10. Disclosure of Your Information

We may disclose aggregated, non-identifying information about our users without restriction. We may disclose personal information we collect or that you provide:

• To our subsidiaries and affiliates;

• To contractors, service providers, and other third parties who support our business operations and are bound by contractual confidentiality and use restrictions;

• To a buyer or successor in connection with a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of Madwire assets;

• To third-party marketing partners only with your express opt-in consent;

• To analytics and advertising service providers including Google LLC, subject to the cookie consent preferences you have expressed;

• To comply with any court order, law, or legal process, including government or regulatory requests;

• To enforce our terms of use and other agreements, including for billing and collection;

• To protect the rights, property, or safety of Madwire, our customers, or others, including exchanging information for fraud protection and credit risk reduction;

• For any other purpose disclosed by us when you provide the information, or with your consent.

We do not sell your personal information to third parties for monetary consideration, except as necessary to provide the services you have requested. In states where "sale" is defined broadly under applicable law (e.g., California, Colorado, Virginia, and others), we provide opt-out rights as described in the State-Specific Privacy Rights section below.

11. Your Choices and Rights

Marketing Communications

You may opt out of receiving marketing communications from us at any time by contacting us at privacy@madwire.com or by using the unsubscribe link included in marketing emails. Opting out of marketing does not affect transactional or service-related communications.

Cookies and Tracking

You may manage your cookie preferences at any time through our Cookie Preference Center or through the methods described in Section 6.

Accessing and Correcting Your Information

You may send us an email via our contact link or to privacy@madwire.com to request access to, correction of, or deletion of personal information you have provided to us. We cannot delete your personal information without also deleting your user account. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

Global Privacy Control (GPC)

We honor the Global Privacy Control (GPC) browser signal as a valid opt-out of the sale of personal data and the use of personal data for targeted advertising, where required by applicable state law. You may enable GPC through a supported browser or browser extension.

12. Data Security

We have implemented administrative, technical, and physical measures designed to protect your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. Access to your personal data is limited to employees, agents, contractors, and other third parties who have a legitimate business need to know. Such parties process your personal data on our instructions and are subject to a duty of confidentiality.

We have put in place procedures to respond to any suspected personal data breach and will notify you and any applicable regulator where we are legally required to do so.

The security of your information also depends on you. You are responsible for keeping your account password confidential. Unfortunately, no internet transmission is completely secure, and we cannot guarantee the security of information transmitted to our Websites.

13. Data Retention

We retain your personal data only for as long as necessary to fulfill the purposes for which we collected it, including to satisfy any legal, accounting, or reporting requirements. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process it, and applicable legal requirements.

In general, we retain customer account data for the duration of the customer relationship plus a period of up to seven (7) years to comply with tax, financial reporting, and contract-related obligations, unless a shorter or longer period is required by applicable law.

14. State-Specific Privacy Rights

In addition to any rights described elsewhere in this policy, residents of the following states may have additional privacy rights under their respective state laws. To exercise any of the rights listed below, please submit a verifiable consumer request to privacy@madwire.com or through our Privacy Request Portal. We will respond within the timeframe required by applicable law (generally 45–60 days, with possible extension). We will not discriminate against you for exercising your privacy rights.

California Residents — CCPA / CPRA

California residents have rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). These include the right to:

• Know what personal information we have collected, used, disclosed, and sold or shared;

• Delete personal information we have collected, subject to certain exceptions;

• Correct inaccurate personal information;

• Opt out of the sale or sharing of your personal information, including for cross-context behavioral advertising;

• Limit the use and disclosure of sensitive personal information;

• Non-discrimination for exercising your rights.

For a full description of your rights and how to exercise them, please visit our California Privacy Notice and our Do Not Sell or Share My Personal Information page. We honor the GPC as a valid opt-out signal under California law.

California residents may also submit rights requests by contacting us at privacy@madwire.com or by calling our toll-free number listed on our Contact Us page.

Colorado Residents — Colorado Privacy Act (CPA)

Colorado residents have the right to: (1) opt out of the processing of personal data for targeted advertising, sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects; (2) access personal data we process about you; (3) correct inaccuracies; (4) delete personal data; and (5) obtain a portable copy of personal data in a readily usable format. We honor the GPC as a valid opt-out signal under Colorado law. To submit a request, contact privacy@madwire.com. If we deny your request, you may appeal by contacting us. If you are unsatisfied with the result, you may contact the Colorado Attorney General.

Virginia Residents — Consumer Data Protection Act (CDPA)

Virginia residents have the right to: (1) confirm whether we process your personal data; (2) access your personal data; (3) correct inaccuracies; (4) delete your personal data; (5) obtain a portable copy; and (6) opt out of the processing of personal data for targeted advertising, sale, or profiling. We do not process sensitive data about Virginia residents without consent. Submit requests to privacy@madwire.com. You may appeal a denial of your request by contacting us; unsatisfied appeals may be directed to the Virginia Attorney General.

Connecticut Residents — Connecticut Data Privacy Act (CTDPA)

Connecticut residents have rights to access, correct, delete, and obtain a portable copy of personal data, and to opt out of the sale of personal data, targeted advertising, and profiling. We honor the GPC as a valid opt-out. Submit requests to privacy@madwire.com. Appeals may be directed to us and ultimately to the Connecticut Attorney General.

Texas Residents — Texas Data Privacy and Security Act (TDPSA)

Effective July 1, 2024, Texas residents have the right to confirm whether we process personal data about them, access it, correct inaccuracies, delete it, obtain a portable copy, and opt out of the sale of personal data, targeted advertising, or profiling that produces legal or similar significant effects. Submit requests to privacy@madwire.com.

Oregon Residents — Oregon Consumer Privacy Act (OCPA)

Effective July 1, 2024, Oregon residents have the right to confirm, access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, sale of personal data, and profiling. Oregon's law provides additional protections for sensitive data and does not contain certain exemptions found in other state laws. Submit requests to privacy@madwire.com.

Montana Residents — Montana Consumer Data Privacy Act (MCDPA)

Effective October 1, 2024, Montana residents have rights to confirm, access, correct, delete, and obtain a portable copy of personal data, and to opt out of sale of personal data and targeted advertising. Data collection is limited to what is adequate, relevant, and reasonably necessary. Submit requests to privacy@madwire.com.

New Jersey Residents — New Jersey Data Privacy Act (NJDPA)

Effective January 15, 2025, New Jersey residents have the right to confirm, access, correct, delete, and port personal data, and to opt out of the processing of personal data for sale, targeted advertising, or profiling. We honor the GPC as a valid opt-out under New Jersey law. Submit requests to privacy@madwire.com.

Delaware Residents — Delaware Personal Data Privacy Act (DPDPA)

Effective January 1, 2025, Delaware residents have the right to confirm, access, correct, delete, and port personal data, and to opt out of the processing for targeted advertising, sale, and profiling. Submit requests to privacy@madwire.com.

Iowa Residents — Iowa Consumer Data Protection Act (ICDPA)

Effective January 1, 2025, Iowa residents have the right to confirm, access, and obtain a portable copy of personal data and to opt out of the sale of personal data and targeted advertising. Note: Iowa's law does not grant the right to delete or correct data collected by third parties. Submit requests to privacy@madwire.com.

New Hampshire Residents — New Hampshire Privacy Act (NHPA)

Effective January 1, 2025, New Hampshire residents have the right to confirm, access, correct, delete, and port personal data, and to opt out of targeted advertising, sale, and profiling. Submit requests to privacy@madwire.com.

Tennessee Residents — Tennessee Information Protection Act (TIPA)

Effective July 1, 2025, Tennessee residents have the right to confirm whether we process their personal data, obtain a copy, and request correction of inaccuracies. We comply with TIPA's requirements for covered businesses meeting the applicable thresholds. Submit requests to privacy@madwire.com.

Minnesota Residents — Minnesota Consumer Data Privacy Act (MCDPA)

Effective July 31, 2025, Minnesota residents have the right to confirm, access, correct, delete, and obtain a portable copy of personal data, and to opt out of targeted advertising, sale, and profiling. Submit requests to privacy@madwire.com.

Maryland Residents — Maryland Online Data Privacy Act (MODPA)

Effective October 1, 2025, Maryland residents have the right to confirm, access, correct, delete, and port personal data, and to opt out of targeted advertising, sale, and profiling. Maryland's law imposes stricter requirements on the processing of sensitive data, limiting its collection to what is strictly necessary to provide the requested product or service. Submit requests to privacy@madwire.com.

Indiana Residents — Indiana Consumer Data Privacy Act (ICDPA)

Effective January 1, 2026, Indiana residents will have the right to confirm, access, correct, delete, and port personal data, and to opt out of targeted advertising, sale, and profiling. The law applies to businesses that process the personal data of at least 100,000 Indiana residents, or 25,000 residents when more than 50% of revenue derives from selling personal data. Submit requests to privacy@madwire.com.

Other States

Privacy laws are rapidly evolving across the United States. Even if your state is not listed above, you may have rights under applicable state law. We are committed to honoring consumer privacy rights as required by law in your jurisdiction. If you are unsure whether you have rights under a law not listed here, please contact us at privacy@madwire.com and we will work to address your request in good faith.

How to Submit a Rights Request

To exercise any applicable privacy rights, please submit a verifiable request to us by:

• Emailing privacy@madwire.com;

• Using our Privacy Request Portal; or

• Writing to us at: Madwire, LLC, Attn: Data Privacy Officer, 3420 E. Harmony Rd, Suite #125., Fort Collins, CO 80528.

We may need to verify your identity before processing your request. We will confirm receipt of your request within 10 business days and respond fully within the timeframe required by applicable law (generally 45 days, extendable by an additional 45 days with notice).

15. International Transfers

Data provided to us is processed in the United States. If you are located outside the United States, please be aware that information we collect may be transferred to and processed in the United States, where data protection laws may differ from those in your country.

For transfers from the European Economic Area (EEA) or Switzerland, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms, to ensure an adequate level of protection for personal data. We require all sub-processors to agree to appropriate transfer mechanisms as a condition of our agreements with them.

References in our prior policies to Commission Decision 2010/87/EU have been updated to reflect the current Standard Contractual Clauses adopted by the European Commission in its Implementing Decision (EU) 2021/914.

16. Changes to Our Privacy Policy

It is our policy to post any changes we make to our privacy policy on this page. If we make material changes to how we treat your personal information, we will notify you by email to the address associated with your account and/or through a prominent notice on our Websites' home page. The date the policy was last revised is identified at the top of this page. You are responsible for ensuring we have an up-to-date, deliverable email address for you, and for periodically reviewing this policy for changes.

17. Contact Information

To ask questions or comment about this privacy policy and our privacy practices, please contact us:

• Email: privacy@madwire.com
• Postal Address: Madwire, LLC, Attn: Data Privacy Officer
• 3420 E. Harmony Rd. Suite# 125 Fort Collins, CO 80528
• Sales: 833-277-1331
• Client Services: 855-773-8171