Privacy Policy

At Riiwards, Inc. (hereinafter, “Riiwards” and also “we” or “us”), we respect and protect the privacy of our customers and others who use our websites, products and services. This Privacy Statement provides details about how your personal information is collected and used by us. Personal information is any information that identifies you or would enable someone to contact you, which may include, but is not limited to, your name, email address, phone number and other non-public information that is associated with such information. It does not include aggregate information, anonymous information or any other non-personally identifiable information. This Privacy Statement applies to the Riiwards websites; products and services located in www.riiwards.com , www.riiwards.net, birthdayclub.io domains and any other sites owned or operated by us from time to time, and our mobile applications or web widget (hereinafter, the “Sites”). Riiwards is located 4695 Chabot Drive Suite 200 Pleasanton, CA-94506, and is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC). This Privacy Statement shall be supplemented by our Terms and Conditions, and any other guidelines, terms and policies made available by us from time to time, all incorporated herein by reference. As used herein and elsewhere, the words “collect”, “use”, “process”, “treat”, “disclose” and similar terms shall be related to personal information and other data that we may collect from our users and/or visitors, including cookies inside a computer and mobile device IDs. By registering with us or otherwise using our products and services, you thereto consent to the collection, transfer, processing, storage, disclosure and other uses of your personal information as described in this Privacy Statement.

1. General Information

1.1 Security and Privacy We employ reasonable technical, administrative and physical safeguards to protect the confidentiality and security of your personal information. We use industry-recognized technical safeguards, such as encryption of personal data, firewalls, and procedures to protect your information from loss, misuse or unauthorized access, disclosure, alteration, destruction and/or alteration. We respect and enforce the right of individuals to access their personal data, and we will not process personal information in a way that is incompatible with the purposes for which it has been collected or subsequently authorized by you to us. Riiwards will take reasonable steps to ensure that personal data is reliable for its intended use, and is kept accurate, complete, and current. Notwithstanding our efforts, we cannot guarantee absolute or unqualified protection of this information given the open nature and inherent risks of the Internet and World Wide Web, and we make no representations or warranties as to the effectiveness of our security and assume no liability for security breaches or any failure in the security of your computer equipment, your internet service provider or other networks and communications providers. 1.2 International Use, Disclosure & Dispute Resolution We are headquartered in the United States of America. Personal information may be accessed by us or transferred to us in the United States. Personal information is shared by us with our partners, businesses who use our service and service providers elsewhere in the world. By providing us with personal information, you consent to this transfer. We will protect the privacy and security of personal information according to this Privacy Statement, regardless of where it is processed or stored, however you acknowledge and consent to the fact that personal information stored or processed in the United States will be subject to the laws of the United States, including the ability of governments, courts or law enforcement or regulatory agencies of the United States to obtain disclosure of your personal information. Our use of your personal data will always have a legal basis, either because it is necessary for our service performance, or because you have consented to our use of your personal data, or because it is in our legitimate interests. Riiwards is committed to: (i) comply with the EU-U.S. Data Privacy Framework (DPF), the UK Extension to the EU-U.S. DPF and the Swiss-U.S. Data Privacy Framework (DPF), the rights of EU and UK individuals and Swiss individuals as set forth by the U.S. Department of Commerce regarding the collection, use, and retention of personal information transferred from the European and the United Kingdom Union and Switzerland to the United States; (ii) subject all personal data received from the EU, Switzerland and the United Kingdom in reliance on this Privacy Statement to the EU-U.S. Data Privacy DPF Principles and Swiss-U.S. DPF Principles; and (iii) being subject to the regulatory, investigatory and enforcement powers of the Federal Trade Commission, the U.S. Department of Transportation or any other U.S. authorized statutory body. For the purposes of European Directive 95/46/EC and applicable national implementing laws in your jurisdiction, with respect to your data, we are a data controller. To learn more about the DPF program, please visit https://www.dataprivacyframework.gov/. Riiwards has self-certified with DPF. In certain situations, Riiwards Inc. may be required to disclose personal data in response to lawful requests by public authorities, including meeting national security or law enforcement requirements. In compliance with the EU-US and Swiss-US DPF Principles, Riiwards commits to resolve complaints about your privacy and our collection or use of your personal information. European Union or United Kingdom or Swiss individuals with inquiries or complaints regarding this privacy policy should first contact Riiwards at: [email protected]. Riiwards has further committed to refer unresolved privacy complaints under the DPF Principles to an independent dispute resolution mechanism, the DPF Services, operated by BBB National Programs. If you do not receive timely acknowledgment of your complaint, or if your complaint is not satisfactorily addressed, please visit https://bbbprograms.org/programs/privacy/dpf/disputes  for more information and to file a complaint. This service is provided free of charge to you. If there is any conflict between the terms in this privacy policy and the DPF Principles, the DPF Principles shall govern.  To learn more about the DPF program, and to view our certification, please visit https://www.dataprivacyframework.gov/. Questions and inquiries concerning your privacy may be directed by email to [email protected]. Under certain conditions, if you still believe that your complaint or dispute has not been resolved, you can invoke binding arbitration as a last resort.  For further information, please see the DPF website https://www.dataprivacyframework.gov/. 1.3 Children Our Sites and our products and services are not directed to persons under the age of eighteen (18). We do not knowingly collect personal information from persons under the age of eighteen (18). If a parent or guardian becomes aware that his or her child has provided us with personal information without such parent or guardian’s consent, he or she should contact us. If we become aware that a child under eighteen (18) has provided us with personal information, we will delete such information from our files. 1.4 Tracking Technologies From time to time, we may place the so-called ‘cookies’ in your computer in order to track and collect data regarding your use of our products and services. Cookies are small text files that our services transfer to you and that allow us to recognize you and obtain data such as the environment in which our products are operating, OS type and version. We may also collect and use the data contained in log files, which may include your IP (internet protocol) address, your ISP (internet service provider), the browser you used to visit our platform, the time you visited our Sites and which sections you visited. Unlike cookies, device IDs of mobile devices cannot be deleted, but you can select to reset your Advertising IDs in the “Settings” section of your mobile device, among other settings. You can always configure your browser to refuse cookies and beacons. For more information, please visit www.allaboutcookies.org. Technologies such as beacons, tags and scripts are also used by us and our partners (including marketing partners and affiliates) as well as our analytics and other service providers. These technologies are used in many ways, including analyzing trends, administering and improving the Sites, tracking users’ movements around the Sites, gathering demographic information about our user base. We store IP address and information on every time login. We use IP address to ban suspicious or malicious users. We may also use Google Analytics, Ad Words, Double Click and/or Ad Sense tracking codes, and other third-party software tools (such as remarketing codes) in order to collect information and marketing analytics about the manner in which you browse our Sites. The served ads will be targeted based on your previous browsing history, and may include retargeting codes. For example, third-party vendors may show you Riiwards’ ads on certain websites across the Internet, even after you leave our Sites. The collected information is anonymized, meaning it cannot be tracked back to individuals. Using such tools, we learn how to optimize, and serve ads based on a user’s past visits, providing you with a better user experience. For more information about interest-based and other types of advertising, and about how to opt-out, you can visit Google’s opting-out and privacy pages located at www.google.com, the Network Advertising Initiative website located at www.networkadvertising.org, and also www.youronlinechoices.com. 1.5 Notification of Changes We reserve the right to modify this Privacy Statement at any time, so please review it frequently. If we decide to change this Privacy Statement in any material way, we will notify you via our Sites so our users are always aware of what information we collect, how we use it and under what circumstances we disclose it. For material changes in how we use personal information, we will provide advance notice by email prior to the change becoming effective. In all cases, your continued use of any Sites or our products and services constitutes the acknowledgement of such changes, and your binding acceptance to any such changes. 1.6 Other Use of Your Data If we are involved in a merger, acquisition, a sale of all or a substantial portion of our assets, or other similar sale transaction, your information may be transferred as part of that transaction. We will notify you by email and/or a prominent notice on our website of any such transfer and any choices you may have regarding your personal information. Lastly, we may disclose your personal information to courts, law enforcement authorities and other relevant third parties (such as internet service providers) when such disclosure is necessary or advisable, in our sole discretion: (i) to conduct an investigation where the legitimate rights or important interests of others would be violated; (ii) to respond to a third party or law enforcement subpoena or court order or bring legal action; (iii) to prevent harm to others or pursue other relief when you or a third party; (iv) when you are or may be violating our terms and conditions of use; (v) to prevent breaching a legal or other professional privilege or obligation; (vi) to prevent prejudicing employee security investigations or grievance proceedings or in connection with employee succession; (vii) when planning and executing corporate re-organizations or in future or ongoing negotiations involving the organization; (viii) upon the danger of causing injury or other harm to any person; (ix) when violating our property or other legal rights, or those of other users or third parties; and/or (x) when violating federal, state, local, or other applicable law. This disclosure may include transferring information to the U.S. and outside the European Economic Area, United Kingdom or Switzerland. To the extent we are legally permitted to do so, we will take reasonable steps to notify you in the event that we are required to provide your personal information to third parties in connection with a subpoena.

2. Specific Information for Consumers

2.1 Information Collection and Use by Us We, our partners and affiliates, and our selected third-party partners using our products and services are the sole guardians of personal information collected. We collect information only as necessary to fulfill the purposes set forth in this Privacy Statement and we will only use this information as described in this Privacy Statement. We may combine any or all of this data with other information we collect about you. In connection with your use of our products or services, we will obtain contact information and personal information, incl.:

• Information that you provide during any voluntary registration to businesses birthday club, rewards clubs, loyalty programs, the “Club”, (first and last name, birth month and day).
• Check-in information when checking in when visiting a business to track your visits so you get rewards based on number of visits as decided by the business.
• Review comments: We reserve the right to publish your ‘Like’, ‘Dislikes’ and ratings or comments under consideration of your privacy.

Businesses whose Clubs you signed up with will use your information to send you rewards via email or text message and may use your info to send you targeted offers via email or text message. In addition, we may use your information to inform you about relevant offers or Clubs from other businesses on our platform that we believe may be of interest to you. These messages are designed to help you discover new rewards or businesses, and we limit such communications to ensure relevance. You may opt out of such cross-promotional messages at any time using the unsubscribe link or by managing your preferences in the communication settings. We may use any of this information to offer and improve our products and services, to provide you with requested information or technical support. We may aggregate and anonymize information received to produce reports on trends, demographics and statistics. 2.2 Sharing of Information We do not share your personal information directly with other businesses or merchants whose Clubs you have not joined. However, we may send cross-promotional communications on behalf of other participating businesses using your contact information, as described in Section 2.1. These communications are sent by us (not the other businesses), and your personal data is not disclosed to those businesses unless you choose to join their Club. We may use carefully selected third party providers so that they can assist us in servicing you (for example, providing customer service, email services). Our contracts with such third parties prohibit them from using any of your personal information for any purpose beyond the purpose for which it was shared. We share personal information with our partners like WiX who require this data to be shared so that other applications can use it. The personal data disclosed may only be processed for limited and specified purposes consistent with the consent provided by you to Riiwards, and we review the privacy policies of our providers to ensure that they effectively process the personal information transferred in a manner consistent with the level of protection granted under this Privacy Statement. We will notify them if we make a determination that they can no longer meet their obligation to provide the same level of protection as is required by this Privacy Statement. If that becomes the case, we will take reasonable and appropriate steps to stop and remediate unauthorized processing. Upon your request, we will provide you with a summary or a copy of the relevant privacy provisions of our contract with such providers. 2.3 Access to Personal Data, Storage of Information, Choice/Opt-out We take steps to ensure that the personal information we collect is accurate and up to date, and that you have the ability to access it and make corrections to it. To request a full copy of your data stored in our system or to make changes to it please email [email protected].

• You have the choice for limiting the use and disclosure of their personal data. For such purposes, Riiwards offers you the following means in order to enforce your privacy rights.
• You have the choice to opt out of the mailing list of any business you signed up for at any time. We give you this choice in every email we send to you. You can ask to opt out by emailing [email protected].
• For other types of privacy requests, please contact us by emailing [email protected]. Your privacy request must include, at the least, the following information: (i) your complete name, address and/or e-mail address in order for us to notify you the response to your request; (ii) attached documents establishing your identity; and (iii) a clear and concise description of the personal information with regard to which you seek to enforce any of your privacy rights. If you request rectification, please indicate amendments to be made and attach documentation to back up your request.
• To request deletion of your records please email [email protected].

Upon receipt of your privacy request, and after due review, we may then edit, deactivate and/or delete your personal information from our products and services. We will undertake our reasonable commercial efforts to respond to access requests within a reasonable time period, in a reasonable manner, and in a form that is readily intelligible to the individual. We reserve the right to charge a fee that is not excessive when justified, for example, where requests for access are manifestly excessive, in particular because of their repetitive character. Note that your data is not deleted when you unsubscribe from any one business because you may have subscribed to more than one business. Please take into account that we may not be able to delete all of your data from our secure databases or the databases of third parties to which your personal information has already been disclosed. In case of secure databases under our control where deletion is impossible, we will make such information inaccessible. If that is the case, please contact such third parties directly in order to request enforcement of your privacy rights. Our Anti-Spam Policy tolerates only permission-based email. You get emails from us only if you sign up for a business using our product. And you can opt out any time. We may delete your information stored with us in certain situations, e.g. if a business’ Club has been discontinued. 2.4 Refer a Friend If you choose to use our referral service to tell a friend about Clubs, we will ask you for your friend’s email address. We will automatically send your friend a one-time email inviting him or her to join a Club. Your friend may contact us at [email protected] to request that we remove this information from our database. 2.5 Information of Third-Party Service Providers From time to time, our Sites may display hyperlinks to the websites of our commercial partners and other third parties. If you click on such links, you are choosing to visit such websites, and will be redirected there. Please take into consideration that we are not responsible for the privacy and personal data practices undertook by such third parties (including any tools, cookies, information or content contained thereunto), and that we do not have control over the manner in which such third-parties may collect, process, treat or use your personal information. When you use such links to go to another website, our Privacy Statement is no longer into effect and your browsing thereof is in your own and final risk. In addition, any banner or ad that we may have on our platform does not constitute any endorsement of any third-party thereof. 2.6 California Consumer Privacy Act (CCPA) – Notice to California Residents If you are a California resident, you have certain rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). This section applies solely to visitors, users, and others who reside in the State of California. We may collect the following categories of personal information, as defined by the CCPA: identifiers (such as name, email address, phone number), commercial information (such as transaction history), internet or other electronic network activity (such as browsing and usage data), and inferences drawn from any of the above. Under CCPA, California residents have the right to:

• Know the categories and specific pieces of personal information we collect, use, disclose, and share.
• Delete personal information we collect, subject to certain exceptions.
• Correct inaccurate personal information.
• Opt-out of the sale or sharing of personal information (Note: We do not sell your personal information).
• Limit the use of sensitive personal information (where applicable).
• Not be discriminated against for exercising any of these rights.

To exercise any of your CCPA rights, please submit a request by emailing [email protected] with the subject line “California Privacy Rights Request.” We may need to verify your identity before processing your request.

3. Specific Information for Businesses

3.1 Information Collection and Use by Us Business information collected on Sites will be used to provide service such Clubs. Clubs collect subscribers (consumers) contact information to participate in your program. We will never sell or rent your contact lists to anyone without your permission and will never use your contact lists or content for any purpose other than as described here. In connection with your use of our products or services, we may obtain contact lists & personal information (including email addresses and other information for your subscribers) to incorporate in your Club. Our Anti-Spam Policy prohibits use of any contact lists other than those received through opt-in. We will make the subscriber information available to you and you may use the subscriber info within the tools made available to you by us. Please note that extracting data & using the data outside of our tools will make you a data controller & owner subject to data privacy and security regulations. In the course of your use of our products or services or visit to the Sites, we may also obtain the following information about you:

• Information that you provide during any registration process (such as business email, business name, contact person, business address, description, business type).
• Rewards & offers for consumers to advertise your Club and display the offerings in widgets.
• We may publish your business information as well as rewards & offers in directories together with listings of other businesses.
• Information from third party social networking sites, including information that social networking sites provide to us if you use your credentials at such social networking sites to log into some of our Sites (such as your name and email address to pre-populate our sign-up form). The information you allow us to access varies by social networking site, and it is affected by the privacy settings you establish at the social networking site. You can control and find out more about these privacy settings at the applicable social networking site.
• Data relating to your activity on our Sites (such as your IP address, browser type and version, geographic location, pages you view, how you got to our Sites and any links you click on to leave our Sites, metadata about your use and your subscribers’ use of our Sites and your emails you send (including clicks and opens), your interactions with any videos we offer and any device or other method of communication you use to interact with the Sites), which we store in a variety of places within our infrastructure, including system log files, back end databases and analytics systems.

We may use any of this information to offer and improve our products and services, to provide you with requested information or technical support, to facilitate your movement through the Sites or your use of our products and services, to do a better job of advertising and marketing our products and services, to diagnose problems with our servers or our products and services, in connection with our security and compliance programs, to administer our Sites, to communicate with you, to target prospective customers with our products or services, to assist us in offering you a personalized experience or otherwise tailor our Sites, product and service offerings to you, or as otherwise described in this Privacy Statement. We may aggregate and anonymize information received to produce reports on trends and statistics, such as mobile search trends, email open rates by industry, campaign best practices or the number of users that have been exposed to, or clicked on, our Sites or evaluated or purchased our products and services. Where permitted by law, we may also use your personal data for marketing purposes with your consent which may include contacting you by email, telephone, text message and post with information including, but not limited to, information about any new products and services, news and special offers. We will not, however, send you any unsolicited marketing or any spam and will take all reasonable steps to ensure that we fully protect your rights and comply with our obligations under the Data Protection Act 1998, the General Data Protection Regulation when it comes into effect on 25/5/2018 and the Privacy and Electronic Communications (EC Directive) Regulations 2003. With your consent, we may also obtain and post testimonials or reviews for inclusion on our Sites or elsewhere. Your posts may remain even after you suspend or cancel your account. Reviews and contributions to any of our public communities are considered public and non-confidential by us and are not treated as proprietary information or personal information covered by this Privacy Statement. To request removal of your personal information on our public forums or on the public portions of our Sites, contact us at [email protected]. In some cases, we may not be able to remove your personal information, in which case we will let you know if we are unable to do so and why. 3.2 Sharing of Information We may use carefully selected third party tools so that they can assist us in servicing you (for example, providing customer service, email and other communication services, billing services). If Riiwards shares personal data with a third-party service provider that as an agent processes the data on behalf of Riiwards, then Riiwards will be liable for that third party’s processing of personal data, unless Riiwards can prove that it is not responsible for the event giving rise to the damage. We may also share non-personal information with any third party, including the media, industry observers, marketing and advertising partners, vendors, customers, potential customers or partners. For example, we may disclose email open rates, campaign best practices or the number of users that have been exposed to, or clicked on, our Sites or evaluated or purchased our products and services. 3.3 Import of Contacts from Third-Party Platforms Our business customers may import customer contact data from WiX or other sources into Sites. Imported contacts are temporarily stored and are not enrolled in the Club until they have explicitly agreed to join. Each contact will receive an invitation to opt in to the business’s Club. Only contacts who actively sign up and accept our Privacy Policy and Terms and Conditions will be added as subscribers and begin receiving rewards, newsletters, or promotional messages. 3.4 Export of Subscriber Data Riiwards provides businesses with tools to export subscriber data collected through their Clubs. This feature is intended to help businesses manage and analyze their customer engagement. By using the export function, you acknowledge and agree that: You, as the business, act as the data controller for the exported information and are solely responsible for ensuring that its use complies with applicable data protection laws, including but not limited to the GDPR, CCPA, and other relevant privacy regulations. You may only export data for subscribers who have validly consented to join your Club and to receive communications as described at the point of sign-up. The exported data may not be used for purposes outside the scope of what the subscriber agreed to, including but not limited to selling or sharing with third parties, unless separately authorized by the subscriber. Once exported, Riiwards is not responsible for the handling, processing, storage, or deletion of the data. You must implement appropriate security measures to protect exported data from unauthorized access or misuse. We recommend that you document subscriber consent and limit access to exported data to authorized personnel only. Misuse of subscriber data may result in termination of your access to the platform. 3.5 Access to Personal Data, Storage of Information We take steps to ensure that the personal information we collect is accurate and up to date, and that you have the ability to access it and make corrections to it. To request a full copy of your data stored in our system or to make changes to it please email [email protected]. You may change your rewards & offerings any time via your account settings accessible through Site and partner sites. You have a choice about how we use your personal information to communicate with you, and you may opt out at any time by changing your account preferences. You may also log in to some of our Sites using sign-in services such as Facebook Connect or an Open ID provider. These services will authenticate your identity and provide you with the option to share certain personal information with us, such as your name and email address to pre-populate our signup form.

4. How to Contact Us

If you have any inquiries or complaints about us, our services, our Terms and Conditions of Use and/or this Privacy Statement, please contact us by email to [email protected], by post to 4695 Chabot Drive, Suite 200, Pleasanton, CA 94588, USA, and by phone to +1 (925) 558-2797. 4.1 General Data Protection Regulation (GDPR) – European Representative Pursuant to Article 27 of the General Data Protection Regulation (GDPR), Riiiwards Inc. has appointed European Data Protection Office (EDPO) as its GDPR Representative in the EU. You can contact EDPO regarding matters pertaining to the GDPR: – by using EDPO’s online request form: https://edpo.com/gdpr-data-request/ – by writing to EDPO at Avenue Huart Hamoir 71, 1030 Brussels, Belgium 4.2 General Data Protection Regulation (GDPR) – UK Representative Pursuant to Article 27 of the UK GDPR, Riiwards Inc. has appointed EDPO UK Ltd as its UK GDPR representative in the UK. You can contact EDPO UK regarding matters pertaining to the UK GDPR: – by using EDPO’s online request form: https://edpo.com/uk-gdpr-data-request/ – by writing to EDPO UK at 8 Northumberland Avenue, London WC2N 5BY, United Kingdom