Privacy Policy

Overview

CallBack LLC, a New Mexico limited liability company ("CallBack," "we," "us," and "our") respects your privacy and is committed to protecting it through compliance with this Privacy Policy ("Privacy Policy"). This Privacy Policy describes the types of Information we may collect from you when you visit the website at https://www.callbackcrm.com or use the Services offered there (the "Platform"), and that you may provide in electronic messages to CallBack. It also describes our practices for collecting, using, maintaining, protecting, and disclosing that Information.

Please read this Privacy Policy to understand our policies and practices regarding your Information and how we will handle it. If you do not agree with our policies and practices, do not use the Platform. By accessing or using the Platform, you agree to this Privacy Policy. CallBack may change this Privacy Policy at any time, at its discretion. Your continued use of the Platform after we make changes is deemed to be acceptance of those changes, so please check the Privacy Policy periodically for updates.

This Privacy Policy is subject to and governed by the CallBack Terms of Service ("Terms of Service") available on the Platform. The Services are part of the Platform and are described further in the Terms of Service.

The Types of Information That CallBack Collects About You and How CallBack Collects Information About You

CallBack may collect two types of information from you when you visit the Platform: Personal Information and Non-Personal Information (collectively "Information").

"Personal Information" refers to data by which you may be personally identified, such as name, email address, employer, job title and department, telephone number, mobile phone number, and other information listed in Section 12.

"Non-Personal Information" means data that is about you, but does not identify you specifically.

If you do nothing during your visit to our Platform but browse, read pages, or view content, we will gather and store Information about your visit that does not identify you personally.

We collect Information:

• —Directly from you when you provide it to us.
• —Through our communications with you.
• —From third parties.
• —Automatically as you navigate through the Platform.
• —Automatically, on an aggregate level, when you utilize our Services.
• —Through analytics.

Information You Provide Directly to CallBack. The Information that you provide us directly through our Platform may include:

• —Information that you provide when you subscribe to our Services or purchase our products.
• —Information you provide when you create an account on our Platform or subscribe to our mailing list.
• —Information that you provide by filling in forms on our Platform.
• —Information that you provide when you report a problem with our Platform. We may ask you for additional Information to resolve the problem.
• —Information that you provide in connection with an inquiry you have.
• —Records and copies of your correspondence (including email addresses), if you contact us.
• —Your responses to surveys.
• —Details of transactions you carry out through the Platform.

Information Automatically Collected from You. The Information that CallBack may automatically collect and store about you when you visit the Platform may include:

• —Your location;
• —The Internet Protocol Address and domain name used. The Internet Protocol address is a numerical identifier assigned either to your internet service provider or directly to your computer. We use the Internet Protocol address to direct internet traffic to you;
• —The type of browser and operating system you used;
• —The date and time you visited the Platform;
• —The web pages or Services you accessed at the Platform;
• —The website you visited prior to coming to the Platform; and
• —Cookies, which are small text files that a web server (such as CallBack, it's affiliated software providers, or its chosen web hosting company server) places on a user's computer. When accessing a cookie, the CallBack server reads a number associated with a browser, but is unable to determine any data about a user. With that number, our web server can tailor its content to the needs of the specific browser, and we can optimize the Platform for your use. You can remove or reject cookies using your browser or device settings, but in some cases doing so may affect your ability to use our products and Services.

Google Analytics Advertising Features. We also may have the following Google Analytics Advertising Features Implemented: Demographics and Interest reporting, Re-marketing, GDN Impression Reporting and Double Click Campaign Manager. These features collect data using Google advertising cookies and anonymous identifiers. CallBack and third-party vendors use these first-party cookies to access the success of online marketing campaigns, inform future campaigns and improve usability on the Platform. To learn how to opt-out of the Google Analytics Advertising Features we use, please see Google Analytics' currently available opt-outs for the web at https://tools.google.com/dlpage/gaoptout.

How CallBack Uses Information It Collects About You and the Purposes for the Collection and Use

We use Information that we collect about you or that you provide to us, including any Personal Information, for the following purposes:

• —To provide, operate, and maintain the Platform and Services, including creating and managing your account, authenticating you, and delivering the features you subscribe to.
• —To process payments, manage billing, and administer your subscription, including charging your payment method, issuing invoices, calculating taxes, and preventing payment fraud.
• —To provide customer support and respond to your inquiries, requests, and technical issues.
• —To monitor and improve the security, reliability, and performance of the Platform, including detecting and preventing fraud, abuse, and unauthorized access.
• —To improve the Platform, develop new features and Services, and conduct research and analytics to better understand how our customers use the Platform.
• —To send you transactional, administrative, and service-related communications, such as account notifications, billing notices, security alerts, and updates to these policies.
• —To send you marketing communications about CallBack products, features, and offers, where permitted by applicable law and your communication preferences. You may opt out of marketing communications at any time.
• —To comply with applicable legal, regulatory, tax, accounting, and reporting obligations, and to respond to lawful requests from government authorities.
• —To establish, exercise, or defend legal claims and to enforce these terms.

HIPAA / Protected Health Information. CallBack is not a HIPAA Business Associate by default. To the extent CallBack receives or processes Protected Health Information ("PHI") under a separately executed Business Associate Agreement, CallBack will not use PHI for its own marketing, analytics, product improvement, or model training. PHI will be used solely to provide the Platform and Services to the customer that is the Covered Entity or upstream Business Associate, as permitted by the BAA and applicable law.

Platform statistics are compiled into traffic reports, which help CallBack understand, anticipate, and respond to user needs. If we learn, for example, of heightened interest in certain aspects of the CallBack website, we are likely to highlight that information on the Platform home page. This Information helps us create a better overall experience for Platform users.

We will only retain your Personal Information for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements and for other purposes described in this Privacy Policy. We may retain your Personal Information for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. To determine the appropriate retention period for Personal Information, we consider the amount, nature and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of your Personal Information, the purposes for which we process your Personal Information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

In some circumstances you can ask us to delete your data: see your legal rights below for further information. And in some circumstances we will anonymise your Personal Information (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

How CallBack Protects Your Information

We have implemented measures designed to protect your Information from accidental loss and from unauthorized access, use, alteration, and disclosure. Unfortunately, the internet is not completely secure. Although we are working to protect your Information, we cannot guarantee the security of your Information either in transmission or when stored. We are not responsible for circumvention of any privacy settings or security measures contained on the Platform.

When CallBack Shares Your Information

We may disclose your Information:

• —To our subsidiaries and affiliates.
• —To contractors, service providers, and other third parties we use to support our business, as described further below, including third party payment facilitators.
• —To a buyer or other successor (potential or actual) in connection with a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of CallBack's assets, including any related due diligence.
• —To fulfill the purpose for which you provide it.
• —For any other purpose disclosed by us when you provide the Information.
• —With your consent.
• —To comply with any court order, law, or legal process, including to respond to any government or regulatory request.
• —To enforce or apply our Terms of Service.
• —If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of CallBack or others.

CallBack does not sell any of your Personal Information.

Updating and Correcting Information

We believe you should have the ability to access and edit the Personal Information that you have provided to us. You may change any of your Personal Information in your account online at any time by linking to your account in accordance with instructions posted elsewhere on the Platform. We encourage you to promptly update your Information if it changes. You may ask to have Information on your account deleted or removed; however, some Information, such as past transactions, logs of technical support calls, or other Information may not be deleted. In addition, it may be impossible to completely delete your Information without some residual Information due to our backup procedures.

Third Parties Providing Services On Our Behalf

We use third parties to host the Platform, design and operate the Platform features, and to perform administrative, analytics, and payment processing. Services these third parties provide include providing information to CallBack about the use of the Platform and viewing of our content. We may disclose your Information to these companies so they can carry out these services. These companies are bound by contractual obligations to keep Information confidential.

Information From Children

We do not knowingly collect, use, or disclose Information from individuals under 18. If we learn that we have collected the Personal Information of an individual under 18, we will take steps to delete the information as soon as possible. If you are under 18, do not provide any Information about yourself to CallBack. If you become aware that Information of an individual under 18 years of age has been provided, please contact us at legal@callbackinc.com.

Links to Other Websites and Services

We are not responsible for the practices employed by websites or services linked to or from the Platform, including the information or content contained therein. Our Privacy Policy does not apply to third-party websites or services.

Do Not Track

Some browsers incorporate a "Do Not Track" ("DNT") feature that, when turned on, signals to websites and online services that you do not want to be tracked. At this time, the Platform does not respond to DNT signals.

Residents of the European Economic Area ("EEA") and United Kingdom ("UK")

If you are located in the EEA or UK, you may have certain rights with respect to your Personal Information that are described below.

Processing. CallBack may process your Personal Information on one or more of the following legal bases:

• —as necessary to enter into a contract with you or a legal entity you represent, to perform our contractual obligations, to provide Services, to respond to requests from you, or to provide customer support;
• —where we have a legitimate interest, as described in this Privacy Policy (see "How CallBack Uses Information It Collects About You and the Purposes for Collection and Use");
• —as necessary to comply with relevant law and legal obligations, including to respond to lawful requests and orders; or
• —with your consent.

Your Rights. Subject to applicable law, you may have the right to:

• —ask whether we hold Personal Information about you and request copies of such Personal Information and information about how it is processed;
• —request that inaccurate Personal Information is corrected;
• —request deletion of Personal Information that is no longer necessary for the purposes underlying the processing, processed based on withdrawn consent, or processed in non-compliance with applicable legal requirements;
• —ask us to restrict the processing of Personal Information where the processing is inappropriate;
• —object to the processing of Personal Information;
• —request portability of Personal Information that you have provided to us (which does not include Information derived from the collected Information), where the processing of such Personal Information is based on consent or a contract with you and is carried out by automated means; and
• —lodge a complaint with the appropriate data protection authorities.

You can exercise your rights of access, rectification, erasure, restriction, objection, and data portability by contacting us at legal@callbackinc.com. We will respond to verifiable requests within one (1) month of receipt.

When you consent to our processing your Personal Information for a specified purpose, you may withdraw your consent at any time, and we will stop any further processing of your data for that purpose.

Cross-Border Data Transfers. CallBack is located in the United States, and your Personal Information will be transferred to and processed in the United States. For transfers of Personal Information from the EEA, the United Kingdom, or Switzerland to the United States, CallBack relies on the European Commission's Standard Contractual Clauses (SCCs), as updated from time to time (typically Module 2 or Module 3, depending on the relationship between the parties), to provide an adequate level of protection. You may request a copy of the applicable SCCs by contacting legal@callbackinc.com.

The categories of Personal Information that CallBack collects are identified in Section 2. Additional information about how long CallBack will retain your Information and how it shares your Information is found in Section 3 and Section 5 above.

U.S. State Privacy Rights

Residents of U.S. states with comprehensive consumer privacy laws (including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Tennessee, Delaware, Maryland, Minnesota, New Hampshire, New Jersey, Florida, and others as such laws come into effect) may have the following rights regarding their Personal Information, subject to applicable exceptions:

• —The right to know what categories of Personal Information we have collected about them and the sources from which it was collected.
• —The right to access the specific pieces of Personal Information we have collected.
• —The right to correct inaccurate Personal Information.
• —The right to delete Personal Information, subject to applicable exceptions.
• —The right to data portability — to receive Personal Information in a structured, commonly used format.
• —The right to opt out of the "sale" or "sharing" of Personal Information as those terms are defined under applicable law. CallBack does not sell Personal Information for monetary consideration.
• —The right to limit the use and disclosure of sensitive Personal Information.
• —The right to non-discrimination for exercising privacy rights.
• —The right to opt out of certain forms of automated decision-making and profiling, where applicable.

To exercise any of these rights, contact us at legal@callbackinc.com. We will respond within one (1) month of receiving a verifiable request. We will not discriminate against you for exercising any of your rights under applicable privacy law.

California Residents (CCPA / CPRA). In addition to the rights above, California residents may exercise the rights provided under the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"). You may submit a request by emailing legal@callbackinc.com. You may also submit a "Do Not Sell or Share My Personal Information" request via the cookie banner on our website, or by sending us a Global Privacy Control (GPC) signal — we honor GPC signals as opt-out requests under the CPRA. Pursuant to California's "Shine the Light" law (Civil Code §1798.83), you may also request information regarding our disclosure of Personal Information to third parties for their direct marketing purposes.

California Consumer Health Data (CCHA). Under the California Consumer Health Data Act, you have additional rights regarding consumer health data, including the right to confirm whether we are collecting, sharing, or selling consumer health data, the right to withdraw consent, and the right to have such data deleted. To exercise these rights, contact us at legal@callbackinc.com.

Washington Residents (My Health My Data Act). Under the Washington My Health My Data Act ("MHMDA"), Washington residents have rights regarding "consumer health data," which is defined broadly to include data relating to physical or mental health. You may request access to, deletion of, or withdrawal of consent for consumer health data we have processed. CallBack does not sell consumer health data. To exercise these rights, contact us at legal@callbackinc.com.

Your Choices About Information

We may, from time to time, send you emails regarding new products and Services that we feel may interest you. In addition, if you indicated upon registration that you are interested in receiving offers or information from us and our partners, we may occasionally call or send you direct mail about products and Services that may be of interest to you. Only CallBack (or agents working on behalf of CallBack and under confidentiality agreements) will send you these solicitations, and only if you have previously indicated that you wish to receive them.

If you do not want to receive solicitations from us, you can "opt-out" by accessing your account online and editing your account information to no longer receive such offers and mailings. If you no longer wish to receive marketing or promotional communications from us, click on the "unsubscribe link" provided in such communications or send us an email to legal@callbackinc.com. You can also login to your account and change the applicable communication settings so that you no longer receive such communications.

If you opt out of receiving marketing/promotional emails, we may still send you non-promotional emails, such as emails about your accounts or our ongoing business relations.

Please report your concerns about collection or use of Personal Information through the Platform to legal@callbackinc.com.

Subprocessors

CallBack engages third-party service providers ("Subprocessors") to help operate the Platform and provide the Services. A current list of our Subprocessors is published at https://www.callbackcrm.com/legal/subprocessors, including the purpose for which each Subprocessor is engaged. We will provide at least thirty (30) days' advance notice of any addition, replacement, or material change to our Subprocessors, except in the case of emergency security or service-continuity changes, where notice will be provided as soon as practicable thereafter.

Data Breach Notification

In the event of a confirmed material breach of security that compromises the confidentiality, integrity, or availability of customer Personal Information, CallBack will notify affected customers without undue delay and in no event later than seventy-two (72) hours after CallBack confirms the breach is material. The notification will include the nature of the breach, the categories of data involved, the likely consequences, and the measures taken or proposed to address the breach. CallBack will cooperate with customers' own breach-response and regulatory notification obligations.

Sharing with Affiliated Companies

We may share information about material contract breaches (including chargeback abuse, fraud, and repeated terms violations) with our affiliated companies for the purpose of declining future service. This sharing is limited to information necessary for that purpose and is not used for credit, insurance, or employment decisions.

How To Contact Us About This Privacy Policy

To ask questions about this Privacy Policy and our privacy practices, contact us at legal@callbackinc.com.