Privacy Notice

Boon Road, Inc. ("Formtoro", "we", "our" or "us") owns and operates the Formtoro website located at www.formtoro.com, (the "Site") and (b) Formtoro's proprietary marketing technology platform (the "Platform") which enables users to deploy sign-ups, surveys, pop-ups, and other forms (the "Forms").

When we refer to the "Services" throughout this Privacy Notice, we mean the Site, Platform, Forms, and any other products, websites, services, applications and/or other products that include a link and/or reference to this Privacy Notice, and any related services and/or new features and/or functionality provided by us through or in connection with any of the foregoing.

Please read this Privacy Notice carefully. It provides important information about your personal information and tells you about your rights under applicable privacy laws. If you have any questions, comments, or concerns regarding this Privacy Notice and/or our data practices, please contact us at: privacy@boonrd.com

BY ACCESSING OR USING THE SERVICES (OR ANY PART THEREOF), OR SUBMITTING INFORMATION IN CONNECTION WITH YOUR USE OF THE SERVICES (OR ANY PART THEREOF), YOU ACKNOWLEDGE AND AGREE THAT YOU HAVE READ THIS PRIVACY NOTICE.

Table of Contents

1. Information We Collect
2. Automated Collection of Information
3. Children's Privacy
4. How Formtoro Uses Personal Information
5. Sharing Personal Information
6. Marketing Communications
7. Accessing, Correcting and Updating Personal Information
8. External Websites
9. Data Retention
10. Data Security and Protection
11. Notice to Users Outside the United States
12. Changes to this Privacy Notice
13. How to Contact Us

1. Information We Collect

How and what personal information we collect in connection with the use of the Services depends on how and why you use the Services.

The term "personal information" or "personal data" means any information about an individual from which that person may be identified. For example, it may include a person's name, telephone number, email address, or payment information, and in some jurisdictions, IP address. It does not include data from which the identity of an individual has been definitively removed along with any identifiers connected to such individual (also known as anonymous or anonymized data).

Formtoro collects personal information when you:

• Visit and/or browse the Site
• Access and/or use the Platform
• Register an account to access and use the Services ("Account")
• Interact with and/or use any Forms deployed on the websites of the business, entity and/or organization (hereinafter, the "Customer") that has entered into a customer agreement with Formtoro (the "Customer Agreement") for the use of the Services
• Interact with and/or use support and other services provided by us as part of or in connection with the Services
• Sign up for our marketing communications and/or newsletters
• Communicate with us directly

Information Collected by Formtoro

The personal information we collect for our own business purposes depends on how and why you use the Services. For instance, the information provided when visiting and/or browsing the Site or signing up for our marketing communications is more limited than the information that may be provided when you register an Account.

Please be advised that we may ask you to update your information from time to time in order to keep it accurate.

Customer Contact, Account & Registration Information

When you use the Services as a Customer and/or an authorized employee, contractor, and/or agent of the Customer (hereinafter, an "Authorized User"), Formtoro may collect the following contact, account & registration information directly from you:

• Your identity (including your first name and last name) and email address
• The names and email addresses of Authorized Users the Customer is authorizing to access and use the Services
• Your username, password and/or other login credentials

Payment and Transaction Information

Formtoro, through its third party payment providers, collects certain payment information from its Customers, such as credit card information, bank account information, and billing address, as well as information regarding the payments paid by you in connection with the use of the Services.

Note that we do not directly collect or store any payment information. The information provided to Formtoro only includes partial payment or credit card information, and limited transaction information via our payment processors' portals. Payment transaction information is processed and stored exclusively by our third-party, PCI-compliant, payment processors on our behalf in order to collect fees payable by you in connection with your use of the Services.

Please review the following Privacy Policies of our current payment providers to learn more about how they collect, process and protect your personal information:

• Stripe: https://stripe.com/privacy-center/legal

Usage Information

We collect technical and/or analytics consisting of information about our users' interactions with the Services ("Usage Information"), and may include information about the device and/or platform (e.g., iOS or Android), and/or the web browser, used by you to interact with and/or access the Services, your IP address, access dates and times, information about your approximate location (as determined through your IP address), device information, device event information, crash data, and log files and data.

Typically, all Usage Information is collected in anonymous form and does not identify an individual person. To the extent any Usage Information is linked or tied to personally identifiable information, such information is deemed "personal data" and we will use it and protect it in accordance with this Privacy Notice.

Information Collected on Behalf of our Customers

Please note that if you are accessing and/or using the Services as an Authorized User of the Customer, or you interact with a Customer's website, service and/or products that utilize our Services (hereinafter, a "Consumer"), then certain information collected by us in connection with your use of the Services is controlled by the Customer. When Formtoro collects and/or processes such information, it does so as a "data processor" on behalf of the Customer, who is the "data controller."

Whether that Customer is your employer, another organization, or an individual, that Customer determines its own policies regarding storage, access, modification, deletion, sharing, and retention of such information which may apply to your use of the Services. If applicable, please check with the Customer about the policies and settings it has in place with respect to information you submit in connection with your use of the Services.

Information from Third Party Integrations

If you enable any integrations in connection with your use of the Services with third party products and services, including, without limitation data products, services and integrations (collectively, "Third Party Integrations") we may collect certain information through such Third Party Integrations and/or from the providers of such Third Party Integrations.

Other Information

In addition to the information collected in the scenarios above, we may also collect certain information in the following instances:

• Contact information, such as first and last names, and/or email address collected through our sign-up forms to receive our marketing communications and/or newsletters
• Information, data, content, documents and/or materials provided to us through forms, surveys, or contact forms (such as feedback, requests for support, or other communications with us)

Aggregated Data

With the personal information and other data (including, Usage Information) collected by us, we process "Aggregated Data", such as statistical or demographic data. Aggregated Data may be derived from personal information, but is not considered personal information under the law if it does not directly or indirectly reveal your identity. If we combine or connect Aggregated Data with your personal information so that it can directly or indirectly identify you, we treat the combined data as personal information, which will be processed in accordance with this Privacy Notice.

2. Automated Collection of Information

Automated Technologies Used by Formtoro

We or authorized third parties may collect certain information (including, without limitation, Usage Information) by automated means using technologies such as cookies, web beacons, embedded scripts, pixels, browser analysis tools, server logs, and mobile identifiers.

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your computer or device in order to remember information about you, such as your IP address, device identifier, language and/or currency preference or login information. We use both session ID cookies and persistent cookies.

Similar technologies include "web beacons" and/or "tracking tags" which are small graphics, which may be invisible to you, that have a unique identifier and are embedded in the web pages you visit and/or email messages you receive, and "embedded scripts" which are programming codes that are designed to collect information about your interactions with the Services, such as the links you click on.

You can find more information about cookies at: www.allaboutcookies.org or www.youronlinechoices.eu.

Information Collected by These Technologies

When you visit the Site and/or use the Services, or if you interact with a Form we have deployed on our Customer's website, we may by means of cookies, beacons, tags, scripts, and/or similar technologies automatically collect technical information about the devices and software you use to access the Site, Services and/or Forms, such as the type of Internet browser or mobile device you use, the website or source that directed you to the Site and/or the Form, your IP address or device ID (or other persistent identifier that uniquely identifies your computer or mobile device on the Internet), the operating system of your computer or mobile device, and other similar technical information.

Note that, while we may use these technologies to track the use of the Services, Formtoro does not directly track users across third party websites.

Typically, all technical, analytics, and usage information is gathered in anonymous form and does not identify you personally.

How Formtoro Uses the Technology and Information Collected

These technologies (or a combination of them) are used to help us:

• Compile statistics and analytics about your use of and interaction with the Site and/or Services, including details about how and where the Site and/or Services are accessed, how often you visit or use the Site and/or Services, the date and time of your visits, your actions on the Site and/or Services, and other similar traffic, usage, and trend data
• Gather important functionality, testing, and performance data about the Site and/or Services
• Moderate user behavior on the Site and/or Services, such as protecting against fraud and other inappropriate activities
• Gather demographic information about our user base
• Perform other similar functions

Third Party Tools

We may use third party tools and technologies to help us gather this information discussed above. For instance, we use Google Analytics to collect and process certain analytics data and security with technologies such as tracking pixels.

Disabling Cookies

Most web and mobile device browsers automatically accept cookies, but if you prefer, you can change your browser to prevent that or to notify you each time a cookie is set. You can also learn more about cookies by visiting www.allaboutcookies.org which includes additional useful information on cookies and how to block cookies using different types of browsers or mobile devices. Please note, however, that by blocking or deleting cookies used on the Site and/or Services, you may not be able to take full advantage of the Site and/or Services.

Google provides some additional privacy options described at www.google.com/policies/privacy/partners/ with respect to Google Analytics cookies. To opt out from Google Analytics, you can download a plug-in from http://tools.google.com/dlpage/gaoptout.

Do Not Track

Formtoro does not process or respond to web browsers' "do not track" signals or other similar transmissions that indicate a request to disable online tracking of users who use the Site and/or Services.

3. Children's Privacy

Formtoro does not target the Services to persons under the age of 18, and does not knowingly collect personal information from persons under the age of 13 or the equivalent age as specified by law in the applicable jurisdiction (e.g., 16 years of age if you are located in the EEA). Therefore, we ask you not to provide us with personal information of persons under the age of 13 or the equivalent age as specified by law in your jurisdiction. If we learn that personal information of persons under the age of 13 or the equivalent age as specified by law in the applicable jurisdiction, has been collected on or through the Services, then we may deactivate the account or otherwise terminate access to the Services and/or make the user content inaccessible.

Sensitive Data

Formtoro does not require you to provide any sensitive data about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, health and genetics, or biometric data to use the Services.

4. How Formtoro Uses Personal Information

Depending on how you use the Services, we use your personal information in the following instances:

• To host and provide the Site
• To perform and provide the Services to the Customer pursuant to the Customer Agreement
• To enable Third Party Integrations connected to the Services
• Deliver direct marketing communications regarding our products and services that we may think are of interest to you if you have signed up to receive marketing communications, and to Customers and/or Authorized Users acting on a Customer's behalf
• Respond to your queries and requests, or otherwise communicate directly with you
• To understand how users are interacting with and using the Services (which may include administrative and support communications with us), and other actions taken in connection with the use of the Services
• Detect any fraudulent or illegal activity in connection with the use of the Site and/or Services or against Formtoro or its customers and users of the Site and/or Services
• Perform system maintenance and upgrades, and enable new features
• To improve existing and/or develop new products and services
• To comply with a legal or regulatory obligation (for example, keeping records of our sales for tax compliance)
• Provide information to regulatory bodies when legally required, and only as outlined below in Legal Obligations and Security

5. Sharing Personal Information

Aside from disclosing your information to those of our personnel who are authorized to process the information in order to provide the Services and who are committed to confidentiality, we disclose your personal information only to the third parties as described below.

Third-Party Service Providers

We share personal information with third parties that provide services to us that help us in the operation, provision, administration and management of the Services, and to otherwise operate our business. Depending on how you use the Services, the following categories of third parties collect data on our behalf or receive personal information:

• Hosting services providers
• Analytics providers
• Payment processing providers
• Providers of business operations and communication tools
• Other third-party service providers that help us provide features and functions for the Services (e.g., customer support providers)
• Professional service providers, such as auditors, lawyers, consultants, accountants and insurers

For a list of our current third party service providers, please contact us at: privacy@boonrd.com

We require all third party service providers to respect the security of your personal information and to treat it in accordance with the law.

Customers

We will share and disclose personal information of Authorized Users and Consumers of a Customer with the applicable Customer and otherwise in accordance with the Customer's instructions, including any applicable terms in the Customer Agreement, and in compliance with applicable law and legal process. If you are an Authorized User or Consumer, please contact the Customer to learn more about how your information may be used, shared and/or disclosed by us on behalf of the Customer.

Third Party Integrations

When you choose to enable and/or connect Third Party Integrations to interact with the Services, certain data and information may be exchanged between us and the provider of the applicable Third Party Integration. Note that Third Party Integrations with whom you choose to share your information with are not the Services providers. The applicable providers of Third Party Integrations may use your personal information differently than we do and we do not control their use of your information. Please review the privacy notices of any Third Party Integrations you decide to enable in connection with the use of the Services.

Interactive Communication Tools and Features

We may enable users to post and/or comment in our public forums, chats, blog posts and similar means of discussion.

If you post and/or comment in any of these public interactive communication tools, any personal information submitted there will be available to anyone who has access to that content, and can be read, collected, or used by other users of these forums, and could be used to send unsolicited messages. Please make your choice to share your information carefully.

Business Transfers

We may also share data with third parties to whom we choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal information in the same way as set out in this Privacy Notice.

Affiliates and Subsidiaries

Personal information that we collect about you through the Services may be shared with the employees, contractors, and agents of Formtoro and our affiliated and subsidiary entities ("Affiliates") who are involved in providing or improving the Services that we offer to you. We obligate the employees, contractors and agents of Formtoro and our Affiliates to ensure the security and confidentiality of your personal information and to act on that personal information only in a manner consistent with this Privacy Notice.

Legal Obligations and Security

If we are required to disclose personal information by law, such as pursuant to a subpoena, warrant or other judicial or administrative order, our policy is to respond to requests that are properly issued by law enforcement within the United States. Under such circumstances, unless prohibited by applicable law, we will attempt to provide you, or the Customer if you are an Authorized User or Consumer of such Customer, with prior notice that a request for your information has been made in order to give you an opportunity to object to the disclosure. We will attempt to provide this notice by email, if you have given us an email address. However, government requests may include a court-granted non-disclosure order, which prohibits us from giving notice to the affected individual. In cases where we receive a non-disclosure order, we will notify you, or the Customer if you are an Authorized User or a Consumer of such Customer, when it has expired or once we are authorized to do so.

Note that if we receive information that provides us with a good faith belief that there is an exigent emergency involving the danger of death or serious physical injury to a person, we may provide information to law enforcement trying to prevent or mitigate the danger (if we have it), to be determined on a case-by-case basis.

If you are an Authorized User or Consumer, please contact the Customer to learn more about how Customer responds to requests for information pursuant to legal orders.

With your Consent

There may be situations where you are asked to consent to share personal information with third parties for additional reasons not included in this Privacy Notice. In such event, we will only share such personal information if we have received your prior consent and only for the purposes as listed in the request to share such information.

6. Marketing Communications

If you are a Customer and have not otherwise opted out (or with your consent where required by applicable law), or if you have opted-in to receive direct marketing emails from us, we may use your personal information to send you marketing information about the Services, other Formtoro products and services, new product releases, and new feature releases of the Services that we think may interest you. We carry out direct marketing by email.

If you no longer wish to receive marketing communications, you may manage the receipt of marketing and non-transactional communications by clicking on the "unsubscribe" link located on the bottom of any of our marketing e-mails. We will use commercially reasonable efforts to process such requests in a timely manner. Note that you cannot opt out of receiving transactional e-mails or communications related to the Services (e.g., requests for support), which, for clarification, are not marketing communications.

7. Accessing, Updating and Correcting Personal Information

If you would like to correct or update certain personal information (such as your contact information), please contact us at: privacy@boonrd.com, and we will use reasonable efforts to correct and/or update such information. If you are an Authorized User or a Consumer of the Customer, please contact the Customer if you wish to request the correction and/or update of personal information under their control.

8. External Websites

On or through the Services, we may provide or make available, for informational purposes only, links to other websites or resources with which we do not have a contractual relationship and over which we do not have control ("External Websites"). Such links are not paid advertisements, nor do they constitute an endorsement by Formtoro of those External Websites, and are provided to you only as a convenience. By clicking on links to External Websites, the operators of the External Websites may collect your personal information. We are not responsible for the content or data collection practices of those External Websites, and your use of External Websites is subject to their respective terms of use and privacy policies.

9. Data Retention

Personal information is processed for the period necessary to fulfill the purposes for which it is collected (for example, in connection with the Services provided to you pursuant to the applicable terms and/or agreement entered into with Formtoro with respect to your use of the Services), to comply with legal and regulatory obligations and for the duration of any period necessary to establish, exercise or defend any legal rights.

In order to determine the most appropriate retention periods for your personal information, we consider the amount, nature and sensitivity of your information, the reasons for which we collect and process your personal information, and applicable legal requirements.

In some instances, we may choose to anonymize personal information instead of deleting it, for statistical use, for instance. When we choose to anonymize, we make sure that there is no way that the personal information can be linked back to any specific individual.

If you are an Authorized User or a Consumer of a Customer, please contact the Customer if you wish to request the removal of personal information under their control.

10. Data Security and Protection

We have put in place reasonable and appropriate security measures designed to prevent your personal information from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. For example, we use encryption, secure socket layer, firewalls, and password protection. In addition, we limit access to personal information to those employees, agents, contractors and the third parties who have a business need-to-know.

We also have procedures in place to deal with any suspected data security breach. However, no method of transmission over the Internet, or method of electronic storage, is 100% secure, and while we take reasonable steps to provide secure services, by using the Services, you understand and assume the risks associated with your activities on the internet.

In addition, you have responsibility and control over protecting your personal information. For example, you, and not Formtoro, are responsible for safeguarding your password, and other authentication information you use to access the Services. You should not disclose your password and/or authentication information to any third party and should immediately contact us at privacy@boonrd.com if there is any unauthorized use of your password or you have reason to believe that your information and/or Account is no longer secure.

In addition, as described in this Privacy Notice, Formtoro cannot secure, and has no responsibility for, any personal information that you share or release on your own or that you request us to share or release or share with other users of the Services.

11. Notice to Users Outside the United States

The Services, and Formtoro's servers, are operated in the United States. If you are located outside of the United States, please be aware that your information, including your personal data, may be transferred to, processed, maintained, and used on computers, servers, and systems located outside of your state, province, country, or other governmental jurisdiction where the privacy laws may not be as protective as those in your jurisdiction. If you are located outside the United States and choose to use the Services, you hereby irrevocably and unconditionally consent to such transfer, processing, and use in the United States and elsewhere.

12. Changes to this Privacy Notice

Formtoro reserves the right to update or modify this Privacy Notice at any time. If we make any material changes to this Privacy Notice, we will provide reasonable prior notice of such changes either by posting a prominent notice of any such changes on the Site and/or sending a notification to the email address we have on file for you (if any). It is your responsibility to regularly visit and review this Privacy Notice. In addition, if you are a Customer, you are also responsible for notifying your Authorized Users and any Consumers (to the extent applicable) of changes to this Privacy Notice.

If you do not agree to any updates or modifications to the Privacy Notice, terminate your Account and cease all use of the Services. Your continued use of the Services after the effective date of any updates, modifications and/or changes to this Privacy Notice, as indicated by the "Last Updated" date set forth above, signifies to us that you acknowledge and agree to be bound by the revised Privacy Notice.

13. How to Contact Us

If you have any questions about this Privacy Notice, please contact us at: privacy@boonrd.com