PRIVACY POLICY – CANARY7

At Canary7 Ltd (“Canary7”, “we”, “us” or “our”), we take the protection of your personal data seriously.

This Privacy Policy explains how we collect, use, store and protect personal data when you:

• interact with us as a customer or supplier, or as an employee or representative of one;
• visit our premises;
• visit or use our website;
• use the Canary7 warehouse management platform or associated software applications; or
• use any other services provided by Canary7.

It also explains your privacy rights and how applicable data protection laws protect you.

For the purposes of this policy:

• “Software Services” means the Canary7 warehouse management platform and associated software services provided on a software-as-a-service basis.
• “Services” means the Software Services and any other paid services provided by Canary7.
• “Customer Data” means data collected or processed through Canary7 or in connection with providing our Services.
• “Canary7 Data” means data collected or processed specifically through the Canary7 platform.

This policy does not apply to third-party websites or applications that you may use to access our websites or Software Services, or that you access through links provided by us. These third parties are responsible for their own privacy practices.

This policy applies to Canary7's processing of personal data except where personal data is processed in connection with recruitment or employment. Those activities are covered by separate internal policies.

This Privacy Policy should be read alongside:

• Schedule 1 – General Cookies and Other Technologies Policy
• Schedule 2 – Canary7 Cookies and Other Technologies Policy

Before using our Services, you or the organisation you represent will be required to agree to our applicable customer terms. Users accessing the Canary7 platform will also be required to agree to the applicable End-User Licence Agreement.

1. WHO WE ARE

1.1 Contact Details

Legal entity: Canary7 Ltd Company number: NI685499 Registered address: 7 Corchoney Road, Cookstown, Northern Ireland, BT80 9HU ICO registration number: ZB329131

Canary7 is registered with the UK Information Commissioner's Office (“ICO”) as a fee paying data controller.

1.2 Our Role as Data Controller and Data Processor

Under the UK General Data Protection Regulation, EU General Data Protection Regulation (together, the “GDPR”) and other applicable data protection legislation, Canary7 may act as either a data controller or a data processor , depending on the circumstances.

When Canary7 acts as a data processor

When you use the Software Services to process personal data, or we otherwise process personal data on your behalf as part of providing our Services, Canary7 acts as a data processor.

Depending on the circumstances, you or your organisation may act as either the data controller or another data processor, with Canary7 acting as the processor or subprocessor. When we act as a processor or sub-processor, we process personal data in accordance with the relevant customer's instructions, our contractual obligations and applicable data protection law.

When Canary7 acts as a data controller

Canary7 acts as a data controller when we determine why and how personal data is processed.

For example, we act as a controller when processing personal data for Canary7 user account registration and administration, providing access to our Services, managing our customer relationships or responding to enquiries.

1.3 Third-Party Links

Our websites and Software Services may contain links to third-party websites, applications, widgets, plug-ins and social media platforms.

Selecting these links or enabling these connections may allow third parties to collect or receive information about you. They may also allow you to import information from thirdparty services into Canary7.

We do not control these third parties and are not responsible for their privacy practices. We recommend reviewing the privacy policy of any third-party website, application or service you use.

Further information about third-party services that may interact with Canary7 is provided in Schedule 2.

2. PERSONAL DATA WE COLLECT

2.1 Information You Provide to Us

We may collect personal data that you provide when you:

• complete a form on our website;
• contact us by email, telephone or post;
• register to use our Software Services;
• complete a customer survey;
• contact our customer service or support teams;
• engage Canary7 to provide Services;
• subscribe to our communications; or
• otherwise interact with us.

This may include:

• your name;
• job title;
• business name;
• billing address;
• personal or business email address;
• telephone or mobile number; and
• other relevant contact information.

Canary7 Data

When registering to use the Software Services, you may be required to provide information including your name, telephone number and email address, together with relevant nonpersonal information.

When using the Software Services, you may also upload personal data relating to yourself or other individuals.

We may also receive personal data when you report technical or service issues. This can include information about the issue, notes relating to the support provided and details of how the issue was resolved.

2.2 Financial Information

Where you are a supplier, we may collect bank or other financial details that you provide so that we can make payments to you.

We may also process customer payment and billing information, including credit card details, sort codes and account numbers where applicable. Online payment information is processed using third-party PCI-compliant payment service providers. These providers are only permitted to use payment information for the purposes of processing the relevant payment on our behalf.

Bank details provided directly to Canary7 will be stored securely.

2.3 Information Provided Verbally

Where you provide personal information verbally and consent is required for us to use that information, we will confirm your consent in writing.

2.4 Marketing Information

We may collect information about your preferences for receiving marketing communications from Canary7 or third parties, as well as your preferred methods of communication.

This includes information provided when you opt in to receive marketing communications from us.

2.5 Personal Data About Other People

You may provide personal data relating to another individual, for example:

• a representative authorised to act on your behalf;
• another user you register;
• an employee or colleague; or
• an individual whose information is imported into Canary7 as part of order fulfilment or another business process.

Where you provide personal data relating to another individual, you are responsible for ensuring that you are legally permitted to provide and process that information and, where required, that the individual has been provided with appropriate privacy information.

2.6 If You Do Not Provide Required Personal Data

Where we need personal data to comply with a legal requirement or perform a contract with you, failure to provide that information may mean that we cannot provide the relevant product or Service or fulfil our contractual obligations.

Where this occurs, we will let you know.

2.7 Telephone Recordings

Telephone conversations may be recorded for training, quality and monitoring purposes.

2.8 CCTV

We may operate CCTV at our premises.

If you visit our premises, your image may therefore be recorded. CCTV footage may be processed where necessary for our legitimate interests, including protecting the safety and wellbeing of our employees and visitors and maintaining the security of our premises.

2.9 Technical Data From Our Websites

When you use our websites, we may automatically collect technical information about your device and how you interact with our websites.

This can include:

• IP address;
• approximate geographical location;
• browser type;
• referral source;
• pages viewed;
• length of visit; and
• device and usage information.

Further information is provided in Schedule 1 – General Cookies and Other Technologies Policy .

2.10 Technical and Usage Data From Canary7

We may also collect technical and usage information when you use the Canary7 platform.

If you are logged into a Canary7 account, this information may be associated with your user account and may therefore identify you.

Further information is provided in Schedule 2 – Canary7 Cookies and Other Technologies Policy .

2.11 Social Media

We may receive publicly available information from social media platforms such as Facebook, LinkedIn, Twitter and Google.

For example, if you respond to a Canary7 promotion, advertisement or offer through a social media platform, we may receive information associated with your profile.

Depending on the information you have made available, this may include your name, address, telephone number or business contact details.

We may use this information to respond to your enquiry, fulfil your request or send you relevant information and offers where you have provided the appropriate consent.

2.12 Publicly Available Information

We may collect personal information about customers and prospective customers from publicly available sources.

This can include your name, address and other publicly available information.

Sources may include credit reference agencies such as Experian and public registers such as Companies House or the Electoral Register.

Where information is supplied by a third party, we endeavour to ensure that the third party is permitted to provide it in accordance with applicable data protection legislation.

2.13 Personal Data Processed Through Canary7

Users of our Software Services may use Canary7 to collect, store and process personal data relating to other individuals.

We require users not to process special category personal data through the Software Services. However, subject to our contractual terms, Canary7 does not routinely control or monitor the personal data that customers process through the platform.

2.14 User Responsibilities

Our Terms of Service require users to comply with applicable laws when using Canary7.

Users must not use the Software Services to:

• process personal data without a valid lawful basis;
• process prohibited sensitive or special category personal data;
• process prohibited financial information; or
• infringe the rights of another person or organisation.

Although users are required to comply with these terms, Canary7 does not actively monitor all information uploaded to or processed through the Software Services.

If you believe that your personal data or your organisation's data has been processed through Canary7 in breach of these requirements, please contact us.

2.15 Information From Other Sources

We may occasionally receive personal information from other sources.

Where this occurs, we endeavour to ensure that the information has been obtained from a reputable source that is legally permitted to provide it.

2.16 Keeping Your Personal Data Up to Date

It is important that the personal data we hold about you is accurate and current.

Please let us know if your personal data changes during your relationship with Canary7.

3. INFORMATION WE DO NOT INTENTIONALLY COLLECT

We do not intentionally collect special category or other highly sensitive personal data through our Software Services.

This includes information relating to:

• race or ethnicity;
• religious or philosophical beliefs;
• health or medical information;
• sex life or sexual orientation;
• political opinions;
• trade union membership;
• genetic or biometric information; or
• criminal convictions and offences.

Our Terms of Service restrict users from processing this type of information through Canary7.

However, we do not proactively monitor all information processed by our users and cannot guarantee that a user will not process information in breach of these restrictions.

Children

Canary7 is not intended for children under the age of 16 or anyone below the minimum legal age applicable in their country.

We do not knowingly collect personal information from, or specifically direct our content towards, children below the applicable age.

If we become aware that an account is being used by someone below the applicable minimum age, we may close the account. If you are aged between 16 and 18 and use our Services or websites from the UK or European Union, you must inform your parent or guardian and obtain their consent.

4. HOW WE USE PERSONAL DATA

We only use personal data where we have a lawful basis to do so.

Depending on the circumstances, we may process personal data:

• where necessary to perform a contract with you or take steps before entering into a contract;
• where necessary for our legitimate interests or those of a third party, provided your rights and interests do not override those interests;
• where necessary to comply with a legal or regulatory obligation; or
• where you have provided consent and consent is the appropriate lawful basis.

We may rely on more than one lawful basis depending on how and why particular personal data is being processed.

4.1 How We Use Canary7 Data

We may use Canary7 Data to:

• operate, maintain and improve Canary7 and its features;
• provide access to Canary7 and related functionality;
• enable users to interact with the platform;
• provide technical support and customer service;
• communicate with users about Canary7 and relevant updates;
• detect and prevent fraud and security incidents; and
• comply with legal and regulatory obligations.

4.2 Our Standard Business Operations

We may use personal data to:

• provide the Services we have agreed to provide;
• fulfil our contractual responsibilities;
• maintain appropriate administrative records;
• provide information you request from us;
• verify your identity;
• administer billing and payments;
• recover outstanding payments; and
• notify you of issues that may affect our Services or your use of Canary7.

4.3 Marketing

We maintain contact information for individuals and organisations that do business with Canary7 or have expressed an interest in our Services.

We may use this information to:

• respond to enquiries;
• notify you of relevant changes to our Services;
• provide information relating to our business; and
• send marketing communications where permitted.

You can ask us to stop sending marketing communications at any time by using the unsubscribe link contained in our marketing emails or by contacting us.

Opting out of marketing communications will not affect communications that are necessary for us to provide our Services or administer our relationship with you.

Canary7 does not sell your personal data to third parties.

4.4 Testimonials

We may publish customer testimonials or comments on our websites or other platforms.

Where a testimonial contains personal data, we will obtain the customer's consent before publishing their name and testimonial.

4.5 Changes to the Purpose of Processing

We will normally only use personal data for the purpose for which it was originally collected.

If we reasonably consider that we need to use it for another compatible purpose, we may do so in accordance with applicable law.

If we need to use personal data for an unrelated purpose, we will notify you and explain the lawful basis that allows us to do so.

We may process personal data without your knowledge or consent where this is required or permitted by law.

4.6 Legal Requirements

We may retain, process or disclose personal data where necessary to:

• comply with legal or regulatory requirements;
• protect Canary7's legal rights;
• establish, exercise or defend legal claims;
• recover outstanding debts; or
• respond to lawful requests from regulatory, government or law enforcement authorities.

4.7 Access to Canary7 Data

Although Canary7 may technically have access to personal data stored within the platform, we process this information in accordance with our customers' instructions, our contractual obligations and applicable law.

Customers remain responsible for the information they process through Canary7 and for ensuring that their use of the platform complies with our Terms of Service.

We do not routinely access information stored within a Canary7 account.

Access may occur where necessary for:

• security;
• maintenance;
• technical support;
• providing the Services;
• responding to a request from the account owner; or
• complying with a legal requirement.

4.8 Improving Our Software Services

We may use appropriate Canary7 Data to provide, maintain, enhance and improve the Software Services, including functionality relating to fraud detection and platform security.

4.9 Website Administration and Improvement

We may use information collected through our websites to:

• process registrations;
• provide requested Services and communications;
• send relevant updates;
• customise website functionality;
• deliver website content;
• understand website traffic and usage;
• measure user interests and traffic patterns; and
• improve our websites, Services and features.

4.10 Aggregated and Non-Identifying Information

We may create and use aggregated or anonymised information that does not directly identify an individual.

For example, we may use aggregated information to understand how Canary7 is being used or to demonstrate improvements in warehouse performance achieved through use of the platform.

We do not treat confidential customer information, such as customer names, customer lists or stock information, as non-identifying information. Where technical identifiers such as IP addresses or unique IDs are considered personal data under applicable law, we will treat them accordingly.

5. HOW WE SHARE PERSONAL DATA

We do not disclose personal data outside Canary7 except where necessary for the purposes described in this policy, where you have given permission, or where we are legally required to do so.

Depending on the circumstances, we may share personal data with:

Government and regulatory authorities

This may include HM Revenue & Customs, regulators, law enforcement bodies and other authorities where disclosure is required by law.

Buyers or investors

If Canary7 buys, sells, transfers or merges any part of its business or assets, personal data may be disclosed as part of that transaction.

Where appropriate, we will take steps to protect the confidentiality of your personal data and notify you of any material change affecting how it is processed.

Professional advisers

We may share relevant information with professional advisers such as lawyers, bankers, auditors, accountants and insurers where necessary for them to provide their services to Canary7.

Contractors and consultants

We may use contractors, consultants and other service providers to assist with the delivery and support of our Software Services, sales activities and other business operations.

They will only be given access to personal data where necessary to perform their role.

Service providers

We may use third-party service providers to support our operations. These may include:

• email marketing providers;
• customer relationship management platforms, such as HubSpot;
• website analytics providers;
• Amazon Web Services for hosting and server infrastructure;
• Stripe for payment processing;
• PrintNode for printing order fulfilment information and labels; and
• Cumul.io for displaying dashboard information through Canary7.

Where a third party processes personal data on our behalf, we require it to maintain appropriate confidentiality and security and to process personal data in accordance with our instructions and applicable law.

Co-marketing partners

Where you have specifically opted in, we may share appropriate information with trusted partners to provide co-marketing content that may be relevant to you.

Where this occurs, we will identify the relevant partner and provide appropriate information about how your personal data will be used.

Protecting Our Rights

Where necessary, we may share personal data with credit reference agencies, debt collection providers, legal advisers or law enforcement agencies to protect or enforce our legal rights.

We do not sell, rent or trade personal data to third parties for their own commercial purposes.

We may share aggregated or anonymised information that does not identify individuals.

6. INFORMATION SHARED THROUGH CANARY7

Canary7 may allow users to share information with other authorised users, including where Canary7 accounts or services are linked.

If you choose to share Canary7 Data with another user or third party, that party may be able to access and process the information you have chosen to share.

Users who receive information through Canary7 must only use that information for the purposes authorised by the relevant account holder.

For example, an email address provided for identification or attribution purposes must not be used for unauthorised advertising.

Users are expected to keep shared information secure and respond appropriately to complaints, deletion requests and requests not to be contacted.

7. HOW WE PROTECT YOUR INFORMATION

Canary7 takes appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, loss or destruction.

We follow generally accepted industry standards to protect personal data during transmission and while it is stored.

Access to personal data is limited to employees, agents, contractors and other authorised parties who have a legitimate business need to access it.

Those individuals and organisations are required to process personal data in accordance with our instructions and are subject to appropriate confidentiality obligations.

We have procedures in place to identify and respond to suspected personal data breaches. Where required by law, we will notify affected individuals and the relevant regulatory authority. Although we take reasonable precautions to protect personal data, no electronic transmission or storage system can be guaranteed to be completely secure.

8. INTERNATIONAL DATA STORAGE AND TRANSFERS

Information collected by Canary7 may be stored or processed in the United Kingdom, European Union and Pakistan.

We aim to provide an appropriate standard of privacy protection regardless of where our users are located and comply with applicable data protection requirements in the jurisdictions in which we operate.

Where our suppliers, service providers or affiliates outside the UK or EEA have access to personal data, we require appropriate safeguards to be in place.

Where required, these safeguards may include recognised data transfer mechanisms such as Standard Contractual Clauses or other legally approved safeguards.

This includes relevant service providers located in Pakistan.

We also seek to ensure that:

• we have an appropriate lawful basis for processing personal data;
• only the personal data reasonably necessary for the relevant purpose is collected;
• individuals have appropriate ways to access, correct or request deletion of their information; and
• appropriate security, accountability and data protection measures are maintained.

Amazon PII Data

Amazon personally identifiable information (“PII”) is retained for up to 30 days following order delivery and is stored in encrypted form using AES-256 encryption.

9. COMPLAINTS

If you have concerns about how Canary7 handles your personal data, please contact us so that we can investigate and respond.

You can contact us at:

privacy@canary7.com

Please use “Data Privacy” as the subject of your email.

We will respond within the timeframes required by applicable law.

If you are based in the UK, you also have the right to make a complaint to the Information Commissioner's Office (ICO) .

If you are based in an EU member state, you may have the right to complain to the relevant supervisory authority in that country.

We would appreciate the opportunity to address your concerns directly before you approach a regulatory authority.

10. LEGALLY REQUIRED DISCLOSURES

Canary7 may disclose personal data or other relevant information to law enforcement agencies, regulators or other authorities where required by a valid court order, warrant or other lawful request.

We may also disclose information where we reasonably believe it is necessary to protect Canary7's rights or property or the rights, safety or interests of another person or the public.

Where legally permitted, we will make reasonable efforts to notify affected users before disclosing their information.

We may be unable to provide advance notice where disclosure is prohibited by law, court order or required in an urgent situation.

11. YOUR DATA PROTECTION RIGHTS

If you are already a Canary7 user, you may be able to access, update or amend basic profile information through your user account or by contacting us.

Depending on where you are located and the circumstances in which your personal data is processed, you may have the following rights under data protection law.

Right of Access

You may request a copy of the personal data we hold about you and information about how it is being processed.

Right to Correction

You may ask us to correct personal data that is inaccurate or complete information that is incomplete.

We may need to verify the accuracy of new information you provide.

Right to Erasure

You may ask us to delete personal data where there is no longer a valid reason for us to continue processing it.

This right is subject to certain legal exceptions, and there may be circumstances where we are required or permitted to retain information.

Right to Object

You may object to the processing of your personal data where we rely on legitimate interests and your particular circumstances give you grounds to object.

You also have the right to object to the use of your personal data for direct marketing.

Right to Restrict Processing

You may ask us to restrict the processing of your personal data in certain circumstances, including where:

• you dispute the accuracy of the information;
• our processing is unlawful but you do not want the information deleted;
• you need us to retain the information for a legal claim; or
• you have objected to our processing while we assess whether we have overriding legitimate grounds to continue.

Right to Data Portability

Where applicable, you may request that certain personal data be provided to you or another organisation in a structured, commonly used and machine-readable format.

This right generally applies to information processed automatically on the basis of consent or contractual necessity.

Right to Withdraw Consent

Where we rely on your consent to process personal data, you can withdraw that consent at any time.

Withdrawal will not affect the lawfulness of processing that took place before consent was withdrawn.

Withdrawing consent may affect our ability to provide certain Services where the relevant information is required.

Exercising Your Rights

If you wish to exercise any of these rights, please contact us.

You will not normally be required to pay a fee. However, we may charge a reasonable fee or refuse to act where a request is clearly unfounded, repetitive or excessive, where permitted by law. We may request information to verify your identity before responding to a request. This is an important security measure designed to prevent personal data from being disclosed to someone who is not entitled to receive it.

We aim to respond to legitimate requests within one month. If a request is particularly complex or you have made several requests, we may require additional time. If this happens, we will notify you and keep you updated.

12. DATA RETENTION AND DELETION

12.1 General Personal Data

We retain personal data only for as long as reasonably necessary for the purposes for which it was collected, including satisfying legal, accounting and reporting requirements.

When determining an appropriate retention period, we consider:

• the amount, nature and sensitivity of the information;
• the potential risk of harm from unauthorised use or disclosure;
• why we need the information;
• whether the purpose can be achieved by other means; and
• applicable legal requirements.

Where relevant, personal data may be retained for the period covered by your consent, the duration of our contractual relationship, any period during which we have a legitimate reason to retain it, or a legally required retention period.

Certain customer information, including contact, identity, financial and transaction information, may need to be retained for six years after the customer relationship ends for tax, accounting or legal purposes.

Information relating to contracts may also be retained for the duration of the contract and for the applicable limitation period afterwards.

In some circumstances, we may anonymise personal data so that it can no longer be associated with an individual. We may retain and use genuinely anonymised information indefinitely for research, analytical or statistical purposes.

12.2 Closing a Canary7 Account

If you wish to cancel your Canary7 account and initiate deletion of relevant personal data, contact:

privacy@canary7.com

We may retain certain information where necessary to comply with legal obligations, resolve disputes, maintain security or enforce our agreements.

12.3 Canary7 Data

We will endeavour to delete Canary7 Data within six months of the relevant account being terminated or the data being deleted through the account.

This period allows deletion to align with our standard data deletion cycles and may, where available, allow us to restore an account or accidentally deleted Canary7 Data.

Restoration is not guaranteed, and Canary7 Data may be permanently deleted sooner.

13. COMMUNICATING WITH USERS

We may use your email address to communicate with you about your account, the Services and other matters that you have agreed or are otherwise entitled to receive.

Depending on your communication preferences, we may send emails relating to:

• new Canary7 features;
• service notifications;
• requests for feedback;
• customer support;
• important changes to our policies; and
• marketing communications.

Marketing emails may also contain information about relevant products or services offered by our commercial partners where you have consented to receive such communications. Marketing emails will include an unsubscribe option.

Email Tracking

Our marketing emails may contain a small tracking pixel that allows us to understand whether an email has been opened and may collect information such as your IP address.

We use this information to assess the effectiveness of our communications and reduce unwanted or irrelevant emails.

If you do not wish to receive this type of tracking as part of our marketing communications, you can unsubscribe from our marketing emails.

14. CHANGES TO THIS PRIVACY POLICY

We keep this Privacy Policy under regular review and may update it to reflect changes to our business, Services, technology or legal obligations.

Where we make material changes, we will take reasonable steps to bring those changes to your attention before they take effect, where appropriate.

We encourage you to review this Privacy Policy periodically to stay informed about how Canary7 handles personal data.

The date of the latest version of this policy will be displayed on this page.

Historic versions may be obtained by contacting us.

15. CONTACTING CANARY7

If you have questions about this Privacy Policy or how Canary7 handles personal data, please contact:

privacy@canary7.com

16. LEGAL

This Privacy Policy is governed by and interpreted in accordance with the laws of Northern Ireland.

Subject to applicable law, the courts of Northern Ireland will have jurisdiction in relation to disputes arising out of or in connection with this policy.

This Privacy Policy forms part of our Terms of Service.

SCHEDULE 1 – GENERAL COOKIES AND OTHER TECHNOLOGIES POLICY

1. Technical Information We Collect

When you visit our websites, we may automatically collect technical information about your device and how you interact with our websites.

This may include:

• IP address;
• approximate geographical location;
• browser type;
• operating system;
• referring website or URL;
• pages visited;
• date and time of your visit;
• duration of your visit;
• log file information; and
• device or browser identifiers.

An IP address does not necessarily identify you on its own. However, it may constitute personal data or be capable of identifying a device or individual when combined with other information.

2. Cookies and Similar Technologies

Our websites use cookies and similar technologies, which may include HTML5 local storage.

A cookie is a small file stored on your computer, mobile device or browser. Cookies can be used to remember preferences, identify authorised users, maintain sessions and understand how our websites are used.

We may use cookies and similar technologies to:

• recognise your device;
• identify authorised users;
• keep users logged in;
• remember preferences;
• support website functionality;
• process online transactions;
• understand website usage; and
• improve our websites and Services.

Some cookies are necessary for the operation of our websites and Software Services. Disabling certain cookies may prevent some features from working correctly.

3. Web Beacons and Similar Technologies

We may use web beacons, tracking pixels or similar technologies within our websites or emails.

These technologies may be used to understand:

• how many people visit our websites;
• how visitors navigate our websites;
• whether an email has been opened; and
• whether particular content or links have been viewed.

4. Embedded Scripts

We may use embedded scripts to collect information about how users interact with our websites, such as which links are selected.

These scripts may be temporarily downloaded to your device and remain active only while you are connected to the relevant website or Service.

5. Server Logs

Your browser automatically provides certain technical information when you visit a website.

Our server logs may therefore record information including:

• pages accessed;
• referring URLs;
• browser type;
• operating system;
• date and time of access; and
• duration of visits.

6. Location Information

We may derive an approximate location from information such as your IP address.

Where used, location information helps us provide and improve our Services.

7. Unique Identifiers

We may assign a device or browser a unique identifier based on technical or log information.

These identifiers may be used to maintain security, understand use of our Services and assist with fraud detection.

8. Google Analytics

We may use Google Analytics to understand how visitors use our websites and to assess website performance.

Information collected may include technical and usage information such as:

• IP address;
• browser type;
• internet service provider;
• referring and exit pages; and
• date and time information.

We use this information to understand general website usage, compile statistical reports and improve our websites and content.

Certain pages may also contain third-party content, such as embedded videos, which may set their own cookies. These cookies are controlled by the relevant third party and are subject to its privacy practices.

9. Do Not Track

Some browsers provide “Do Not Track” or similar privacy settings.

Our websites do not use these signals as the sole method of managing privacy preferences. Where applicable, cookie and tracking preferences should be managed through the controls provided on our website or within your browser.

SCHEDULE 2 – CANARY7 COOKIES AND OTHER TECHNOLOGIES POLICY

1. Technical Information Collected Through Canary7

When you access Canary7, we may collect technical information including:

• IP address;
• browser information;
• operating system;
• referring URLs;
• pages or areas accessed;
• dates and times of access;
• session information;
• log information; and
• device identifiers.

When you are logged into your Canary7 account, technical and usage information may be associated with your account.

2. Cookies

Canary7 uses cookies and similar technologies, including local storage, to support the operation of the Software Services.

These technologies may be used to:

• keep you logged in;
• recognise authorised users;
• remember preferences;
• maintain security;
• support platform functionality; and
• provide information that helps us develop and improve Canary7.

Some cookies are necessary for Canary7 to function correctly. Disabling these cookies may prevent you from logging in or using certain parts of the Software Services.

3. Web Beacons and Embedded Technologies

We may use web beacons, tracking technologies and embedded scripts to understand how Canary7 is being used and to maintain and improve our Services.

These technologies may collect information about how users interact with the platform, including links selected and features used.

4. Plausible Analytics

We may use Plausible Analytics to understand the general performance and usage of Canary7.

The purpose of this analytics is to help us:

• evaluate how Canary7 is used;
• compile statistical reports;
• understand platform performance; and
• improve our content and Software Services.

We do not use Plausible Analytics for the purpose of identifying or individually profiling Canary7 users.

5. Third-Party Content and Services

Canary7 may interact with third-party software and services as part of providing its functionality.

These third parties may use cookies or similar technologies in accordance with their own privacy policies.

Third-party privacy policies and practices are controlled by the relevant provider and may change from time to time. Users should review the privacy information provided by any third-party service with which they interact through Canary7.

6. Tracking and Privacy Preferences

We do not use Canary7 to track users' general browsing activity across unrelated thirdparty websites.

Where tracking or analytics technologies are used, they are intended to support the operation, security, performance and improvement of Canary7.

You may also be able to manage certain cookie and privacy preferences through your browser or device settings. For further information about email tracking, please refer to Section 13 – Communicating with Users of this Privacy Policy.