Aggero – Privacy Notice – Influencers

Welcome to Aggero (along with each of Aggero (as defined below), collectively, “Aggero”, “we”, “us” or “our” in this privacy notice) privacy notice for influencers.

As of the Effective Date, Aggero include:

18 St. Cross Street, 4th Floor, London, United Kingdom, EC1N 8UN

We collate publicly available information about influential individuals (“you” or “your” in this privacy notice if we have obtained information about you). This pooled information, or ‘personal data’, is made available on Aggero’s market-research database via Aggero’s influencer relationship management platform (the “platform”) for its users to discover, evaluate and manage their engagement with influential people.

Aggero respects your privacy and is committed to protecting your personal data. This privacy notice will inform you as to how we look after your personal data when it is used on our market-research database, your privacy rights and how the law protects you.

When a business customer of Aggero uses our platform, that customer may enter information relating to influencers into its Aggero account. To the extent that information constitutes personal data under the GDPR, that information (excluding that certain publicly available influencer data for which Aggero is the controller (as defined in the GDPR)) is referred to in this privacy notice as “CRM-Stored Influencer Data”). To the extent we process CRM-Stored Influencer Data solely in order to provide the platform to a particular customer, under the GDPR, to the extent applicable, we will act as a processor (as defined in the GDPR) on behalf of that customer in respect of that CRM-Stored Influencer Data; this privacy notice will not apply to the processing of that CRM-Stored Influencer Data and the applicable customer will act as a controller in respect of that CRM-Stored Influencer Data and is responsible for obtaining all

necessary consents and providing you with all requisite information as required by applicable law.

Purpose of this privacy notice

It is important that you read this privacy notice together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or processing personal data about you so that you are fully aware of how and why we are using your personal data. This privacy notice supplements the other notices and is not intended to supersede them.

Who we are

Aggero is based in the United Kingdom. We have developed and manage our market-research database, our ‘Sponsorship Discovery and Monitoring Platform’, which allows its users to manage, expand, validate and scale their networks with influencers and track campaigns.

Controller

Aggero is responsible for the protection of personal data that it collates from publicly available information and adds to its market-research database. As such, we are a controller under applicable data protection legislation for personal data which we obtain about you (excluding CRM-Stored Influencer Data).

Further help

If you have any questions about this privacy notice, including any requests to exercise your legal rights referred to in ‘Your legal rights’ (paragraph 7 below), please contact our compliance team using the following email address: contact@aggero.io

If you are an individual located in the United Kingdom or any country in the European Economic Area (the “EEA”), you have the right to make a complaint at any time to the supervisory authority which regulates the processing of personal data in the country in which you are located. We would, however, appreciate the chance to deal with your

concerns before you approach your supervisory authority, so please contact us by emailing contact@aggero.io in the first instance.

1. The data we process and how it is obtained

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We collate, use, store and transfer different kinds of publicly available personal data about you which is obtained directly or indirectly via secondary sources such as social media networks and other Internet sources. This personal data may include the following:

a. your name, age and affiliated organization (if applicable);

b. your social media handle;

c. messages which you have shared publicly on social media; and

d. any other information you manifestly make public.

We may combine the above referenced personal data with information we receive from third parties relating to your social media audience. Such combined personal data, while anonymous with respect to your social media followers, is identifiable of you.

2. How we use your personal data

We will only use your personal data to the extent that the law allows us to do so. We will use your personal data where it is necessary to pursue our legitimate interests and your interests and fundamental rights do not override those interests.

As part of these legitimate interests, the platform may benefit you as an influencer by facilitating your connection with companies (and their brands) to enable those companies to expand your presence in the influencer marketing ecosystem and to enhance your subject-matter expertise. Influencers often reach out to us and request to be included on the platform. The platform also affords a mutual benefit to both brands and influencers by empowering brands and influencers to build meaningful relationships for their shared gain. Additionally, the platform affords a greater public benefit by facilitating the growth and development of, and insight into, the wider influencer marketing ecosystem.

Purposes for which we will use your personal data

We process your personal data for the purposes of allowing users of our platform and associated market-research database to discover, evaluate and manage their engagement with influential people. In addition to allowing users to conduct market research, as noted above, we will use your personal data to connect you through our platform with companies (and their brands).

In particular, we would like you to be aware that the Aggero platform uses algorithms to construct profiles about individual influencers and therefore we may use the personal data described in Section 1 so that an evaluation can be made about your behaviour, preferences and interests (among other things). Under the GDPR (to the extent applicable), this usage may be considered profiling. In particular, these algorithms assess your reach (e.g. size of your social media audience), relevance (e.g. the contextual affinity of your content to Aggero’s customers’ areas of interest) and resonance (e.g. audience engagement with your social media content) in various areas. The GDPR defines “profiling” as “any form of automated processing of personal data

consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements”. To the extent Aggero’s processing constitutes profiling under the GDPR (to the extent applicable), you have the right to specifically object to the processing of your personal data for the purpose of profiling in accordance with paragraph 7 below. To learn more, please reach out to contact@aggero.io.

Opting out

You can ask us or third parties to stop processing your personal data. To do this send an email to contact@aggero.io.

3. Disclosures of your personal data

We may share your personal data with the persons and in the contexts set out below: a. users of our platform and associated market-research database; b. service providers who provide us with IT, system administration, and other services;

c. professional advisers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services;

d. persons to whom we are under a duty to disclose or share your personal data in order to comply with any legal obligation, including without limitation public authorities who may need to see your personal data to meet national security or law enforcement requirements, and regulators and other authorities who require reporting of processing activities in certain circumstances;

e. third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with

them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice;

f. third parties with whom we may be required to communicate if we discontinue our business, or file a petition or have filed against us a petition in bankruptcy, reorganization or similar insolvency petition, application or proceeding;

g. our Corporate Affiliates; for the purposes of this privacy notice: “Corporate Affiliate” means any person or entity which directly or indirectly controls, is controlled by or is under common control with Aggero, whether by ownership or otherwise; and “control” means possessing, directly or indirectly, the power to direct or cause the direction of the management, policies or operations of an entity, whether through ownership of fifty percent (50%) or more of the voting securities, by contract or otherwise; and

h. third parties with whom we may be required to communicate in order to enforce or apply the terms of our agreements; or to protect the rights, property, or safety of Aggero, our customers, or others.

We use reasonable efforts to ensure that all third parties respect the security of your personal data and to treat it in accordance with the law. Apart from users of our market-research database, who will separately be required to adhere to privacy laws when dealing with your personal data, we do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our documented instructions.

4. International transfers

Where we use certain service providers in circumstances requiring a transfer of your personal data from a country in the EEA to another country outside of the EEA, we may use specific contracts approved by the European Commission which give personal data the same protection it has in the EEA under the GDPR. If we rely on another basis to transfer your personal data outside of the EEA, we will keep you updated by way of updates to this privacy notice.

Please contact us by emailing contact@aggero.io if you want further information on the specific mechanism used by us when transferring your personal data out of the EEA.

5. Data security

We have put in place appropriate security measures intended to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. Processors of your personal data acting on our documented instructions will only process your personal data in accordance with our instructions and are subject to a duty of confidentiality.

6. Data retention

We will only retain your personal data for as long as necessary to fulfil the purposes for which it was obtained. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

7. Your legal rights

Under certain circumstances, you may have certain rights under data protection laws in relation to your personal data, including to:

Request access to your personal data. This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of any new data you provide to us.

Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your personal data unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request for erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In particular, to the extent Aggero’s processing constitutes profiling under the GDPR, you have the right to specifically object to the processing of your personal data for the purpose of profiling. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.

If you wish to exercise any of the rights set out above, please email us to contact@aggero.io. Please note that Aggero reserves the right to refuse any request to exercise such rights to the extent permitted by applicable law.

No fee usually required

You generally will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

Time limit to respond

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

8. Changes of purpose

We will only use your personal data for the purposes for which it was obtained, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us by emailing contact@aggero.io.

If we need to use your personal data for an unrelated purpose, we will update this privacy notice and explain the legal basis which allows us to do so.

Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

9. Changes to our privacy notice

Any changes we make to this privacy notice in the future will be posted to our website. Please check back frequently to see any updates or changes to this privacy notice.

10. Privacy Notice for California Residents

Notwithstanding any earlier Effective Date applicable to this privacy notice generally, this paragraph 10 shall be effective from and after January 1, 2020. This paragraph 10 shall apply to you only if you are a California resident. This paragraph 10 shall apply only to the extent Aggero’ is regulated under the CCPA (as defined below) as a business (as defined in the CCPA).

When a business customer of Aggero uses our platform, that customer may enter information relating to influencers into its Aggero account. To the extent that information constitutes consumer information (as defined below) under the CCPA (as defined below), that information (excluding that certain publicly available influencer data for which Aggero is the business (as defined in the CCPA)) is referred to in this privacy notice as “California CRM-Stored Influencer Data”). To the extent we process California CRM-Stored Influencer Data solely in order to provide the platform to a particular customer, under the CCPA, to the extent applicable, we will act as a service provider (as defined in the CCPA) on behalf of that customer in respect of that California CRM-Stored Influencer Data; this privacy notice will not apply to the processing of that California CRM-Stored Influencer Data and the applicable customer will act as the business in respect of that California CRM-Stored Influencer Data and is responsible for obtaining all necessary consents and providing you with all requisite information as required by applicable law.

As used in this paragraph 10, “sell” (including all grammatically inflected forms thereof) means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, consumer information (as defined below) to another business or a third party for monetary or other valuable consideration.

“Selling” does not include (i) disclosing consumer information to a third party at your direction, provided the third party does not sell the consumer information except in

accordance with the California Consumer Privacy Act (the “CCPA”), (ii) where you intentionally interact with a third party through the platform, provided the third party does not also sell the consumer information, (iii) where you have opted out in accordance with paragraph 10(g), disclosures to third parties for the purposes of alerting such third parties that you have opted out of the sale of your consumer information, (iv) using or sharing your consumer information with a service provider as necessary to perform business purposes, provided that such service provider provides its services on Aggero’s behalf and provided that the service provider does not further collect, sell or use the consumer information except as necessary to perform the business purpose, or (v) transfers of your consumer information to a third party as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of Aggero’s, provided that information is used or shared consistently with the CCPA.

(a) Consumer Information Collected: We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with particular California residents, devices or households (“consumer information”). In particular, we have collected the following categories of consumer information from California residents, households or devices within the last twelve (12) months:

Category Examples Business or commercial purposes for which we use consumer

information

Identifiers.

Any identifiers you have manifestly made public, including your real name, date of birth, age, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social media handle or other similar identifiers.

For the purposes of allowing users of our platform and associated market-research database to discover, evaluate and manage their engagement with influential people. In addition to allowing users to conduct market research, as noted above, we will use your consumer information to connect you through our platform with companies (and their brands).

B. Personal information categories listed in

the

California Customer Records

statute

(Cal. Civ. Code §

1798.80(e)) .

Protected classificatio n

characterist ics under California or federal law.

Commercia l

information .

Biometric information .

Any personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) that you have manifestly made public, including your name, physical characteristics or description, address, telephone number, education, employment, employment history or any medical information.Some personal information included in this category may overlap with other categories.

Any protected classification characteristics under California or federal law that you have manifestly made public, including your age (if you are 40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).

Any commercial information you have manifestly made public, including products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

Any biometric information you have manifestly made public, including genetic, physiological, behavioral, and biological characteristics or other physical patterns, and sleep, health, or exercise data.

F. Internet or other

similar

network

activity.

G. Sensory data.

Professiona l or

employme nt-related information .

Inferences drawn from other

personal

information .

Any Internet or other similar network activity you have manifestly made public, including your interaction with a website or application (such as your social media posting history).

Any sensory data you have manifestly made public, including audio, electronic, visual or similar information.

Any professional or employment-related information you have manifestly made public, including your current or past job history.

Metrics reflecting characteristics and aptitudes, such as the relevance, reach and resonance of influencers, as well as demographic information of influencers’ audiences.

you through our platform with companies (and their brands).

(b) Use of Consumer Information: We use consumer information for the business or commercial purposes described in the table above and in the manner described in paragraphs 2 and 3 of this privacy notice with respect to personal data.

(c) Disclosures of Consumer Information for a Business Purpose: Aggero may disclose your consumer information described in the table above to a third party for a business purpose, as described in paragraph 3. In the preceding twelve (12) months, Aggero has disclosed the following categories of consumer information (as described in the table above) for a business purpose:

(i) Identifiers.

(ii) Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).

(iii) Protected classification characteristics under California or federal law. (iv) Commercial information.

(v) Biometric information.

(vi) Internet or other similar network activity.

(vii) Sensory data.

(viii) Professional or employment-related information.

(ix) Inferences drawn from other personal information.

(d) Sales of Consumer Information: Your consumer information (as described in the table above) may be sold (as defined above) for the business purpose of allowing users of our platform and associated market-research database to discover, evaluate and manage their engagement with influential people. In addition to allowing users to conduct market research, as noted above, we will use your consumer information to

connect you through our platform with companies (and their brands). In the preceding twelve (12) months, Aggero has sold the following categories of consumer information (as described in the table above):

(i) Identifiers.

(ii) Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).

(iii) Protected classification characteristics under California or federal law. (iv) Commercial information.

(v) Biometric information.

(vi) Internet or other similar network activity.

(vii) Sensory data.

(viii) Professional or employment-related information.

(ix) Inferences drawn from other personal information.

(e) California Residents’ Rights and Choices: The CCPA provides California residents with specific rights regarding their consumer information. This paragraph describes your CCPA rights (to the extent applicable to you) and explains how to exercise those rights.

(i) Access to Specific Information and Data Portability Rights: You may have the right to request that Aggero disclose certain information to you about our collection and use of your consumer information over the past 12 months. Once we receive and confirm your

verifiable consumer request (in the manner described in paragraph 10(f) below), to the extent required by the CCPA, we will disclose to you:

(A) The categories of consumer information we collected about you. (B) The categories of sources for the consumer information we collected about you.

(D) The categories of third parties with whom we share that consumer information.

(E) The specific pieces of consumer information we collected about you (also called a data portability request).

(F) If we sold or disclosed your consumer information for a business purpose, two separate lists disclosing (i) sales, identifying the consumer information categories that each category of buyer purchased; and (ii) disclosures for a business purpose, identifying the consumer information categories that each category of recipient obtained.

(ii) Deletion Request Rights: You have the right to request that Aggero delete any of your consumer information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm a verifiable request from you (if you are a California resident) in the manner described in paragraph 10(f) below (“verifiable consumer request”), we will delete (and direct our service providers to delete) your consumer information from our records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

(A) Complete the transaction for which we collected the consumer information, provide a product or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.

(B) Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.

(D) Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.

(E) Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et seq.).

(F) Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.

(G) Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.

(H) Comply with a legal obligation.

(I) Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

(f) Exercising Access, Data Portability, and Deletion Rights:

(i) To exercise the access, data portability, and deletion rights described in paragraph 10(e) above, please submit a verifiable consumer request to us by either: (1) calling us at +40 749 473 745 or contacting us in accordance with the paragraph above titled “Further help”. Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your consumer information. You may also make a verifiable consumer request on behalf of your minor child. You may make a verifiable consumer request for access or data portability no more than twice within a 12-month period. The verifiable consumer request must: (i) provide sufficient information that allows us to reasonably

verify you are the person about whom we collected consumer information or an authorized representative; and (ii) describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. We cannot respond to your request or provide you with consumer information if we cannot verify your identity or authority to make the request and confirm the consumer information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use consumer information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request. For instructions on exercising sale opt-out rights, see paragraph 10(g) below.

(ii) We endeavour to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to ninety (90) days), we will inform you of the reason and extension period in writing. If you have an account with us, we may deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your consumer information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance. If your requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may either charge a reasonable fee, taking into account the administrative costs of providing the information or communication or taking the action requested, or refuse to act on the request and notify you of the reason for refusing the request.

(g) Consumer Information Sales Opt-Out and Opt-In Rights:

(i) If you are 16 years of age or older, you have the right to direct us to not sell your consumer information at any time (the “right to opt-out”). We do not sell the consumer information of California residents we actually know are less than 16 years of age, unless we receive affirmative authorization (the “right to opt-in”) from either the California resident who is at least 13 years of age and less than 16 years of age, or the parent or guardian of a California resident less than 13 years of age. California residents who opt in to consumer information sales may opt out of future sales at any time.

(ii) To exercise the right to opt-out, you (or your authorized representative) may submit a request to us by contacting us in the manner described in Section 10(f) above or by visiting the following Internet Web page link:

Do Not Sell My Personal Information

(iii) Once you make an opt-out request, we will wait at least twelve (12) months before asking you to reauthorize consumer information sales. However, you may change your mind and opt back in to consumer information sales at any time by emailing contact@aggero.io.

(iv) You do not need to create an account with us to exercise your opt-out rights. We will only use consumer information provided in an opt-out request to review and comply with the request.

(h) Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights, including, unless permitted by the CCPA, by:

(i) Denying you goods or services.

(ii) Charging you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.

(iii) Providing you a different level or quality of goods or services.

(iv) Suggesting that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

This version of this privacy notice is effective as of, and was last updated on, January 1st, 2020 (the “Effective Date”).

Aggero.