Privacy Policy

1. INTRODUCTION

Banyan Software, Inc. (“we”, “us” or “our”) takes our obligations under data protection laws seriously. This Privacy Policy (“Policy”) outlines our continued commitment towards respecting your privacy and complying with the applicable laws and associated rules governing how and when your personal information is collected, used and disclosed when you access our website at www.banyansoftware.com (the “Website”).

It is important that you read this Policy carefully. We may provide supplemental privacy notices on specific occasions when we are collecting or processing personal information about you – for example, in connection with a job application – so that you are fully aware of how and why we are using your information. Those notices supplement this Policy and are not intended to override it.

U.S. Residents: If you reside in the United States, please also see our US Annex below for your rights under applicable U.S. privacy laws, including but not limited to the California Consumer Privacy Act.

2. ABOUT

Banyan Software, Inc., a Delaware corporation (“Banyan”), acquires and grows vertical market software businesses. Banyan and its subsidiaries operate across North America, the United Kingdom, Europe, Australia, New Zealand, and other jurisdictions globally. Our principal offices are located at 2 Bloor St W, Suite 600, Toronto, ON M4W 3E2, Canada.

For the purposes of applicable data protection law, Banyan Software, Inc. is responsible for this Policy and is the controller of your Personal Information collected through this Website.

3. DEFINITIONS

We will use the following terms regularly in this Policy:

“Personal Information” means any information that: (i) identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household; or (ii) relates to an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to the physical, physiological, mental, economic, cultural or social identity of that natural person.

4. HOW WE COLLECT INFORMATION

We use different methods to collect information from and about you, including through:

Information you give us. This is information you provide by accessing our Website or by corresponding with us (for example by email or our contact form). It includes information such as your name and email address when you submit an enquiry or contact us, and any information you provide when you report a problem with our Website. If you contact us, we will keep a record of that correspondence.

Information we collect about you and your device. Each time you visit our Website we will automatically collect Personal Information including device, content and usage data. We collect this data using cookies and other similar technologies. As you interact with our Website, we will automatically collect the following:

• technical information, including the Internet protocol (IP) address used to connect your computer to the Internet, browser type and version, date and time of visit, time zone setting, browser plug-in types and versions, operating system and platform; and
• information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through and from our Website (including date and time); page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse- overs), and methods used to browse away from the page.

Information we receive from other sources. We may receive information about you from third parties, including device and usage data from analytics providers and search information providers that assist us in the improvement and optimisation of our Website.

We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data may be derived from your Personal Information but is not considered personal data in law if it has been anonymised so that it cannot directly or indirectly reveal your identity. However, if we combine or connect aggregated data with your Personal Information so that it can directly or indirectly identify you, the combined data will be treated as Personal Information and used in accordance with this Policy.

5. TYPES OF INFORMATION WE COLLECT

The amount and type of information we collect depends on the nature of your interaction with our Website. The table below sets out the kinds of Personal Information we collect:

6. HOW WE USE THE INFORMATION WE COLLECT

We will only use your Personal Information when the law allows us to do so. We will use your Personal Information for the following purposes:

We may also use automated decision-making (ADM) in the context of third-party advertising tools such as Google Ads and the Google conversion tracking tool. The practical effect of such processing is whether or not one of our advertisements is shown to you. Such processing is subject to Google’s privacy policies.

Opting Out

Visitors to our Website can set preferences for how Google advertises to you and tracks your conversions using the Google Ad Settings page. Alternatively, you can opt out by visiting the Network Advertising Initiative opt-out page or permanently using the Google Analytics Opt Out Browser add-on.

There are limited circumstances in which we may collect, use or disclose Personal Information without your consent. These include: (a) when required or permitted by law; (b) in an emergency that threatens life, health or personal security; (c) when we require legal advice from a lawyer; (d) to collect a debt; (e) to protect ourselves from fraud; or (f) to investigate an anticipated breach of an agreement or contravention of law.

8. JOB APPLICANTS AND RECRUITMENT

This Section applies if you submit an application for a position with Banyan Software. Please read it carefully alongside this Policy.

Personal Information We Collect from Applicants

In connection with a job application, we may collect and process the following categories of Personal Information:

• Identity and contact information (name, address, email address, phone number);
• Professional and career information (CV/résumé, cover letter, work history, qualifications, certifications, professional references);
• Information provided during the recruitment process, including responses provided during interviews and any pre-screening assessments; and
• Information provided by references or background check providers, where applicable and permitted by law.

Use of AI Screening Tools

We use automated tools to assist with candidate screening and application processing. These tools may analyse information you provide in your application to help us evaluate and prioritise candidates. We wish to be transparent about this:

• Automated tools do not make final hiring decisions. All decisions about your application are reviewed and made by a human member of our recruitment team.
• You have the right to request human review of any automated assessment of your application. To make such a request, please contact us using the details in Section 19.
• Where required by applicable law (including under GDPR Article 22), we will provide you with additional information about the logic involved in any automated processing and its significance upon request.

Video Interview Recordings

Interviews conducted by video conference (including via Zoom or similar platforms) may be recorded. The following applies to any such recordings:

• You will be informed and asked for your consent before any recording takes place. You may decline to be recorded; this will not affect the progress of your application.
• Recordings are used solely for the purposes of the hiring process and are accessible only to members of the relevant recruitment team and applicable hiring managers.
• Recordings are retained for no longer than 90 days following the conclusion of the relevant recruitment process, after which they are securely deleted.

Retention of Applicant Data

We retain Personal Information of unsuccessful applicants for 12 months following the conclusion of the recruitment process, after which it is securely deleted or anonymised. If your application is successful, your information will be transferred to your employment record and retained in accordance with our employment data policies.

With your consent, we may retain your information beyond this period to consider you for other suitable roles that may arise. You may withdraw this consent at any time by contacting us as set out in Section 19.

Legal Basis for Processing Applicant Data

We process applicant Personal Information on the following legal bases, depending on the applicable jurisdiction:

• EU/UK (GDPR): Legitimate interests in assessing candidate suitability (Article 6(1)(f)); legal obligation where applicable (Article 6(1)(c)); and consent for optional processing such as retaining data for future roles.
• Canada (PIPEDA and applicable provincial laws): Consent, express or implied, for collection and use in the context of the recruitment relationship.
• United States: As set out in the applicable provisions of this Policy and the US Annex.

9. HOW WE SHARE THE INFORMATION WE COLLECT

We may disclose Personal Information to fulfil the purposes identified in this Policy and for purposes related thereto, including as follows:

• within our organisation, including with our affiliates and portfolio companies, particularly where necessary for operational, compliance, or recruitment purposes;
• to business partners, suppliers and sub-contractors engaged to support the operation of our Website or our recruitment processes;
• to analytics and search engine providers that assist in the improvement and optimisation of our Website;
• to third parties in the context of an actual or contemplated sale, transfer, or merger of parts of our business or assets. If a change to our business occurs, the new owners may use your Personal Information in the same way as set out in this Policy; and

• to regulators, law enforcement agencies or courts where we are required or permitted to do so by law, or where necessary to enforce our legal rights, respond to claims, or protect the rights, property or safety of us, our affiliates, or the public.

10. RETENTION OF YOUR PERSONAL INFORMATION

We will only keep your Personal Information for as long as necessary to fulfil the purposes for which it was collected.

To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process your Personal Information, and whether we can achieve those purposes through other means. We also take into account legal and regulatory requirements, limitation periods for taking legal action, good practice, and our general business purposes.

For example, we retain web server logs that record information about visitors to our Website (such as IP address, browser type and operating system) for approximately 30 days. We retain logs for this period to analyse traffic and investigate issues if something goes wrong on our Website.

For applicant data, please refer to Section 8 above.

11. INTERNATIONAL DATA TRANSFER

Banyan Software, Inc. is headquartered in the United States, and our Website infrastructure and third-party service providers (including hosting, analytics, and communications tools) are primarily based in the United States. As a result, Personal Information we collect through this Website may be transferred to, processed in, and stored in the United States or other countries where we or our service providers operate, which may have data protection laws that differ from those in your country of residence.

Where we transfer Personal Information outside of the European Economic Area (EEA), the United Kingdom (UK) or Switzerland, we ensure an equivalent degree of protection by relying on appropriate safeguards, including:

• standard contractual clauses approved by the European Commission or, for UK transfers, the UK International Data Transfer Agreement or Addendum to the EU Standard Contractual Clauses;
• adequacy decisions made by the European Commission or UK authorities in respect of certain countries; or
• other lawful transfer mechanisms approved by the relevant authorities, including the EU-US Data Privacy Framework and the UK-US Data Bridge where applicable.

Please contact us if you would like further information on the specific mechanisms we use when transferring your Personal Information outside the EEA, UK or Switzerland.

12. SECURITY OF PERSONAL INFORMATION

We have put in place appropriate technical, organisational and security measures designed to prevent your Personal Information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your Personal Information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your Personal Information on our instructions and they are subject to a duty of confidentiality.

We use firewalls and encryption to protect information we collect through this Website, including Transport Layer Security (TLS) encryption for data in transit and encryption at rest for stored Personal Information. We also employ a range of security techniques to protect Personal Information against loss, misuse, alteration, and unauthorised action; however, no system of security is completely impenetrable and we cannot guarantee the absolute security of your Personal Information.

We have procedures in place to deal with any suspected Personal Information breach and will notify you and any applicable regulator of a breach where required or otherwise appropriate.

13. MINORS

Our Website is not designed for use by minors (persons under the age of 18, or under a lower age if restricted by applicable law). If you are aware that a minor has provided us with Personal Information, please contact us at privacy@banyansoftware.com. If it comes to our attention that we have collected Personal Information from a minor, we may delete this information without notice.

14. COOKIE

POLICY

What are cookies and do we use them?

Cookies are small files that a website transfers to your computer’s hard drive through your web browser (if you allow it) that enable the website’s systems to recognise your browser and capture and remember certain information. We use cookies to help us understand your preferences based on previous or current site activity, and to compile aggregate data about site traffic and interaction so we can offer better site experiences in the future.

We use the following cookies:

• Strictly necessary cookies. These are required for the operation of our Website. They include cookies that enable you to log into secure areas of our Website.
• Analytical or performance cookies. These allow us to recognise and count the number of visitors and to see how visitors move around our Website. This includes cookies set by Google Analytics and Microsoft Clarity, which help us understand how visitors interact with our Website and identify opportunities to improve it.
• Functionality cookies. These are used to recognise you when you return to our Website. This enables us to personalise our content for you and remember your preferences.
• Targeting cookies. These cookies record your visit to our Website, the pages you have visited and the links you have followed. This may include cookies set by Google Ads and similar third-party advertising platforms. We use this information to make our Website and advertising more relevant to your interests.

You can opt out of Microsoft Clarity by using standard cookie consent settings in your browser or through tools like Your Online Choices or the Network Advertising Initiative. You can manage your Google cookie preferences via Google’s Ad Settings page.

Can I disable cookies?

Yes. You can choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies, through your browser’s settings. Each browser is slightly different, so look at your browser’s Help menu to learn the correct way to modify or disable your cookies.

Please note that if you disable cookies some features of our Website that make your experience more efficient may be unavailable.

15. THIRD PARTY LINKS

Our Website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our Website, we encourage you to read the privacy notice of every website you visit.

16. CONSENT UNDER CANADIAN PRIVACY

LAWS

If you are in Canada, we will not collect, use, or disclose your Personal Information without your prior consent. Your consent may be expressed or implied. You may expressly give your consent in writing, verbally or through any electronic means. In certain circumstances, your consent may be implied by your actions. For example, providing us with your Personal Information through our contact form constitutes implied consent to use that information to respond to your enquiry. We will assume that you have consented to our reasonable collection and use of Personal Information consistent with the purposes for which the information was given.

Quebec Residents – Loi 25

If you are located in Quebec, additional requirements under Quebec’s Act Respecting the Protection of Personal Information in the Private Sector (Law 25) apply to our collection and use of your Personal Information.

Where we use automated tools to process Personal Information for the purposes of making decisions that produce legal or significant effects on individuals – including in the context of recruitment screening – we will inform you of this use, the principal parameters of the automated processing, and the role that the resulting profile plays in the decision. You have the right to request that a human member of our team review any such decision, and to request correction of any inaccuracies in the profile on which it is based.

For cross-border transfers of Personal Information originating from Quebec, we conduct privacy impact assessments where required by applicable law to ensure that Personal Information transferred outside Quebec receives protection equivalent to that provided under Law 25.

You may contact us as set out in Section 19 to request further information about our automated decision- making practices, to exercise your correction rights, or for any other inquiry related to your rights under Law 25.

17. YOUR RIGHTS

You have certain rights depending on which data protection laws apply to you in relation to your Personal Information. When provided for, and subject to limitations set forth in applicable law, you can:

• Access. Request a copy of the Personal Information we hold about you.
• Rectification & Erasure. Request that we rectify or delete any Personal Information about you that is incomplete, incorrect, unnecessary or outdated.
• Objection. Object at any time to Personal Information about you being processed for direct marketing purposes.
• Restriction of Processing. Request restriction of processing of your Personal Information for certain reasons, such as where you consider the information to be inaccurate or you have objected to processing while the existence of legitimate grounds is under consideration.
• Data Portability. Request and receive the Personal Information we have collected about you in a commonly used and machine-readable form.
• Right to Withdraw Consent. Where Personal Information is processed solely on the basis of your consent, withdraw that consent at any time, without affecting the lawfulness of processing carried out before withdrawal.
• Right to Lodge a Complaint. If you believe our processing of your Personal Information is inconsistent with applicable data protection laws, lodge a complaint with your local supervisory data protection authority.

Your rights under other data protection laws may be similar or different to those above. If you ask to exercise these rights from a jurisdiction where you do not have a particular right, we will consider the request at our discretion.

Withdrawal of consent will not affect the lawfulness of any processing carried out before you withdrew your consent. Please note that even after you have chosen to withdraw your consent, we may be able to continue

to process your Personal Information to the extent required or permitted by law, in particular in connection with exercising or defending our legal rights or meeting our legal and regulatory obligations.

To exercise any of the above rights, please contact us as set out in Section 19 and provide sufficient details so that we can respond appropriately. We will process requests in accordance with applicable law and within a reasonable period of time – we aim to respond to all requests within thirty (30) days or provide notice if we require longer. We may need to verify your identity before we can address a request. To the extent permitted by applicable law, fees may be charged to access information, but you will be notified of any applicable fee in advance.

18. ADDITIONAL RIGHTS

Applicable laws may give you additional rights that are not described in this Policy. We encourage you to review the laws applicable to your jurisdiction or to consult with an independent advisor if you have questions about your privacy rights.

19. CONTACT US

If you have any questions about this Policy, wish to exercise your rights, or need to contact us for any other purpose related to your Personal Information, please contact us by email at: privacy@banyansoftware.com.

Banyan Software, Inc.

2 Bloor St W, Suite 600, Toronto, ON M4W 3E2, CanadaToronto, ON M4W 3E2, Canada

20. CHANGES TO THIS POLICY

This Policy is effective as of the date listed at the top of this page.

We review this Policy regularly and have the discretion to update it at any time. You can verify if this Policy has changed by checking the last updated date at the beginning of this Policy. We encourage you to review this page periodically to stay informed about our practices with respect to the collection, use, disclosure and protection of your Personal Information.

We may, but are not obligated to, notify you of any material changes to this Policy. Your continued use of our Website after any changes constitutes your acceptance of such change.

US ANNEX – IF YOU ARE IN THE UNITED STATES

This US Annex has been compiled for the benefit of visitors to our Website who are concerned with how their Personally Identifiable Information (“PII”) is being used online. PII, as used in US privacy law and information security, is information that can be used on its own or with other information to identify, contact, or locate a single person, or to identify an individual in context. Please read this Policy carefully to get a clear understanding of how we collect, use, protect or otherwise handle the PII which we obtain from your visits to our Website.

What PII do we collect?

This is set out at Section 5 of this Policy.

When do we collect PII?

This is set out at Section 4 of this Policy.

How do we use PII?

This is set out at Section 6 of this Policy.

How do we protect PII?

This is set out at Section 12 of this Policy.

ADDITIONAL US STATE PRIVACY RIGHTS

In addition to California, a growing number of US states have enacted comprehensive privacy laws that may grant residents additional rights with respect to their Personal Information, including rights to access, correct, delete, and opt out of certain processing activities such as targeted advertising or profiling.

If you are a resident of a state with applicable privacy laws and wish to exercise your rights, please contact us at privacy@banyansoftware.com. We will respond to verifiable requests in accordance with the requirements of applicable law.

CALIFORNIA PRIVACY RIGHTS – FOR CALIFORNIA RESIDENTS

The following table explains, as required by California privacy laws, whether we have collected, disclosed or sold certain categories of PII in the past 12 months. We do not sell PII in the conventional sense (i.e., we do not receive money from any party in exchange for providing them with your PII).

However, certain data collection on our Website by third parties for purposes of interest-based advertising may constitute a “sale” or “sharing” under California privacy law. Where the table below indicates we have sold or shared categories of PII, this will have occurred only in the context of interest-based advertising as described at Section 6 of this Policy.

Your Rights

You have the right to request that we disclose what information we collect, use, disclose and sell. You also have the right to request that we delete any PII about you that we have collected. To submit either of the above requests, you may contact us by email at privacy@banyansoftware.com. Please note that any request to delete your PII will be subject to identity verification before it is processed.

If you opt to exercise your privacy rights, we are required to verify your identity in order to prevent unauthorised access to your data. This may require us to ask you certain questions or require you to provide state-issued identification. Requests to exercise these rights may be granted in whole, in part, or not at all, depending on the scope and nature of the request and applicable law. Where required by applicable law, we will notify you if we reject your request and explain why we are unable to honour it.

Right to Know and Access Information

You may access information we maintain about you. If we grant your request, we will provide you with a copy of the PII we maintain about you in the ordinary course of business.

Deletion of Information

You may request that we delete your PII. We may decline to fulfil some or all of your request as permitted by applicable law (for example, where we are legally required to retain certain records).

We shall not discriminate against you for exercising any of your rights under applicable privacy law.

You may designate an authorised agent to make a request to exercise your rights on your behalf. For your protection, we reserve the right to deny any request from an agent who does not submit proof that they have been authorised to act on your behalf.

DO WE ALLOW THIRD-PARTY BEHAVIOURAL TRACKING?

We do allow third-party behavioural tracking for data analysis and optimisation as set out in Section 6 above. By default, this is done on the basis of aggregated or anonymised data.

COPPA (CHILDREN’S ONLINE PRIVACY PROTECTION ACT)

In compliance with COPPA, we do not specifically market our Website to children under the age of 13 and do not knowingly collect PII from children under 13.

FAIR INFORMATION PRACTICES PRINCIPLES

The Fair Information Practices Principles form the backbone of privacy law in the United States and have played a significant role in the development of data protection laws around the globe.

In the event of a personal data breach that is likely to affect your rights, we will notify affected individuals and applicable regulators without unreasonable delay following our determination of the breach’s scope and impact, and in accordance with the timeframes required by applicable law.

We also agree to the Individual Redress Principle, which requires that individuals have a right to pursue legally enforceable rights against data collectors and processors who fail to adhere to the law.

CAN-SPAM ACT

The CAN-SPAM Act sets rules for commercial email, establishes requirements for commercial messages, and gives recipients the right to have emails stopped from being sent to them. To be in accordance with the CAN-SPAM Act, we agree to the following:

• we will not use false or misleading subject lines or email addresses in communications with you;
• in the event that our message is an advertisement, we will identify it as such;
• we will include the physical address of our business or site headquarters in all communications with you;
• we will honour opt-out/unsubscribe requests promptly; and
• we will allow users to unsubscribe using the link at the bottom of each email.

If at any time you would like to unsubscribe from receiving future emails from us, you can email us at privacy@banyansoftware.com and we will promptly remove you from all correspondence.