Effective: November 27, 2024

PRIVACY POLICY FOR THE DAYCHECK PROGRAM PROVIDED BY SPOTON FLEX LLC

Your privacy is important to SpotOn Flex LLC and any vendors, agents, and service providers acting on its behalf (collectively,“SpotOn”, “our”, “we”, or “us”). We provide this privacy policy (“Policy”) to help you understand what information we collect and how it is used. This Policy applies to SpotOn`s DayCheck Earned Tips Transaction (“ETT”) program (“DayCheck”) and describes how we process the personal information of our DayCheck users (“users”, “you”, or“your”) through the access or use the Services (as the term “Services” is defined by the SpotOn DayCheck Consumer Terms and Conditions). In addition to this Policy, the terms and privacy policy of Astra, Inc. (“Astra”) (Astra facilitates certain ACH transfers), (available at https://astrafi.com/terms/ which incorporates https://astrafi.com/privacy/) also applies to your use of the Services.

This Policy applies only to personal information collected in connection with DayCheck – this Policy does not cover other SpotOn accounts, products, or services. For more information about SpotOn`s privacy practices in connection with other accounts, products, or services, please review the SpotOn Privacy Policy for Consumers (available at www.SpotOn.com/privacy). SpotOn may provide additional or different notices in connection with specific programs or offerings.

This Policy forms part of and should be read in conjunction with the SpotOn DayCheck Consumer Terms and Conditions. All terms not defined shall have the same meanings as given to them under the Agreement or applicable data protection law.

Quick Links:

Notice of Monitoring.

Information SpotOn Collects and Purpose for Collection.

Cookie Policy.

Disclosure of Personal Information.

De-Identified Data.

Your Choices with Respect to Marketing Communications.

Your Privacy Rights.

Retention of Personal Information.

Financial Incentive/ Bona Fide Loyalty Program.

Children’s Privacy.

Security of Your Personal Information.

Updates to this Privacy Policy.

How to Contact Us.

California Personal Information Chart.

1. Notice of Monitoring.

Please note that if you use the chat function on our site, all information you send and receive will be recorded. If you do not wish for us to record this information, please do not use the chat function on our website. By using our chat function you consent to SpotOn monitoring all communications.

2. Information SpotOn Collects and Purpose for Collection.

a. Information You Provide.

We collect personal information directly from you when you provide it to us (for example, from forms you complete or information you submit when you request or obtain Services, or when you call customer service for assistance with a transaction). This information is collected for a number of purposes, as described in more detail below.

Performing Services:

• Communicate with You. To provide you with order confirmations and order updates, provide customer service, or otherwise communicate with you via text message, email, chat, mobile/web application, or by phone regarding your account, transactions, or customer service requests, we may collect your name, information, email, mailing and/or billing address, phone number, recordings of your communications with us, and other information relevant to your transactions or inquiries. We may also record your conversations with us when you communicate with our customer service or fraud department(s). In order to use chat, you must consent to our collection and use of this information in order for us to provide this service.

• Administering DayCheck Services. In addition to your name contact information, we collect information from you if you choose to obtain any Service from us for purposes of providing the Service. We may collect this information directly from you, or indirectly from your employer or our business partners in connection with the Services. When you use a Service from us, we may collect first and last name, email address, date of birth, mailing address, country, location of transaction, IP, gender, age group, bank account information, employment information, and communications preferences.

• If required, we may request additional information from you to facilitate transactions, meet regulatory requirements or for the purposes of fraud prevention. This is typically requested to verify your identity or bank account information such as a government issued i.d., a tax identification number, or a bank statement.

Market and Promote SpotOn Products:

• Marketing Communications. SpotOn uses personal information to market and promote its products and services including for the purpose of: sending marketing, advertising, and promotional communications by email, text message or mail, or sending information about events that may be of interest to you. We collect your name, mobile number, mailing address, email and communication preferences.

• Promotions. We may use personal information you provide to administering promotions, or events. Information collected may include your name, email address, and location.

• User Generated Content. You may submit content that you create to us for use on our site (such as through our Q&A tool) or in other promotional or marketing communications. We only use content that you create with your consent. Information that you provide may include personal information such as name, email address, contents of your questions about Services, and video, photo and audio recording content that you upload or send to us. Please note that all user generated content is subject to moderation, and that by submitting content you consent to SpotOn moderating your content.

Improve or Develop Products or Services:

• User Feedback. To enhance the user experience, improve our website, or improve our products or services, you may choose to submit feedback or we may request that you provide us with feedback regarding the Services you obtained or your interaction with us through our website or through customer service. Where we request feedback, we may ask for your name, email address, phone number, and opinion.

• Surveys and Consumer Research. To conduct surveys, market analysis, or other research about our website, products or services, we or our third party service providers may request that you complete a survey or participate in consumer research. We may request your name, email address, phone number, demographic information, and personal opinions.

• User Generated Content. You may submit content that you create to us for use on our site (such as through our Q&A tool) or in other promotional or marketing communications. We only use content that you create with your consent. Information that you provide may include personal information such as name, email address, contents of your questions about Services, and video, photo and audio recording content that you upload or send to us. Please note that all user generated content is subject to moderation, and that by submitting content you consent to SpotOn moderating your content.

b. Information Automatically From Your Browser Or Device

This section describes the personal information which may be collected automatically from your browser or device. Where we collect information automatically, we generally do so through the use of cookies or other tracking technologies or through security and activity logs. For more information on our use of cookies and other tracking technologies, please review the Cookie Policy below.

Performing Services:

• Administering DayCheck Services. In order to operate the site, App, and provide the Services we may collect information automatically to ensure that the site functions properly and maintain the security of our site. We may collect IP address, activity logs, certain device information and browser information. We may also derive location information from your IP address.

• Communicate with You. When we communicate with you online, we may collect information automatically from your device or browser in order to operate the service, including IP address, device and browser information, and activity logs. In order to use chat, you must consent to our recording and use of this information in order for us to provide the Services.

Personalize Your Experience:

• Remember Your Preferences. To save you time when you use our Services by remembering your preferences, automatically fill in forms (such as your address), or to save items to your cart we may collect IP address, device information, and browser information.

Improve or Develop our Products or Services:

• Analytics. To improve SpotOn’s understanding of its customers’ needs; measure the effectiveness of our advertising and promotion communications; obtain and evaluate analytics data for the purpose of improving our product offerings and services, understanding how our visitors interact with our website, advertisements, and communications we or our third party service providers may collect technical information about your visit, such as IP Address, host name, user agent, browser identification, referrer, and date/time of your access to our website. We aggregate this information so that the information is no longer personal information related to you.

c. Information Collected from Third Parties.

Performing Services:

• Administering DayCheck Services. When you use the Services, we receive first and last name, date of birth, country, email address, phone number, payroll information, bank account information, and other information related to you from your employer and our Business Partners.

• Bank: When you use the Services to request an ETT, our service providers and banking partners may share or receive first and last name, date of birth, country, email address, phone number, bank account information, transaction confirmation, and other information related to you and your request for a DayCheck transaction.

• Employer: When you use the Services in connection with an ETT, your Employer may share or receive first and last name, date of birth, country, email address, phone number, payroll information, bank account information, transactional information, and other information related to you and your ETT request.

• Astra: When you use the Services in connection with an ETT, first and last name, phone number, bank account information, transaction amount, and other information related to you and your ETT request.

Market and Promote SpotOn Products:

• Nonpersonalized advertising. We may use third parties to deliver information about our products, services, and promotions.

d. Other Uses of Personal Information

SpotOn may also use any of the personal information it collects or receives for the following business purposes:

• Prevent and Detect Fraud or Other Security Incidents. SpotOn uses personal information to prevent, detect, investigate, or take action regarding possible malicious, deceptive, fraudulent, or illegal activity, including fraudulent transactions, attempts to manipulate or violate our policies and terms, security incidents, and potential harm to the rights, property, or safety of SpotOn and its customers, employees, or others.

• Operate Our Business. SpotOn uses personal information to perform core business functions, including: maintaining records for accounting or warranty purposes; debugging to identify and repair errors; collecting amounts owed to SpotOn; conducting internal audits, and; providing and maintaining the functionality of SpotOn’s website.

• Comply with Legal Obligations. SpotOn may use personal information to the extent needed to comply with its legal or regulatory obligations, to establish or exercise its rights, and to defend against a legal claim.

• Business Transactions. In the event we enter into a merger, are acquired, enter into bankruptcy, or sell a major part of our assets, your information may be among the assets transferred. To the extent we are able, we will notify (i) the new owner of the restrictions placed on your information, and (ii) you of the sale.

• Improve our Products or Services. We may use personal information that we collect to undertake internal research; verify or maintain the quality of our products or services, and; improve, upgrade or enhance our products or services.

3. Cookie Policy

This section describes how SpotOn uses cookies and similar technologies to collect and store information when you visit our website or use our App. Like many companies, SpotOn uses certain technologies – cookies, web beacons, clear GIFs, tracking pixels, and similar technologies (collectively, “cookies”) – to collect information when you interact with our website and email communications.

a. How do Cookies Work?

To understand how tracking technologies work, it is helpful to describe the types of technologies we use and what they are used for:

• Cookies – a “cookie” is a small text file that websites send to your computer, device, or other internet-connected tool you are using that contains data used by the website for its business purposes.

• Web Beacons – a “web beacon” or “pixel” is a tag used on a web browser or HTML email that records your activities when viewing the web page or email where it is placed.

Cookies are classified by their purpose:

• Essential – These cookies are required for the website to function. You cannot disable these.

• Personalization - Allow the website to remember choices you make (such as your username, language, or the region you are in) and provide enhanced, more personal features. For example, a website may provide you with local weather reports or traffic news by storing data about your general location.

• Analytics - Help the us understand how its website performs, how visitors interact with the site, and whether there may be technical issues.

• Targeted Advertising - Used to deliver advertising that is more relevant to you and your interests. May also be used to limit the number of times you see an advertisement and measure the effectiveness of advertising campaigns.

Our websites use first party cookies and third party cookies. The difference between first party cookies and third party cookies relates to the control of the party who serves the tracking technology. First party cookies are cookies that are specific to the website that created them. Their use enables us to operate an efficient service and to track the patterns of behavior of visitors to the website. Third party cookies, on the other hand, are placed on your device or served by a third party (i.e., not by SpotOn). While we may allow third parties access to the website to place these cookies on users` devices, we do not retain control over the information supplied by the cookies, nor do we retain access to that data. This information is controlled wholly by that third party in accordance with their respective privacy policy.

b. How Does SpotOn Use Cookies

We use cookies consistent with this Policy. For example, a cookie may be used to determine your preferred language, maintain the security of our website and your account, measure website analytics, measure the effectiveness of our advertising and promotional communications, and gain information for marketing and advertising purposes, including by identifying the website from which a person was referred to SpotOn’s site and to track other websites visited by an individual.

Information gathered through usage of a cookie is not linked to any direct personal identifiers (e.g., your name or e-mail address), unless you become a customer of SpotOn. Once you submit personal information on our websites (e.g., by signing up to receive information from us) we may link such personal information with data associated with your visit(s) to our websites.

If you have a user service account, we will, to the extent legally permissible, combine Cookie Data with your Account to improve your experience with our services. Where permissible, your Account will be identified either from you signing in with your Account or by using your IP address collected through a cookie.

Third-Party Analytics. Our websites use third-party web analytics services that uses cookies, to help the websites analyze how users use the websites. The information that is collected about your use of the website will be de-identified or pseudonymized by the third-party analytics provider (Google and Adobe) for the purpose of evaluating your use of the sites, compiling reports on website activity and providing other services relating to website activity and internet usage. The third-party analytics providers that SpotOn uses will not link your IP address with any other data held by them about you. Information collected by us through use of third-party analytics includes: number of visitors, referring URLs, and pages visited.

For further information, about third party analytics please see [Google Analytics, Heap Analytics, Facebook’ and Adobe Analytics’] site(s):

• Google`s Privacy & Terms
• Safeguarding your data
• Adobe Analytics overview
• Adobe Analytics Privacy Center
• Heap Privacy Policy
• Facebook Privacy Settings

c. Disabling, Deleting, or Opting-Out of Cookies

If you do not want to have cookies placed on your device, many of them offer ways to opt-out.

You can opt-out of receiving personalized ads from advertisers and ad networks that are members of the Network Advertising Initiative (“NAI”) or who follow the Digital Advertising Alliance (“DAA”) Self-Regulatory Principles for Online Behavioral Advertising using their respective opt-out tools. The NAI`s opt-out tool can be found here: http://www.networkadvertising.org/choices/. and the DAA`s opt out tool can be found here:http://www.aboutads.info/choices/.

In addition, your mobile devices may offer settings that enable you to make choices about the collection, use, or transfer of mobile app information for online behavioral advertising (for example, Apple iOS’ Advertising ID and Google Android’s Advertising ID). Please note that opting out does not prevent the display of all advertisements to you.

In addition, most web browsers allow at least some control of most cookies through browser settings. You may refuse the use of cookies by selecting the appropriate settings on your browser to decline cookies. You may also delete existing cookies through your browser. Please visit the following websites to learn more (depending on the browser you use):

• Firefox, Microsoft Edge, Internet Explorer, Google Chrome and Safari.

Please note, if you disable cookies, you may not be able to use the full functionality of our websites. In particular, you may have limited access to some areas or be transitioned to a different experience.

You may also disable JavaScript at any time. Please remember: some features of our websites may not function properly unless cookies and JavaScript are enabled, and some areas of our websites may not function at all.

You may choose to delete cookies placed on your device and to block new third-party cookies from being placed by using your internet browser’s privacy and security settings.

4. Disclosure of Personal Information.

SpotOn may disclose your personal information in certain circumstances, as described below.

• Service Providers. SpotOn utilizes other companies to perform certain services for it or on its behalf. These service providers may collect or receive your personal information so that they can provide services to SpotOn, which include:

• Providing marketing services (such as developing campaigns, sending emails or text messages, delivering advertisements, facilitating customer product reviews);

• Hosting or maintaining our website, servers, databases, and/or software platforms;

• Compliance, fraud monitoring and safety

• Conducting surveys;

• Analyzing customer data and survey responses;

• Providing or facilitating warranty or after-sales service; and

• Providing customer service.

• Business Partners (Third Party Businesses). SpotOn partners with other businesses to provide professional services. These third party businesses may collect or receive your personal information so that they can provide services to you and to SpotOn consistent with this Policy, which include:

• ACH Transaction Processor – Astra – In addition to this Policy, the terms and privacy policy of Astra, Inc. (“Astra”) (Astra facilitates certain ACH transfers), (available at https://astrafi.com/terms/ which incorporateshttps://astrafi.com/privacy/) also applies to your use of the Services.

• Payment Card Issuer – we disclose personal information to our bank partner so that they can issue a card and administer any transactions.

• Professional Services – We may disclose personal information to establish, exercise, or protect the rights of SpotOn or its employees, affiliates, agents, and other customers; defend against a legal claim; protect the safety and security of our visitors; and take action regarding possible illegal activities or violations of our policies. legal, accounting, or consulting services.

• Your Employer. SpotOn works with your employer to administer your ETT requests. We may share information with your Employer in connection with the ETT services, including your first and last name, transaction history, shift information, the data and time an amount was paid to or from your account, the amount of transfers to or from your account, current and past balances, and the status of any ETTs you have requested.

• Third Parties. SpotOn uses or allows others to place third party advertising cookies and pixels on its website. Third parties include advertisers and marketing partners, data analytics providers, and social media platforms.

• As Legally Required. We may disclose personal information in response to warrants, subpoenas, court orders, government investigations, or to comply with applicable laws and regulations.

SpotOn may also disclose your personal information to other third parties not described above if you consent to such disclosure.

5. De-Identified Data.

SpotOn may de-identify and aggregate data for its business purposes, including but not limited to, to improve the products and features of its Services, to maintain the security and integrity of its systems, for analytics, and other legitimate business purposes. “De-identified Data” means information that cannot reasonably be used to infer information about, or otherwise be linked to a particular data subject. Where we process De-identified Data, we commit to maintain and use the information in de-identified form and not attempt to reidentify the information, except where permitted by law. We may disclose De-identified Data to third parties who commit themselves to maintaining these same standards for any business purpose.

6. Your Choices with Respect to Marketing Communications.

a. Email Opt-Out.

If you do not want to receive marketing or promotional emails from SpotOn, please click on the “unsubscribe” link at the end of one of our emails. You will be taken to a website where you can opt-out of future marketing emails. Please note that this will not opt you out of receiving transactional emails from us, such as order confirmations or shipment tracking information.

b. Text Opt-Out.

You can opt-out of receiving text messages from us at any time by replying to a text with the words “STOP,” “UNSUBSCRIBE,” or “END.”

c. Additional Information for California Residents

Legal Categories of Personal Information

The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively “CCPA”) requires us to tell you about the “legal categories” of personal information we have collected or received, disclosed, shared or sold, the sources of personal information, and categories of third parties to whom we have disclosed or sold personal information in the past twelve (12) months. To do this, we have put together a table which summarizes the information we have provided in this Notice to make things easier to understand, which includes:

• the legal category of personal information and the definition for each category

• the source from which your personal information is collected,

• the business purpose for processing your personal information, and

• the categories of third parties to whom we share or sell personal information.

Please review the California Personal Information Chart at the bottom of this policy to learn more.

Shine the Light Notice

California residents also have the additional rights regarding disclosure of your personal information to third parties for their own direct marketing purposes. We do not share “personal information” as defined by California’s “Shine the Light” law with non-Affiliate third parties for their direct marketing purposes absent your consent. If you are a California resident, you may request information about our compliance with the Shine the Light law and/or withdraw previously given consent to sharing with non-Affiliate third parties for their direct marketing purposes by contacting using the methods in the Submission of Requests section below. Please note that we are only required to respond to one request per customer each year, and we are not required to respond to requests made by means other than through the provided privacy@spoton.com.

7. Your Privacy Rights.

This section provides you with additional information, describes your rights and explains how to exercise those rights.

• Right to access — The right for a consumer to access from a business/data controller the information or categories of information collected about a consumer, the information or categories of information shared with third parties, or the specific third parties or categories of third parties to which the information was shared; or, some combination of similar information.

• Right to correct — The right for a consumer to request that incorrect or outdated personal information be corrected but not deleted.

• Right to delete — The right for a consumer to request deletion of personal information about the consumer under certain conditions.

• Right to opt out of certain processing — The right for a consumer to restrict a business’s ability to process personal information about the consumer.

• Right to portability — The right for a consumer to request personal information about the consumer be disclosed in a common file format.

• Right to opt-out of sales — The right for a consumer to opt out of the sale of personal information about the consumer to third parties.

• Right to opt in for sensitive data processing — The right for a consumer to opt in before a business can process their sensitive data.

• Right against automated decision making — A prohibition against a business making decisions about a consumer based solely on an automated process without human input.

In addition, will not treat a consumer who exercises their privacy rights differently than a consumer who does not exercise a right.

a. Submitting a Privacy Rights Request

Submission of Requests:

You may submit a request to exercise a privacy right by emailing us at privacy@spoton.com

Verifying Your Identity: To protect your privacy and security, we will take reasonable steps to verify your identity before providing your personal information, altering your personal information, or deleting your information. Only you or someone legally authorized to act on your behalf may make a request related to your personal information. For example, if you make a request, we will ask you to confirm your name, email address, or other information we have in our records to verify your identity.

Requests from Authorized Agents: You may designate an authorized agent to make a request for you. If you designate an authorized agent to make a request on your behalf, we may require you to verify your identity and provide the authorized agent’s identity and contact information to us. If you have authorized someone else to make a request on your behalf, they can submit your request by emailing us at privacy@spoton.com. Please note, your authorized agent will be asked to provide a power of attorney or other authorization form when they submit a request on your behalf.

Response to Requests: We will confirm receipt of your request within 10 business days of receipt and generally will respond to your request within 45 days of receipt. If we need more time to respond, we will inform you of the reason and we may take up to an additional 45 days to respond.

You will not have to pay a fee to access your personal information or to exercise any of the other rights. However, we may charge a reasonable fee if your request is repetitive or excessive; alternatively, we may refuse to comply with your request in these circumstances.

8. Retention of Personal Information.

SpotOn retains personal information for as long as the personal information is needed to comply with its legal, accounting, and regulatory obligations, to provide warranty service for products under warranty, and to protect SpotOn in the event of a legal claim or dispute. Personal information generally will be destroyed, deleted, or anonymized seven years after the year in which it was collected unless a valid request to delete the personal information is received before then (in which case it may be deleted earlier) or SpotOn has a valid reason to retain the information (for example, if there is an ongoing legal dispute that precludes SpotOn from deleting the information).

9. Children’s Privacy.

Our Services are not aimed at or intended for children. SpotOn does not knowingly collect, receive, disclose, sell or share information from children under the age of 16. If you believe we might have any information from or about a child under age 16, please let us know by sending an email to privacy@spoton.com.

10. Security of Your Personal Information.

SpotOn has implemented and maintains reasonable physical, technical, and organizational safeguards to protect your personal information from unauthorized access, acquisition, or disclosure, alteration, or destruction. Although we strive to keep your personal information secure, no safeguards can be guaranteed to be completely secure, so you should exercise caution when transferring personal information over the internet. Please advise us immediately of any incident involving any unauthorized access to or disclosure of personal information that is in our custody or control by sending an email to privacy@spoton.com.

11. Updates to this Privacy Policy.

SpotOn reserves the right to make changes to this Policy by posting an updated Policy on its public facing website and in the App. Changes are effective immediately upon posting or upon a later effective date if one is indicated. You should review this Policy periodically to understand our current practices.

12. How to Contact Us.

If you have questions or concerns about SpotOn’s privacy practices, send an email to privacy@spoton.com.

13. California Personal Information Chart.

This section summarizes how SpotOn processes Personal Information in accordance with California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, “CCPA”). The terms used in this section shall have the same meanings as given to them under the CCPA.

In the last 12 months, we have collected or received, disclosed, shared or sold the following categories of Personal Information:

SpotOn does not knowingly collect, receive, disclose, sell or share information from children under the age of sixteen 16 years of age.