Privacy Policy 1. Scope This Privacy Policy applies to personal information Cordant processes in connection with: • our websites and other online properties; • sales, marketing, and business development activities; • customer and prospect relationships; • user accounts and administration of the Cordant platform; • support and other communications with us; • events, webinars, and other business activities; and • recruiting and job applications. When Cordant processes data through its platform on behalf of a customer, that customer generally determines why and how the information is processed. In those circumstances, Cordant acts as a processor or service provider to the customer, and the customer's privacy notice and our agreement with that customer govern the processing. 2. Information We Collect The personal information we collect depends on how you interact with Cordant. Information you provide to us We may collect information such as: • name; • business email address; • telephone number; • job title and role; • company or organization; • account credentials; • communications you send to us; • demo, sales, or support requests; • event registrations; • marketing preferences; and • information you provide when applying for a position with Cordant. We ask that you not submit sensitive personal information through general website forms unless we specifically request it. Information collected automatically When you use our websites or services, we may automatically collect certain technical and usage information, including: • IP address; • browser and device information; • operating system; • pages viewed; • referring and exit pages; • dates and times of activity; • interactions with our website or communications; • log data; and • cookie and similar technology identifiers. We use this information to operate our services, understand how they are used, protect against misuse, and improve performance. Information from other sources We may receive business contact information from: • your employer or organization; • business partners; • event organizers; • publicly available business sources; • professional networks; • service providers; and • other parties you have authorized to provide information to us. 3. Customer Data Processed Through Cordant Cordant's platform may connect to systems, documents, records, agreements, and other information made available by our customers. This information may contain personal information. For this data, Cordant generally acts on the instructions of the customer that provided or authorized access to the data. We process it only as necessary to provide, secure, support, and improve the services in accordance with our agreements with that customer. Cordant does not acquire ownership of customer data simply because the platform can access or analyze it. We do not sell customer data. We do not use customer data for advertising. We do not use customer data to train general-purpose artificial intelligence models unless the customer has expressly agreed to that use. Where technically and commercially appropriate, our agreements with service providers require them to process customer data only for purposes of providing services to Cordant and not for their independent purposes. If you are an individual seeking to exercise rights regarding personal information contained in a Cordant customer's systems, you should normally direct your request to that customer. If we receive such a request directly, we may refer it to the applicable customer or assist the customer in responding as required by law and our agreement. 4. How We Use Personal Information We may use personal information to: • operate and provide our websites and services; • establish and administer customer accounts; • authenticate users and control access; • provide demonstrations; • respond to inquiries and support requests; • manage customer, partner, and vendor relationships; • process transactions and administer contracts; • communicate about our products, services, and events; • understand website and product usage; • improve our products, services, and user experience; • develop new features and capabilities; • maintain the security, integrity, and availability of our systems; • detect and prevent fraud, abuse, security incidents, and other harmful activity; • comply with legal and regulatory obligations; • establish, exercise, or defend legal claims; • conduct corporate transactions such as financing, mergers, acquisitions, or reorganizations; and • recruit and evaluate candidates. We may also use information for other purposes disclosed when it is collected or with your consent. 5. Artificial Intelligence and Automated Processing Cordant may use artificial intelligence, machine learning, and other automated technologies as part of our products and internal operations. Where these technologies process customer data, they are subject to the same contractual, security, and confidentiality controls that apply to other processing of customer data. Cordant does not independently use personal information collected through our website to make decisions about individuals that produce legal or similarly significant effects. Our products may generate analyses, recommendations, explanations, or other outputs to assist customers in their operations. Customers remain responsible for determining how those outputs are used within their organizations. 6. How We Disclose Personal Information We may disclose personal information to the following categories of recipients. Service providers We use companies that help us operate our business, such as providers of: • cloud infrastructure; • security services; • website hosting; • customer relationship management; • communications; • analytics; • customer support; • payment processing; • professional services; and • business operations. These providers may process personal information only as necessary to perform services for us and subject to appropriate contractual restrictions. Your organization If you use Cordant through your employer or another organization, we may disclose information about your account and use of the service to authorized administrators of that organization. Professional advisers We may disclose information to lawyers, accountants, auditors, insurers, financial advisers, and other professional advisers where reasonably necessary. Corporate transactions If Cordant is involved in a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, or similar transaction, personal information may be disclosed as part of that process. Legal and security purposes We may disclose information when we reasonably believe doing so is necessary to: • comply with applicable law, regulation, court order, subpoena, or legal process; • respond to lawful requests from governmental authorities; • enforce our agreements or protect our rights; • protect the rights, property, or safety of Cordant, our customers, users, or others; or • investigate or prevent fraud, security incidents, or unlawful activity. 7. Sale and Targeted Advertising Cordant does not sell personal information for monetary consideration. Cordant does not share personal information for cross-context behavioral advertising as those terms are defined under applicable U.S. state privacy laws. We may disclose information to service providers and processors that perform services on our behalf. Those disclosures are not intended to permit the recipient to use the information for its own independent advertising purposes. Where required by applicable law, Cordant recognizes qualifying universal opt-out preference signals, such as Global Privacy Control. 8. Cookies and Similar Technologies Cordant and our service providers may use cookies and similar technologies to: • operate essential website functionality; • remember preferences; • maintain security; • understand website performance and usage; and • measure the effectiveness of our communications. Some cookies are necessary for our websites to function. Others may be optional. Where required by law, we will request consent before using non-essential cookies and provide a mechanism to manage cookie preferences. You may also control cookies through your browser settings. Disabling some cookies may affect website functionality. 9. Marketing Communications We may send business and marketing communications about Cordant products, events, research, or other information we believe may be relevant to you. You may unsubscribe from marketing emails using the unsubscribe link in the message or by contacting us. Even if you opt out of marketing communications, we may continue to send non-promotional communications relating to your account, transactions, security, or our business relationship with you. 10. Legal Bases for Processing If you are located in the European Economic Area, United Kingdom, Switzerland, or another jurisdiction requiring a lawful basis for processing, Cordant may process personal information based on: • Contract: where processing is necessary to enter into or perform an agreement with you or your organization; • Legitimate interests: where processing is necessary for our legitimate business interests, including operating, securing, improving, and marketing our services, and those interests are not overridden by your rights; • Consent: where you have given us consent to process information for a particular purpose; or • Legal obligation: where processing is necessary for us to comply with applicable law. Where processing is based on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that occurred before consent was withdrawn. 11. Data Retention We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to: • provide our services; • maintain our business relationship with you or your organization; • comply with legal, accounting, and regulatory requirements; • resolve disputes; • enforce agreements; and • protect the security and integrity of our systems. Retention periods vary depending on the type of information, why it was collected, contractual requirements, and applicable law. Customer data is retained and deleted in accordance with our agreements with the applicable customer and our data retention procedures. 12. Security Cordant uses technical and organizational safeguards designed to protect personal information against unauthorized access, use, alteration, disclosure, or destruction. These measures may include access controls, authentication, encryption, monitoring, logging, vulnerability management, and other administrative, technical, and physical safeguards appropriate to the nature of the information and the risks involved. No system can be guaranteed to be completely secure. We continually evaluate our safeguards as our technology, products, and risks evolve. 13. International Data Transfers Cordant and our service providers may process information in the United States and other countries where we or our providers operate. These countries may have data protection laws that differ from those in your jurisdiction. Where required, we use appropriate safeguards for international transfers of personal information, which may include approved contractual protections such as Standard Contractual Clauses or other legally recognized transfer mechanisms. 14. Your Privacy Rights Depending on where you live, you may have rights regarding your personal information. These may include the right to: • know whether we process your personal information; • request access to personal information we maintain about you; • request correction of inaccurate personal information; • request deletion of personal information; • obtain a portable copy of certain personal information; • object to or restrict certain processing; • opt out of certain forms of sale, sharing, targeted advertising, or profiling; • withdraw consent where processing is based on consent; • appeal a decision we make regarding a privacy request; and • lodge a complaint with an applicable data protection authority. You will not be discriminated against for exercising rights provided by applicable privacy law. Certain rights are subject to exceptions and limitations under applicable law. Exercising your rights To submit a privacy request, contact us at: privacy@cordant.ai Please include enough information for us to understand your request and identify the information involved. We may need to verify your identity before completing certain requests. Where permitted by law, you may also use an authorized agent to make a request on your behalf. If your request concerns information Cordant processes solely on behalf of one of our customers, we may direct you to that customer. 15. California Privacy Rights If you are a California resident and the California Consumer Privacy Act, as amended by the California Privacy Rights Act, applies to our processing of your personal information, you may have specific rights regarding that information. The categories of personal information Cordant may collect are described in Section 2, the purposes for which we use that information are described in Section 4, and the categories of parties to whom we may disclose information are described in Section 6. Depending on our relationship with you, those categories may include identifiers, professional or employment-related information, internet or electronic network activity, commercial information, and other information you provide to us. Cordant does not sell personal information for monetary consideration and does not share personal information for cross-context behavioral advertising. California residents may exercise applicable rights to know, access, correct, delete, and obtain information about the use and disclosure of their personal information as described in Section 14. 16. Colorado and Other U.S. State Privacy Rights Residents of Colorado and other U.S. states with applicable comprehensive privacy laws may have rights to access, correct, delete, and obtain a portable copy of personal data and, where applicable, to opt out of certain sales, targeted advertising, or profiling. Where applicable, you may also have the right to appeal our response to a privacy request. Cordant honors applicable privacy rights in accordance with the law of your state. 17. European and UK Privacy Rights If the GDPR, UK GDPR, or similar data protection law applies to you, you may have rights to: • access your personal data; • correct inaccurate or incomplete data; • request deletion; • restrict processing; • object to certain processing; • receive certain data in a portable format; • withdraw consent; and • lodge a complaint with the data protection authority in your country. These rights are subject to applicable legal requirements and exceptions. 18. Children's Privacy Cordant provides business-to-business products and services and is not directed to children. We do not knowingly collect personal information from children through our websites for consumer purposes. If you believe a child has provided personal information to us inappropriately, please contact us so that we can review and, where appropriate, delete the information. 19. Third-Party Websites and Services Our websites may contain links to third-party websites or services. Cordant is not responsible for the privacy, security, or content practices of third parties. We encourage you to review their privacy notices before providing personal information to them. 20. Changes to This Privacy Policy We may update this Privacy Policy from time to time as our business, products, or legal obligations change. When we make changes, we will update the Last Updated date at the top of this policy. If changes are material, we may provide additional notice where appropriate or required by law. 21. Contact Us If you have questions about this Privacy Policy, our privacy practices, or your personal information, contact us at: Cordant, Inc. Email:privacy@cordant.ai Address: 5490 SW 85th St, Miami, FL 33143 For privacy rights requests: privacy@cordant.ai