Alida Privacy Notice

Last updated: March 21, 2023

Introduction

In this privacy notice (the “Notice”), we, Alida (formerly Vision Critical), describe our practices regarding the use and processing of personal information when we engage in the activities set forth in Section 1 below. This Notice also describes rights you may have under privacy laws.

1. Whom does this Notice apply to and what does it cover?

This Notice is published by Alida Inc., with registered address at: Canada
365 Bloor St E, 5th Floor, Toronto, ON, M4W 3L4 (“Alida”, “we”, “us” or “our”).

The Notice describes personal information that we collect via our websites located at www.alida.com, and other Alida websites that refer to this Notice (collectively the “Site”) and also how we will handle personal information about you when:

• we market or sell our services to you
• we provide you with services or products
• we procure goods or services from you

we interact with you for business purposes, as further described below

We use the term “personal information” to mean any information relating to an identified or identifiable individual. See below for types of personal information that we collect.

This Notice should be read in conjunction with any additional privacy statements or notices provided to you by us at or before the time you provide us with your personal information.

EEA and California Privacy Notices: If you are located in the European Economic Area, the United Kingdom or Switzerland (“EEA+”), please also see our Supplemental EEA+ Privacy Statement. If you are a resident of California, please also see our Supplemental California Consumer Privacy Act (“CCPA”) Privacy Policy.

Data that Alida processes on behalf of its customers: This Notice does not apply to our processing of personal information on behalf of our customers (as set out in the relevant service agreements between Alida and its customers). If another organization asks you to take its survey or attend its interview on or through an Alida website, or otherwise refers you to Alida because that organization wants us to collect information from you for that organization, please read that organization’s privacy notices for information about how your information is collected, used and disclosed and for what purposes. When we collect personal information from you for one of our customers, we process it at the request of our customers, and the processing is governed by the customer’s respective privacy notice and applicable laws.

2. How does Alida collect my personal information?

Directly from you: If you create an account, fill out a form, send an email to Alida, or otherwise send us information through the Site or other business channels, we collect personal information about you.
Information Passively Submitted on our Site: When you visit the Site, your browser and computer automatically provide to us certain technical information about your computer or device and how you arrived at the Site.

Information from Other Sources: We collect personal information through other sources such as third-party service providers, our advisors and consultants, social media platforms, joint marketing partners and from other publicly available platforms.

Combining information: We may link information that you automatically provide with information that we collect from other sources and/or information you actively submit.

3. What personal information does Alida collect about me?

We may collect the following personal information:

• Contact information: name, position, role, company or organization, telephone, work address, personal address
• Vendor and supplier information: contact details and other information about you or your company to enable us to perform due diligence (for example anti-money laundering and sanctions screening) and procure services;
• Social media information: such as your social media account name, survey responses, photo uploads, posts, “likes” and interactions with the Alida brand;
• Your account log-in information: for access to Alida products and services;
• Information from public sources: e.g. professional social media site profiles and related information;
• Office and event attendance records: to record your attendance (and any feedback you may provide) related to any office or event visits for event management, public health and security purposes and to improve our services and events;
• Sales and marketing data: information related to the sales and marketing of our products and services, including your opt-in, opt-out and information on your interests related to Alida commercial messages, notes, transcripts and recordings of sales calls and similar information. See below for more information;
• Technical and device information: when you access this website and our services, for example IP address, browser type and version (e.g. Internet Explorer, Firefox, Safari etc.), time zone setting, browser plugin types and versions, operating system you are using (e.g. Vista, Windows XP, MacOS, etc), device type, hardware model, MAC address, unique identifiers and mobile network information. See our Cookie Notice for more details.
• Online and device data: including the URL that referred you, your browser type and version, your device type, your internet protocol (IP) address, your location, the pages you visit as you navigate through the Site (clickstream data), how long you stay on those pages, and the hyperlinks you click on. This information is collected using various technologies including server logs, cookies, web beacons, and other tracking technologies as described in more detail in our Cookie Notice.
• Sensitive Information: We may collect certain information that may be deemed to be “sensitive”, depending on applicable privacy laws. This may include: gender; allergies and dietary requirements; financial and tax-related information related to sole traders; health and information on any disabilities (for example, so that we can make reasonable accommodations for you during a visit to one of our offices) sexual orientation (for example if you provide us with details of your spouse or partner for an event) and criminal record information (for example for sanctions screening as part of vendor due diligence). We will handle Sensitive Information in compliance with applicable laws, which may require us to collect your explicit consent, or give you the opportunity to opt-out of the collection and processing.
• Information in connection with legal or law enforcement investigations or proceedings: where this is necessary to conduct legal investigation or proceedings.

Alida does not collect personal information about your online activities across third party websites or online services.

Alida is dedicated to the protection of protecting children's privacy. Alida does not knowingly collect or process information about children under 16. This Site is not intended for or directed at children.

4. How Does Alida use my Personal Information?

We use personal information that we collect for the following purposes:

• Provide our services: provide requested services to you, as described further within this Site, and manage and administer our business relationship with you, including keeping records about business contacts, services and payments to develop our relationship and target our marketing and promotional campaigns;
• Sales & Marketing: advertise, market and sell our services and products to you; where permitted by law, we may contact you with sales and marketing messages; see below for information on how you can unsubscribe from Alida’s marketing messages;
• Improve our services: improve Alida’s products and services that it offers, train our staff and improve our communications and sales processes;
• Facilitate online activities: create accounts, enable interaction in online forums and surveys that we may offer, send you invites and service emails if you become a member of our communities as part of your ongoing membership; contact you to administer rewards such as sweepstakes/contests;
• Communicate with you: respond to enquiries and send emails, newsletters and other messages to keep you informed of market insights and of our services;
• Events: run customer and industry awards programs, briefings, roundtables and other events;

• Procure customer surveys and feedback: procure customer feedback and answer related issues and concerns which may arise;
• Optimize the Site: better understand Site and platform performance, maintain technical performance and optimize and personalize user experience;
• Customer and vendor legal compliance: discharge our contractual obligations, perform due diligence (under anti-money laundering, sanctions screening and other crime prevention and detection laws and regulatory requirements) which may involve automated screening checks to verify identification and prevent fraud;
• Physical security: provide security to our offices, events and other premises;
• Online security: protect our information assets and technology platforms from unauthorized access or usage and monitor for malware and other security threats;
• Comply with legal obligations: comply with our legal and regulatory obligations including auditing and reporting requirements, and prevent the fraudulent use of our services;
• Business transactions: prepare for, evaluate and give effect to a merger, acquisition, reorganization, restructuring, sale of business, or similar business transaction that Alida decides to enter into.
• Advertising and analytics: To permit advertising and analytics services that are intended to deliver advertising to you and/or analyze your interactions, based on your interactions with our website or app

5. How do I opt-out of Alida’s marketing communications?

You may opt-out of receiving marketing and other promotional emails from us at any time by clicking the unsubscribe links embedded within the emails we send, or by contacting us directly at privacyofficer@alida.com. Members of communities we own can opt-out of participating by using the unsubscribe links embedded in emails, or by using the subscription preference options in the Profile / Settings section of the member hub. Some emails are transactional in nature, including emails we send to our clients regarding the services they have purchased. These emails do not provide the ability to opt-out.

6. How does Alida use Cookies?

Alida uses cookies to assist us in fulfilling the purposes described earlier. For more information about cookies and how we use them, please see our Cookie Notice.

7. To whom does Alida disclose my personal information?

We may disclose your personal information to third parties as described below:

• Alida group companies: including their staff and contractors in order to provide our goods and services;
• Suppliers: who support our business including IT and communication suppliers, outsourced business support, marketing and advertising agencies, data back-up service providers;
• Other event delegates: with your consent, where you attend an Alida event and your name will appear on the attendee list;
• Screening service providers: so that we can comply with legal obligations in relation to the prevention or protection of crime, anti-money laundering, sanctions screening and any other required checks;
• Law enforcement: including regulators and other competent authorities;
• Emergency services and contacts: to protect health and safety of our clients, staff, and organizations as necessary
• Buyers or interested parties: with a buyer of all or substantially all of our assets relating to a particular business line or division, or in connection with a merger, acquisition, reorganization or restructuring.

8. How does Alida keep my personal information safe?

Alida takes steps intended to implement commercially reasonable safeguards and precautions to protect your personal information, including technical and organizational measures against unauthorized access, improper use, alteration, unlawful or accidental destruction, and accidental loss. The transmission of data over the internet cannot be guaranteed as completely secure and so please note that any transmission is at your own risk.

9. Where will Alida store and process my personal information?

Alida is a global organization (see the Alida affiliates page for more information on our locations) and so your personal information may be transferred and stored outside of your region, state, province or country, including in Australia, Canada, France, Germany, Hong Kong, India, Japan, Netherlands, Philippines, Singapore, South Africa, UK, and the USA. Alida will take steps to protect your personal information in accordance with applicable laws.

10. For how long does Alida keep my personal information?

Alida will retain your personal information as long as required to enable us to meet the purposes described in Section 4 above, as applicable based on the context in which we collected your personal information. We generally retain your personal information for as long as you have a business relationship with us and for 7 years thereafter, unless we are required to delete or anonymize it sooner. If you do not have a direct business

relationship with us, such as where we have received your personal information from a third-party data provider, we shall retain your personal information for 7 years following our last communication with you unless we are required to delete or anonymize it sooner. In some cases, we may be required to retain personal information for a longer period of time based on laws or regulations that apply to our business or for other necessary business purposes, in which case we will retain your personal information until that legally mandated retention period expires.

11. What rights do I have in relation to my personal information?

Subject to applicable law, you may have the following rights in relation to your personal information:
Right to access: To know certain details about whether and how we process your personal information, and to obtain copies of the personal information;

Right to correction: To have incomplete or inaccurate personal information we hold about you be corrected;
Right to withdraw consent: To withdraw your consent with future effect, where we are processing it on the basis of your consent.

Right to deletion: To have certain personal information that we maintain about you be deleted.
Other rights: To restrict or object to certain activities in which we engage with respect to your personal information.

If you want to exercise any of these rights, please refer to the contact details below. We endeavor to respond within 30 days, and (in all cases) within the timeline set by applicable law. In some cases, we may need to verify your identity or redact information if providing it would result in the disclosure of the personal information of others. If a request is unreasonable or impractical then we may need to charge a fee (where permitted under applicable laws) or need longer than 30 days to respond. If we are unable to process your request for any reasons we will provide you with an explanation of the reason for denial, and you will be permitted to request a review.

12.California Notice at Collection

The additional disclosures in this California Notice at Collection apply only if you reside in California. These disclosures do not reflect our practices where an exception or exemption applies under the California Consumer Privacy Act (CCPA). Please see Section 3 above for information about the categories of personal information we collect about you. The categories of personal information we collect correspond with the

following categories under the CCPA's definitions of "personal information" (in the following bullets, a "consumer" means a California resident):

• Categories of "personal information" as defined by the CCPA:
  • Identifiers such as a real name, alias, postal address, unique personal
  • identifier, online identifier, Internet Protocol address, email address,
  • account name, or other similar identifiers.
  • Any information that identifies, relates to, describes, or is capable of being associated with, a particular individual, including, but not limited to, his or her name, signature, address, telephone number, employment, employment history, but excluding publicly available information that is lawfully made available to the general public from federal, state, or local government records.
  • Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer's interaction with an internet website application, or advertisement.
  • Audio, electronic, visual, thermal, olfactory, or similar information.
  • Professional or employment-related information.
  • Inferences drawn from any personal information to create a profile about a consumer reflecting the consumer's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

We only use sensitive personal information of Website users for purposes referred to under Subsection 1798.121(a) of the CCPA, namely:

• To perform the services or provide the goods reasonably expected by average California residents who request those goods or services;
• To prevent, detect and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information;
• To resist malicious, deceptive, fraudulent or illegal actions directed at us and to prosecute those responsible for those actions;
• To ensure the physical safety of natural persons;
• For short-term, transient use;
• To perform services on behalf of us;
• To verify or maintain the quality or safety of our services and products;
• To improve, upgrade, or enhance our services and products; and
• To perform functions that are required under laws that apply to us;.
• For advertising and analytics purposes.

Please see Section 4 above for information about the purposes for which we collect California residents' personal information. Alida does not sell your personal information for monetary value. Alida may permit advertising and analytics services that are intended to deliver advertising to you and/or analyze your interactions, based on your interactions with our website or app, which may constitute a “sale” or “sharing” of data under California law. See our Cookie Policy, as well as our Supplemental CCPA Privacy Statement for more information. Please see Section 6 above for the criteria we consider in determining how long to retain each category of personal information. You can access our Supplemental CCPA Privacy Statement here.

13.Third Party Websites and external links

The Site and our emails, newsletters and other communications may contain links to websites not affiliated with us (“external websites”). Your use of an external website or any information or other content found on an external website is subject to and governed only by the terms and conditions of such website. Alida does not endorse or make any representations or warranties concerning, and will not in any way be liable for any content, products, services, or other materials available on or through an external website. The personal information that you provide through external websites is not subject to this privacy notice. Alida encourages you to review the privacy policies and terms of use of external websites before you submit any personal information to them.

14. How will I know about changes to Alida’s privacy notice?

We may change the terms of this Policy so please review it periodically. We will provide advance notice of changes or obtain consent to changes where required by applicable law. To view previous versions of this Policy, please visit the Archive linked below.

15. How do I contact Alida about this Notice or submit a query?

Should you have any questions regarding this Notice, you can contact our Privacy Officer by email at privacyofficer@alida.com, or by mail at:

365 Bloor St E, 5th Floor

Toronto, ON, M4W 3L4

Canada

Attention: Privacy Officer

Supplemental EEA+ Privacy Statement

Last updated: 1 January 2023

Introduction

This Supplemental EEA+ Privacy Statement applies only if you are located in the European Economic Area ("EEA"), the United Kingdom ("UK") or Switzerland. This Statement should be read in conjunction with the Alida Privacy Notice.

1. What laws apply?

If you are located in the EEA, the EU General Data Protection Regulation applies to the processing of your personal data. If you are located in the UK, the UK General Data Protection Regulation applies to the processing of your personal data. References to the “GDPR” below are references to the General Data Protection Regulation as it applies in the country where you are located.

If you are located in Switzerland, the provisions of the Swiss Federal Data Protection Act (the “FDPA”) apply to you. References to the GDPR below shall be interpreted analogously for the purposes of applying the FDPA. If we use a term that the GDPR defines, the term has the same meaning as under the GDPR.

2. Who is the data controller?

Alida Inc. ("we") is the data controller. Our address is 200 Granville Street, Mezzanine Floor, Vancouver, BC V6C 1S4.

Our EU GDPR-specific representative is Vision Critical GmbH, Kaiser-Wilhelm-Ring 17-21, 50672, Cologne, Phone: +49 221 65088931. Our UK GDPR-specific representative is  is Alida Solutions Limited. Email privacyofficer@alida.com.

Our Data Protection Officer may be contacted at privacyofficer@visioncritical.com.

3. On what legal bases does Alida process personal data?

We process the personal data of users of our Site on several different legal bases, as follows:

• Contract Performance: Use of our Site and various features thereof (such as our forum boards) is subject to our Terms of Use and other applicable terms and conditions. We process the personal data of users of our Site as necessary to perform contractual obligations in respect of such users or take steps at such users’ request prior to entering into a contract, as may be applicable, pursuant to Article 6(1)(b) of the GDPR.
• Legitimate Interests: We process the personal data of users of our Site as necessary to pursue the following legitimate interests, pursuant to Article 6(1)(f) of the GDPR: To provide a good user experience, to maintain and secure our Site, to tailor our communications, marketing and services to our users, and to support and provide requested services.
• Legal Obligations: If we are subject to a lawful access request, engaged in a legal proceeding or suspect a user of illegal conduct, we may need to process your personal data to comply with relevant laws, regulatory requirements and to respond to lawful requests, court orders, and legal process, pursuant to Article 6(1)(c) of the GDPR.
• Consent: If we are required to obtain your consent to send you marketing communications, place certain cookies on your device, or engage in other processing activities associated with the Site, we may perform such processing on the basis of your consent if you have provided it, pursuant to Article 6(1)(a) of the GDPR. In such cases, you may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. Providing your consent is voluntary, however we will not be able to provide you with a service for which we require your consent unless it is Provided.
• Vital Interests: In extenuating circumstances, we may need to process your personal data to protect the vital interests of you or another natural person, pursuant to Article 6(1)(d) of the GDPR.

4. Where does Alida transfer personal data and how are the transfers protected?

We disclose your personal data to recipients in the following jurisdiction or jurisdictions outside of the EEA+ which provide adequate protection to personal data according to the European Commission: Canada and Israel. In each case, the transfer is thereby recognized as providing an adequate level of data protection from a European data protection law perspective (see Article 45 of the GDPR).

We disclose your personal data to recipients in the following jurisdiction or jurisdictions outside of the EEA which do not provide adequate protection to personal data according to the European Commission: Australia, the United States, South Africa, Singapore, Hong Kong, Japan and India. By entering into appropriate data transfer agreements based on Standard Contractual Clauses as referred to in Article 46(5) of the GDPR, or other adequate means, and performing data protection assessments of data transfer arrangements as appropriate, we take the position that all such recipients will provide an adequate level of data protection and that appropriate technical and organizational security measures are in place to protect personal data against accidental or unlawful destruction, loss or alteration, unauthorized disclosure or access, and against all other unlawful forms of processing. Any onward transfer (including to our affiliates outside the EEA+) is subject to appropriate onward transfer requirements as required by the applicable contract or applicable law. You can ask for a copy of such appropriate data transfer agreements by contacting privacyofficer@visioncritical.com.

5. What Data Subject Rights do I have?

Under the conditions set out under the GDPR and any other national data protection laws in the EEA+, you have the following rights:

• Right of access: You have the right to obtain from us confirmation as to whether your personal data is being processed, and, where that is the case, to request access to the personal data. The access information includes, among other things, the purposes of the processing, the categories of personal data concerned, and the recipients or categories of recipients to whom the personal data have been or will be disclosed. You have the right to obtain a copy of the personal data undergoing processing. Subject to applicable law, we may charge a reasonable fee for copies, based on administrative costs.
• Right to rectification: You have the right to obtain from us the rectification of inaccurate personal data concerning you. Depending on the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.
• Right to erasure: You have the right to ask us to erase your personal data to the extent it is not required for legally required purposes.
• Right to restriction of processing: You have the right to request restriction of processing of your personal data, in which case, it would be marked and processed by us only for certain purposes.
• Right to data portability: You have the right to receive your personal data which you have provided to us in a structured, commonly used and machine-readable format and you have the right to transmit the personal data to another entity without hindrance from us.
• Right to object: You have the right to object, on grounds relating to your particular situation, at any time to the processing of your personal data by us and we can be required to no longer process your personal data. If you have a right to object and you exercise this right, your personal data will no longer be processed for such purposes by us. Exercising this right will not incur any cost. Such a right to object may not exist, in particular, if the processing of your personal data is necessary to take steps prior to entering into a contract or to perform a contract already concluded.
• Right to Submit Complaints: You have a right to lodge a complaint with a supervisory authority. You may view a list of the contact details of the supervisory authorities in the EEA, UK and Switzerland at the links below:
• EEA: https://edpb.europa.eu/about-edpb/board/members_en
• UK: https://ico.org.uk/global/contact-us/
• Switzerland: https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact.html

Please note that these rights may be limited under the applicable national data protection law.

To exercise your rights please contact us at privacyofficer@alida.com.

6. Am I required to provide my personal data?

You are not required to provide any personal data to us, but if you do not provide any personal data to us, you may not be able to use certain features of the Site, such as those available to account holders, participants on our platform, or job applicants, among others. You can use the Site without consenting to cookies that are not strictly necessary; which will mean that your experience on the Site will be less tailored to you and certain features of the Site may not function as intended. You can also use the Site without consenting to receiving marketing communications from us; which will mean that you may not receive marketing communications that you may be interested in.