Privacy Notice

Collection of Personal Data

Types of Personal Data We Collect

Exclusions

Protecting Personal Data

Disclosing Personal Data to Third Parties

Categories of Personal Data We Collect	Categories of Third Parties With Whom We Disclose Personal Data for a Business Purpose	Categories of Third Parties to Whom Personal Data is Sold or Shared for Targeted Advertising
Identifiers (Section 2.A)	·         Affiliates and subsidiaries ·         Service providers ·         Professional consultants ·         Vendors necessary to complete transactions you request ·         Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes ·         In connection with a corporate transaction ·         Entities to which you have consented to the disclosure	·          Partners who work with us on promotional opportunities, including co-branded products and services
Records about you (Section 2.B)	·       Affiliates and subsidiaries ·       Service providers ·       Professional consultants ·       Vendors necessary to complete transactions you request ·       Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes ·       In connection with a corporate transaction ·       Entities to which you have consented to the disclosure	·         Partners who work with us on promotional opportunities, including co-branded products and services
Demographic Information (Section 2.C)	·         Not applicable. We do not collect this information to the degree that it could identify you.	·         Not applicable. We do not collect this information to the degree that it could identify you.
Financial & Commercial information (Section 2.D)	·         Not applicable. We do not collect this information through our website.	·         Not applicable. We do not collect this information through our website.
Biometric information (Section 2.E)	·         Not applicable. We do not collect this information through our website.	·         Not applicable. We do not collect this information through our website.
Internet or other electronic network activity (Section 2.F)	·         Not applicable. We do not collect this information to the degree that it could identify you.	·         Not applicable. We do not collect this information to the degree that it could identify you.
Geolocation data (Section 2.G)	·         Affiliates and subsidiaries ·         Service providers ·         Professional consultants ·         Vendors necessary to complete transactions you request ·         Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes ·         In connection with a corporate transaction	·         Partners who work with us on promotional opportunities, including co-branded products and services
Audio, electronic, visual, or other sensory information (Section 2.H)	·         Not applicable. We do not collect this information through our website.	·         Not applicable. We do not collect this information through our website.
Professional or employment-related information (Section 2.I)	·         Affiliates and subsidiaries ·         Service providers ·         Professional consultants ·         Vendors necessary to complete transactions you request ·         Law enforcement, government, agencies, and other recipients for legal, security, or safety purposes ·         In connection with a corporate transaction ·         Entities to which you have consented to the disclosure	·         Not applicable – we do not sell or share this information outside of our business purpose.
Education information (Section 2.J)	·         Not applicable. We do not collect this information through our website.	·         Not applicable. We do not collect this information through our website.
Inferences (Section 2.K)	·         Not applicable. We do not make inferences based on the personal information you provide via our website.	·         Not applicable. We do not make inferences based on the personal information you provide via our website.
Sensitive personal information (Section 2.L)	·         Not applicable. We do not collect this information through our website.	·         Not applicable. We do not collect this information through our website.

Promotional and Marketing Policy

Cookies and Tracking Technologies

About cookies

Cookie List

Strictly Necessary Cookies

Targeting Cookies

Social Media Cookies

Additional Cookies Information

Third-party Websites

Children

Our website is not intended for children under 16 years of age. No one under age 16 may provide any information to us through this website. We do not knowingly collect Personal Data from children under 16. If you are under 16, do not access, use, or provide any information on the website or on or through any of its features. If we learn we have collected or received Personal Data from a child under 16 without parental consent, we will delete that information. If you believe we might have any information from or about a child under 16, please contact us by sending us an email at DPO@ipipeline.com or writing to us iPipeline Headquarters (USA), 222 Valley Creek Boulevard, Suite 330, Exton, PA 19341.

Data Security

Although we maintain reasonable security safeguards, no security measures or communications over the Internet can be 100% secure, and we cannot guarantee the security of your information. While we work hard to protect data incidents, we have dedicated controls and procedures in place for when such situations, along with the procedures that are required to make notifications to you and to the relevant Supervisory Authority as appropriate.

Data Retention

Your Personal Data will be retained as long as necessary to fulfill the purposes we have outlined above unless we are required to do otherwise by applicable law. This includes retaining your Personal Data to provide you with the products or services you have requested and interact with you; maintain our business relationship with you; improve our business over time; ensure the ongoing legality, safety and security of our services and relationships; or otherwise in accordance with our internal retention procedures. Once you have terminated your relationship with us, we may retain your Personal Data in our systems and records in order to ensure adequate fulfillment of surviving provisions in terminated contracts or for other legitimate business purposes, such as to enable easier future user onboarding, demonstrate our business practices and contractual obligations, or provide you with information about our products and services in case of interest. If you would like to know more about the retention periods applicable to your Personal Data, you can contact us at DPO@ipipeline.com.

International Transfers of Personal Data

Your data may be used and disclosed by the Company and its divisions, holding companies, subsidiaries and affiliates, or other entities outside of your country, including in countries that have a different standard of data protection than in your own country. For individuals whose data is subject to the General Data Protection Regulation (GDPR) in either the EEA or the UK, we have taken steps to protect your privacy and fundamental rights when your Personal Data is transferred to the other countries, including the United States. For transfers to entities outside the EEA or UK, we make use of the European Commission’s Standard Contractual Clauses. For transfers to third parties, we make sure that the recipient is subject to a jurisdiction for which there is an adequacy decision of the European Commission or UK, as applicable, or that there are adequate safeguards such as Standard Contractual Clauses or Binding Corporate Rules in place.

Changes to this Privacy Policy

We may update this Privacy Policy at our discretion to reflect changes we deem necessary or to satisfy legal requirements. We will post a prominent notice of material changes on our websites.

Contact Us

We welcome comments and questions regarding this Privacy Policy. Any such questions should be directed via e-mail to DPO@ipipeline.com. Additionally, you may make your request in writing to iPipeline Headquarters (USA), 222 Valley Creek Boulevard, Suite 330, Exton, PA 19341.

ADDITIONAL STATE-SPECIFIC PRIVACY RIGHTS

Provisions in the California Consumer Privacy Act (CCPA), Virginia Consumer Data Protection Act (VDCPA), Colorado Privacy Act (CPA), Utah Consumer Privacy Act (UCPA), Nevada Senate Bill 220, and Connecticut Data Privacy Act (CTDPA) and other state statutes require some or all of the following disclosures. These disclosures supplement the Privacy Notice above and areas effective as of April 11 2024. Categories of personal information collected. The personal information that iPipeline collects or has collected from consumers in the twelve months prior to the effective date of this Disclosure, fall into the following categories established by the California Consumer Privacy Act and listed in Section 2 above. Sources from which we collect your Personal Data. We collect the categories of Personal Data listed above directly from consumers. Purposes for which we use your Personal Data: We use your Personal Data for the purposes listed in Section 3 of the main privacy notice above. No selling or sharing of Personal Data. iPipeline has not sold or shared any Personal Data of consumers, as those terms are defined under the California Consumer Privacy Act, in the 12 months prior to the effective date of this Disclosure. California Shine the Light: If you are a California resident, you may opt out of sharing your Personal Data subject to California Civil Code §1798.83 (the “Shine the Light law”) with third parties for those third parties’ direct marketing purposes by using our iPipeline Data Protection Request Form. California Eraser Law: Any California residents under the age of eighteen (18) who have posted content or information on our Digital Properties can request removal by contacting us at DPO@ipipeline.com, detailing where the content or information is posted, and attesting that you posted it. We will make reasonable, good faith efforts to remove the post from prospective public view or anonymize it so the minor cannot be individually identified to the extent required by applicable law. This removal process cannot ensure complete or comprehensive removal. For instance, third parties may have republished or archived content that we do not control. No Discrimination. iPipeline will not discriminate against any consumer for exercising their rights under the applicable state laws. Virginia Consumer Data Protection Act Deidentified Data Disclosure. We may use deidentified data in some instances. To the extent we use deidentified data, we will either maintain this data without attempting to re-identify it or we will treat it as Personal Data subject to applicable law. Quebec Data Protection Contact. Pursuant to the requirements of Bill 64 of the National Assembly of Quebec, you may contact our Director of Data Protection at DPO@ipipeline.com.