers necessary for the performance of a contract, to protect your vital interests, or for the establishment, exercise, or defense of legal claims.

In order to protect the data rights of EU residents when transferring data outside the EU, Gravy Pass relies on EU-approved standard contractual clauses as a basis for such transfers, in compliance with Article 47 of the GDPR.

Security Measures

The security of your Personal Information is a top priority at Gravy Pass, especially when it is transferred overseas.

Implementing Robust Security Measures

We implement rigorous technical and organizational measures to protect your Personal Information against loss, misuse, unauthorized access, modification, or disclosure. These measures are designed to provide a security level commensurate with the risk associated with processing your Personal Information. However, it's important to acknowledge that no method of transmitting or storing information online is completely secure. While we strive to protect your Personal Information, we cannot guarantee its absolute security.

Specific Security Practices

Our security practices include:

• Restricting Access: We limit access to Personal Information wherever practical, ensuring only authorized personnel can view such data.
• Encryption: We use industry-standard encryption to protect data both in transit and at rest, safeguarding against unauthorized access.
• Secure Network: We maintain a secure network with no direct access between the internet and the systems that process your data, enhancing overall security.
• Pseudonymization Techniques: Techniques such as hashing email addresses or device IDs are employed to minimize risks associated with data processing.
• Regular Security Assessments: We regularly perform scans and penetration tests on our applications and networks to identify and address potential vulnerabilities.
• Third-Party Security Requirements: We demand that any third parties with whom we conduct business uphold equivalent security and confidentiality measures to protect data integrity.

These precautions are part of our commitment to ensuring the security of your Personal Information and maintaining your trust in our practices.

Retention of Personal Information

Gravy Pass determines the retention periods for Personal Information in consultation with our Partners and Advertisers, considering several factors including legal requirements and business needs. Our retention policies ensure that Personal Information is kept only as long as necessary for the purposes for which it was collected, subject to your rights as a data subject and our requirements to defend legal claims or maintain legitimate business operations.

We determine that Personal Information should be retained in the following ways:

• Consultation with Partners: We set data retention periods in consultation with our Partners and Advertisers, based on the need to retain the data to fulfill contractual obligations, provide services, and support marketing efforts.
• Legal and Business Requirements: Retention periods may vary depending on local laws and market practices. These periods are also influenced by the necessity to hold data for periods required to establish, exercise, or defend legal rights or for ongoing legitimate business interests, such as proving that you consented to a particular Offer or communication.

We rely on the following criteria to determine appropriate retention periods:

• Necessity for Service Provision: The need for the Personal Information to fulfill our services to Partners and Advertisers.
• Sensitivity of the Information: The types and sensitivity of the Personal Information being processed.
• Regulatory Requirements: Compliance with relevant laws and regulations affecting data retention, including those related to tax, employment, accounting, and securities.
• Legal Claims: Consideration of whether the Personal Information might be relevant to potential legal claims.

Responsibility of Partners and Advertisers

Gravy Pass is not responsible for the retention practices of our Partners and Advertisers. You should consult the privacy policies of the Partners and Advertisers with whom you interact to understand how they manage the Personal Information they collect and retain.

For more details on how you can exercise your rights concerning your Personal Information, please refer to the 'Your Rights in Relation to Your Personal Information' section.

Use of Tracking Technologies

Like many companies, Gravy Pass employs various Tracking Technologies when displaying online Offers. These technologies include cookies, entity tags (eTags), pixels, web beacons/GIFs, local storage, and other identifiers that may be used on your device and browser settings.

Their purpose is to recognize you and your device each time we display Offers, enhancing your user experience in the following ways:

• Recognition and Personalization: We apply statistical probabilities to data sets, which help us recognize or make assumptions about users and devices, such as identifying a user across multiple devices.
• Configuration Changes: Tracking Technologies may alter settings or configurations on your device. We use both session and persistent Tracking Technologies to maintain and enhance user interaction with our services.
• Enhanced Online Experience: These technologies are used for various purposes, including setting preferences, selecting tailored Offers, performing analytics, attributing conversions, and reducing fraud.

Rejecting the use of Tracking Technologies does not mean that you will no longer see advertisements when you visit Gravy Pass Sites. However, the ads you see may be less tailored to your interests. You have the right to reject the use of Tracking Technologies. Detailed information about how these technologies are used and how you can exercise your rights is available in our 'Cookies' Policy.

Exclusions

At Gravy Pass, when we provide your Personal Information to a third-party, such as an Advertiser or Partner in relation to an Offer, it is important to understand that this information will be managed according to that third party's own privacy policy, not Gravy Pass's. We recommend that you consult the privacy policies of our Advertisers and Partners for more details on their handling, use, disclosure, transmission, or storage of your Personal Information.

This policy does not cover the practices of companies that Gravy Pass does not own or control, or to individuals that are not employed or managed by Gravy Pass, even if Offers, coupons, or links to their websites may appear within our services.

As a provider of marketing technology, Gravy Pass does not endorse any specific Partners or Advertisers, nor do we assume any responsibility for completing or finalizing Offers on their behalf. We provide you with the opportunity to choose to receive information about Offers that interest you, without taking your specific personal circumstances into account.

Your Privacy Rights

At Gravy Pass, applicable laws may provide you with numerous rights regarding the processing of your Personal Information. These rights include:

• Access and Information Rights: You have the right to request access to or copies of your Personal Information that we process or control, along with detailed information about the nature, processing, and disclosure of that Personal Information. This includes the categories of Personal Information collected, the sources of that information, the purposes for collection, the categories of parties to whom the Personal Information has been disclosed, and details about any automated decision-making processes employed.
• Rectification: You can request correction of inaccuracies in your Personal Information that we control.
• Deletion and Restriction: You have the right to request the deletion of your Personal Information or restrict its processing, on legitimate grounds.
• Objection: On legitimate grounds, you may object to our processing of your Personal Information.
• Profiling and Automated Decision-Making: Where profiling or automated decision-making is used, you have the right to opt out.
• Sensitive Information: You can request that we limit the use and sharing of your sensitive Personal Information to specific purposes as defined under applicable privacy laws.
• Consent Withdrawal: If our use of your Personal Information is based on your consent, such as for direct marketing via electronic mail, you have the right to withdraw that consent.
• Sale and Sharing Objections: You have the right to opt out of the sale or sharing of your Personal Information for cross-context behavioral advertising. This can be done through specific mechanisms such as a "Do Not Sell or Share My Personal Information" link.
• Complaints: You can file a complaint with a Data Protection Authority concerning our processing of your Personal Information.
• Non-Discrimination: You will not be discriminated against for exercising any of your privacy rights. However, we may deny certain requests or only partially fulfill them based on our legal rights and obligations.

How to Exercise Your Rights

To exercise any of these rights or if you have questions about these rights or our privacy practices, please contact us via email at privacy@gravypass.com. For opting out of cookie-based sales and sharing of your Personal Information, please contact us via email at privacy@gravypass.com. You may also designate an authorized agent to make requests on your behalf.

If you are dissatisfied with the response to your request, you can appeal by sending an email to privacy@gravypass.com with the subject line "Personal Information Requests Appeal".

Please note that different rights may apply to employees, contractors, or job applicants, and are covered under separate privacy notices provided at relevant times.

Opting Out and Unsubscribing

At Gravy Pass, we provide the option for you to opt out of seeing all future third-party Advertiser Offers on our sites, helping you avoid any targeted third-party Offers in the future.

To Opt Out from Advertiser Offers:

Please send an email to privacy@gravypass.com with the subject "Opt Out". We will keep a copy of your email address on file to maintain a record that you have opted out. If you have used multiple email addresses with our Partners, you will need to opt out separately for each email address to ensure you no longer receive targeted third-party Offers.

Note: Even after opting out, you may still need to unsubscribe directly from any mailing lists of our Partners or Advertisers to stop receiving electronic communications from them.

Opting Out from Partner Offers:

Opting out from third-party Advertiser Offers does not affect offers from Partners that are native to the Partner's site. You cannot opt out from seeing first-party Partner Offers that are part of the native experience on their sites.

Opting Out of SMS Messages:

If you have opted in to receiving SMS messages from Gravy Pass, you can opt out at any time by: - Texting STOP to (866) 377-1970 - Emailing privacy@gravypass.com with the subject line "SMS Opt Out" and including the phone number you wish to opt out - Contacting our customer support team

Once you opt out, you will receive a confirmation message, and we will no longer send you SMS messages. Please note that if you have subscribed to SMS messages from multiple Gravy Pass services or campaigns, you may need to opt out of each separately by following the specific opt-out instructions provided in each campaign.

California Privacy Rights

For residents of California, Gravy Pass adheres to the specific provisions of California privacy law regarding the collection, processing, use, disclosure, and retention of Personal Information.

Collection and Use of Personal Information

Depending on your interactions with Gravy Pass, we may collect and utilize various categories of Personal Information for business and commercial purposes as outlined in our Privacy Policy. These categories include:

• Identifiers: Such as your name, email address, phone number, and date of birth.
• Protected Classification Characteristics: Under California or federal law, such as gender and age.
• Commercial Information: Your interactions with Offers, purchases from Advertisers or Partners, interests in services, and areas of the Gravy Pass sites you visit.
• Internet or Other Electronic Network Activity Information: Including your browsing activity on our sites and interactions with our content and emails.
• Geolocation Data: Your general location determined by your IP address or ZIP code.
• Professional Information: Such as your job title and business contact information.
• Sensitive Information: Your login credentials and other sensitive data necessary for accessing our services.
• Inferences: Drawn from any of the information listed to create a profile about your preferences and behavior.

Sources of Personal Information

We collect these categories of Personal Information from the following sources:

• Directly from You: Information you provide during your interactions with us.
• Automatically from Your Devices: As you interact with our services.
• Service Providers: Data collected through external services that support our business.
• Advertisers and Partners: Information shared during your interaction with these entities.
• Social Networking Sites: Data collected when you interact with our social media content.
• Third-Party Data Providers: Including data validation services, authentication services, and data enrichment providers.
• Online Marketing and Segmentation Providers: And ad-targeting companies.
• Corporate Affiliates in the Gravy Pass Group: Information shared within our corporate family for business operations.

Disclosure of Personal Information

The collected Personal Information may be disclosed to:

• Corporate Affiliates in the Gravy Pass Group: For consolidated business operations.
• Service Providers: Such as technology vendors, CRM platforms, and legal advisors.
• Online Marketing and Segmentation Providers: And ad-targeting companies.
• Advertisers and Partners: For executing business transactions and marketing.
• Legal Compliance and Protection: Entities involved in legal compliance, fraud prevention, and securing our rights.
• Potential Acquirers: In the event of a business sale or merger.

Sales and Sharing of Personal Information

Under California privacy law definitions, we may "sell" or "share":

• Categories of Personal Information: Including identifiers, commercial information, internet activity, geolocation data, and inferences.
• Entities: Personal Information is sold or shared with advertisers, advertising networks, and social networks.
• Protection of Minors: We do not knowingly sell or share Personal Information of consumers under 16 years of age.

We commit to using or disclosing sensitive Personal Information only for purposes explicitly specified under applicable California privacy regulations.

Children's Privacy

Gravy Pass does not allow advertisements to be targeted at individuals under the age of 16.

Gravy Pass does not knowingly collect Personal Information from or about children under the age of 13. If we learn that we have collected Personal Information of a child under the age of 13, we will delete that data from our systems.

Privacy Concerns and Complaints

We take your concerns very seriously. If you have any concerns or complaints about your privacy or data use, please contact our privacy team for assistance at privacy@gravypass.com.

Updates to This Privacy Policy

This Privacy Policy may be updated periodically to reflect changes in our privacy practices. Changes will be posted on our website.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact our Data Protection Officer at support@gravypass.com.

Version: April 2025