Privacy Policy

This privacy policy (“Privacy Policy”) is designed to help you understand how Dirrl, Inc. (“Dirrl,” “we,” “us,” or “our”) collects, uses, and shares your personal information and to help you understand and exercise your privacy rights.

Scope

This Privacy Policy applies to personal information processed by us on our website https://dirrl.com and/or other Dirrl-branded websites (“Website”), mobile applications, and related services and offerings (collectively, the “Services”). By visiting our Website or accessing our Services, you are agreeing to the terms of this Privacy Policy. This Privacy Policy is incorporated by reference into the Dirrl Terms of Service or other agreement governing the use of Dirrl Services (the “Agreement”).

Capitalized terms not otherwise defined in this Privacy Policy shall have the meaning ascribed to them in the Agreement.

1. Information We Collect

The categories of information we collect depend on how you interact with us, our Services, and the requirements of applicable law. For example, we may collect different information from you depending on whether you are a visitor to our Website or register to use our Services.

If you register to use Dirrl’s Services, you may be required to provide personal information, such as your name, email address, mailing address or phone number, organization name and other data (collectively, “Account Information”). Dirrl may collect this information for the purposes described in this Privacy Policy, for instance to detect fraud and inauthentic content and enable you to create, share, or display User-Generated Content (defined below).

Account Information. If you register to use Dirrl’s Services, or in order to submit User-Generated Content, you may be required to create an account with Dirrl as a Client or as a Customer or user\consumer. During account creation, you may be asked to submit information, such as but not limited to, your name, email address, mailing address or phone number, and other data (collectively, “Account Information”). To understand how a Client will use such data, please consult the terms and conditions on that Client’s website (e.g. the Marchant’s privacy notice or privacy policy).

User-Generated Content. As part of our Services to Clients and Customers, we provide Customers the ability to submit reviews, and to comment on or rate goods, products, and services on websites and mobile applications within our network (collectively, “User-Generated Content”). You should be aware that any information you provide in the area that is intended to collect such User-Generated Content may be published on a publicly facing website or mobile application and may be read, collected, and used by Dirrl, its affiliates, subsidiaries, vendors, and by Clients. Therefore, please do not include any information within these areas that you do not want to share with the public, including personally identifiable information, such as your name, email address or financial information. Dirrl uses User-Generated Content to provide Services to Clients and for market research, product development, service improvement, fraud detection, and analytics.

Other users and Clients may be able to identify you, or associate you with your content, if you include personal information in the content you post publicly. You can reduce the risk of being personally identified by using the Services pseudonymously, though doing so could detract from the credibility of your contributions to the Services.

Personnel Information. “Personal Information” means information that can be used to identify you, as further described below. Your submission of Personal Information is voluntary, but we may be unable to provide you requested information or services if you choose not to provide necessary Personal Information. We or our representatives may collect the following categories of Personal Information:

1. Identifiers - A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name or other similar identifiers.

2. Categories listed in the California Customer Records law (Cal. Civ. Code §1798.80 (e)) - A name, signature, physical characteristics or description, address, telephone number.

3. Commercial information - Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

4. Internet or other similar network activity - Browsing history, search history, information on a consumer’s interaction with our Website, Services, application, or advertisement.

5. Geolocation data - Physical location or movements. We may collect Personal Information that is considered “sensitive” in some jurisdictions to the extent you create such information by using our application, or to the extent you share it with us. You are not required to provide sensitive information to use our Website and our Services. However, if you provide it, it will be used in accordance with this Privacy Policy.

We also collect “Non-Personal Information,” meaning technical and other information that does not identify you personally. Non-Personal Information also includes information that may originally have been Personal Information but has been aggregated or anonymized, such that it cannot be used to identify any individual or has been segregated from other Personal Information.

2. How We Obtain Your Personal Information

When you register for and use the Services. When you register for the Services, we typically collect fields such as your first name, last name, email address, postal address, telephone number, organization name, and profile picture. We also collect information about actions inputted into the Services, such as tasks you have assigned or accepted, and details of purchases you have made from a Client, which may include Personal Information.

Your communications with us. We may collect your name, email address, postal address, language preferences and telephone number when you request information about our Services, register for email alerts, request customer or technical support, or otherwise communicate with us. When applying for a job, we may collect resume/CV, cover letters, and similar materials.

Surveys/Forms/Questionnaires/Content. We may contact you to participate in surveys or other questionnaires, or the Services may offer you the opportunity to create User-Generated Content or other original content which can be shared with other users. If you decide to participate, you may be asked to provide certain information, which may include Personal Information.

Third-Party Providers. The Services may give you the option to link your accounts on third-party platforms or use those platforms via our Services (collectively, “Third-Party Providers”) and we may import relevant Personal Information from those Third-Party Providers. This linking is entirely optional and subject to the consent you provide to either us or to the Third Party, but may enable a richer and more effective user experience. If you do link such accounts, you acknowledge and agree that we, via the Services, will receive Personal Information from such Third-Party Providers.

Automatic Data Collection. We, or our third-party partners, may collect personal information and de-identified information automatically when you use our Services, such as your Internet protocol (IP) address, user agent string (e.g., browser or device information), user settings, actions taken on the Services, browser or device information, location information (including approximate location at derived from IP address or, as applicable, as otherwise allowed via your consent through the device’s operating system), and Internet service provider, for purposes such as analytics, machine-learning, security, and otherwise providing more streamlined/optimized, personalized, or relevant features and functionality on the Services. This information is collected via various technologies, including mobile SDKs, pixels or cookies on our websites, or server logs, which may be provided by us or our third-party partners (e.g., Google Analytics). Cookies are identifiers that we transfer to your device to enable our system to recognize you and your personalized settings, to better understand how you interact with the Services, to monitor aggregate usage, and to optimize web traffic routing on our Website. You may be able to disable or limit the use of cookies in your browser or device settings, but please note that certain parts or features of the Services may not be fully functional if you do so.

Targeted Advertising. We may take advantage of certain targeted or interest-based advertising, which will utilize technologies such as cookies to recognize you across websites for these purposes. Please see the “YOUR PRIVACY CHOICES AND RIGHTS” section below for more information on the opt-out options provided by these companies in relation thereto and within the advertising industry generally.

3. How We Use Your Information

We use your information for a variety of business purposes, as described below.

To Provide Our Services. We use your Personal Information to provide you with our Services, such as:

1. Managing your information and accounts;

2. Facilitate account creation and authentication and otherwise manage user accounts. We may process your information so you can create and log in to your account, as well as keep your account in working order;

3. Delivering and facilitating delivery of Services. We may process your information to provide you with the requested service. We may process your Personal Information to detect and prevent fraud or bugs on our website and Services to the extent necessary;

4. Providing access to certain areas, functionalities, and features of our Services;

5. Facilitating connections to, and transactions with, third-party partners as part of our Services;

6. Facilitating display and re-display of User-Generated Content;

7. Answering requests for customer or technical support; and

8. Communicating with you about your account, activities on our Services including policy changes.

For Legitimate Business Purposes. We may process your Personal Information for a variety of reasons, depending on how you interact with our Services, including:

1. Improving, upgrading or enhancing our Services, including through automation and machine learning, such as by providing you with personalized suggested tasks based on your, and others’, usage of the Services;

2. Saving or protecting an individual’s vital interest. We may process your information when necessary to save or protect an individual’s vital interest, such as to prevent harm;

3. Operating and maintaining our websites and Services. For instance, we may use your browsing information for this purpose;

4. Providing you with personalized recommendations when you are visiting our websites. By using Personal Information for this purpose, you may expect to be presented with more engaging and relevant content than without the use of personalization;

5. To improve our websites. We process your information, including device and usage information, to track your browsing behavior for analytics purposes. This eventually allows us, based on our legitimate interests or on your consent, to improve our websites as well as the overall user experience.

6. Pursuing our legitimate business interests such as research and development (including marketing research), direct marketing or advertising (as set forth in this Privacy Policy), network and information security, and fraud prevention;

7. Detecting security incidents, protecting against malicious, deceptive, fraudulent or illegal activity, and prosecuting those responsible for that activity;

8. Measuring interest and engagement in our Services;

9. Developing new products and Services;

10. Ensuring internal quality control and safety;

11. Authenticating and verifying individual identities;

12. Debugging to identify and repair errors or issues with our Services;

13. Auditing relating to interactions, transactions, and other compliance activities;

14. Processing employment applications if you apply for a job with us;

15. Enforcing our agreements, policies, and intellectual property rights;

16. Monitoring and analyzing trends, usage, and activities in connection with the Services and for marketing or advertising purposes;

17. Conducting studies and research with third-party researchers or academic institutions to operate, analyze, improve, and support the Services;

18. Linking or combining with other information we receive from third parties to help understand your needs and provide you with better service;

19. Complying with our legal obligations or otherwise establishing, exercising, or defending legal claims; and

20. For other purposes, which we will notify you about and seek your consent.

In Aggregate and De-Identified Form. We may aggregate and/or de-identify any information collected so that such information can no longer be linked to you or your device (“Aggregate/De-Identified Information”).We may use Aggregate/De-Identified Information for any purpose we deem appropriate, including without limitation for research and marketing purposes, and may also share such data with any third parties, including advertisers, promotional partners, and sponsors, in our discretion.

Usage Data. Dirrl may collect and use quantitative, transactional and performance data on the use of the Services and may also generate technical logs, data and learnings about use of the Services or Website visits (collectively the “Usage Data”). If you have an account, this Usage Data is linked to your account. If you do not have an account, this Usage Data may be linked to your device ID; however, we only use your device ID if necessary to help us diagnosis and/or respond to any issues with the Services. Dirrl may use such information to operate, analyze, improve and support the Services and for other lawful purposes.

4. How We Disclose Your Information

We disclose your information to third parties to assist with the business purposes set forth above.

Disclosures to Provide our Services. The categories of third parties with whom we may share your information are described below:

• Service Providers. We may share your Personal Information with our third-party contractor service providers who are subject to reasonable confidentiality terms and who are only permitted to use that information to help us provide our Services (each, a “Service Provider”). This includes our sub-processors and Service Providers that provide us with IT support, cloud hosting, customer service, analytics, verifying your identity, and related services. This includes Service Providers that provide us support with processing payments, web hosting and maintenance services, technology assistance and support, email and messaging communications, analytics providers, data storage providers, and web and video hosting providers and developers.

• Business Partners. We may share your Personal Information with business partners to provide you with a product or service you have requested. We may also share your Personal Information to business partners with whom we jointly offer products or services. For example, we may disclose certain of your information to a business partner if you choose to purchase their product to help you fulfill a task in the Services. The information we disclose may include your name, phone number, email address, company name and address, opportunity/interest details of your company, and information on whether your company is a current client of our partner.

• Dirrl Entities. We may share with other companies and brands owned or controlled by Dirrl, and other companies owned by or under common ownership as Dirrl. These companies will use your personal information in the same way as we can under this Privacy Policy.

Disclosures to Protect Us or Others. We may access, preserve, and disclose any Personal Information we store that is associated with you to external parties if we, in good faith, believe doing so is required or appropriate to comply with law enforcement or bona fide national security requests and legal process, such as a court order or subpoena; protect your, our, or others’ rights, property, or safety; enforce our policies or contracts; collect amounts owed to us; or assist with an investigation or prosecution of suspected or actual illegal activity.

Disclosure in the Event of Merger, Sale, or Other Asset Transfers. If we are involved in a merger, acquisition, financing, reorganization, bankruptcy, receivership, purchase or sale of assets, or transition of service to another provider, your Personal Information may be sold or transferred as part of such a transaction(including in connection with any diligence by any potential transacting party conducted prior to and in connection with such transactions).

Other Purposes. We may also share your Personal Information for other purposes or to other parties as requested by you, as permitted by applicable law, or in any manner you have otherwise consented to.

Aggregate and De-Identified Information. We may share Aggregate/De-Identified Information with any third party we deem appropriate, including advertisers, promotional partners, and sponsors, in our discretion.

5. Your Privacy Choices and Rights

You may choose not to provide Personal Information. If you choose not to provide Personal Information (or ask us to delete it), we may not be able to provide you with our Services or certain functionality of the Services. We will tell you what information you must provide to receive the Services or to conduct business with us, including by designating it as required at the time of collection or through other appropriate means.

Marketing Emails. If you register for our services, you may receive marketing communications from us or our partners. You can use an “unsubscribe” (or similar) link found at the bottom of a marketing email or text “STOP” (as appropriate) to opt out of receiving future marketing communications.

Note that you will continue to receive transactional or administrative emails regarding products or Services.

Access, Correct or Delete Your Information or Exercise Your Jurisdiction’s Privacy Rights. If you have a direct relationship with Dirrl and would like to access, correct, amend or delete any of your personally identifiable information collected or held by Dirrl via its Services or Website or exercise the data privacy rights applicable to your jurisdiction, please log into your account or you may email contact@dirrl.com. We will respond to such requests within a reasonable timeframe.

Please note that in certain circumstances we may be required by law to retain your personal information or to continue providing a service.

“Do Not Track”. Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. Please note that we do not respond to or honor DNT signals or similar mechanisms transmitted by web browsers.

Advertising. To the extent we work with third-party services for advertising purposes on our Services (e.g. Google, Instagram, Facebook, X), please see the policies of these respective companies for opt-out purposes. We are not responsible to the extent any such opt outs are not honored by these or companies, as opt-out preferences provided by these companies are not under our control.

Further, you may stop or restrict the placement of third-party cookie technologies on your device or remove them by adjusting your preferences as your browser or device permits. However, please note that cookie-based opt-outs are often not effective on mobile applications. You may opt-out of personalized advertisements on some mobile applications by following the instructions for Android, iOS and others.

More broadly, the online advertising industry also provides websites from which you may opt out of receiving targeted ads from data partners and other advertising partners that participate in self-regulatory programs. You can access these and learn more about targeted advertising and consumer choice and privacy by visiting the Network Advertising Initiative, the Digital Advertising Alliance, the European Digital Advertising Alliance, and the Digital Advertising Alliance of Canada. Please note you must separately opt out in each browser and on each device.

6. Security of Your Information

We take steps to ensure that your information is treated securely and in accordance with this Privacy Policy. Unfortunately, no system is 100% secure, and we cannot ensure or warrant the security of any information you provide to us. We have taken commercially reasonable safeguards designed to keep your Personal Information protected and require our Service Providers and partners to have appropriate safeguards as well. To the fullest extent permitted by applicable law, we do not accept liability for unauthorized disclosure.

By using our Services or providing Personal Information to us, you agree that we may communicate with you electronically regarding security, privacy, and administrative issues relating to your use of our Services.

7. Supplemental Privacy Rights for California Residents

California law may entitle California residents to certain additional protections regarding Personal Information. For purposes of this section alone, “Personal Information” means any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household.

Information We May Collect. We collect the categories of Personal Information as described in the “INFORMATION WE COLLECT” section above. We collect, use, and disclose Personal Information in the ways described above in this Privacy Policy. We do not sell Personal Information to third parties. We may collect the following categories of personal information:

Commercial Disclosures or Personal Information Sold by Dirrl. As of the date of this Privacy Policy, Dirrl is not selling personal information and has not sold any personal information in the prior 12 months. We may share personal information with service providers to perform functions on our behalf, such as processing payments and providing customer support. Dirrl will not sell Personal Information in the future belonging to Website visitors, users, and other consumers.

Your Rights. California Civil Code Section 1798.83, also known as the “Shine The Light” law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of Personal Information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared Personal Information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us using the contact information provided herein.

If you are under 18 years of age, reside in California, and have a registered account with us, you have the right to request removal of unwanted data that you publicly post on the Services. To request removal of such data, please contact us using the contact information provided herein and include the email address associated with your account and a statement that you reside in California. We will make sure the data is not publicly displayed on the Services, but please be aware that the data may not be completely or comprehensively removed from all our systems (e.g., backups, etc.).

California residents have the following rights to the extent granted by applicable law:

1. To request and receive information regarding your Personal Information we have collected in the past 12 months (including the categories of Personal Information we have collected, the categories of sources of such information, and the purposes for which we have collected such information);

2. To request and receive information about whether we have disclosed your Personal Information to third parties in the past 12 months (and if so, which categories of information we have disclosed, and which categories of third parties we have disclosed it to);

3. Not to be subject to a decision based solely an automated decision-making, including profiling, which produces legal effects or otherwise significantly affects you (“Automated Decision Making”)

4. To request and receive a copy of your Personal Information collected by us in the past 12 months; and

5. To request specific treatment relating to the processing of Sensitive Personal Information elements described above.

6. Our timely response to your request is that your Personal Information be deleted.

As a California resident, you also have a right to opt-out of the sharing of your Personal Information. You may opt-out of the sharing of Personal Information by:

1. Selecting the option to opt-out of the use of cookies in the cookie settings banner;

2. Turn on a Global Privacy Control in your web browser or browser extension. For more information on valid Global Privacy Controls, please refer to this website: https://oag.ca.gov/privacy/ccpa

3. Clicking on the “unsubscribe” link at the bottom of a Dirrl commercial message;

4. To opt-out of the use of your email address or to submit a data access, correction, or deletion request, please contact us at contact@dirrl.com.

Methods to Exercise Your Rights as a California Resident. To exercise any of these rights, please read the “Access, Correct or Delete Your Information or Exercise Your Jurisdiction’s Privacy Rights” section above. We may require verification of your identity before further processing your request. Please be as specific as possible in relation to the personal information you wish to access. Once we receive your request, we will review it, determine whether we can verify your identity, and process the request accordingly. If we need additional information to verify your identity, we will let you know. We will respond to your request within 45 days of receipt, or notify you if we require additional time.

We will not discriminate against you if you choose to exercise any of these rights. In certain instances, we may be permitted by law to decline some or all of such request, including if we determine that our business does not fall within the scope of the California statutes. Please note that if you make unfounded, repetitive, or excessive requests (as determined in our reasonable discretion) to access your Personal Information, you may be charged a fee to the extent permitted by law.

If you would prefer, you may designate an authorized agent to make a request on your behalf.

8. Supplemental Privacy Rights for Residents of the European Economic Area

If you are a natural person residing within the European Economic Area (“EEA”) or your personal data is processed by us on behalf of a controller residing in EEA (“Data Subject”), then the EU General Data Protection Regulations (“GDPR”) require us to explain the valid legal bases we rely on in order to process your Personal Information. As such, the following additional rights are applicable to you: Dirrl aims to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Information (known as “Personal Data” under the GDPR). If you wish to be informed what Personal Data, we hold about you and if you want it to be removed from our systems, please contact us using the contact information set out below. Note that where we act as the data processor on behalf of Clients you will be required to contact the data controller directly to exercise your rights.

In certain circumstances, where we act as data controller, you have the following data protection rights:

1. Request access to your Personal Data (commonly known as a “data subject access request”). This enables you to receive a copy of the Personal Information we hold about you where we are the data controller and to check that we are lawfully processing it.

2. Request correction of the Personal Data that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected, though we may need to verify the accuracy of the new information you provide to us.

3. Request erasure your Personal Data. This enables you to ask us to delete or remove Personal Information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your Personal Information where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully, or where we are required to erase your Personal Information to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

4. Object to processing of your Personal Data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your Personal Information for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

5. Request restriction of processing of your Personal Data. This enables you to ask us to suspend the processing of your Personal Data in the following scenarios: (a) if you want us to establish the information’s accuracy; (b) where our use of the information is unlawful but you do not want us to erase it; (c) where you need us to hold the information even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your information but we need to verify whether we have overriding legitimate grounds to use it.

6. Request the transfer of your Personal Data to you or to a third party. We will provide to you, or a third party you have chosen, your Personal Information in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

7. Withdraw consent at any time where we are relying on consent to process your Personal Data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent.

Please note that we may ask you to verify your identity before responding to such requests.

We may rely on the following legal bases to process your Personal Information:

Consent. We may process your information if you have given us permission (i.e., consent) to use your Personal Information for a specific purpose. You can withdraw your consent at any time by visiting the “Access, Correct or Delete Your Information or Exercise Your Jurisdiction’s Privacy Rights” section above.

Performance of a Contract.** **We may process your Personal Information when we believe it is necessary to fulfill our contractual obligations to you, including providing our Services or at your request prior to entering into a contract with you.

Legal Obligations. We may process your information where we believe it is necessary for compliance with our legal obligations, such as to cooperate with a law enforcement body or regulatory agency, exercise or defend our legal rights, or disclose your information as evidence in litigation in which we are involved.

Vital Interests. We may process your information where we believe it is necessary to protect your vital interests or the vital interests of a third party, such as situations involving potential threats to the safety of any person.

Automated Decision-Making and Profiling. Dirrl may use automated decision-making processes, including profiling, to enhance user experience, improve our services, or for marketing purposes. These processes may be based on your preferences, interests, or behavior while using our platform. If such automated decision-making has a significant impact on you or produces legal effects concerning you, you have the right to:

1. Obtain human intervention in the decision-making process;

2. Express your point of view regarding the decision;

3. Contest the automated decision; and

4. Receive an explanation of the decision and its underlying logic.

To exercise these rights, please contact us using the contact information provided in our privacy policy.

Cross-Border Data Transfers: Please be aware that your Personal Data may be transferred to, processed, and stored in Canada and the United States, where our servers and central database are located. To ensure the protection of your data during these transfers, Dirrl relies on the European Union’s Standard Contractual Clauses as the primary safeguard. These clauses are contractual commitments between parties transferring personal data, binding them to protect the privacy and security of your data, in compliance with EU data protection regulations.

Lodging a Complaint with a Data Protection Authority. If you believe that our processing of your Personal Data infringes upon the GDPR, you have the right to lodge a complaint with a supervisory authority, particularly in the EU member state where you reside, work, or where the alleged infringement occurred. To find the contact information for your local Data Protection Authority, please visit the following link: https://edpb.europa.eu/about-edpb/about-edpb/members_en

9. International Data Transfers

All information processed by us may be processed and stored anywhere in the world, including, but not limited to, Canada, the United States or other countries, which may have data protection laws that are different from the laws where you live. If you use our Services, you consent to the transfer and processing of your information from any country to any other country in accordance with this Privacy Policy.

10. Retention of Personal Information

Unless consent is withdrawn earlier, we retain all the Personal Information we collect as described in this Privacy Policy for as long as you use our Services or as necessary to fulfill the purposes for which it was collected, provide our Services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws.

11. Updates to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our information practices. When we do, we will also revise the “last updated” date at the beginning of the policy. If we make any material changes, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification (sent to the e-mail address specified in your account, if applicable). We will always post the then-current version of this Privacy Policy on our Website. You understand and agree that you will be deemed to have accepted the updated Privacy Policy if you continue to use our Services after the new Privacy Policy is posted. We encourage you to review this Privacy Policy periodically to stay informed on our privacy practices.

12. Contacting Us

For questions, requests, or concerns regarding this Privacy Policy or our privacy practices, please contact Dirrl at: contact@dirrl.com