GDPR Addendum to CloudResearch Privacy Statement

Effective Date: 3/7/2025

This GDPR Addendum (“Addendum”) supplements the CloudResearch Privacy Statement and applies solely to individuals located in the European Economic Area (EEA), Switzerland, and the United Kingdom (collectively, “European Users”). In the event of any conflict between the CloudResearch Privacy Statement and this Addendum, this Addendum shall prevail with respect to European Users.

1. Data Controller and Data Processor

For the purposes of the General Data Protection Regulation (GDPR) and applicable data protection laws:

• CloudResearch LLC acts as a data controller when processing Personal Data of European Users who access our website or register for our services directly.
• CloudResearch LLC acts as a data processor when processing Personal Data on behalf of our Customers who are the data controllers.

2. Legal Basis for Processing Personal Data

We process your Personal Data under the following legal bases:

• Contractual Necessity: To perform our contractual obligations to you, including providing our Services, managing your account, and facilitating payments.
• Legitimate Interests: For our legitimate interests, such as to improve our Services, conduct business analytics, maintain security, and prevent fraud, provided these interests are not overridden by your data protection rights.
• Consent: Based on your explicit consent, which you can withdraw at any time.
• Legal Obligation: To comply with our legal obligations under EU law or the law of an EU member state.

3. Your Data Protection Rights

Under the GDPR and applicable data protection laws, you have the following rights:

• Right to Access: You have the right to request a copy of the Personal Data we hold about you.
• Right to Rectification: You have the right to request that we correct any inaccurate or incomplete Personal Data we hold about you.
• Right to Erasure: In certain circumstances, you have the right to request that we delete your Personal Data.
• Right to Restrict Processing: In certain circumstances, you have the right to request that we restrict the processing of your Personal Data.
• Right to Data Portability: You have the right to request a copy of your Personal Data in a structured, commonly used, and machine-readable format.
• Right to Object: You have the right to object to our processing of your Personal Data based on legitimate interests, for direct marketing, or for statistical purposes.
• Right to Withdraw Consent: Where we rely on your consent to process your Personal Data, you have the right to withdraw your consent at any time.

To exercise any of these rights, please contact us at privacy@CloudResearch.com. We will respond to your request within one month. This period may be extended by two additional months where necessary, taking into account the complexity and number of requests.

4. International Data Transfers

As mentioned in our Privacy Statement, CloudResearch operates primarily in the United States, through servers located in the United States. When we transfer Personal Data outside the EEA, Switzerland, or the UK, we ensure that:

• The transfer is to a country that has been deemed to provide an adequate level of protection for Personal Data by the European Commission or other applicable authority; or
• The transfer is subject to appropriate safeguards, such as Standard Contractual Clauses (SCCs) approved by the European Commission, binding corporate rules, or other legally acceptable mechanisms.

5. Cookie Management

For European Users, we will only use non-essential cookies with your explicit consent. When you first visit our website, you will be presented with a cookie banner that allows you to accept or decline non-essential cookies. You can change your cookie preferences at any time by visiting our Cookie Preferences page.

6. Data Breach Notification

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify the relevant supervisory authority without undue delay and, where feasible, within 72 hours after becoming aware of the breach. We will also communicate the personal data breach to you without undue delay, unless the breach is unlikely to result in a high risk to your rights and freedoms.

7. Data Retention Periods

We will store your Personal Data only for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements. The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you
• Whether there is a legal obligation to which we are subject
• Whether retention is advisable in light of our legal position (e.g., in connection with enforcement of our agreements, applicable statutes of limitations, litigation, or regulatory investigations)

8. Children’s Privacy

For European Users, our services are not directed at children under 16 years of age, and we do not knowingly collect Personal Data from children under 16. If we become aware that we have collected Personal Data from a child under 16, we will delete that information as quickly as possible.

9. Data Protection Officer and EU Representative

We have appointed a Data Protection Officer (DPO) who is responsible for matters relating to privacy and data protection. Our DPO can be reached at:

Data Protection Officer
CloudResearch LLC
support@cloudresearch.com

We have also appointed an EU representative as required under Article 27 of the GDPR. Our EU representative can be contacted at:

Instant EU GDPR Representative Ltd
Adam Brogden
INSTANT EU GDPR REPRESENTATIVE LIMITED Office 2 12A Lower Main Street, Lucan Co. Dublin K78 X5P8 Ireland

contact@gdprlocal.com

10. Complaints

If you are not satisfied with our response to your data protection concerns or believe that our processing of your Personal Data infringes applicable data protection laws, you have the right to lodge a complaint with a supervisory authority in the EU member state of your habitual residence, place of work, or place of the alleged infringement. Contact details for data protection authorities in the EEA, Switzerland, and the UK can be found at the European Data Protection Board website.

11. Changes to this Addendum

We may update this Addendum from time to time. Any changes will be posted on this page with an updated effective date. For material changes, we will provide notice via email to registered users or by a prominent notice on our website.

Contact Us

If you have any questions about these Terms of Service, You can contact us:

• By email: support@cloudresearch.com