Data Privacy Framework Notice

This Data Privacy Framework Notice ("DPF Notice") sets out the principles we follow with respect to the collection, use, and retention of Non-HR Personal Data that is transferred from the European Economic Area ("EEA"), the United Kingdom ("UK"), and Switzerland to the U.S.

Bloomreach, Inc. ("Bloomreach") complies with the EU-U.S. Data Privacy Framework ("EU-U.S. DPF"), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework ("Swiss-U.S. DPF") as set forth by the U.S. Department of Commerce. We have certified to the U.S. Department of Commerce that we adhere to the EU-U.S. Data Privacy Framework Principles with regard to the processing of Personal Data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. We have also certified to the U.S. Department of Commerce that we adhere to the Swiss-U.S. Data Privacy Framework Principles with regard to the processing of Personal Data received from Switzerland in reliance on the Swiss-U.S. DPF (collectively, the "DPF Principles"). If there is any conflict between the terms in this DPF Notice and the DPF Principles, the DPF Principles shall govern.

To learn more about the DPF, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Personal Data Collected: The types of Personal Data we receive in the U.S., as well as the purposes for which we collect and use it, are set out in the Website Privacy Notice, Services Privacy Notice, and the Job Applicant Privacy Notice.

Choice: We will give you an opportunity to opt out where Personal Data we control about you is to be disclosed to an independent third party or used for a purpose that is materially different from those set out in the Website Privacy Notice, Services Privacy Notice, and the Job Applicant Privacy Notice. If you otherwise wish to limit the use or disclosure of your Personal Data, please contact us via the details provided below.

Third Parties: Information about the types of third parties to which we disclose Personal Data and the purposes for which we do so is described in the Website Privacy Notice, Services Privacy Notice, and the Job Applicant Privacy Notice. If we have received your Personal Data in the U.S. and subsequently transfer that information to a third party acting as our agent, and that agent processes your Personal Data in a manner inconsistent with the DPF Principles, then we will remain liable unless we can prove we are not responsible for the event giving rise to the damage.

Your Rights: If you are located in the EEA, UK, or Switzerland, you have the right to request access to the Personal Data that we hold about you and request that we correct, amend, or delete your Personal Data if it is inaccurate or processed in violation of the DPF.

If you would like to exercise these rights, please write to us via contact details provided below. We may request specific information from you to confirm your identity and will respond to your request in accordance with the DPF Principles and applicable data protection laws.

You may also opt-out of receiving marketing communications from us. You can use the unsubscribe option within Bloomreach’s marketing emails or complete the "opt out from emailing" form available here: https://www.bloomreach.com/en/legal/control-your-data/opt-out. To opt-out of other forms of marketing (such as postal marketing or telemarketing), please contact us using the contact details provided below.

Required Disclosures: Please note that under certain circumstances, we may be required to disclose your Personal Data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

Enforcement: Bloomreach's compliance with the DPF Principles is subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission.

Contact Us: If you wish to exercise any of your DPF rights, or have any questions or comments about our DPF certification, please contact us at:

• Email: dpo@bloomreach.com
• Telephone: +1 (888) 263-3917
• Postal address: Bloomreach, Inc., 700 E El Camino Real #130, Mountain View, CA 94041, United States

Complaints and Disputes: We will investigate and attempt to resolve any DPF-related complaints or disputes within forty-five (45) days of receipt. If you have an unresolved DPF-related complaint that we have not addressed to your satisfaction, please contact our U.S.-based third-party dispute resolution provider, JAMS Data Privacy Framework Dispute Resolution ("JAMS DPF Dispute Resolution"). You can contact JAMS DPF Dispute Resolution, and submit a complaint, by visiting https://www.jamsadr.com/DPF-Dispute-Resolution. These services are provided free of charge to you. If neither Bloomreach nor our third-party dispute resolution provider resolves your complaint, you may be entitled to pursue binding arbitration through the Data Privacy Framework Panel. For further information about the Data Privacy Framework Panel, please visit: https://www.dataprivacyframework.gov/program-articles/How-to-Submit-a-Complaint-Relating-to-a-Participating-Organization%E2%80%99s-Compliance-with-the-DPF-Principles.

Changes to this Notice: It may be necessary for Bloomreach to make changes to this DPF Notice consistent with the DPF's requirements, so please check this page occasionally. We will announce any material changes to this DPF Notice via channels appropriate to our relationship with you.