Privacy notice

Privacy statement

InhabitIQ, Inc. and its subsidiaries and affiliates ("Inhabit", "we," "us" or "our"), with its family of software business units, take pride in conducting services responsibly and ethically. We place the highest regard on the data privacy and security of our customers and on our legal obligations to protect such personal data.

We developed a data privacy program that respects and protects the privacy rights of individuals whose personal information we process. We recognize that data privacy coincides with data protection, thus, we implement reasonable and appropriate data security and protection measures to preserve the confidentiality, integrity, and availability of the personal information we process.

I. Who are we?

Inhabit is a global PropTech software company serving the residential and vacation property management industries offering software-as-a-service (SaaS) solutions for core areas like accounting and operations, customer relations management, marketing, background screening, rent payment processing, and insurance.

Through Inhabit's family of business units, we provide a technology solution with all the capabilities property management companies and property owners need to manage their rental and vacation properties through services and solutions such as property management software and applications, payment processing, marketing, branding and lead generation, inspections and facility management, utility billing, corporate accounting, regulatory compliance, document management, budgeting, credit reporting, employment and resident screening, online leasing, CRM, renter insurance and learning management, property listing, among other.

When we use the term "Service(s)" we mean collectively:

1. The information provided through https://stayinhabit.com/ and the provision of online booking platform, Stay by Inhabit (the "Platform").
2. Our marketing and business development activities, including any social media, and emails that we send ("Marketing").

The Services are intended for a general audience and are not targeted to children under the age of 13.

Stay by Inhabit is not the owner, operator, or manager of any property listed on the Site. All properties are owned and/or operated by independent Property Management Companies ("PMCs"). Stay by Inhabit acts solely as a facilitator of bookings between the Guest and the PMC.

We are a "Data Controller" under Data Privacy Laws when we process personal information relating to the PMCs, potential PMCs, our business partners, our suppliers or service providers.

We also act as a "Data Controller" when we process personal information of Guests or Prospective Guests in the performance of the Services.

II. What is the scope of this Privacy Notice?

We strive to be transparent and keep you informed on how we process your personal information through this notice.

This notice sets out how we:

• collect personal information;
• use personal information;
• store personal information;
• share personal information;
• dispose of personal information; and
• protect personal information,

in each case as a Data Controller and in some instances, as Data Processor.

This Privacy Notice covers the disclosures that are required by "Data Privacy Laws" governing our processing of personal and sensitive personal information, which include, but are not limited to the following:

• The General Data Protection Regulation and the UK Data Protection Act 2018 and General Data Protection Regulation;
• Canada's Personal Information Protection and Electronic Documents Act, Alberta and British Columbia's Personal Information Protection Act (PIPA), Quebec's Law 25 (Private Sector Act); and
• US state privacy laws currently in effect—including the California Consumer Privacy Act, the Colorado Privacy Act of 2021, the Connecticut Data Privacy Act of 2022, the Delaware Personal Data Privacy Act, the Florida Digital Bill of Rights, the Iowa Consumer Data Protection Act, the Montana Consumer Data Privacy Act, the Nebraska Data Privacy Act, New Hampshire Senate Bill 255, New Jersey Senate Bill 332, the Oregon Consumer Privacy Act, the Texas Data Privacy and Security Act, the Utah Consumer Privacy Act of 2022, and the Virginia Consumer Data Protection Act of 2021—as well as similar state laws such as Indiana Consumer Data Protection Act, Kentucky Consumer Data Protection Act, Maryland Online Data Privacy Act, Minnesota Consumer Data Protection Act, Rhode Island Data Transparency and Privacy Protection Act, Tennessee Information Protection Act, to the extent they take effect.

This notice applies as we process personal information as a Data Controller relating to:

• visitors to Stay by Inhabit Platform;
• Guests booking via the Platform;
• PMCs including their representatives, officers, employees, partners, independent contractors, agents and other authorized internal users;
• Prospective PMCs, including their representatives, officers, employees; and
• our partners, independent contractors and third-party service providers.

If you are an individual Guest of a property managed by third-party Property Management Company (PMC) who discovered and booked vacation rental properties via this Site, the processing of your personal information will be governed by this Privacy Notice.

Please note that the PMCs have their own privacy notices, and this notice does not apply to their collection, use, storage, destruction, disclosure, and/or processing of any personal information they handle within their own systems.

This Privacy Notice does not cover the practices of companies we do not own or control or people we do not manage and this Privacy Notice does not apply to any third-party sites that may link to or be accessible from our Platform.

We use some phrases in this Privacy Notice that are unique to our business or our Services. Below are definitions of some of the key terms.

• "Personal Information or Personal Data" refers to information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal Information does not include anonymized, de-identified or aggregated information, certain information publicly available, or certain other information excluded from the scope of various Data Privacy Laws.
• "Sensitive Personal Information" varies depending on the applicable Data Privacy Laws. Generally, this includes information that could harm an individual if disclosed, this requires a higher level of security and protection and is subject to additional restrictions and regulations. It includes health, financial, biometric data, genetic data and other identifying information.
• "Processing" means any operations performed on personal information, including: collecting, storing, retrieving, consulting, analyzing, disclosing or sharing with someone else, erasing, or destroying personal data.
• "PMC" refers to the Property Management Company who contracts with Inhabit for the provision of the Services.
• "Guests" refers to the individual who use the Platform in a limited capacity to discover and book vacation rental properties.
• "User" refers to representatives, officers, employees, partners, independent contractors, agents and other authorized internal users of the PMC who are given admin access to the Platform.

III. What do we collect?

We collect the following Personal Information from the following categories of individuals and sources.

A. Data from Guests or Potential Guests

1. Directly from you as a Guest via your booking activities, when you interact with our customer support by email, chat or telephone or when you transact with Stay by Inhabit for the provision of the Services:

• Name, phone number, email address, other information which is required to complete your request or transaction using the Services or otherwise fulfill your request ("Identifiers").
• Financial information such as credit or debit card account name and number, verification number (CVV), expiration date, billing address ("Financial Data").
• Precise geo location, non-precise geo location, zip code, address ("Location Data").
• Message contents, comment, special requests, feedback, product reviews, questions and information provided for customer support, commercial information (such as transaction data, purchase/booking history) ("Commercial Data").
• Usernames, passwords, log-in credentials, login type, account creation/deletion date ("Log-in Data").
• Internet or other network or device activity (such as browser type and language, operating system or app usage, device ID, IP address, cookies) ("Internet Data").

B. Data from PMCs or Potential PMCs

1. Directly from you when you interact with our customer support by email, chat or telephone or when you transact with Stay by Inhabit for the provision of the Services:

• Name, address, property address, phone number, email address, occupation, position or designation, other information which is required to complete your request or transaction using the Services or otherwise fulfill your request ("Identifiers").
• Financial information to create and maintain your account (including without limitation, rent payment amounts and bank account and credit card information) ("Financial Data").
• Message contents, comment, special requests, feedback, product reviews, questions and information provided for customer support, commercial information (such as transaction data, billing history) ("Commercial Data").
• Usernames, passwords, log-in credentials, login type, account creation/deletion date ("Log-in Data").
• Internet or other network or device activity (such as browser type and language, operating system or app usage, device ID, IP address, cookies) ("Internet Data").

2. Directly from you as a visitor to our Platform:

When you visit our Platform, you may choose to provide information to us, such as when you contact us to request or provide information through our "Contact" page on the Platform.

In addition, when you interact with our Platform, we use technology and Google tools (such as Google Analytics, Google AdSense, Google Display Network Impression Reporting) to gather information on how visitors are using the Sites and Services. For more information, see Google's explanation at How Google uses information from sites or apps that use our services.

We collect IP address information so that we can properly manage our system and gather information about how our site is being used. This includes the device type and browser you are using, location data, the pages you are viewing and your interactions on the page. Your IP address may be associated with records containing Personal Information. We collect details of visits to our Site, including the volume of traffic received, logs and the resources that you have accessed. We may also collect certain location information such as your mobile device's GPS signal, or information about nearby WiFi access points and cell towers.

We may collect the following categories of information from our Sites:

• Name, company name, phone number, email address, state or province, unique personal identifiers (cookies, IP address), ("Identifiers").
• Internet or other network or device activity (such as type of device, internet connection, browser type and version, time zone, operating system and platform, referring/exit pages, account access date/time stamp, UTMs (Urchin tracking modules) for lead source) ("Internet Data").

IV. How we use the personal information we collect

We only collect the information reasonably necessary to provide our Services, to carry out our operations or as may be as required by law.

Some of these uses may, under certain circumstances be based on your consent or may be necessary to fulfill our contractual commitments to the Guests or the PMCs, or are necessary to serve our legitimate interests as provided below:

A. For provision of our Services

• To facilitate the use of the Platform and other software application, to maintain and administer Guest and PMC accounts which includes sending transaction records, notice and other documents necessary for the continued use of the Platform and for other purposes that would be necessary or beneficial to administer our Clients' use of the same ("Servicing").
• To continuously provide you with our Services through your use and access of the Platform ("Servicing").
• To respond to your queries, comments, feedback, or requests and address your complaints and provide customer support ("Servicing").
• To verify or ascertain your identity, uniquely identify you or your business and identify potentially fraudulent activity ("Fraud Prevention").
• To carry out our obligations arising from our contracts ("Servicing").
• To conduct research and gain an understanding of the users of our Platform, their experiences and preferences to further improve the Platform ("Quality Improvement").
• To assist in business development, compile statistics regarding how the Platform or our Service is used in order to improve them, for example, we may use your personal data to improve the layout of our Platform based on the click path you utilized to access certain information within the Platform ("Quality Improvement").
• To run system diagnostics to ensure that platform is functioning properly and to improve the user experience ("Quality Improvement").
• To detect or prevent security incidents or other illegal activity, debug, verify or maintain quality or safety or improve or upgrade a service or device owned or controlled by us ("Security").

B. For marketing and advertising activities ("Marketing")

• To communicate with you regarding services, activities, programs, trainings, promotions, services, products or other offers in which you have indicated an interest or to which you've subscribed and to contact you with information that may be of interest to you.
• To provide information we think you may find useful or which you have requested from us.
• To personalize your experience and allow us to deliver individualized content and product offerings according to your specific interests.
• To provide you with the marketing materials of third parties which we think may interest you.

We only process the personal data of Guests or PMCs for our own marketing purposes in compliance with applicable laws.

We do not sell or share text messaging originator opt-in data and consent status with any third parties for marketing or promotional purposes.

C. For compliance with our legal obligations, regulatory requirements and for other legal purposes ("Legal")

• To process any complaints, implement preventive measures and to investigate act, omission, or misconduct that would constitute a violation of our contracts and of the applicable laws.
• To verify your identity or conduct internal audits or reviews.
• To enforce our agreements.
• To gather the necessary information required by law, record keeping and good business practices.
• To comply with our legal obligations and other regulatory requirements.
• To protect our lawful rights and interests in court proceedings and to establish, exercise or as defense from legal claims.

Interest-Based Advertising?

We and our third-party advertising partners may use cookies or web beacons to collect information for the purposes of interest-based advertising based on your visits to our Site. These cookies identify the pages you view, the links and ads you click on, other actions you take on those websites, and the referring website. Similarly, online advertisers use cookies to deliver advertising to you for companies other than us based on your visits to our Site and other websites. To know more, see our Cookie Policy.

V. How we share and disclose your personal information

The below chart summarizes the categories of personal and sensitive personal information we collect, from where we collect it, how we use it, and with whom we share it.

This chart is updated in an annual review and reflects the prior twelve (12) months from the date of last review in compliance with the CCPA.

We generally do not directly sell your Personal Information in the conventional sense (for money). Like many companies, however, we do disclose Personal Information for internal business purposes or operational purposes of our business (servicing, quality improvement, fraud detection, security, legal), and we use services that help deliver interest-based ads to you or analyze our website traffic. Making personal information (such as online identifiers or browsing activity) available to these companies may be considered a "sale" under certain Data Privacy Laws. If you would like to opt out of sales of your personal information that take place via cookies, immediately notify us in accordance with the "Your Choices and Rights" section below.

We share Personal Information with the following categories of recipients for the following business purposes:

1. Third-party Service Providers: Your Personal Information will only be shared with and processed by our affiliates and non-affiliated third-party service providers as permitted by law and for the purposes described in this Privacy Notice. We may disclose Personal Information to certain non-affiliated specialized service providers, including professional advisors, consultants, technical service providers, and other third parties, who are bound by contractual obligations to keep Personal Information confidential and use it only for the purposes for which we disclose it to them. We may disclose your Personal Information to third-party service providers to provide us with services such as Platform hosting, including information technology and telephony services, and related infrastructure, customer service, e-mail delivery, auditing, and other similar services.
2. Corporate Subsidiaries and Affiliates: We share the collected personal information as described in this notice with our subsidiaries and affiliated businesses within the Inhabit IQ, each of which use your personal information consistent with this Privacy Notice. Those businesses may also use your personal information for each of their own purposes, including marketing purposes. Please visit their Privacy Notice on their website to learn more.
3. Business Transfers: When applicable, we may share your information in connection with a substantial corporate transaction, such as the sale of the Platform, a merger, consolidation, asset sale, or in the unlikely event of bankruptcy.
4. With Your Consent or at Your Direction: We may share information for any other purposes disclosed to you at the time we collect the information or pursuant to your consent or direction.
5. Other Legal Reasons: In addition, we may use or disclose your Personal Information as we deem necessary or appropriate: (1) under applicable law; (2) to respond to requests from public and government authorities including public and government authorities; (3) to pursue available remedies or limit damages we may sustain; (5) to protect our operations or those of any of our affiliates; (6) to protect our rights, privacy, safety or property of, our affiliates, you and others; and (7) to enforce our terms and conditions.

When the information collected from or about you is not defined as personal information under applicable law, we may share such non-personal, de-identified information or aggregated information in a way permitted by law, with third parties at our discretion.

VI. How long we retain personal information

We will retain your Personal Information for the period necessary to fulfill the purposes outlined in this Privacy Notice, to provide you the Services, to comply with our legal obligations, to conduct audits, resolve disputes, and enforce of our agreements.

VII. How do we secure your personal information

We use reasonable organizational, technical and physical measures to maintain the privacy and security of your Personal Information within our organization against any unauthorized access, use, disclosure, loss or alteration, or theft of personal information. We maintain policies and practices to ensure the protection of your personal information. Depending on the volume and sensitivity of the information, the purposes for which it is used and the format in which it is stored, we implement a combination of measures to protect your personal information, including:

• Internal policies and procedures that define the roles and responsibilities of our employees throughout the information life cycle and limits their access to such information on a "need-to-know" basis;
• Technical safeguards such as encryption, firewalls, antivirus software and similar measures to protect information stored in electronic format;
• A designated Privacy Officer to monitor our compliance with applicable privacy laws;
• Employee privacy and data security training; and
• Procedures for receiving, investigating and responding to security incidents involving personal information.

Unfortunately, no data transmission or storage system can be guaranteed to be secure at all times. Although we work to protect the security of your account and other data that we hold in our records, please be aware that no method of transmitting data over the internet or storing data is completely secure.

If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with the "Contact Us" section below.

VIII. Your choices and rights

We offer you certain choices and you also may have certain rights in connection with the personal information we collect about you.

A. Your choices

To ask us to remove your information from our marketing mailing lists, please contact us as outlined in the How to Exercise Your Rights Section below. You also can unsubscribe from our marketing mailing lists by following the "Unsubscribe" link in our emails. Even if you unsubscribe from our marketing communications, we may still need to send you communications relating to our Services, such as service announcements.

You also have choices about whether cookies and other similar technologies are placed on your computer or mobile device.

B. Your rights

Subject to applicable Data Privacy Law, you may have certain rights to know, access, update, port your personal data, correct inaccuracies, delete, restrict processing of your personal information in our custody and control.

For security purposes, we will verify your identity when you request to exercise your data privacy rights. For certain types of requests, we may also need to ask you for additional information to verify your identity. Once we have verified your identity (and your agent, as applicable), we will respond to your request as appropriate.

Your rights over your personal information depend on the Data Privacy Law applicable where you reside:

1. California privacy rights

For additional information for residents of the State of California, see this section. The California Consumer Privacy Act of 2018 ("CCPA") and California Privacy Rights Act of 2020 ("CPRA") provide certain rights to residents of California. This section applies if you are a natural person who is a resident of California ("California Consumer") and use our Services. Certain terms used below have the meanings given to them in the CCPA and CPRA. The CCPA and CPRA shall be collectively referred to herein as the "CPRA".

Additional disclosures — Do-Not-Track. "Do Not Track" ("DNT") is the concept that has been promoted by regulatory authorities for the internet industry to develop and implement a mechanism for allowing internet users to control the tracking of their online activities across websites. Currently, various web browsers (Chrome, Firefox, Safari, Internet Explorer, Microsoft Edge) offer a DNT option that sends a signal to websites visited by the browser user about the user's DNT preference. We do not recognize or respond to browser initiated Do Not Track (DNT) signals as a DNT standard has not been adopted to this day. Our third-party partners, such as web analytics companies and third-party ad networks, may collect information about you and your online activities over time and across our Services and our Site. These third parties may not change their tracking practices in response to DNT settings in your web browser and we do not obligate these parties to honor DNT settings.

Your rights. As a California Consumer, you have the following rights; these rights are not absolute and may be subject to exceptions and verification. We may be required or permitted by law to decline any request. Only you, a person that you authorize to act on your behalf, or an entity registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable request related to accessing or deleting your personal information.

• Right to know, access, data portability. You have the right to know the categories and specific pieces of personal information that we collect about you, the purposes of the collection of your personal information, categories of third parties with whom we share your personal information and the categories of the personal information that we shared with third parties. You can also make a request to access the categories or specific pieces of personal and sensitive personal information we collected, used, or shared about you in the past twelve (12) months. Along with your verified request, we will give you any categories of sources from which the personal or sensitive personal information is collected; the purpose for collecting, selling, or sharing; and any categories of third parties with whom we share such personal information.
• Right to delete. You can make a request to delete any personal and sensitive personal information we collected from you. Upon receiving a verified request, we will notify you once your information has been deleted. We will also communicate your deletion request to the third parties who process your personal information on our behalf and direct them to delete your information.
• Right to opt-out of sale. California Consumers have the right to opt out of "sales" of their personal information. The CCPA's broad definition of "sale" may include using services to deliver targeted advertising on other sites or applications. If you make a request to opt out of our "sales" of personal information, it will likely have a direct impact on the types of advertisements you see online. We will honor requests to opt out of "sales" of your personal information. You may opt out as outlined on Your Privacy Choices. You may also opt out by broadcasting an Opt-Out Preference Signal, such as the Global Privacy Control (GPC) (on the browsers and/or browser extensions that support such a signal). If you choose to use the GPC signal, you will need to turn it on for each supported browser or browser extension you use. We do not knowingly "sell" or "share" the personal information of people under 16 years old.
• Right to limit the use or disclosure of sensitive personal information. We only use your sensitive personal information for business purposes or operational purposes of our business (servicing, quality improvement, fraud detection, security, legal), thus, your sensitive personal information is processed to only that which is essential for providing you our services, providing services to our Clients and for other legitimate business purposes. We will notify you if at any point we intend to use your sensitive personal information for any additional purposes.
• Right to non-discrimination. If you choose to exercise any of your rights under the CCPA, we will not differentiate our services as a result of your decision. We also do not offer any financial incentives to opt-in to sell your personal information.
• Right to correct. You have the right to request the correction, updating and completion of any Personal and Sensitive Personal Information we maintain about you.

2. Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia

For additional information for residents of any of these states, this section applies.

Your rights. The U.S. privacy laws provide their consumers with specific rights regarding their personal information. To the extent that you are a resident of one of these states, this section describes your rights under the applicable Data Privacy Laws and explains how you may exercise these rights. The categories of personal information we process, our purposes for processing, the categories of personal information that we share with third parties, and the categories of third parties with whom we share it are detailed in this Privacy Notice. To the extent that our personal information processing activities are addressed by a separate privacy notice, please consult the terms of that privacy notice for detailed information about our data practices, including the categories of personal information that we collect and disclose.

A. Right to know — You have the right to know whether we process your personal information.

B. Right to access — You can make a request to access the categories or specific pieces of personal and sensitive personal information we collected, used, or shared about you. Along with your verified request, we will give you any categories of sources from which the personal or sensitive personal information is collected; the purpose for collecting, selling, or sharing; and any categories of third parties with whom we share such personal information.

C. Right to data portability — You have the right to access and obtain a copy of your personal information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another business without hindrance, where the processing is carried out by automated means. You may request such personal information up to twice annually, subject to certain exceptions.

D. Right to delete — You have the right to delete personal information that you have provided by or that we have obtained about you. Please note that we may deny such a request if the requested deletion falls under an exception to this right set forth in Data Privacy Laws. If the personal data is no longer needed for any purposes that justify its retention and we are not required by law to retain it, we will do what we can to delete. We may need certain types of data so that we can provide our Services to you. If you ask us to delete it, you may no longer be able to access or use our Services.

E. Right to opt out of selling or sharing — You have the right to opt out of the processing of the personal information for purposes of: (i) targeted advertising; (ii) the sale of personal information; or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you (provision or denial of housing, insurance, employment opportunities, or access to essential goods or services; decisions that have a foreseeable risk of unfair or unlawful treatment, financial or physical injury or other substantial injury).

As of the latest date of the Privacy Notice:

• We DO process personal information for the purposes of targeted advertising.
• We generally DO NOT directly sell your personal information in the conventional sense (for money). Like many companies, however, we do disclose personal information for internal business purposes or operational purposes of our business (servicing, quality improvement, fraud detection, security, legal, auditing, and service improvement), and we use services that help deliver interest-based ads to you or analyze our website traffic. Making personal information (such as online identifiers or browsing activity) available to these companies may be considered a "sale" under certain Data Privacy Laws.
• We DO NOT engage in profiling decisions based on your personal information that produce legal or similarly significant effects concerning you.

If you would like to opt out of "selling" or "targeted advertising", you may do so as outlined on the following page: Your privacy choices. You may also opt out by broadcasting an Opt-Out Preference Signal, such as the Global Privacy Control (GPC) (on the browsers and/or browser extensions that support such a signal). If you choose to use the GPC signal, you will need to turn it on for each supported browser or browser extension you use.

F. Right to correct — You have the right to correct inaccuracies in the personal information we collect from you, taking into account the nature of the personal information and the purposes for which we process it.

G. Right to nondiscrimination — We value giving consumers control over their privacy and personal information. If you choose to exercise any of your data privacy rights, we will not differentiate our services as a result of your decision. We also do not offer any financial incentives to opt-in to sell your personal information.

H. Your right to appeal — Under applicable Data Privacy Laws, if we decline to take action or do not respond regarding a request that you have submitted pursuant to one of the privacy rights set forth in this section, you have the right to appeal our refusal to take action within a thirty (30) calendar days after you receive our decision. We will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, we will also provide you with an online mechanism, if available, or other method through which you may contact your state attorney general's office to submit a complaint.

3. GDPR privacy rights

For additional information for residents of European countries, including the United Kingdom and Switzerland, this section applies. If you are a resident of one of many European countries, including the United Kingdom and Switzerland, an important European privacy law (or an equivalent counterpart to it) the General Data Protection Regulation (the "GDPR") provides you with certain rights, and places certain obligations on companies regarding how your "personal data" (as the GDPR uses that term) is used. We describe those rights and obligations below, and how and in what circumstances we honor them. We set out our compliance with the GDPR and, to the extent applicable, those other laws, in this section.

Legal basis. The GDPR requires us to tell you about the legal ground we're relying on to process any personal data about you. The legal grounds for us processing your personal data for the purposes set out in Section IV above will typically be because: you provided your (legally sufficient) consent; it is necessary for our contractual relationship, e.g., in order to provide you services or features you've requested and we've promised; the processing is necessary for us to comply with our legal or regulatory obligations — for instance, to communicate with you about or to help honor your legal rights; and/or the processing is in our legitimate interest. For instance, we may process and share business data collected from our website for our own internal marketing purposes, or other information for purposes of security, data hygiene or validation, in a manner that constitutes a "legitimate interest".

Your data subject rights — A. Right to rectify, delete, restrict or object to the processing. You have the right to request that we delete your personal data (or where applicable, withdraw your prior consent to our processing of your data). You may also request that we correct or rectify your personal data if it is inaccurate, incomplete or false. If you request that we delete your personal data, or withdraw your consent, we will customarily retain a copy of your data sufficient to suppress it from our active databases in the future: but if that is not what you wish, you may indicate that to us (in which case your information may be added to our database later, because we will not have "suppressed" it). Moreover, when we delete your personal data, we may retain it (to the extent legally permissible) for certain important (but narrow) internal purposes such as legal, compliance, accounting or auditing purposes, and in some cases, for security purposes.

B. Personalized online advertising opt-outs. You may object to profiling by online advertising platforms with whom we sometimes partner to help generate (and measure or analyze) "personalized" online advertising. These platforms are generally separate third party "controllers" of your data. You may unsubscribe from marketing and other communications that we may send (on behalf of ourselves or others) by clicking the "opt-out" or "unsubscribe" link in the footer of those emails.

C. Your right to access. In some jurisdictions, you may have the right to request access to a copy of your personal data. When you request access to your personal data, we are required — for privacy and other important compliance reasons — to verify your identity in a legally sufficient manner: if we cannot do so, we will not be able to satisfy your access request. Please note that as part of the verification process, we may not be able to sufficiently "verify" your identity in a manner sufficient to safeguard against the potential adverse privacy effects on disclosure of personal data to the wrong individual (or a person who is purposefully seeking the information of another). Because such improper disclosure would likely adversely affect the privacy rights and freedoms of a relevant data subject/consumer, we limit certain personal data we make available.

D. Right to lodge a complaint. You have the right to lodge a complaint with a supervisory authority if you believe your data rights have been violated. In particular, if you are an individual in the European Union, you can lodge a complaint in the Member State of the European Union of your habitual residence, place of work or of an alleged violation of data protection laws.

Questions or concerns. If you have a complaint or concern or question about how we handle your personal data, please contact us at the contact addresses in this notice, and we will seek to address any concerns you may have. If you are not happy with how we have attempted to resolve your complaint, you may contact the relevant data protection authority.

When we are a processor. EU data protection law (and certain other data protection laws) makes a distinction between organizations that process personal data for their own purposes (known as "data controllers") and organizations that process personal data on behalf of other organizations (known as "data processors"). We act as a data controller (for instance, when we make decisions about the data that comprises our own datasets) and act as a processor (for instance, if we process the personal data to collect, store, analyze or use it solely for our PMC's benefit and at their direction as part of the Services we provide). We generally are only able to help data subjects exercise their rights as to the personal data we are a data controller of. If you have a question or request as to data we're a processor of, you should generally address that to the relevant data controller.

C. Exercising your rights

1. How to exercise your rights

To submit a request to access, rectify, delete, or port your personal data, email [email protected]. Note in the body the specific right you want to exercise. In the subject line, include "<Your State/Country> Consumer Request". To protect your privacy and security, we will attempt to verify your identity before acting on your request.

2. Use of an authorized agent

An agent legally authorized to act on your behalf may make a verifiable request. You must provide written permission and, where required, a power of attorney meeting Data Privacy Laws. We may request additional information to verify the agent or avoid fraud.

3. Minors

We do not knowingly collect personal information of minors under the age of 13, nor are our Sites or Services directed at children under 13. If you believe we have collected information from a child under 13, please contact us and we will take appropriate action.

4. Inhabit as a service provider

Through Stay by Inhabit, we act as a "Service Provider" to PMCs. For personal information we hold as a Service Provider, you should generally contact the PMC; we may refer your request to them.

IX. Changes to this Privacy Notice

Changes to this Privacy Notice will be posted on this page. If we make a material change to our privacy practices, we will provide notice on our Platform or by other means as appropriate. If we are required by applicable data protection laws to obtain your consent to any material changes before they come into effect, we will do so in accordance with law.

X. Contact us