TerminalStreet Privacy Policy

This privacy policy describes the personal data TerminalStreet and/or its affiliates (hereinafter collectively referred to as "TerminalStreet") may receive and why such personal data may be received in its capacity as a data controller, how such personal data may be used (including whom it may be shared with and for what purposes), and choices about such personal data.

This privacy policy applies to the extent TerminalStreet processes personal data in its capacity as a data controller under the GDPR (or "business" under the CCPA) when an individual: (a) visits and engages with any of TerminalStreet's websites, (b) attends a virtual or in-person TerminalStreet event, (c) provides contact information for the purposes of TerminalStreet contacting about TerminalStreet products/services, (d) uses third-party websites or applications that cite this privacy policy, (e) provide billing information for TerminalStreet products/services account administration, or (f) apply to or are contacted about possible employment with TerminalStreet.

Personal Data TerminalStreet May Receive

• Identifiers: Such as name, address, email, phone number, TerminalStreet account username.
• Commercial information: Such as transaction data including billing contact's name, work phone number, work email, work address, professional title, and company name.
• Financial data: Such as payment information processed by our third-party payment processors in accordance with their respective privacy policies.
• Internet or other network or device activity: When visiting any TerminalStreet websites, TerminalStreet automatically receives certain information such as: (a) browser and device type, (b) operating system, and (c) referring web pages including the pages visited on such sites. And information such as IP address, data collected via strictly necessary and accepted website cookies / similar technologies.
• Employment data: Such as education and employment history and other relevant personal data provided in an employment application submitted to TerminalStreet, information from a background check including information provided from reference checks.
• Location information: Such as the location of an event where an individual signed up to receive communication or interact with TerminalStreet.
• User-generated content: Such as public comments provided by an individual in a TerminalStreet hosted webinar, blog, or similar forums.
• Contact and Communication data: Information provided through our contact forms including name, email, company information, phone number, messages, newsletter subscription preferences, and form source tracking (which page or form was used to submit the information).
• Security and Technical data: CSRF tokens, session identifiers, and other security measures used to protect our services and prevent abuse.

How TerminalStreet Uses Personal Data

TerminalStreet uses personal data to:

• Provide, test, maintain/support, secure and improve TerminalStreet's websites, to prevent fraud, misuse and cyberattacks, to calculate de-identified aggregate statistics, and for account administration/billing purposes.
• Send marketing information, product recommendations and other non-transactional communications (e.g., marketing newsletters, telemarketing calls, SMS or push notifications, information about TerminalStreet products, news or events) about TerminalStreet, its affiliates and partners.
• Plan or host virtual or in-person events, contests, or other programs.
• Create and manage the recruitment system, job applications and a database of interested individuals and leads (including verifying the information provided to TerminalStreet) and assess and evaluate applicants' skills and qualifications against the position(s) applied for.
• Cooperate with public and government authorities, courts or regulators in accordance with TerminalStreet's legal obligations.
• Comply with applicable law.

To Whom TerminalStreet May Disclose Personal Data

TerminalStreet may disclose personal data to:

• TerminalStreet service providers who need to access such personal data in order to provide services to TerminalStreet. However, prior to sharing personal data with such parties, TerminalStreet will have a written agreement consistent with the obligations outlined in applicable data protection laws and regulations.
• Advertising and analytics partners. Any secondary use or sharing of personal data obtained through the use of third party cookies by these third parties is subject to their respective privacy policies.
• In response to a request so long as TerminalStreet believes disclosure is in accordance with, or required by, any applicable law, regulation or legal process.
• If TerminalStreet has a good-faith belief that access, use, preservation, or disclosure of the personal data is reasonably necessary to enforce its terms of service, detect, prevent, or otherwise address threats to its platform, or protect against harm to the rights, property or safety of TerminalStreet, its users, or the public as required or permitted by law.
• In connection with, or during negotiations of, any merger, sale of company assets, financing or acquisition of all or a portion of TerminalStreet's business by another company.

International Transfers

Personal data may be processed by one or more TerminalStreet affiliates, processors, or service providers in order to operate TerminalStreet's business. Therefore, personal data may be processed outside of the location from which it was received. TerminalStreet ensures that the transfer of personal data offers an adequate level of protection and security, for instance by entering into the appropriate agreements that continuously ensure the same level of protective measures as set forth in applicable data protection laws and regulations.

Retention

TerminalStreet stores personal data for so long as it is needed to fulfill the purposes for which it was collected, or as required by law. More specifically:

• Account Information: We maintain your account information for as long as your account is active and for a period thereafter to comply with legal obligations or to resolve disputes.
• Marketing Information: If you have opted to receive marketing communications, we keep this information until you unsubscribe or request deletion.
• Usage Data: We retain usage data for up to 26 months to help us improve and optimize our website and services.
• Security Logs: Security-related logs are typically retained for 12 months for security, troubleshooting, and compliance purposes.

Security

TerminalStreet takes reasonable steps to protect personal data from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, no internet or email transmission is ever fully secure or error-free. In particular, email sent to or from TerminalStreet's websites may not be secure. Therefore, individuals should take special care in deciding what information they send to TerminalStreet via email.

Children

TerminalStreet's website is not directed to children under the age of 16, and TerminalStreet does not knowingly collect personal data from children under the age of 16. If TerminalStreet learns that it has collected personal data of a child under the age of 16, TerminalStreet will take steps to delete such information from its systems as soon as possible.

Choices About Personal Data

Individuals have several choices and rights regarding TerminalStreet's use of their personal data:

• Account Information: If an individual has a TerminalStreet account, they may update, correct or delete certain personal data by logging into their account and managing their profile.
• Marketing Communications: Individuals may opt out of receiving marketing emails from TerminalStreet by following the instructions in those emails. If an individual opts out, TerminalStreet may still send non-promotional communications, such as those about their account or ongoing business relations.
• Cookie Preferences: Most web browsers are set to accept cookies by default. Individuals may be able to set their browser to remove or reject browser cookies.

Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA) and UK, we process personal data according to the following legal bases:

• Contractual Necessity: We process your information to perform our contract with you (e.g., providing services after you sign up) or to take steps at your request before entering into a contract.
• Legitimate Interests: We process your information for our legitimate interests, such as improving our services, security measures, and marketing. We balance these interests against your rights and freedoms.
• Consent: We process certain data based on your specific consent, such as marketing emails, which you can withdraw at any time.
• Legal Obligation: We process your information when necessary to comply with our legal obligations.

International Data Transfers

Personal data may be processed by one or more TerminalStreet affiliates, processors, or service providers in order to operate TerminalStreet's business. Therefore, personal data may be processed outside of the location from which it was received, including countries that may not provide the same level of data protection as your home country.

When transferring personal data from the EU, EEA, UK, or Switzerland to countries that do not have an adequacy decision, we implement appropriate safeguards such as:

• Standard Contractual Clauses approved by the European Commission
• Derogations such as consent, contract fulfillment, or the establishment of legal claims

Your Privacy Rights

Depending on your location, you may have certain rights regarding your personal data. These may include:

• Right to Access: You can request a copy of the personal data we hold about you.
• Right to Rectification: You can request that we correct inaccurate or incomplete personal data.
• Right to Erasure: You can request that we delete your personal data in certain circumstances.
• Right to Restrict Processing: You can request that we limit the use of your personal data in certain circumstances.
• Right to Data Portability: You can request a machine-readable copy of certain data to transfer to another service.
• Right to Object: You can object to our processing of your personal data in certain circumstances.
• Right to Withdraw Consent: You can withdraw consent previously provided for the processing of your information.

To exercise these rights, please contact us at [email protected]. We will respond to your request within the timeframe required by applicable law (typically 30 days).

While we will make reasonable efforts to accommodate your request, we may reject requests that are unreasonable, repetitive, or require disproportionate technical effort.

Additional Information for California Residents

California residents may have additional rights regarding their personal data under the California Consumer Privacy Act (CCPA). These rights may include the right to know what personal data is being collected, the right to request deletion of personal data, the right to know what personal data is sold or disclosed and to whom, and the right to opt out of the sale of personal data.

Dispute Resolution for Privacy Matters

For disputes related to privacy, data processing, or this Privacy Policy:

• Direct Resolution (5 business days): Contact our privacy team at [email protected] with detailed information about your concern
• Management Review (10 business days): Unresolved privacy disputes are escalated to our Data Protection Officer for review
• Independent Review: For GDPR-related disputes, you may contact your local Data Protection Authority
• Mediation: Complex privacy disputes may be referred to independent privacy mediation services
• Arbitration: Any dispute not resolved through the steps above will be resolved by binding individual arbitration administered by JAMS, with a class-action waiver and a 30-day opt-out right, as set out in the "Dispute Resolution and Arbitration" section of our Terms of Service, which governs disputes under this document. Individual small-claims actions and claims for injunctive relief for intellectual-property violations are excepted, as provided there.

EU residents have the right to lodge a complaint with their supervisory authority if they believe our processing of their personal data violates the GDPR.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the relevant supervisory authority within 72 hours of becoming aware of the breach (where required by law)
• Notify affected individuals without undue delay if the breach is likely to result in a high risk to their rights and freedoms
• Provide clear information about the nature of the breach, potential consequences, and measures taken to address it
• Offer appropriate assistance and remediation measures to affected individuals

Changes to this Privacy Policy

TerminalStreet may change this privacy policy from time to time. If TerminalStreet makes changes, TerminalStreet will post the updated policy on its website and will update the "Last Updated" date. TerminalStreet encourages individuals to review the privacy policy whenever they access or use TerminalStreet's websites or otherwise interact with TerminalStreet to stay informed about its privacy practices.

Contact TerminalStreet

If you have any questions about this privacy policy or TerminalStreet's privacy practices, please contact us at:[email protected].

Last Updated: July 9, 2026