California Consumer Privacy Statement

Effective Date: September, 2026

This California Consumer Privacy Statement (“Statement”) supplements the NAVEX Privacy Statement. This Statement applies to California consumers, including visitors of NAVEX’s Website and representatives of NAVEX’s business customers and business partners. This Statement does not apply to NAVEX’s personnel or job applicants.

This California Consumer Privacy Statement uses certain terms that have meanings given to them in the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) and its implementing regulations (collectively, the “CCPA/CPRA”).

Notice of collection and use of personal information

We may collect (and may have collected during the 12-month period prior to the effective date of this Statement) the following categories of personal information about you:

Identifiers: identifiers such as a real name, alias, postal address, unique personal identifier (such as device identifiers; cookies, beacons, pixel tags, mobile ad identifiers and similar technology; customer number; unique pseudonym; user alias; telephone number and other forms of persistent or probabilistic identifiers), online identifier, Internet Protocol address, email address, account name, login credentials, and other similar identifiers.
Additional Data Subject to Cal. Civ. Code § 1798.80: signature information.
Commercial Information: commercial information, including products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies.
Online Activity: Internet and other electronic network activity information, including, but not limited to, browsing history, search history and information regarding your interaction with websites, applications or advertisements.
Sensory Information: audio, electronic, visual, and similar information.
Employment Information: professional or employment-related information such as business contact information, occupation details, certifications and professional associations.
Inferences: inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

We may use (and may have used during the 12-month period prior to the effective date of this Statement) the categories of personal information listed above for the purposes described in the NAVEX Privacy Statement and for the following Business Purposes as described in the CCPA/CPRA:

Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytics services, providing storage, or providing similar services;
Providing advertising and marketing services to you, except for cross-context behavioral advertising (which is addressed in the Sale or Sharing of Personal Information Section below);
Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance;
Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of your current interaction with us;
Helping to ensure security and integrity to the extent the use of your personal information is reasonably necessary and proportionate for these purposes;
Debugging to identify and repair errors that impair existing intended functionality;
Undertaking internal research for technological development and demonstration; and
Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us.

NAVEX does not collect or process sensitive personal information with the purpose of inferring characteristics about consumers.

Retention of personal information

We will retain your personal information for the time period reasonably necessary to achieve the purposes described in our NAVEX Privacy Statement and this Statement, or any other notice provided at the time of collection, taking into account applicable statutes of limitation and records retention requirements under applicable law.

Sources of personal information

During the 12-month period prior to the effective date of this Statement, we may have obtained personal information about you from the following categories of sources:

Directly from you, such as when you create an account with us, or contact us
From your devices, such as when you interact with our Website, products, and other online services
Our service providers and contractors
Our affiliates and subsidiaries
Our business customers and partners
Online advertising services and advertising networks
Social networks
Data brokers
Data analytics providers

We do not sell your personal information in exchange for monetary compensation. We may disclose your personal information by allowing certain third parties (such as online advertising services, advertising networks and social networks) to collect personal information via automated technologies on our websites for cross-context behavioral advertising purposes. Under California law, these kinds of disclosures may be considered a “sale” when the personal information is exchanged for non-monetary consideration, or “sharing” when the personal information is disclosed for cross-context behavioral advertising purposes. You have the right to opt out of these types of disclosures of your information.

We may sell or share for cross-context behavioral advertising purposes (and may have sold or shared during the 12-month period prior to the effective date of this Statement) the following categories of personal information about you to online advertising services, advertising networks and social networks:

Identifiers
Online Activity
Inferences

We do not have actual knowledge that we sell or share the personal information of minors under 16 years of age.

Disclosure of personal information

During the 12-month period prior to the effective date of this Statement, we may have disclosed the following categories of personal information about you for a business purpose to the following categories of recipients identified below, including service providers, contractors, and third parties:

Categories of Personal Information	Categories of Recipients
Identifiers	Our service providers and contractors Our affiliates and subsidiaries Data analytics providers Our business customers and partners Online advertising services and advertising networks Social networks Professional services organizations, such as auditors and law firms
Additional Data Subject to Cal. Civ. Code § 1798.80	Our service providers and contractors Our affiliates and subsidiaries Data analytics providers Our business customers and partners Online advertising services and advertising networks Social networks Professional services organizations, such as auditors and law firms
Commercial Information	Our service providers and contractors Our affiliates and subsidiaries Data analytics providers Our business customers and partners Online advertising services and advertising networks Social networks Professional services organizations, such as auditors and law firms
Online Activity	Our service providers and contractors Our affiliates and subsidiaries Data analytics providers Our business customers and partners Online advertising services and advertising networks Social networks Professional services organizations, such as auditors and law firms
Sensory Information	Our service providers and contractors Our affiliates and subsidiaries Data analytics providers Our business customers and partners Online advertising services and advertising networks Social networks Professional services organizations, such as auditors and law firms
Employment Information	Our service providers and contractors Our affiliates and subsidiaries Data analytics providers Our business customers and partners Online advertising services and advertising networks Social networks Professional services organizations, such as auditors and law firms
Inferences	Our service providers and contractors Our affiliates and subsidiaries Data analytics providers Our business customers and partners Online advertising services and advertising networks Social networks Professional services organizations, such as auditors and law firm

In addition to the categories of recipients identified above, during the 12-month period prior to the effective date of this Statement, we may have disclosed personal information about you to government entities (e.g., in response to law enforcement requests) and third parties in connection with corporate transactions (e.g., mergers, acquisitions, joint venture, reorganization, divestitures, dissolution or liquidation).

California consumer privacy rights

You have certain choices regarding your personal information, as described below.

Access: You have the right to request, twice in a 12-month period, that we disclose to you the categories of personal information we have collected, about you, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about you. If we maintain your personal information for longer than 12 months, our process for submitting a request to know allows you to request personal information collected beyond the 12-month period preceding our receipt of your request. When submitting a request, you may request personal information collected during a specified date range, or all personal information we maintain about you. This expanded request option does not apply to personal information collected before January 1, 2022.

Correction: You have the right to request that we correct the personal information we maintain about you, if that information is inaccurate.

Deletion: You have the right to request that we delete certain personal information we have collected from you.

Opt-Out of Sale or Sharing: You have the right to opt-out of the sale of your personal information or the sharing of your personal information for cross-context behavioral advertising purposes.

How to submit a request

To submit a request to (a) access, correct, or delete your personal information, click  here. You may also email us at  privacy@navex.com, with “Personal Information Request” in the subject line and provide full details about your request, including your contact information, or call us toll-free at 1-844-842-0916. To opt-out of the sale or sharing of your personal information, follow the instructions provided in this link, or email us at  privacy@navex.com, with “Personal Information Request” in the subject line and provide full details about your request, including your contact information. You may also opt-out of the sale or sharing of your personal information by using the Global Privacy Control signal. Requests sent using the Global Privacy Control will apply to the device and browser from which they are submitted. For more information about the Global Privacy Control, please visit <https://globalprivacycontrol.org/>. To submit a request as an authorized agent on behalf of a consumer,please email us at privacy@navex.com with the subject line Authorized Agent Request.

Verifying requests

To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your request. For example, if you have an online account with us, we may verify your identity by requiring you to sign into your account. Alternatively, or if you do not have an online account with us, we may require you to provide us information to enable us to verify your identity, for example your corporate email address, phone number, or job title. In addition, if you do not have an online account and you ask us to provide you with specific pieces of personal information, we may require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request.

If you designate an authorized agent to make a request on your behalf, depending on whether you have an online account with us, we may require that you verify your identity as set forth above. We also may require you to provide the authorized agent a written confirmation that you have authorized the agent to act on your behalf and the scope of such authorization.

Additional information

If you choose to exercise any of your rights under the CCPA/CPRA, you have the right to not receive discriminatory treatment by us. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request. For questions or concerns about our privacy policies and practices, please contact us at  privacy@navex.com. You may also call us at 1-(866)- 297-0224 or mail us at 5885 Meadows Road, Suite 500, Lake Oswego, OR 97035, Attn: Data Protection Officer.