Tomgrow Ltd. – Website Privacy Policy

Tomgrow Ltd. (including its affiliates and subsidiaries, collectively referred to as “Tomgrow”, the “Company”, “we”, “us” or “our” in this Privacy Policy) respects your privacy and is committed to protecting your Personal Data. This Privacy Policy (“Privacy Policy”) is designed to inform you as to how we handle your Personal Data in connection with your visit to our website [Add link to company’s website] (“Website”) and notify you about your privacy rights and how the law protects such rights. “Personal Data” shall mean any information about an individual from which that person can be identified.

To the extent that the European General Data Protection Regulation (“GDPR”) or the United Kingdom General Data Protection Regulation (“UK GDPR”) apply to Personal Data that we process in accordance with this Privacy Policy, we act as act as a “data controller” with respect to such processing. To the extent that the California Consumer Privacy Act (“CCPA”) or the California Privacy Rights Act (“CPRA”) applies, we act as a “business”.

We encourage you to read this Privacy Policy carefully and to regularly check this page to review any changes we might make to the terms of this Privacy Policy. This Privacy Policy supplements other policies we may provide as part of our interactions with you or policies you may have received from other controllers and is not intended to override such policies.

This Privacy Policy is provided in a layered format so you can click through to the specific areas set out below.

1. The Data We Collect About You
2. How We Collect Your Personal Data
3. How We Use Your Personal Data
4. Sharing Your Personal Data with Third Parties
5. Minors
6. International Transfers
7. Your Rights
8. Accessibility
9. Contact Details
10. Changes to this Privacy Policy

If you are a resident of the state of California, please read the additional information for California residents.

1. 1.      The Data We Collect About You

When you use our Website or contact us through it, we may collect the following types of Personal Data on you:

• Identity Data includes your first and last name.
• Contact Data includes your email address and telephone number.
• Address Data includes your country, state and zip code.
• Usage Data includes information about how you use or interact with our Website (such as, when you entered the Website, how long you stayed on the Website and/or a specific page on the Website).
• Technical Data includes information on your internet connection (such as your IP address and internet service provider name), on the device and software that you are using to access the Website (e.g., your web browser type and computer operating system).
• Additional Inquiry Data includes additional information that you may provide when you contact us through the Website or when you sign up for any of our services.

We also collect, use and share aggregated data such as statistical data for any purpose. Such information does not reveal your identity and therefore is not considered Personal Data. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific feature available through the Website.

Protecting the Privacy Rights of Third Parties

If you provide us any Personal Data relating to others, you must make sure that you have permission to do so.

• 2.      How We Collect Your Personal Data

We use different methods to collect data from and about you including through:

• Direct interactions. When you contact us through our Website, subscribe to our communications, or otherwise provide your Personal Data directly to us, you will be asked to provide us with your Identity Data, Contact Data, and/or Address Data so that we can provide our services to you, respond to your questions or requests or otherwise contact you. You may also provide Additional Inquiry Data in such instances.
• Automated technologies or interactions. As you interact with our Website, we automatically collect the applicable Technical Data and Usage Data. We collect this data by using cookies, server logs, and other similar technologies.
• Third parties or publicly available sources. We may receive Technical Data and Usage Data about you from third parties, such as Usage Data and Technical Data that we may receive from analytics providers, and from advertising and marketing partners.

You are not legally obligated to provide any Personal Data to Tomgrow. Any Personal Data that you choose to provide to Tomgrow is provided at your own free will.

• 3.      How We Use Your Personal Data

We will only use your Personal Data when permitted by law. We will commonly use your Personal Data in the following circumstances:

• Where the processing is necessary in connection with the performance of any contract we have entered into with you or where it is necessary for taking steps at your request prior to entering a contract.
• Where the processing is necessary for our legitimate interests (or those of a third party), and such legitimate interests are not overridden by your interests, fundamental rights, or freedoms. Legitimate interest means our interest in managing and conducting our business.
• Where the processing is necessary for compliance with a legal or regulatory obligation.
• Where you have provided your consent for such processing. Such consent can be revoked at any time.

Purposes for Which We Use Your Personal Data

Below is a description of the ways we use your Personal Data. To the extent that the GDPR and UK GDPR apply, we have mentioned the legal bases we rely on to use your Personal Data, and identified what our legitimate interests are where appropriate:

• We use your Identity Data, Contact Data and/or Address Data to enter into a contract or to perform a contract with you. We also use your Usage Data and Technical Data for the performance of a contract with you (to provide our services to you via the Website).
• We use your Contact Data and Additional Inquiry Data to respond to your requests or questions and to manage our relationship with you, including by notifying you about changes to our terms of use or Privacy Policy. We do so for the performance of a contract with you, if it is necessary to comply with a legal obligation or if it is necessary for our legitimate interests.
• We use your Usage Data, Technical Data, and Contact Data for marketing purposes, to deliver relevant and personalized content to you, send service messages, and to measure or understand the effectiveness of our marketing efforts. We do so where it is necessary for our legitimate interests (to grow our business, to inform our marketing strategy and to maintain and secure the services); or if we have obtained your prior consent (where laws require consent for such communications).
• We use your Usage Data and Technical Data to improve our Website, services, marketing, customer relationships and experiences, including by personalizing and customizing our content. We do so where it is necessary for our legitimate interests (to keep our Website updated and relevant, to develop our business and to inform our marketing strategy).
• In the event of a legal dispute between you (and/or a party on your behalf) to us (and/or a party on our behalf), we may use your Personal Data to the extent necessary in connection with handling such dispute. We do so where it is necessary for our legitimate interests (to defend and enforce our legal rights).
• We may also use your Personal Data as: (a) required by subpoena, law, or other legal process; (b) necessary to assist law enforcement officials or government enforcement agencies; (c) necessary to investigate violations of or otherwise enforce our terms of use, to maintain security of the Website and prevent fraudulent or illegal activity; (d) necessary to protect us from legal action or claims from third parties, including you and/or other users; or (e) necessary to protect the legal rights, personal/real property, or personal safety of our company, users, employees, and affiliates. We do so based on our legitimate interest (to defend and enforce our legal rights and to protect and ensure the continuous operation of our Website).

Note that we may process your Personal Data for more than one lawful ground depending on the specific purpose for which we are using your data.

Promotional Offers

You may receive marketing communications from us if you have requested information from us and you have not opted out of receiving marketing communications.

You can change your contact preferences at any time through your account or by sending us an email with your request to: [Please add relevant email address for change of mailing preferences]. If you wish to stop receiving marketing communications from us, you may ask us to stop sending you marketing communications at any time by following the opt-out link on any marketing message sent to you or by contacting us.

Cookies and Other Tracking Technologies

We automatically collect Personal Data through cookies and similar technologies when you interact with our Website. For additional information on how we use such technologies, please read our cookies policy, available at: [Please add link to Cookies Policy].

In addition, our Website may use Google Analytics (or similar service providers) to collect information about the use of our Website. Google Analytics collects information from users such as age, gender, interests, demographics, how often they visit our Website, what pages they visit, and what other websites they have used before coming to our Website. We use the information we get from Google Analytics to analyze traffic, remarket our products and services to users, improve our marketing, advertising, and to improve our Website. We have enabled Google Analytics advertising features such as remarketing with Google Analytics, Google Display Network Impression Reporting, and Google Analytics Demographics and Interest Reporting. For more information on how Google collects and processes your data, visit https://www.google.com/policies/privacy/partners/. Google provides website visitors the ability to prevent their data from being used by Google Analytics. For more information see: https://tools.google.com/dlpage/gaoptout.

We may also use Hotjar to optimize the services provided by us. Hotjar is a technology service that helps us better understand our users’ experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our services with user feedback. Hotjar uses cookies and other technologies to collect data on our users’ behavior and their devices. This includes a device’s IP address (processed during your session and stored in a de-identified form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), and the preferred language used to display our Website. Hotjar stores this information on our behalf in a pseudonymized user profile. For further details, please see the “about Hotjar” section of Hotjar’s support site.

Third-Party Links

The Website may include links to third-party websites, plug-ins and applications. Clicking on those links or interacting with such content may allow your data to be shared with the relevant third-party. We do not control these third-party websites and are not responsible for their privacy statements; we therefore recommend that you read the privacy policy of every websites you visit.

• 4.      Sharing Your Personal Data with Third Parties

We share Personal Data with third party service providers that provide us services in connection with the purposes listed above.

For example, we may share your applicable Identity Data, Contact Data, Address Data, Usage Data and Technical Data with web analytics providers, email and marketing service providers and other vendors that assist us in maintaining the Website. We may also share your Identity Data and Contact Data with service providers of Tomgrow’s treatments. For additional information, please see the description above in the section titled Cookies and Other Tracking Technologies.

We may also share your Personal Data with legal and regulatory authorities to the extent required by applicable law our professional advisors (e.g. lawyers, accountants) to the extent necessary for the provision of their services to us; and third parties to whom we may choose to sell, transfer, or merge our business (or parts thereof) or our assets, or parties whose business we wish to acquire.

• 5.      Minors

In order to use the Website, you must be at least 18 years of age, or older, if otherwise required by the laws of the country you reside in. Our Website is not designed for use by anyone under the age of 18 and we do not knowingly collect Personal Data from children under the age of 18.

If you are a parent or legal guardian and have concerns about your child’s privacy, or if you believe that your child may have provided us with their Personal Data, please contact us using the Contact Details below. When you approach us as a parent or legal guardian, we may request that you provide certain information needed to confirm your identity, in order to prevent malicious removal of account information.

• International Transfers

We may transfer your Personal Data to countries outside of the country in which you reside (including outside of the European Economic Area (EEA) or the United Kingdom (UK)), that do not necessarily provide the same level of data protection as the country in which you reside and are not recognized by the European Commission and/or the applicable UK authority as providing an adequate level of data protection.

Our transfers of Personal Data outside of the EEA or the UK are done for the performance of a contract or implementation of pre-contractual relations with you, based on your consent, or subject to safeguards that ensure the protection of your Personal Data, such as standard contractual clauses approved by the European Commission and/or the applicable UK authority.

• 7.      Your Rights

Certain privacy laws, including the GDPR and UK GDPR, provide users with rights related to their Personal Data. To the extent that such laws apply to our processing of your Personal Data, you may have the following rights:

• Request access. This means that you may receive a copy of the Personal Data we hold about you.
• Request correction. This means that you may ask us to correct or complete inaccurate or incomplete data that we hold about you.
• Request erasure. This means that you may ask us to delete or remove Personal Data that we hold about you. If we are unable to comply with such request, we will notify you of the specific legal reasons for our decision.
• Object to processing. This means that you may object to the processing of your Personal Data where it is used for direct marketing purposes, or where we are relying on a legitimate interest and you feel that such interest is overridden by your rights and freedoms.
• Request restriction of processing. This means that you may ask us to suspend the processing of your Personal Data if you believe that such data is inaccurate, if our processing is unlawful or if we no longer need to process such data for a particular purpose, but you need us to continue to hold the data.
• Data Portability. This means that you may request that we transfer your Personal Data to you or to a third party. This right applies where we have obtained and processed the data from you based on your consent or where we used the information to perform a contract with you.
• Withdraw consent at any time. This means that you may withdraw your consent where we are processing your Personal Data based on your consent.

If you wish to exercise any of the rights set out above, please contact us.

What We May Need From You

When you approach us with a request to exercise one of your rights, we may request that you provide us with information needed to confirm your identity as a security measure to ensure that your Personal Data is not disclosed to any person who has no right to receive it.

Time Limit to Respond

We try to respond to all legitimate requests within one month or less, if required by law. Where it takes us more than one month to respond (for example, where your request is particularly complicated or where you have made a number of requests) we will notify you and keep you updated.

• 8.      Accessibility

If you have a disability and would like to access this policy in an alternative format, please contact us via our Contact Details listed below.

• 9.      Contact Details

If you have any questions or concerns, please contact us at:

Email: [Please add]

Postal address: [Please add]

You have the right to make a complaint at any time to data protection authorities. We would, however, appreciate the chance to address your concerns before you approach a data protection authority, so please contact us in the first instance.

1. 10.   Changes to this Privacy Policy

We reserve the right to change this Privacy Policy at any time. If we do so, we will post an updated version of this Privacy Policy so that our users and customers are always aware of what information we collect, use, and disclose. Your continued use of our Website and services after any change to this Privacy Policy will constitute your acceptance of such change.

This version was last updated on May 7, 2023

Additional Information for California Residents

Scope

The California Consumer Protection Act (“CCPA”) and the (“CPRA”) provide California residents with rights regarding their Personal Data. This section supplements the Privacy Policy and applies only to users that are California residents. This section describes the rights under the CCPA/CPRA and explains how to exercise those rights. It does not apply to our handling of publicly available information from government records, de-identified or aggregated information or other information that is excluded from the CCPA/CPRA’s scope.

Personal Information We Collect, Use and Disclose

Below is a description of the categories of Personal Information that we collect and disclose to third parties:

• Identifiers: identifiers, such as name, postal address, email address and IP address.
• Contact Data: personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)), such as name, address, and telephone number.
• Technical Data: Internet or other electronic network activity information, including, but not limited to, information regarding your interaction with the Website or an advertisement (such as, when you entered the Website, how long you stayed on the Website and/or a specific page on the Website), and information on your internet connection (such as your IP address and internet service provider name), and on the device and software that you are using to access the Website (e.g., your web browser type and computer operating system).
• Inference Data: inferences drawn from other Personal Information, such as a profile of a person’s preferences.
• Additional Inquiry Data: information that you provide to us when you contact us at your initiative may contain other categories of Personal Information that are not described above.

We do not collect, sell or share Sensitive Personal Information, as such term is defined in the CCPA/CPRA.

If you provide us any Personal Information relating to others, you must make sure that you have permission to do so. This section describes our current practices and our practices during the past 12 months.

Purposes

Below is a description of the ways we use your Personal Information:

• We use your Identifiers or Contact Data to enter into a contract or to perform a contract with you. We also use your Technical Data for the performance of a contract with you (to provide our services to you via the Website).
• We use your Identifiers, Contact Data, and Additional Inquiry Data to respond to your requests or questions and to manage our relationship with you, including by notifying you about changes to our terms of use or Privacy Policy. We do so for the performance of a contract with you or if it is necessary to comply with a legal obligation.
• We use your Technical Data, Identifiers, Inference Data, and Contact Data for marketing purposes, to deliver relevant and personalized content to you, send service messages, and to measure or understand the effectiveness of our marketing efforts.
• We use your Usage Data, Identifiers, Inference Data, and Technical Data to improve our Website, services, marketing, customer relationships and experiences, including by personalizing and customizing our content.
• In the event of a legal dispute between you (and/or a party on your behalf) to us (and/or a party on our behalf), we may use your Personal Information to the extent necessary in connection with handling such dispute.
• We may also use your Personal Information as: (a) required by subpoena, law, or other legal process; (b) necessary to assist law enforcement officials or government enforcement agencies; (c) necessary to investigate violations of or otherwise enforce our terms of use, to maintain security of the Website and prevent fraudulent or illegal activity; (d) necessary to protect us from legal action or claims from third parties, including you and/or other users; or (e) necessary to protect the legal rights, personal/real property, or personal safety of our company, users, employees, and affiliates.

Sources

Below is a description of the sources from which Personal Information is collected:

• Direct interactions. When you contact us through our Website, subscribe to our communications, or otherwise provide your Personal Information directly to us, you will be asked to provide us with your Identifiers and Contact Data so that we can provide our services to you, respond to your questions or requests or otherwise contact you. You may also provide Additional Inquiry Data in such instances.
• Automated technologies or interactions. As you interact with our Website, we automatically collect applicable Technical Data and Inference Data. We collect this data by using cookies, server logs, and other similar technologies.
• Third parties or publicly available sources. We may receive Technical Data and Inference Data about you from third parties, such as analytics providers and advertising or marketing partners.

Cookies and Other Tracking Technologies

We automatically collect Personal Information through cookies and similar technologies when you interact with our Website. For additional information on how we use such technologies, please read our cookies policy, available at: [Add link to Cookies Policy].

Disclosure to third parties

We share Identifiers, Contact Data, Technical Data, Inference Data and Additional Inquiry Data with third party service providers that provide services to us in connection with the purposes listed above.

For example, we store all such categories of Personal Information with third-party cloud storage providers. Additionally, may share your Identifiers, Contact Data, and Technical Data with web analytics providers, email and marketing service providers and other vendors that assist us in maintaining the Website. For additional information, please see the description above in the section titled Cookies and Other Tracking Technologies.

We may also share all of the categories of Personal Information described above with legal and regulatory authorities, to the extent required by applicable law; with our professional advisors (e.g. lawyers, accountants), to the extent necessary for the provision of their services to us; and with third parties to whom we may choose to sell, transfer, or merge our business (or parts thereof) or our assets, or parties whose business we wish to acquire.

This section describes our current practices and our practices during the past 12 months.

Opt-out of the sale or sharing of Personal Information (“do not sell” / “do not share”)

We do not sell the Personal Data we collect, however we may share Identifiers, Contact Data and Technical Data with third parties for cross-context behavioral advertising. To opt-out of personal information sharing, visit [OPT-OUT NOTICE URL].

We do not knowingly sell or share (as such terms are defined in the CCPA/CPRA) Personal Information of consumers under 16 years of age.

Our California Do Not Track Policy

Some browsers transmit “do-not-track” signals to websites. Because of differences in how browsers incorporate and activate this feature, it is not always clear whether users intend for these signals to be transmitted, or whether they even are aware of them. We currently do not take action in response to these signals.

Data Retention

We retain your Personal Information for as long as necessary to fulfill the purposes we collected it for, including for legal or reporting requirements.

In order to determine the appropriate retention period for Personal Information, we consider the following criteria: the volume, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of Personal Information, the purposes for which we collect and process Personal Information, the timeframe during which we may require such Personal Information in connection with potential litigation, and applicable legal requirements.

Your California Privacy Rights under CCPA/CPRA

• Right to Know and Data Portability: you have the right to request certain information regarding our collection and use of Personal Information, and disclosure of Personal Information to third parties over the past twelve months.
• Right to Deletion and Rectification: you have the right to request that we delete any of your Personal Information that we collected from you and retained or that we correct inaccurate Personal Information we retained. We will use commercially reasonable efforts to correct such inaccurate Personal Information. We may deny your deletion request in certain defined cases, for example, if retaining the data is necessary for us or our service providers to perform our contract with you, detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, debug products, exercise free speech, engage in research, enable internal uses or comply with applicable laws and legal obligations.
• Non-discrimination: limiting the use of your Personal Information may affect features and uses that rely on that data. You have a right not to receive discriminatory treatment by us for the exercise of such privacy rights as conferred by the CCPA/CPRA. Unless permitted by the CCPA/CPRA, we will not: deny you goods or services, provide you a different level or quality of goods or services or suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
• Automated decision-making: you will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have notified you and allowed you to opt-out.

Submitting Requests regarding Your Rights

To make a request regarding your rights as detailed above, please submit a request using one of the methods in the Contact Details section below.

You may use a legally authorized agent on your behalf to submit a request, if you provide a signed written permission to such person. Your request to know or delete must provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized agent and should describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. If you use an authorized agent, we may request that you verify your identity with us and directly confirm with us that you provided the agent permission to submit a request.

California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our Website that are California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please contact us using one of the methods in the Contact Details section in the Privacy Policy.

Accessibility

If you have a disability and would like to access this policy in an alternative format, please contact us via our Contact Details listed below.

Contact Details

If you have any questions or concerns, please contact us at:

Email: [Please add]

Postal address: [Please add]

Changes to this Privacy Policy

We reserve the right to change this document at any time. If we do so, we will post an updated version of this document so that our users and customers are always aware of what information we collect, use, and disclose. Your continued use of our Website and services after any change to this document will constitute your acceptance of such change.

This version was last updated on May 8^th, 2023