US Privacy Policy

Effective Date: July 1, 2023

This privacy policy ("Policy") describes how noshd ("noshd,", "inKind," "we," "our," or "us") collects, uses, and discloses information about you as well as your rights and choices regarding such information. It governs your use, access, and all interactions with the noshd mobile application ("Application"), the inkind.com and inkindcapital.com websites (collectively, "Website"), and any other online services owned and operated by noshd that post a link to this Policy ("Services"). (Together, the Website, Application, and Services are the "inKind Program").

Data protection law makes a distinction between organizations that process information for their own purposes (known as "controllers" or "businesses") and organizations that process information on behalf of other organizations (known as "processors" or "service providers"). This Policy applies only where we are a controller or business. It does not apply to information we process as a processor or service provider on behalf of a client, which is subject to the client's privacy policy.

Some jurisdictions require additional disclosures. If you are a California, Nevada, or Virginia resident, please see the disclosures at the end of this Policy.

If you have questions or concerns regarding this Policy, you should contact noshd at hi@noshd.com.

What Information Do We Collect?

Information You Provide Directly to Us

When you use the noshd Program, we may ask that you provide us with information that can be used to contact or identify you.

Contact Information

We may ask you to provide your first and last name, phone number(s), email address, and home or physical address.

Demographic Information

We may ask you to provide your age, gender, birthday (day and month), and general geographical location.

Account Information

We may ask you to create a user name and password when setting up an account with us.

Payment Information

To make a purchase, we may ask you to provide a payment card number along with expiration date and security code. This information is processed by third party payment processors.

Purchase Information

If you choose to make purchases through the noshd Program, including when you buy credit for a specific merchant (a "House Account") or when you buy credit for any partner in our network (an "noshd Pass"), inKind may receive information about you and your purchases at those businesses, such as the date and time of your purchase, the transaction amount, the items purchased, and possibly other information used to make your purchase. We may also collect information you supply to us concerning your preferences and interests, as well as information we obtain through your use of the noshd Program, such as your purchase history.

Dining Preferences

We collect information you choose to provide regarding your dining preferences, including allergy information and dietary restrictions.

Referral Information

We collect information you provide when you refer the Services or gift credit to another person, including the recipient's email address.

User Content

We may collect content, including profile pictures, within any messages you send to us (such as feedback or questions to customer support) or upload to your profile.

Job Application Information

If you apply for a job, we may ask you to provide information to evaluate you for the job and other open positions, including your employment and education history, transcripts, writing samples, and references.

Information From Your Browser or Device

When you use the noshd Program on your mobile phone, computer, or other device, we may automatically collect information such as: (i) information your device sends or transmits, including your device type, your device ID number, and user settings ("Device Information"); (ii) information about your use and navigation of the inKind Program, such as offers viewed and/or used and pages visited ("Service Use Information"); and (iii) information about your general location (such as non-precise location data derived from an IP address).

We and the third parties we work with use tracking technologies to collect this information, including use of session ID and persistent cookies, data collection tags or directives such as "pixel tags," Javascript scripts, API calls, and/or other technologies. A cookie is a small data file that is kept in your device's memory for record-keeping purposes. A pixel tag is an electronic image, often a single pixel and often transparent, that is placed on a web page and may be associated with cookies on your device. For further information on how we use tracking technologies for analytics and advertising, and your rights and choices regarding them, see the "Analytics and Advertising" and "Your Rights and Choices" sections below.

Information From Third Parties and Publicly Available Sources

We also receive information about you from other sources. We are not responsible for the data practices of these other sources, and you should consult their privacy policies, as applicable.

Merchant Partners

We may receive information, such as your dining preferences, likes, dislikes, from our Merchant Partners.

Reservation Platforms

We may receive information regarding your reservations from platforms with which you interact.

Social Media

We may receive information when you interact with a social media platform.

Vendors

We may receive information from vendors we work with, including analytics and advertising providers, fraud prevention services, and others.

Publicly Available Information

We may receive information that is publicly available, such as information available through government records.

How Do We Use The Information

We collect and use information in accordance with the practices described in this Policy, including as follows:

Providing Services to You

We may use information about you to administer the noshd Program, including maintaining your account.

Communications in Response to Your Actions

We use information about you to communicate with you. When you sign up to noshd, purchase a House Account, accept credit gifted or shared by another user or apply to use our services, you will receive emails that confirm specific actions you have requested. You will receive notifications confirming your registration, the successful purchase of a gift card or House Account, and follow-ups from us if you wish to use our services. These emails are a necessary part of the gift card and House Account purchase process. We may also send you responses to emails you send us, if appropriate.

Communications about Updates and Security

We will send you email notifications from time to time. Typically we send these emails to notify you of a change in status for security purposes. For example, certain notifications are sent for your own protection to ensure that another person cannot make a change to your account without your knowledge, or to seek confirmation of an action you have taken. In other cases, these notifications involve changes to various legal agreements or website policies. Generally you may not opt out of such service-related emails.

Marketing Communications

We may at times send emails, texts, or push notifications through the Application to you. Standard text charges may apply. If you have opted-in to receive push notifications on your device, you can opt-out by adjusting your device settings or uninstalling our app. If you have opted-in to receive texts, you can opt-out by texting "STOP" in response to any text message you receive from us or by emailing privacy@inkind.com and specifying you want to opt-out of text messages. Please note that your opt-out is limited to the device and phone number used.

Understanding Trends and Improving the Service

We may use information about you to understand trends and behaviors, determine the effectiveness of our content, marketing, and advertising initiatives, and improve the overall inKind Program and our other services, content, marketing and advertising initiatives.

Personalizing Your Experience

We may use information to personalize your experience with the inKind Program and present relevant content and offers.

Surveys and Feedback Requests

From time to time, we will send user surveys, feedback requests regarding user experience and website operations or marketing offers from us, or from us on behalf of our marketing partners. The completion of these surveys or requests for feedback or acceptance of any offer is strictly voluntary and you can opt out of receiving any such communications in the future by letting us know via the unsubscribe link included in any offer email you receive from us or by emailing us at privacy@inkind.com.

Personalized Advertising

We may use information about you to provide you with personalized advertising.

Referrals or Gifts

We may use information you provide when you refer or gift credit to others to invite them to the inKind Program at your request.

Merchant Partners

We may use information about you to provide you with information about Merchant Partners, facilitate and improve the services at local businesses and for Merchant Partners, and match your information with transactions to identify you to Merchant Partners as a VIP. This may include providing exclusive invitations to events.

Security

We may use your information to protect the rights, property, life, health, security and safety of us or anyone else.

At Your Direction

We use your information at your direction, such as generating your purchase orders and making reservations on your behalf through our reservation system.

With Your Consent

We may use your information for additional purposes with notice to you and with your consent.

Notwithstanding the above, we may use information that does not identify you (including information that has been aggregated or de-identified as those terms are defined by applicable law) for any purpose to the extent permitted by applicable law. For information on your rights and choices regarding how we use information about you, please see the "Your Rights and Choices" section below.

When Do We Disclose Information?

inKind discloses information about you to third parties in certain circumstances including: (a) with your knowledge and consent; (b) as described in this Privacy Policy; (c) as may be required by law, regulatory authorities, or legal process; (d) as permitted to protect the rights, property, safety, confidentiality, or reputation of inKind or its users; (e) to enforce our terms and conditions; (f) to prevent fraud or cybercrime; or (g) to permit us to pursue available remedies or limit the damages that we may sustain.

We may disclose information about you to the following categories of persons:

Service Providers

Under the protection of appropriate agreements, we may disclose information about you to service providers we use to perform various tasks on our behalf including data storage, consolidation, retrieval, analysis, or other processing, as well as for the purposes of effective management of customer information and to help us communicate with you. To the extent required by applicable law, these service providers are prohibited from using information about you for other purposes, provided that we may permit them to use information that does not identify you (including information that has been aggregated or de-identified as those terms are defined by applicable law) to the extent permitted by applicable law.

Related Companies

We may disclose information about you to our affiliate, parent, or related companies so that they may use information for their own purposes in accordance with their privacy policies, and to provide the additional services of those group companies. inKind remains responsible for the management of this information.

Analytics and Advertising

We disclose information to vendors and other parties for analytics and advertising related purposes. These parties may act as our service providers, or in certain contexts, independently decide how to process your information. For more information on advertising and analytics, see the "Analytics and Advertising" section below.

Merchant Partners and Transaction Providers

If you choose to participate in the inKind Program, we disclose Personal Information and the payment card information you entered to the appropriate transaction provider, for example, to our tip processor (Stripe), to a Merchant Partner's reservation platform (like SevenRooms), or to a Merchant Partner's point of sale system operator (like SpotOn). The parties with whom we have current integrations can be found here: https://inkind.com/app-integrations.

Merger or Acquisition

As our business continues to grow and change, we might restructure, buy, or sell subsidiaries and/or business units. In these transactions, customer information is often one of the transferred assets, remaining subject to promises made in the prevailing privacy policy. In the event inKind, or substantially all of its assets or stock, is acquired, transferred, or disposed of (in whole or in part and including in connection with any bankruptcy or similar proceedings), information about you will as a matter of course be one of the transferred assets.

Security and Compelled Disclosure

We may disclose information to comply with the law or other legal process, and where required, in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. We also disclose information to protect the rights, property, life, health, security and safety of inKind or anyone else.

Facilitating Requests

We disclose information where you direct us to disclose the information.

Notwithstanding the above, we may disclose information that does not identify you (including information that has been aggregated or de-identified as those terms are defined by applicable law) to the extent permitted by applicable law. For example, we may disclose such information for the purposes of industry analysis, demographic profiling, investor reporting, and similar purposes with third parties or the public. We may disclose such information in an industry white paper or press article.

Analytics and Advertising

We use analytics services, such as Google Analytics, to help us understand how users access and use the inKind Program. In addition, we work with agencies, advertisers, ad networks, and other technology services to place ads about our products and services on other websites and services. For example, we place ads through Google and Facebook that you may view on their platforms as well as on other websites and services.

As part of this process, we may incorporate tracking technologies into inKind Program (including our website and emails) as well as into our ads displayed on other websites and services. Some of these tracking technologies may track your activities across time and services for purposes of associating the different devices you use, and delivering relevant ads and/or other content to you ("Interest-based Advertising").

As indicated above, vendors and other parties may act as our service providers, or in certain contexts, independently decide how to process your information. We encourage you to familiarize yourself with and consult their privacy policies and terms of use.

Your Rights and Choices

Jurisdictional Rights

In addition to these rights and choices, you may have rights based on your jurisdiction. If you are a California, Nevada, or Virginia resident, please see the disclosures at the end of this Policy.

Account Management

You may review, update, correct or delete certain Information about you in your account by making the appropriate modifications in your account preferences.

• You can make changes in the Application by clicking on Settings and making changes.
• To remove a Payment Card, in the Application, go to "Account," and tap on "Payment Methods," tap on the card you wish to remove and follow the steps to unlink it.
• If you completely delete all such information, then your account may become deactivated. If you would like us to delete your Account and/or remove your records from our system, in the Application, go to "Account," tap on "Settings," then choose "Delete Account. Alternatively, please contact us and we will delete your account within 45 days. " Please note that we will retain and use information about you as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

Tracking Technology Management

The inKind Program may place cookies on your browser. At any time, through your browser settings, you may instruct your device to stop accepting cookies or to prompt you before accepting a cookie from websites you visit by changing your device's settings. If you use multiple browsers on your device, you will need to instruct each browser separately. Your ability to limit cookies is subject to your browser settings and limitations. Please note that if you do not accept cookies, you may lose some functionality of the inKind Program.

The inKind Program may place cookies on your browser. At any time, through your browser settings, you may instruct your device to stop accepting cookies or to prompt you before accepting a cookie from websites you visit by changing your device's settings. If you use multiple browsers on your device, you will need to instruct each browser separately. Your ability to limit cookies is subject to your browser settings and limitations. Please note that if you do not accept cookies, you may lose some functionality of the inKind Program.

Your browser or extension may allow you to automatically transmit preference signals regarding tracking technologies to online services you visit. We respond to such signals, which you can validate through the "Your Privacy Choices" link in the footer of our website. If you choose to opt-out from sale or sharing without the use of a global preference signal, you can also submit this request through the "Your Privacy Choices" link as well. If you are a California resident, you may exercise your right to opt-out of sales or sharing through preference signals. Please visit the California section below for details.

You can stop all collection of information via an app by uninstalling the app. For Apple iOS, we will only receive access to your device's Ad ID (known as an IDFA) if you provide consent. You can reset your device's Ad ID at any time through your device settings, which is designed to allow you to limit the use of information collected about your device.

Analytics and Interest-Based Advertising

Google provides tools to allow you to opt out of the use of certain information collected by Google Analytics at https://tools.google.com/dlpage/gaoptout and by Google Analytics for Display Advertising or the Google Display Network at https://www.google.com/settings/ads/onweb/.

The companies we work with to provide you with Interest-based Advertising may be participants of the Digital Advertising Alliance ("DAA") and/or the Network Advertising Initiative ("NAI"). To opt out of receiving Interest-based Advertising from the participating companies, please visit https://www.aboutads.info/choices and https://www.networkadvertising.org/choices/ for website opt outs and https://www.aboutads.info/appchoices for mobile opt outs. Note that opting out through these links only means that the selected participants should no longer deliver Interest-based Advertising to you, but does not mean that the participants will not process your information for Interest-based Advertising purposes or that you will no longer receive Interest-based Advertising from other companies.

Please note that the above opt outs only apply to the specific browser or device from which you opt out. We are not responsible for the effectiveness of any opt outs offered by other entities.

International Data

We are based in the United States and the information we collect is governed by United States law. If you are outside the United States, your information will be stored and maintained on computers located outside of your state, province, country or other governmental jurisdiction where the privacy laws may not be as protective as those in your jurisdiction. If you choose to provide information to us, inKind collects information in the United States and processes it there and in other jurisdictions. Your use of the inKind Program represents your agreement to this collection, storage, and processing.

Links to Other Sites

The inKind Program may contain links or APIs (e.g. data or content exchange interfaces) to external services or websites of third parties. If you click on a button, banner ad, or other type of third party link, you will be directed to that third party's resources. The fact that we may link to or incorporate a third party's services, functionality, or website, or present a banner ad or other type of advertisement, is not an endorsement, authorization, or representation of our affiliation with that third party, nor is it an endorsement of their privacy or information security policies or practices. We do not exercise control over third party services, functionality, websites or other resources, including their use of information, and you should exercise caution when deciding to disclose any information to a third party. We encourage you to read the privacy policies or statements of the other websites you visit to learn more about their privacy practices.

Children's Information

The inKind Program is not directed to children. We do not knowingly collect personal information from children under 13. If you are under 13 years of age, please do not provide any information. If you are a parent or guardian that has become aware that your child has provided us with information, please contact us (privacy@inkind.com). If we become aware that a member is under the age of 13 and has provided us with their information, we will delete such information from our files.

Data Security

We implement and maintain reasonable administrative, physical, and technical security safeguards to help protect information about you from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction. Nevertheless, transmission via the internet is not completely secure and we cannot guarantee the security of information about you.

Changes to this Policy

From time to time, inKind may update this Policy. Any changes will be effective immediately upon posting of the revised Policy. If we make material changes to our Privacy Policy, we will issue an updated version of this Privacy Policy with an updated date legend and/or notify you via email, the Website, Application, or by other appropriate means if it is a significant change. You should review this Policy regularly to ensure you are familiar with any changes to it. Your continued use of our Services indicates your consent to the Policy then posted.

How To Contact Us

If you have questions or concerns regarding this Privacy Policy, please contact inKind at privacy@inkind.com.

California

California provides additional rights to California residents, including through the California Consumer Privacy Act as replaced by the California Privacy Rights Act ("CCPA"). This section addresses those rights and only applies to California residents.

Notice of Collection

We have collected the following categories of personal information (as described in the CCPA) in the past 12 months:

• Identifiers, including name, postal address, email address, and online identifiers (such as IP address).
• Customer records, including phone number, billing address, and credit or debit card information.
• Characteristics of protected classifications under California or federal law, including gender.
• Commercial or transactions information, including records of products or services purchased, obtained, or considered.
• Internet activity, including browsing history, search history, and interactions with a website, email, application, or advertisement.
• Non-precise geolocation data, including location derived from an IP address.
• Inferences drawn from any of the information identified in this section.

For further details on the personal information we collect and the sources from which we obtain personal information, please review the "What Information Do We Collect?" section above.

We collect and use this personal information for the business and commercial purposes set out in the "How Do We Use The Information" section above. We disclose this personal information to the categories of persons set out in the "When Do We Disclose Information?" section above. Please visit those section for further details.

We do not sell your personal information as that term is traditionally understood. However, some of our disclosures of personal information may be considered a "sale" or "share" as those terms are defined under the CCPA. A "sale" is broadly defined under the CCPA to include a disclosure for something of value, and a "share" is broadly defined under the CCPA to include a disclosure for cross-context behavioral advertising. We collect, sell, or share the following categories of personal information for commercial purposes: identifiers, characteristics, commercial or transactions information, internet activity, non-precise geolocation data, and inferences drawn. The categories of third parties to whom we sell or share your personal information include, where applicable, Merchant Partners, vendors, and other parties involved in cross-context behavioral advertising. For details about your rights regarding sales and shares, please see the "Right to Opt-Out" section below.

We do not knowingly sell or share the personal information of minors under 16 years old who are California residents.

Sensitive Personal Information

To the extent any of the personal information we collect is sensitive personal information, we collect, use, and disclose such sensitive personal information only for the permissible business purposes for sensitive personal information under the CCPA. We do not sell or share sensitive personal information.

Retention

We retain each category of personal information for the length of time that is reasonably necessary for the purpose for which it was collected, and as necessary to comply with our legal obligations, resolve disputes, prevent fraud, and enforce our agreements.

Right to Know, Correct, and Delete

You have the right to know certain details about our data practices. In particular, you may request the following from us:

• The categories of personal information we have collected about you;
• The categories of sources from which the personal information was collected;
• The categories of personal information about you we disclosed for a business purpose or sold or shared;
• The categories of persons to whom the personal information was disclosed for a business purpose or sold or shared;
• The business or commercial purpose for collecting or selling or sharing the personal information; and
• The specific pieces of personal information we have collected about you.

In addition, you have the right to correct or delete the personal information we have collected from you, subject to exceptions.

To exercise any of these rights, please email us at privacy@inkind.com. If you have an account with us, we may require you to use the account to submit the request. In the request, please specify which right you are seeking to exercise and the scope of the request. We will confirm receipt of your request within 10 business days and respond to your request within 45 days. We may require specific information from you to help us verify your identity and process your request. If we are unable to verify your identity, we may deny your request. These rights may be subject to certain exceptions.

Right to Opt-Out of Sales and Sharing

To the extent we sell or share your personal information to third parties as those terms are defined under CCPA, you have a right to opt-out from the sale or sharing, which you can exercise through the "Your Privacy Choices" link in the footer of our website. In addition, you may exercise this right by turning on a recognized opt-out preference signal, such as Global Privacy Control, in your browser or extension.

Note that when you submit an opt-out, your opt-out will only apply to sales and shares of personal information through tracking technologies from the specific browser from which you submitted the opt-out because the connection between your browser identifiers and other personal information we have about you is not known to us. Opt-outs also apply to any pseudonymous profiles we maintain associated with your browser or device. If you want the opt-out to also apply to other personal information we have about you (such as your contact information), please use the link and provide your contact information as requested or make sure you are logged into your account when submitting the opt-out.

Authorized Agent

You can designate an authorized agent to submit requests on your behalf. Requests must be submitted through the methods listed above. Except for opt-out requests, we will require written proof of the agent's permission to do so and may verify your identity directly. Requests must be submitted through one of the designated methods above.

Right to Non-Discrimination

You have the right not to receive discriminatory treatment by us for the exercise of any your rights.

Shine the Light

Customers who are residents of California may request (i) a list of the categories of personal information (as that term is defined by Shine the Light) disclosed by us to third parties during the immediately preceding calendar year for those third parties' own direct marketing purposes; and (ii) a list of the categories of third parties to whom we disclosed such information. To exercise a request, please write us at the email or postal address set out in "Contact Us" above and specify that you are making a "California Shine the Light Request." We may require additional information from you to allow us to verify your identity and are only required to respond to requests once during any calendar year.

Nevada

We do not sell and will not sell your covered information (as those terms are defined by NRS 603A.340).

Virginia

Virginia provides additional rights to Virginia residents through the Virginia Consumer Data Protection Act ("VCDPA"). This section addresses those rights and applies only to Virginia residents.

You have the following rights under the VCDPA:

• To confirm whether or not we are processing your personal data
• To access your personal data
• To correct inaccuracies in your personal data
• To delete your personal data
• To obtain a copy of your personal data that you previously provided to us in a portable and readily usable format
• To opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning you

To exercise any of these rights, please email us at privacy@inkind.com and specify which right you are seeking to exercise. We will respond to your request within 45 days. If you have an account with us, we may require you to use the account to submit the request. We may require specific information from you to help us confirm your identity and process your request. If we refuse to take action on a request, you may appeal our decision within a reasonable period of time by contacting us at support@inkind.com and specifying your wish to appeal. Within 60 days of our receipt of your appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, you may submit a complaint to the Virginia Attorney General at https://www.oag.state.va.us/consumercomplaintform

Updated July 1, 2023.

Australian Privacy Policy of inKind ("inKind Capital", "we" or "us")

Respecting and protecting your privacy is very important to us. The following applies to the collection of data by inKind, its subsidiaries and affiliates via au.inkind.com and the inKind mobile application. If you have questions or concerns regarding this policy, you should contact inKind at support@inkind.com.

In this policy we disclose:
- the types of information we collect and how we use them;
- the choices you can make about the way your information is collected and used;
- how to review and change your information held by us; and
- how we keep your information secure.

inKind understands individuals' concerns regarding confidentiality and takes seriously its obligations in respect of all information it gathers. To safeguard that information, inKind has implemented a program to ensure compliance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles ("APPs").

Data Uses

• Personal data: Verify your identity.
• Personal and financial data: To process your house account purchase and provide you with funding, if you are a restaurantuer.
• Information about your visits to, and use of, au.inkind.com: Help us to maintain and develop appropriate features, functionality and user experience for you.
• Dining preferences: To enhance the experience you have when visiting a restaurant in the inKind network - we share this information with the restaurant, so it can give you a personalised experience.

Consent
By using our websites you consent to our processing of your data as set forth in this Privacy Policy. Your continued use of au.inkind.com, the inKind mobile application, or continued interaction with us after we have notified you of a material change to our Privacy Policy in accordance with the Updates Section below will be deemed an acceptance of these new terms.

Your Information
We collect personal information so that we can conduct our business.

We collect a broad range of personal information about our customers, prospective customers and those purchasing house accounts.

The types of personal information that we collect from you will depend on how you interact with us. For example, your personal information will be collected when you purchase a house account, fill in an application form to start selling house accounts through inKind or submit questions. It may also be collected when you visit this website.

This information may include, but is not limited to, names and contact details, date of birth, place of residence, dining preferences. If you are seeking to use inKind's services for your business, it may also include business data, credit history, bank account numbers and other financial details. Some information is required and some is optional. Additional information may be gathered during your subsequent use of the website and mobile applications.

When we collect personal information directly from you, we will take reasonable steps at or before the time of collection to ensure that you are aware of certain key matters, such as the purposes for which we are collecting the information, the organisations (or types of organisations) to which we would normally disclose information of that kind, the fact that you are able to access the information and how to contact us (or example, where personal information is collected on a form, we will generally include a written privacy statement on the form which sets out these details).

We will collect your personal information directly from you where it is reasonable and practicable to do so. Where we collect information about you from a third party, we will still take reasonable steps to ensure that you are made aware of the details set out above.

If you do not provide the personal information we request, we may not be able to provide our services to you, or may not be able to provide the level of service we usually provide.

Our Communications
When you sign up to inKind, load a house account, accept credit gifted or shared by another or apply to use our services, you will receive emails that confirm specific actions you have requested. You will receive notifications confirming your registration, the successful loading of a house account, and follow-ups from us if you wish to use our services. We may also send you responses to emails you send us, if appropriate. From time to time, we will also send user surveys, feedback requests regarding user experience and website operations or marketing offers from us or from us on behalf of our marketing partners. The completion of these surveys or requests for feedback or acceptance of any offer is strictly voluntary and you can opt out of receiving any such communications in the future by letting us know via the opt out included in any offer email you receive from us.

Sharing Your Information
We work with a number of trusted partners that perform vital functions as part of our operations, including electronic payment service providers. Information is shared with these third parties only to the extent necessary for us to process the transactions you initiate or perform other specific services, like due diligence on those wishing to sell house accounts through inKind. Our partners are legally required to keep your information private and secure.

We may use, or allow our trusted partners to use, your personal information for the purposes of direct marketing or promoting our services. You may ask us not to use your information in this way.

InKind may disclose personal information to countries outside Australia. We will only do so in compliance with all applicable Australian data protection and privacy laws. inKind will take reasonable steps to protect personal information no matter what country it is stored in or transferred to. inKind currently transfers your personal information to our parent company in the United States of America. For purchasers of house accounts, this does not include your financial data, which stays in Australia with our payment processor, Stripe, Inc.

We do not sell or rent your personal information to third parties for marketing purposes.

Secondary uses of information
We may also use and disclose personal information about you for a purpose (the "secondary purpose") other than the main purpose for which you gave us the information (the "primary purpose") where:

• You would reasonably expect us to use or disclose the personal information for that secondary purpose and that secondary purpose is related to the primary purpose for which we collected the information (and directly related in the case of sensitive information);
• You have given us your consent for the personal information to be used or disclosed for the secondary purpose.
• Where there are reasonable grounds to believe that use or disclosure is necessary to prevent a threat to life or health;
• Where we suspect that unlawful activity is or has been engaged in and we use or disclose the personal information to investigate the suspected unlawful activity; or
• The use or disclosure is authorised by law or reasonably necessary to enforce the law.

Notifications
We will send you email notifications from time to time. These are a necessary part of the process of you loading a house account, such as seeking confirmation of an action you have taken. Typically we send these to notify you of a change in status for security purposes. For example, certain notifications are sent for your own protection to ensure that another person cannot make a change to your account without your knowledge. In other cases, these notifications involve changes to various legal agreements or website policies. Generally you may not opt out of such service-related emails.

View and Correct Your Information
You can access, review and update the personal information you submit at any time via the inKind mobile app.

Web-Related Information Collection

Cookies
We use cookies on our website for various purposes. Cookies are small text files created by a website that store information on your computer, such as your preferences when visiting that website. We use cookies when you sign in, to keep track of your personal session, including some account identifiers so that we can ensure that you are the only person making changes to your account. We also use cookies to track your activity on our website as a unique person.

We use both session cookies and/or persistent cookies. We use session ID cookies to make it easier for you to navigate our website. Session ID cookies expire after two hours of inactivity or when you close your browser. We use a persistent cookie that remains on your hard drive for an extended period of time, so that we can recognize you when you return to our website. You can remove persistent cookies by following directions provided in your Internet browser's "help" file or at Google's Opt-Out Add-On Page; however, because we use cookies for our sign-in functionality, if you choose to disable cookies you will not be able to log onto the inKind website.

We use tracking pixels and third party cookies on our sites from Google Analytics, DoubleClick, Facebook, Twitter and other third party vendors.

How We Use the Information We Collect
We use third-party tracking services (e.g. Google Analytics' Demographic and Interests reporting) that use cookies to track non-personally identifiable information about visitors to our website in the aggregate (this enables us to gauge the effectiveness of our services, marketing programs and ad targeting). We use respective web beacons to gather information that lets us tune and improve our users' browsing experience, as well as track user responsiveness to various advertising campaigns and promotional activities. As with cookies, the information these beacons collect is an aggregated, anonymous "click stream" and transactional data, and is not associated with any users as individuals. No personal or sensitive information is transmitted to advertising partners.

Links to Other Sites
If you follow any links that direct you away from our website, this Privacy Policy will not apply to your activity on the other websites you visit. We do not control the privacy policies or the privacy practices of any third parties.

Security Policy
We are committed to maintaining the security and confidentiality of your personal and financial information.

We control access to your information via secure web pages and limit access to employees and third parties on a need-to-know basis. We will take reasonable steps to destroy or de-identify personal information when it is no longer required for the purposes for which we collected it or for legal requirements.

We employ firewalls and other security technologies to protect our servers from external attack. We enable our servers with Secure Socket Layer (SSL) technology to establish a secure connection between your computer and our servers, creating a private "conversation" that cannot be viewed or accessed by other parties. We test our systems regularly to ensure that our security mechanisms are up to date.

We also employ session time-outs to protect your account. You will be logged out of the website automatically after a specified period of inactivity. This time-out feature reduces the risk of others being able to access your account if you leave your computer unattended.

Federal and state regulations may require that we maintain and report aggregate demographic information on members who participate in transactions. We may also maintain information, including personally identifiable information of our members, for a period of seven years or more.

We will properly dispose of all paper files, letters and any other hard copy documents that contain personal information that is no longer required. All information stored in electronic form that is no longer needed will be deleted from our systems. While inKind employs advanced data encryption technology when interfacing with its customers, suppliers and other partners, users should be aware that there is a residual risk in transmitting any data electronically. This risk is inherent in all Internet dealings.

What you can do
You can take several precautions to protect the security of your computer and personal information:

• use a hard to guess password – avoid family members' names or birthday and other information other can easily learn about you. Use special characters in place of letters
• change your password frequently
• log out of our website and close the internet browser when you finish a session
• install security software (antivirus and firewall) to protect your computer from external attacks

We also send automatic notifications if certain actions are taken on your account, such as a change of password, so you can be sure nobody else is making changes without your knowledge. This will be undermined if other people have access to your email account so it might be prudent to restrict access to this account and/or change its password frequently.

If you use a computer that is accessed by other people, such as in a public library or Internet cafe, we recommend that you take special precautions to protect the security of your account and personal data. When accessing our website from a public computer (library or internet café) we recommend you end your session by logging out completely, then closing the browser window and clearing the browser's cache files.

Business Transfers
If any or all of the inKind assets are acquired by, or merged with those of another entity, or in the event of a bankruptcy, we may disclose, share or transfer some or all of our users' data, to or with the relevant entity in connection with the transaction, so that the successor entity can continue providing our services to our users. If the data handling practices of that entity do not meet the substance of this Privacy Policy, you will be given the opportunity not to continue to use our website.

Updates
This Privacy Notice may be updated from time to time in order to reflect changes in our practices. We will notify you of any material changes by posting the new Privacy Policy on the website, and will obtain the necessary consents as required under applicable law if we seek to collect, use or disclose personal data for purposes other than those for which consent has been obtained.

Except as stated above, all changes will apply to the personal data that is already collected, and to personal data that is collected after the effective date of the revised policy. If any proposed change is unacceptable to you, you will have the right to terminate your relationship with us. You are advised to consult this Privacy Policy regularly for any changes.

Accessing your personal information
We will take all reasonable steps to ensure that all information we collect, use or disclose is accurate, complete and up-to-date. Please contact us if your details change or if you believe the information we have about you is not accurate or complete.

We will, on request, provide you with reasonable opportunity to access your personal information and to request that it be corrected or updated within a reasonable time of the request being made. A fee may apply to such access (but not to the making of the request). Exceptions to your access rights include:

• Where providing access will pose a serious threat to the life or health or any individual or pose an unreasonable impact on the privacy of an individual;
• Your request for access is frivolous or vexatious;
• Where the information relates to existing legal proceedings between inKind and you and the information would not be discoverable in the process of those legal proceedings; or
• Where providing access would be unlawful, may prejudice an investigation of possible unlawful activity, may prejudice enforcement of laws, or denying access is specifically authorised by law.

In some circumstances we are permitted to refuse to give access or to correct your personal information. If this occurs, we will provide you written reasons (unless it would be unreasonable to give reasons) and if required, advise you of your right to complain.

You will be required to satisfy identity validation procedures to prove that you and the individual requesting the personal information are one and the same.

How To Contact Us
If you have an access request or if you have any questions or complaints about the manner in which your personal information has been collected or handled by us, or about this Privacy Policy, please contact inKind at privacy@inkind.com. Any complaints will be handled in the order in which they were received and we will respond to you via email to notify you of what action has been taken.

More information
Further information regarding privacy can be obtained from the Office of the Australian Information Commissioner at www.oaic.gov.au.

Updated December 5, 2017.