Effective as of and last updated on July 24, 2023.

This Privacy Policy includes important information about your personal information and we encourage you to read it carefully.

INTRODUCTION

Carbeeza (“we,” “our,” “us” or “Carbeeza”) provides an online automotive marketplace for consumers as well as dealers, marketplaces, original equipment manufacturers (“OEMs”), and its financing partners. Carbeeza also provides UltraLead lead enhancement services to dealers, OEMs and other retailers.

Privacy and security are very important to us at Carbeeza. This Privacy Policy (this “Policy”) is meant to help you understand how we collect, use, and share personal information in our possession, including how we may use your personal information to operate, improve, develop and protect our services. This Policy also outlines certain rights you have regarding your personal information.

SCOPE

As used in this Policy, “personal information” or “personal data” means any information that identifies, relates to, describes, or is capable of being associated with or reasonably linked to, a particular person or household. Personal information may include your name, address, e-mail address, telephone number and basic financial information, such as an estimated credit profile and score.

This Policy applies to Carbeea, its websites at www.carbeeza.com and https://ultralead.ai/ (the “Websites”), and its products and services, including its software and API services (collectively, the “Service”). If you are a Carbeeza or UltraLead customer (i.e., you have contracted with Carbeeza to utilize our services and your contract with us conflicts with this Policy, the terms of your contract supersede the conflicting terms in this Policy.

On third-party websites, including our dealer and marketplace customer websites, the privacy statement or policy of the third party applies, even if those third-party websites integrate the Service. This Policy applies only to information directly submitted to or collected by the Service. This Policy does not govern the information practices or the content of any other websites or where the Service contains links to other websites. Carbeeza encourages you to review the privacy statements of other websites to understand their information practices.

What Personal Information Does Carbeeza Collect?

Below is a brief summary of the categories or types of information that we collect from our customers, the employees and other authorized users of our customers, and end-users.

If you are a Carbeeza or UltraLead customer, which may include automotive dealers and marketplaces and our financing partners (collectively, “Carbeeza Customers”), we may collect and receive information and data pertaining to your customers and billing details, such as credit card and bank account information and your billing address.

If you are an employee, authorized user, or other individual who is granted access to the Service by a Carbeeza or UltraLead Customer (collectively, “Authorized Users”), we may collect your email address, phone number, password, and domain (or similar account details) information.

If you are a user of the Service, which includes customers who are shopping, purchasing, or applying for financing of an automobile (collectively, “End Users”), we may request, and you may provide financial credit data, postal address and email address (together, with Carbeeza Customer Information, “Other Information”).

If you otherwise access or use the Service, including if you are a visitor to the Website, we may collect, or you may provide, the following information: metadata that provides additional context about the way you work and use the Service;

As with most websites and technology services delivered over the Internet, our servers automatically collect information when you access or use our websites or Service and record that information in log files. This log data may include the Internet Protocol (IP) address, the address of the web page visited before using the website or Services, browser type and settings, the date and time the Services were used, information about browser configuration and plugins, language preferences and cookie data; and

information about devices accessing the Website and Service, including the type of device, what operating system is used, device settings, application IDs, and unique device identifiers. Whether we collect some or all of this Other Information often depends on the type of device used and its settings.

How Do We Use and Share Personal Information?

Broadly, we use any personal information we collect or receive to provide the Service or as may be permitted or required by law or regulation.

Carbeeza Customers. If you are a Carbeeza or UltraLead Customer, we may use personal information to fulfill our obligations to you or to perform the services you request. We may also use personal information to carry out our core business operations and to perform functions such as billing and reconciliation and meet our contractual and legal obligations related to anti-money laundering and “know-your-customer” (KYC) obligations.

Authorized Users. If you are an Authorized User, we may use your personal information in connection with providing the Service to a Customer. This may include using your personal information to create, update and maintain your account with Carbeeza.

End Users. If you are an End User, we may use your personal information in connection with or to facilitate the purchase, lease, or financing of an automobile when you go through the automobile transacting or financing process. Further, we may share your personal information with our services providers, vendors, and other third parties in connection with the automobile transacting process and the evaluation of your loan application. This may include your name, email address, phone number, financing credit data and physical address.

Additionally, we may use and share your personal information for other business purposes, which may include:

with our services providers, partners, or contractors, including data processors, in connection with the services they perform for us;

• to enforce a contact with you;

• to comply with applicable law or regulation, or a judicial proceeding, court order, or legal process;

• to ensure the quality of information;

• in connection with a change of ownership or control of all or part of our business

• as we reasonably believe is appropriate to protect the rights, privacy or property of you, Carbeea, our partners, and others; or

• for any other purpose with your consent.

Finally, we may collect, use and share your information in an aggregated, de-identified or anonymized form, which will not identify you personally, for any purpose permitted under applicable law. This may include creating or using aggregated, de-identified, or anonymized data to improve or develop products and services.

We do not sell or rent personal information and will not share your personal information with third parties for their own marketing or promotional purposes unless you ask us to or provide us your consent to do so.

DISCLOSURE

The Company may share personal data with third parties for legitimate business purposes, including but not limited to, service providers, vendors, contractors, and business partners. Personal data may also be disclosed to comply with legal or regulatory requirements, or in response to lawful requests from public authorities. The Company will take appropriate measures to ensure that third parties receiving personal data are bound by confidentiality obligations and provide adequate protection to the personal data.

COOKIES

When you visit our Website, sign up or respond to a promotional offer, fill out a website, or request information from us, we may collect information about you using cookies and other similar tracking technologies. We do this by sending a cookie to your computer or device when you access the Service. We collect this information to make interactions with the Service easier and more meaningful. Unless you choose to identify yourself to Carbeeza, either by responding to a promotional offer, opening an account, or filling out a web form (such as a “Contact Me” or a “30-Day Free Trial” web form), that cookie is the only identifying information Carbeeza collects about your browsing session.

There are two types of cookies we use: session-based and persistent-based. Session cookies exist only during one session. They disappear from your computer when you close your browser software or turn off your computer. Persistent cookies remain on your computer after you close your browser or turn off your computer.

If you have chosen to identify yourself to Carbeeza, website uses session cookies containing unique identifiers to allow Carbeeza to uniquely identify you. Each time you access the Service, a session cookie containing an encrypted, unique identifier that is tied to your account is placed in your browser. These session cookies allow Carbeeza to uniquely identify you when you are navigating the Service and to process your online transactions and requests. Session cookies are required to use the Service.

Carbeeza may use persistent cookies that only Carbeeza can read and use to identify browsers that have previously accessed the Service. In such case, when you access the Service or provide Carbeeza with personal information, a unique identifier is assigned to you. This unique identifier is associated with a persistent cookie that Carbeeza places on your web browser. Carbeeza is especially careful about the security and confidentiality of the information stored in persistent cookies. For example, Carbeeza does not store account numbers or passwords in persistent cookies. If you disable your web browser’s ability to accept cookies, you will be able to navigate the Service, but you will not be able to successfully use the Service.

From time to time, we engage third parties to track and analyze non-personally identifiable usage and volume statistical information from individuals who access the Service. This session tracking is used to store information or maintain data on individuals in order to recognize those individuals’ requests when they connect to the Service. We may also use other third-party cookies to track the performance of Carbeeza advertisements. The information provided to third parties does not include personal information, but this information may be re-associated with personal information after Carbeeza receives it. This Policy does not cover our use of third-party cookies.

STORAGE AND RETENTION OF PERSONAL INFORMATION

We retain personal information for no longer than necessary to fulfill the purposes for which it was collected and used in accordance with our agreements with Carbeeza Customers, as applicable, as described in this Policy, unless a longer retention period is required or permitted under applicable law. As permitted under applicable law, even after you stop using an application or terminate your account with one or more Carbeeza Customers, Carbeeza may still retain your information (for example, if you still have an account with another Customer). However, your information will only be processed as required by law or in accordance with this Policy.

Please refer to the “Your Data Protection Rights” section for options that may be available to you, including the right to request deletion of User Data or Other Information. You can also contact us about our data retention practices using the contact information below.

SECURITY

Carbeeza is committed to protecting the confidentiality of your information and online transactions. We maintain physical, technical, organizational, and administrative security measures designed to protect your personal information from unauthorized access and use, alteration, and destruction. Our security controls include the use of strong browser encryption, use of secure facilities for data storage and processing, and limiting access to your information to employees, agents, and contractors who need to know such information to provide products or services to you. Unfortunately, no data transmission or storage system can be guaranteed to be 100% secure. If you have a reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with the “Contacting Carbeeza” section below.

CHANGES TO THIS PRIVACY STATEMENT

We reserve the right to change this Policy at any time by posting a new version on our Website. You will not be given any notice of these modifications. Your continued use of the Service after any changes are posted will be deemed to constitute your agreement to and acceptance of such changes to this Policy. Carbeeza will also notify Customers of any material changes as specified in their agreements, as they are generally best positioned to notify their end-users about such changes to this Policy, as appropriate.

YOUR DATA PROTECTION RIGHTS

Under applicable law, and subject to limitations and exceptions provided by law, if you are a California resident, you may have the following rights with respect to User Data and Other Information Carbeeza has collected or received about you that constitutes personal information under the CCPA:

to request access to more details about the categories and specific pieces of personal information we may have collected about you in the last 12 months (including personal information disclosed for business purposes);

• to request deletion of your personal information;

• to opt-out of any “sales” of your personal information, if a business is selling your information; and

• to not be discriminated against for exercising these rights.

• to exercise your access or deletion rights, where applicable, you can submit a request to: support@carbeeza.com. You may be required to provide additional information necessary to verify your identity before we can respond to your request.

We will consider all such requests and provide our response within a reasonable period of time (and within any time period required by applicable law). Please note, however, that certain information may be exempt from such requests, for example, if we need to keep the information to comply with our own legal obligations or to establish, exercise, or defend legal claims.

Please note, if you are an End User, we may contact the relevant Carbeeza Customer that collected your User Data or Other Information to process your request.

HR PRIVACY NOTICE

This Policy also applies to all applicants and prospective employees (collectively, “Applicants”) and current and former employees, officers, directors, contractors, and agents of Carbeeza (collectively, “Workers”) whose personal information is collected or processed by us in the course of our business.

In the course of your employment, or during the course of your applying and going through the application process, with Carbeeza, we may collect personal information directly from you, which may include:

General HR Information: this might include: your name, address, phone number, social security number or other unique personal identifier, driver’s license number, date of birth, age, employment and education history and records, professional qualifications, salary information, financial information related to credit and background checks, and other information that may be included on your CV, resume or application;

Demographic and health information: where required to run our business and ensure the safety of our Workers, we may collect sensitive personal information such as details of your health or disability, including information concerning your COVID-19 testing and vaccination status, health insurance information, mental health information, medical and maternity leave, national origin, and immigration status. Where permitted by law, we may also ask Applicants and Workers to provide optional information such as race, disability, marital status, sex, ethnicity, gender, and military or veteran status;

Legal Information: we may collect contractual information, such as information necessary to comply with our legal and contractual obligations or to initiate or respond to legal claims; and

Information from Other Sources: we may collect or receive information about you from other sources, including through third-party services to supplement information provided by you. For example, we may conduct background and credit checks on you prior to your employment.

We collect personal information about you to operate our business. This may include determining whether to offer you employment at the Company, to contact your emergency contact in the event something happens to you at work, to keep you safe and to provide you efficient resources to do your job, to respond to your HR-related questions, and to comply with the law. We may share your information with our vendors and services providers, such as those we use for your HR and IT services, to law enforcement if we receive a proper request or if we reasonably believe it is necessary to protect the rights or safety of you or our team, and to other individuals, including other Workers, if you post content to Company sites, including our wiki page, or our public-facing sites. We do not sell your personal information.

CALIFORNIA CONSUMER PRIVACY ACT

If you are a California resident, the California Consumer Privacy Act (“CCPA”) provides you certain rights and choices regarding how we collect, share, use, and protect your “personal information” and how you can exercise those rights. The CCPA defines “personal information” as information that identifies, relates to, describes, or is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

We do not share or sell personal information, nor have we sold it, in the last 12 months.

Certain information that we collect may be exempt from the CCPA because it is considered public information or covered by financial privacy laws, such as the Gramm-Leach Bliley Act, the California Financial Information Privacy Act, the Health Insurance Portability and Accountability Act, or the Fair Credit Reporting Act.

To the extent that we collect personal information that is subject to the CCPA, that information, our practices, and your rights are described below.

Under the California Consumer Privacy Act, California residents have the right to:

Request that a business delete any personal information about the consumer that the business has collected from the consumer. We collect the following categories of personal information:

• Identifiers (e.g., your name, postal address, and social security number);

• Customer records information; and

• Internet or other electronic network activity information.

Request that a business that collects personal information about the consumer disclose to the consumer, free of charge, the following:

• the categories of personal information that it has collected about that consumer;

• the categories of sources from which the personal information is collected;

• the business or commercial purpose for collecting or selling personal information;

• the categories of third parties with whom the business shares personal information; and

• the specific pieces of personal information it has collected about that consumer.

Request that a business that sells the consumer’s personal information, or that discloses it for a business purpose disclose, free of charge, to the consumer:

• the categories of personal information that the business collected about the consumer;

• the categories of personal information that the business sold about the consumer and the categories of third parties to whom the personal was sold, by category or categories of personal information for each third party to whom the personal information was sold; and

• the categories of personal information that the business disclosed about the consumer for a business purpose.

Direct a business that sells personal information about the consumer to third parties not to sell the consumer’s personal information.

You may submit a CCPA request by providing your first name, last name, email address, telephone number and ZIP code to the contact information listed below. You may also designate an authorized agent to make such requests on your behalf by mailing a signed Power of Attorney to us.

We will not discriminate against you because you exercise any of the rights as described in this section.

COMPLIANCE

Compliance with this Data Privacy Policy is mandatory for all employees, contractors, and third parties who collect, use, or process personal data on behalf of the Company.

CONTACTING CARBEEZA

If you have any questions or comments about this Policy, or Carbeeza’s privacy practices generally, you can contact Carbeeza at support@carbeeza.com.