This policy explains the what, how, and why of the information we collect when you use the Product. It also explains the specific ways we use and disclose that information.

Changes

If there are any changes to this Privacy Policy, we will post them on the Product website and notify you when you log into the Product. Any changes will be effective as of the date we post on the websites or send the email (or whichever date is later). If you object to changes in our Privacy Policy, you will be unable to continue utilizing the Product, and your account may be terminated. If you have questions or concerns about this Privacy Policy, please contact us.

Effective Date

This Privacy Policy is effective and each new version is effective upon logging into the Product.

Information We Collect

Information You Provide to Us

When you register to use the Product, use the Product or Services in any way, communicate with our support team, send us an email, or communicate with us or the Product or Services electronically in any way, you are giving us information that we collect and the right to conduct searches, inquiries, and actions on your behalf that generate information. That information may include: your IP address, name, business name, business website URL, information relating to you or your business's social media account(s), physical address, email address, phone number, credit card information, wage, salary, employment, and other information of any kind. By giving us this information, you consent to your information being collected, used, disclosed, and stored by us.

Consumer Lists and Messages

We may retain the digital wallet device identifiers, email addresses, Consumer spending habits, order history, order preferences, social media habits and actions, cell phone numbers, messages you send to Consumer Lists or Customers of any kind, and any other information that Consumers have provided in any way, directly or indirectly, in any format via the Product, in addition to such information that the Developer of the Product may independently develop as a result of analysis or review of any of the aforementioned information types.

Information from Your Use of the Service

We may collect information about your business and how and when you use the Product. This information may include, but is not limited to, your IP address, time, date and browser used, physical address, your business's SIC code, and actions taken by you within the application. It may also include information posted about you or your business on the internet in any form or listings on various forums and search engines, including but not limited to Google Analytics, Google listings, Yelp, Facebook, Instagram, and Twitter.

Information Provided by Your Payment Processor / Financial Provider

This includes, but is not limited to: Merchant IDs, Merchant Name(s), addresses, phone numbers, merchant status, group numbers, primary contact first and last names, primary contact addresses, website URLs, SIC codes, transaction types, settlement status, entry mode, transaction IDs, linked transaction IDs, Acquirer Reference Numbers, terminal dates and times, authorization dates and times, settlement dates and times, redacted PAN data, PAN hash, card types, foreign card indicators, interchange qualifications, currency codes, transaction totals, batch information, authorization codes, and any other processing, settlement, or financial information. We will never share this information or any derivatives thereof other than: (1) internally within the Products or Services for your business's benefit and use; and/or (2) with your Payment Processor or Financial Provider who provided the information.

Cookies

When you register to use the Product or utilize any of our Services or websites, we store "cookies," which are strings of code, on your computer. We use those cookies to collect information about when you visit our websites, when you use the Product, your browser type and version, your operating system, and other similar information. You may turn off cookies that have been placed on your computer by following the instructions on your browser, but if you block our cookies, it may be more difficult (and maybe even impossible) to use the Product.

Web Beacons

When we send emails to registered consumers we will sometimes track who opened the emails and who clicked the links. We do that to measure our campaign performance and to improve our features for specific segments. To do this, we include single pixel gifs, also called web beacons, in emails we send. Web beacons allow us to collect information about when you open the email, your IP address, your browser or email client type, and other similar details. We also include web beacons in the emails we deliver for you. We use the data from those web beacons to create the reports you see about who has or hasn't opened emails or clicked links. Reports are also available to us when we send you email, so we may collect and review that information.

Use and Disclosure of Information We Collect and Personal Information

We may use and disclose Information we collect and your Personal Information only as follows:

To Promote Use of the Product

For example, if you provide personal information when you visit our website or speak with a representative by phone or in person, we may send you future communications about the Product and/or signing up. If you use any of our Products, and we think you might benefit from using another Product we offer, we may send you correspondence asking you about it.

To Bill and Collect Money Owed to Us

This includes sending you emails, invoices, receipts, notices of delinquency, and alerting you if we need updated payment or billing information. We may use third parties or internal functionality for secure credit card transaction processing, and we may send billing information to those third parties or other internal departments to process your orders and credit card payments.

To Send You System Alert Messages

For example, we may let you know about temporary or permanent changes to a Product, like planned outages, new features, version updates, releases, abuse warnings, and changes to our Privacy Policy.

To Enforce Compliance and Protect Rights

We may use and disclose your information in the following circumstances:

• To enforce compliance with this TOU and applicable law
• To provide customer support to you
• To protect the rights and safety of other end users and third parties, as well as our own
• To meet legal requirements like complying with court orders, regulatory requirements, and valid subpoenas
• To provide information to representatives and advisors, like attorneys and accountants, to help us comply with legal, regulatory, accounting, or security requirements
• To prosecute and defend a court, arbitration, or similar proceeding

To Support, Improve, and Sell Products

This may include adding features that compare campaigns, or using data to suggest other publishers your customers or consumers may be interested in. This may further include producing reports, summaries, and suggestions based on the information, and any derivatives thereof. The Developer of the Product may also communicate information about you internally to conduct research for any additional products or services offered by the Developer of the Product, now or in the future.

To Populate Our Engagement Applications

The purpose of these applications and related Products and Services is to give you a better understanding of how you are performing in key digital marketing areas:

• Listings – How your business's information appears on search engines and other popular sites.
• Reputation – What customers are saying about the merchant on various review sites.
• Social Media – Our platform's ability to link with Facebook, Twitter, and Instagram profiles.
• Website Performance – Our website module, which monitors uptime, page load speed, domain expiration, and Google Analytics.

To Populate Our Intelligence Applications

The purpose of the Intelligence applications is to provide you with sales reports, a view of your merchant statements, chargeback information, and funding events. Our platform uses redacted PAN data to populate these reports and present them to you in an understandable and accessible format.

To Communicate with You About Your Account

We may contact you for informational purposes related to your account.

To Transfer Your Information

In the case of a sale, merger, consolidation or acquisition, any acquirer will be subject to our obligations under this Privacy Policy.

To Send You Informational and Promotional Content

You may choose (or "opt in") to receive promotional content. You can stop receiving our promotional emails by following the unsubscribe instructions included in each email.

Limitations on Use and Disclosure

Other than as required by law or regulation, we will never share your information with another merchant, or with any outside entity (other than an entity through which you receive card processing services). Our internal systems within the Products are designed to ensure that your information is not shared with another merchant. Further, we will never share any information regarding your business's finances, transactions, or settlement data with anyone other than you, or the processing party who provided us with the information.

Social Media and Links to Third-Party Sites

The Product may include links to other websites, whose privacy practices may be different from ours. If you submit information or information of any kind to any of those sites, your information is governed by their privacy policies. We encourage you to carefully read the privacy policy of any website you visit or app you engage with.

Notice of Breach of Security

No one is safe from hackers. If a security breach causes an unauthorized intrusion into our system that materially affects you or people on your Consumer Lists, then we will notify you as soon as possible and later report the action we took in response.

Accuracy of Data, Transparency, and Choice

We do our best to keep your data accurate and up to date, to the extent that you provide us with the information we need to do that. If your data or Information changes (like a new email address), then you are responsible for notifying us of those changes. We may keep some data and Information indefinitely. We will give you access to any Personal Information about you that we hold within thirty (30) days of any request. Unless it is prohibited by law, we will remove any Personal Information about you from our servers at your request.

Enforcement

We regularly review our compliance with this Privacy Policy. If we receive a written question or concern, then we will do our best to respond to the person who made it as quickly as we can.

Legal Basis for Processing (GDPR)

This section applies to individuals in the European Economic Area (EEA) and the United Kingdom, where the GDPR or UK GDPR applies to our processing of your personal data.

Business Warrior Corp. processes personal data on the following legal bases under Article 6 of the GDPR:

• Contract Performance (Art. 6(1)(b)) – Processing necessary to perform our contract with you, including account management, billing, and service delivery.
• Legal Obligation (Art. 6(1)(c)) – Processing necessary to comply with applicable laws, including financial regulations, court orders, and regulatory requirements.
• Legitimate Interests (Art. 6(1)(f)) – Processing for our legitimate business interests including fraud prevention, security monitoring, and product improvement, where these are not overridden by your rights.
• Consent (Art. 6(1)(a)) – Where we rely on consent (e.g., for marketing), you may withdraw consent at any time without affecting the lawfulness of prior processing.

Data Retention

Business Warrior Corp. retains personal information only as long as necessary to fulfil the purposes for which it was collected, including to satisfy legal, regulatory, accounting, or reporting requirements.

• Account and transactional data – Retained for the duration of the business relationship and a minimum of 7 years thereafter to meet financial and regulatory obligations.
• Marketing data – Retained until you unsubscribe or withdraw consent, whichever is earlier.
• Security and access logs – Retained for a minimum of 12 months in accordance with our Information Security Policy.
• Data subject request records – Retained for a minimum of 3 years for audit and compliance purposes.

Upon expiry of the applicable retention period, personal information will be securely deleted or anonymized in accordance with our Redaction and Destruction Policy.

Your Privacy Rights

Rights Under GDPR (EEA and UK Residents)

If you are located in the European Economic Area or the United Kingdom, you have the following rights under the GDPR / UK GDPR:

• Right of Access (Art. 15) – You may request a copy of the personal data we hold about you and information about how we process it.
• Right to Rectification (Art. 16) – You may request correction of any inaccurate or incomplete personal data we hold about you.
• Right to Erasure / Right to be Forgotten (Art. 17) – You may request deletion of your personal data where there is no compelling reason for continued processing, subject to legal retention obligations.
• Right to Restriction of Processing (Art. 18) – You may request that we restrict processing of your personal data in certain circumstances.
• Right to Data Portability (Art. 20) – You may request your personal data in a structured, commonly used, machine-readable format.
• Right to Object (Art. 21) – You may object to our processing of your personal data where we rely on legitimate interests.
• Rights Related to Automated Decision-Making (Art. 22) – You have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.
• Right to Withdraw Consent – Where processing is based on consent, you may withdraw it at any time.

We will respond to all legitimate requests within 30 days. Where requests are complex, we may extend this by a further two months and will notify you accordingly.

Rights Under CCPA (California Residents)

If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA):

• Right to Know – You may request disclosure of the categories and specific pieces of personal information we have collected about you, our business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to Delete – You may request deletion of personal information we have collected from you, subject to certain exceptions.
• Right to Opt-Out of Sale – Business Warrior Corp. does not sell personal information as defined under the CCPA.
• Right to Non-Discrimination – We will not discriminate against you for exercising any of your CCPA rights.
• Right to Correct – You may request correction of inaccurate personal information we maintain about you.

We will respond to verifiable consumer requests within 45 days, with a possible 45-day extension where reasonably necessary.

International Data Transfers

Business Warrior Corp. is based in the United States. If you access our Product from the European Economic Area, the United Kingdom, or other regions with laws governing data collection and use that may differ from U.S. law, please note that your information may be transferred to, stored, and processed in the United States.

Where we transfer personal data from the EEA or UK to a country not recognized as providing an adequate level of data protection, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms.

Privacy Complaints Procedure

If you have a concern or complaint about how Business Warrior Corp. has collected, used, stored, or disclosed your personal information, or about our compliance with this Privacy Policy or applicable privacy law, please contact us in writing:

• Email: Contact us at the privacy/support email address published on our Product website or in your account portal.
• In writing: Address your complaint to the Privacy Officer, Business Warrior Corp., at our registered business address.

Please include your name, contact details, a description of your complaint, and any relevant supporting information.

How We Handle Complaints

• We will acknowledge receipt of your complaint within 5 business days.
• We will investigate the complaint and provide a written response outlining our findings within 30 days. For complex matters, we may require up to an additional 30 days and will inform you of any extension.
• Where we find that a privacy obligation has been breached, we will take corrective action and inform you of the steps taken.
• We maintain a log of all privacy complaints received, outcomes, and corrective actions taken, which is reviewed periodically by management.

Escalation to Supervisory Authorities

If you are not satisfied with our response, you have the right to escalate your complaint to the relevant supervisory authority:

• EEA / EU residents: Lodge a complaint with your local Data Protection Authority (DPA). See https://edpb.europa.eu for a list of EU DPAs.
• UK residents: Contact the Information Commissioner's Office (ICO) at https://ico.org.uk/make-a-complaint/
• California residents: Contact the California Privacy Protection Agency (CPPA) at https://cppa.ca.gov/

Enforcement and Policy Review

We regularly review our compliance with this Privacy Policy. This policy is reviewed and approved at least annually by the Director of IT, or more frequently if material changes are made to our data collection or processing practices. If you have a written question or concern about this policy, please contact us and we will respond as promptly as possible.