PRIVACY POLICY

VendrNova may process personal information in different roles depending on the circumstances.

Website and business interactions

VendrNova generally determines the purposes and means of processing personal information collected through its Website, sales activities, marketing activities, business communications, recruiting activities, and direct commercial relationships.

Enterprise customer data

When an organization uses VendrNova products or services, that organization generally determines:

• Which information is submitted;
• How the product is configured;
• Who may access the information;
• How long the information should be retained; and
• The business purposes for which the information is used.

In these circumstances, VendrNova generally processes personal information on behalf of the customer and subject to the customer's instructions and contract.

If your request concerns information submitted to VendrNova by your employer or another VendrNova customer, you should ordinarily contact that organization first. VendrNova may refer the request to the applicable customer or assist that customer in responding.

The information we collect depends on how you interact with VendrNova.

A. Contact and professional information

This may include:

• Name;
• Business email address;
• Business telephone number;
• Employer or organization;
• Job title, department, or professional role;
• Country, state, or region;
• Professional profile information;
• Communication preferences; and
• Information included in an email, form, message, or meeting request.

B. Sales and commercial information

This may include:

• Products or capabilities in which you are interested;
• Organization size and industry;
• Procurement requirements, challenges, and business objectives;
• Demonstration requests and meeting information;
• Sales correspondence and engagement history;
• Proposal, contracting, onboarding, and account information;
• Customer, prospect, partner, or supplier relationship information; and
• Information necessary to administer a commercial relationship.

C. Account and authentication information

When account functionality is available, we may process:

• Username or business email address;
• Authentication information;
• Organization affiliation;
• Account role and permissions;
• Login and access history;
• Account settings; and
• Security and account-recovery information.

D. Product and service data

In connection with VendrNova products and services, we may process:

• User account and role information;
• Supplier, sourcing, procurement, contract, workflow, and approval information;
• Documents, notes, records, and attachments submitted by authorized users;
• Product usage and configuration information;
• Support and troubleshooting information;
• Audit logs and security events;
• Integration and application programming interface information; and
• Information produced through authorized use of product features.

The nature and content of customer service data are primarily determined by the applicable customer.

E. Website, device, and technical information

We and our approved providers may collect:

• Internet Protocol address;
• Browser type and version;
• Device type and screen resolution;
• Operating system;
• Internet service provider;
• Referring and exit pages;
• Pages viewed;
• Links or buttons selected;
• Website navigation paths;
• Date, time, and duration of a visit;
• Entry and exit pages;
• Approximate location inferred from an IP address;
• Language and display preferences;
• Cookie, session, or similar online identifiers;
• Search terms that led to the Website;
• Campaign and UTM parameters;
• Website errors and diagnostic information;
• Page-load and performance measurements;
• Form-submission events;
• Conversion and funnel events; and
• Security events and indicators of suspected misuse.

F. Communications and meeting information

We may process:

• Emails and messages sent to VendrNova;
• Meeting requests and calendar information;
• Support communications;
• Notes from business conversations;
• Documents or information shared during a meeting; and
• Meeting attendance and engagement information.

A telephone call or online meeting will be recorded only after appropriate notice and, where required, consent. If you do not wish to be recorded, please inform the meeting organizer.

G. Marketing information

This may include:

• Marketing preferences;
• Subscription and unsubscribe status;
• Content downloads;
• Event registration or attendance;
• Email delivery and engagement information, where permitted;
• Campaign source and referral information; and
• Topics, products, or services in which you have expressed interest.

Downloading content or submitting an ordinary business inquiry does not automatically subscribe you to marketing communications unless you separately request or consent to them.

H. Recruiting information

If you apply for a position or communicate with us about employment, we may collect:

• Resume or curriculum vitae;
• Contact information;
• Employment history;
• Education and professional qualifications;
• Professional references;
• Work authorization information;
• Interview notes and assessment information;
• Compensation expectations; and
• Other information voluntarily provided during the recruiting process.

A separate candidate privacy notice may provide additional information and will control if it conflicts with this Privacy Policy.

I. Information you voluntarily provide

We may collect other information that you voluntarily choose to provide.

Please do not submit Social Security numbers, government identification numbers, financial account credentials, medical information, biometric information, passwords, security keys, or other highly sensitive personal information through a general Website form.

VendrNova may collect personal information:

• Directly from you;
• From your employer or organization;
• From a VendrNova customer that authorizes you to use a product or service;
• From suppliers, business partners, referral sources, and event organizers;
• From service providers supporting the Website or our business operations;
• From publicly available professional and business sources;
• Automatically through the Website and approved technologies;
• From product usage and customer-support activities; and
• From authorized integrations.

VendrNova may use personal information to:

Operate the Website

• Deliver and maintain the Website;
• Provide translated or localized Website content;
• Respond to forms, inquiries, and demonstration requests;
• Deliver requested information or content;
• Understand Website traffic and navigation;
• Measure Website and campaign performance;
• Diagnose technical problems;
• Improve page speed, accessibility, and usability;
• Maintain Website security; and
• Detect spam, fraud, abuse, and unauthorized activity.

Provide products and services

• Establish and administer customer accounts;
• Authenticate users and manage permissions;
• Deliver product features and professional services;
• Process authorized customer instructions;
• Provide implementation, training, and support;
• Monitor availability, reliability, and performance;
• Troubleshoot technical problems; and
• Maintain operational, security, and audit records.

Manage business relationships

• Communicate with customers, prospects, partners, and suppliers;
• Conduct demonstrations and meetings;
• Evaluate business requirements;
• Prepare proposals and agreements;
• Manage onboarding, billing, and account administration;
• Maintain relationship records; and
• Provide administrative, legal, security, or service communications.

Improve VendrNova

• Analyze Website and product usage;
• Evaluate navigation, funnels, and conversion activity;
• Develop and improve features and services;
• Conduct quality assurance;
• Perform internal reporting and forecasting;
• Train personnel;
• Protect contractual and legal rights; and
• Support corporate governance and business continuity.

Communicate about VendrNova

• Send communications you request;
• Provide product updates, newsletters, event invitations, or other marketing where permitted;
• Evaluate the effectiveness of communications and campaigns; and
• Maintain unsubscribe and suppression records.

Comply with law and protect others

• Comply with legal, regulatory, contractual, tax, accounting, and reporting obligations;
• Respond to valid legal process;
• Investigate suspected fraud, abuse, security incidents, or violations;
• Protect the rights, safety, property, and security of VendrNova, its customers, users, and others; and
• Establish, exercise, or defend legal claims.

Where applicable law requires a legal basis, VendrNova may process personal information based on:

• Performance of a contract: when processing is necessary to enter into or perform an agreement;
• Legitimate interests: including operating and improving our Website and business, responding to business inquiries, maintaining commercial relationships, measuring Website performance, securing our systems, and conducting appropriate business-to-business marketing;
• Consent: when you have affirmatively agreed to a particular activity, including certain cookies, analytics technologies, or marketing communications;
• Legal obligations: when processing is required to comply with applicable law; and
• Protection of rights and safety: when necessary to protect legal rights, security, safety, or vital interests.

When VendrNova relies on consent, you may withdraw that consent at any time. Withdrawal does not affect processing that occurred before withdrawal.

VendrNova uses or may use the following named providers on its Website. The exact technologies activated during a visit may depend on the page, Website version, device, geographic region, consent selection, and configuration in effect at that time.

A. Repaint

VendrNova uses Repaint to create, host, deliver, and temporarily operate portions of the Website.

Repaint may process:

• IP address;
• Browser and device information;
• Pages requested;
• Date and time of access;
• Usage and diagnostic data;
• Website security and performance information;
• Cookies or similar functional technologies; and
• Information submitted through Repaint-powered forms.

When you submit a Repaint-powered form, the information entered in the form is transmitted through Repaint's form-processing infrastructure and delivered to one or more email addresses designated by VendrNova.

Form information may include:

• Name;
• Business email address;
• Telephone number;
• Organization;
• Job title;
• Information about your business requirements;
• Your message;
• Form-submission date and time; and
• Related technical or security metadata.

VendrNova uses this information to respond to inquiries, arrange demonstrations, evaluate business opportunities, and maintain appropriate business records.

More information about Repaint's practices is available at:

https://repaint.com/privacy

B. Google Analytics and the Google tag

VendrNova uses Google Analytics and the Google tag, also known as gtag.js or "gtag," to measure Website traffic, engagement, performance, and conversions.

The Google tag is code placed on the Website that sends configured measurement information to Google Analytics.

Google Analytics and the Google tag may collect or process:

• Page URLs and page titles;
• Referring websites or sources;
• Search and campaign parameters;
• Dates, times, and session duration;
• Page views and navigation activity;
• Selected links, buttons, or events;
• Form-submission and conversion events;
• Browser, operating system, and device information;
• Screen resolution;
• Approximate geographic location;
• IP address as received and processed by Google;
• Cookie or online identifiers;
• Language information; and
• Website performance and diagnostic data.

Google Analytics may use first-party cookies or similar identifiers, including cookies commonly named `_ga` and `_ga_<container-id>`, depending on configuration and consent.

VendrNova does not intentionally send names, email addresses, telephone numbers, Social Security numbers, or other directly identifying form-field content to Google Analytics. Page URLs, page titles, custom events, and query parameters should not contain such information.

VendrNova uses Google Analytics for Website measurement and improvement. VendrNova does not use Google Analytics or gtag for Google Ads remarketing, personalized advertising, or cross-context behavioral advertising.

Google may process information under its own privacy terms. Additional information is available at:

https://policies.google.com/privacy

https://policies.google.com/technologies/partner-sites

Google also provides a browser-based Google Analytics opt-out tool:

https://tools.google.com/dlpage/gaoptout

C. VisitorTracking

VendrNova uses VisitorTracking to understand Website traffic, visitor journeys, funnels, engagement, and conversions.

VisitorTracking may use cookies, web beacons, scripts, and similar technologies to collect:

• IP address;
• Browser type;
• Device and operating-system information;
• Internet service provider;
• Referring and exit pages;
• Pages visited;
• Date and time information;
• Clickstream and navigation information;
• Session duration;
• Entry and exit points;
• Visitor or session identifiers;
• Funnel activity;
• Conversion events; and
• Other Website interaction information.

VendrNova uses this information to understand how visitors move through the Website, identify areas where visitors leave a process, measure demonstration-request and contact-form conversions, evaluate Website effectiveness, and improve the buyer experience.

VisitorTracking information is used for VendrNova's own Website analytics and business-development purposes. VendrNova does not use VisitorTracking information for cross-context behavioral advertising.

More information is available at:

https://visitortracking.com/privacy-policy/

D. Rybbit

VendrNova uses Rybbit for Website analytics, user-journey analysis, performance measurement, error analysis, funnels, events, and conversion reporting.

Rybbit's standard analytics service may process:

• Pages and URLs visited;
• Page titles;
• Referring sources;
• URL query parameters;
• Entry and exit pages;
• Session duration;
• Browser type and version;
• Operating system;
• Screen resolution;
• Device type;
• Country or region derived from an IP address;
• UTM and campaign parameters;
• Page-performance measurements;
• JavaScript errors;
• Custom events configured by VendrNova;
• Anonymous user or session identifiers; and
• Form-submission events without the contents of sensitive form fields.

According to Rybbit's published documentation, its standard analytics can operate without cookies. Rybbit may temporarily process an IP address to derive approximate location information without retaining the original IP address in its analytics database.

Rybbit session replay

VendrNova may enable Rybbit session-replay functionality for Website quality assurance, troubleshooting, usability analysis, or conversion optimization.

If enabled, session replay may record or reconstruct:

• Mouse movements;
• Clicks;
• Scrolling;
• Page navigation;
• Website layout and Document Object Model changes;
• Form interactions;
• Browser and device information;
• Approximate country or region; and
• The sequence and timing of Website interactions.

Session replay is not intended to collect passwords, payment information, or the contents of sensitive form fields. VendrNova will use available masking and exclusion controls for form inputs and sensitive page elements. Visitors should nevertheless avoid entering sensitive personal information into general Website forms.

Where required by applicable law, session replay will be treated as an optional analytics technology and activated only after appropriate consent.

More information about Rybbit is available at:

https://rybbit.com/privacy

E. MultiLipi

VendrNova uses MultiLipi to provide multilingual Website content, language routing, translation, localization, multilingual search optimization, and related performance functionality.

MultiLipi may process:

• Website page text and other content submitted for translation;
• Translated content;
• URL and page-path information;
• IP address;
• Browser and user-agent information;
• Device and operating-system information;
• Date and time information;
• Language preference;
• Language-preference cookies;
• Approximate location used for language selection where configured;
• Request and response logs;
• Website performance and error information; and
• Information incidentally contained in Website content submitted for translation.

To provide translation, Website text may be transmitted to MultiLipi's servers and to translation or infrastructure subprocessors used by MultiLipi. MultiLipi may cache original and translated content to improve performance.

MultiLipi is not intended to translate or process passwords, credentials, payment information, or other highly sensitive information. VendrNova may use exclusion controls to prevent specified pages, fields, or content blocks from being submitted for translation.

Certain MultiLipi technologies may be necessary to provide a language selected by the visitor. Other MultiLipi analytics or measurement features will be treated according to the visitor's consent choices where required.

More information is available at:

https://multilipi.com/privacy_policy

F. Google Search Console

VendrNova uses Google Search Console to understand how the Website appears and performs in Google Search.

Google Search Console may provide VendrNova with reports about:

• Search queries associated with Website impressions or visits;
• Search-result impressions;
• Clicks from Google Search;
• Average search position;
• Click-through rates;
• Indexed Website pages;
• Crawl and indexing activity;
• Website errors;
• Device categories;
• Country or region information;
• Links to the Website; and
• Website security or search-quality issues.

Google Search Console reports generally provide aggregated or limited search-performance information rather than the contents of forms submitted on the Website.

Google may independently collect information when individuals use Google Search. Google's processing is governed by Google's own privacy terms:

https://policies.google.com/privacy

G. Additional operational technologies

VendrNova may also use technical providers for:

• Domain-name services;
• Website hosting;
• Content delivery;
• Security monitoring;
• Spam and abuse prevention;
• Consent-preference management;
• Email delivery;
• Customer relationship management;
• Meeting scheduling;
• Cloud infrastructure; and
• Routine application and server logging.

If VendrNova adds a provider that materially changes the types of personal information collected or the purposes for which it is used, VendrNova will update this Privacy Policy or provide another appropriate notice.

VendrNova and its approved providers may use cookies, scripts, tags, web beacons, local storage, server logs, session identifiers, and similar technologies.

Strictly necessary technologies

Strictly necessary technologies support:

• Website hosting and delivery;
• Form operation;
• Security and fraud prevention;
• Network management;
• Consent-preference storage;
• Accessibility;
• Language delivery requested by the visitor; and
• Other functionality requested by the visitor.

These technologies may operate without optional consent where applicable law permits because they are necessary to provide the Website or a requested function.

Functional technologies

Functional technologies may remember:

• Language selection;
• Display preferences;
• Accessibility choices;
• Consent settings; and
• Other Website preferences.

Analytics and performance technologies

Analytics and performance technologies may be used to:

• Measure Website traffic;
• Understand navigation and visitor journeys;
• Evaluate content and page performance;
• Measure form and demonstration-request conversions;
• Analyze funnels;
• Detect errors;
• Measure page speed and Web performance;
• Improve Website design and usability; and
• Evaluate marketing sources.

These technologies include Google Analytics/gtag, VisitorTracking, Rybbit, and certain MultiLipi measurement features.

Consent controls

Where a consent interface is provided, visitors may be offered the following choices:

• Accept All
• Reject Optional
• Customize
• Save Choices
• Cookie Settings

Where applicable law requires consent, optional analytics or session-replay technologies will be held until the visitor provides the relevant consent.

Rejecting optional technologies should not prevent a visitor from viewing basic Website content, submitting a contact form, or requesting a demonstration. Some analytics, personalization, or language-preference functionality may be limited.

Visitors may change their preferences through the Cookie Settings control when available. Clearing cookies or browser storage, using another browser, or using another device may require a new selection.

The exact cookies and technologies in use may change as providers update their systems. The Website's consent interface or Cookie Notice may provide a more current cookie-level inventory.

Browser signals

Some browsers provide a legacy "Do Not Track" signal for which no universally accepted technical standard exists. The Website may not respond to that signal.

Where required by applicable law, VendrNova will recognize applicable opt-out preference signals, such as the Global Privacy Control, for the browser or device from which the signal is received.

VendrNova may disclose personal information to:

Website and analytics providers

This includes Repaint, Google, VisitorTracking, Rybbit, and MultiLipi for the activities described in this Privacy Policy.

Other service providers

VendrNova may use service providers supporting:

• Cloud infrastructure and storage;
• Customer relationship management;
• Business email and communications;
• Meeting scheduling and conferencing;
• Customer support;
• Cybersecurity and access management;
• Document management and electronic signature;
• Billing and accounting;
• Professional services;
• Recruiting; and
• Other business operations.

Service providers are authorized to process information for designated services and may be subject to contractual, confidentiality, security, or data-protection requirements.

Customers and authorized users

When VendrNova processes information for an enterprise customer, information may be made available to that customer and its authorized users according to the customer's configuration and instructions.

Business partners and integrations

VendrNova may disclose information to a business partner or integration provider when necessary to provide a requested service, support an authorized integration, or conduct a jointly offered activity.

Professional advisers

VendrNova may disclose information to attorneys, auditors, insurers, accountants, consultants, and other professional advisers subject to appropriate confidentiality obligations.

Legal and safety recipients

VendrNova may disclose information when it reasonably believes disclosure is necessary to:

• Comply with law, regulation, legal process, or a valid governmental request;
• Protect the rights, property, safety, or security of VendrNova or others;
• Investigate fraud, abuse, or a security incident;
• Enforce an agreement; or
• Establish, exercise, or defend legal claims.

Corporate transactions

Information may be disclosed in connection with a merger, financing, acquisition, reorganization, sale of assets, insolvency proceeding, due-diligence process, or similar corporate transaction.

With your direction or consent

VendrNova may disclose information when you direct us to do so or provide consent.

VendrNova does not sell personal information for money.

VendrNova does not intentionally disclose personal information for cross-context behavioral advertising or use personal information to target advertisements based on activity across unrelated businesses, websites, or services.

VendrNova's disclosure of information to website hosting, analytics, translation, form-processing, security, and other service providers is described in this Privacy Policy.

Certain privacy laws define "sale," "sharing," or "targeted advertising" more broadly than ordinary usage. If applicable law treats a VendrNova activity as a sale, sharing, or targeted advertising, VendrNova will provide the notice and opt-out mechanism required by that law.

Customer-provided service data is governed primarily by the applicable customer agreement and any data processing agreement.

VendrNova processes service data to:

• Deliver and support contracted services;
• Follow documented customer instructions;
• Maintain product security and availability;
• Prevent misuse;
• Comply with applicable law; and
• Perform activities authorized by the customer agreement.

Customers are responsible for:

• Determining whether submitted data is appropriate and lawful;
• Providing required notices to individuals;
• Establishing user permissions;
• Managing authorized users;
• Responding to individual requests when the customer controls the relevant data; and
• Avoiding submission of information prohibited by the applicable agreement.

VendrNova products may include artificial intelligence, machine learning, recommendations, summaries, search assistance, classifications, or other decision-support capabilities.

These capabilities are intended to assist authorized users and do not replace professional judgment or the customer's established procurement, legal, financial, security, or approval processes.

VendrNova does not use ordinary Website visitor analytics to make solely automated decisions that produce legal or similarly significant effects concerning a visitor.

For enterprise products:

• Customers determine whether and how authorized AI-assisted features are used;
• Outputs should be reviewed by appropriately qualified people;
• Customers remain responsible for decisions, approvals, and actions taken using product output;
• AI output may be incomplete or inaccurate and should be validated before reliance; and
• Customer data is governed by the applicable customer agreement, documentation, and data-processing terms.

VendrNova will provide additional notice or obtain consent if required before introducing materially different automated decision-making involving personal information.

VendrNova may send business-to-business communications about its products, services, events, or content where permitted by law.

You may unsubscribe by:

• Using the unsubscribe link in a marketing email; or
• Emailing contact@vendrnova.com.

An unsubscribe request will not prevent necessary transactional, contractual, security, legal, or service communications.

VendrNova may retain a limited suppression record to honor an unsubscribe request.

VendrNova retains personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy.

Retention is determined by considering:

• The purpose for which information was collected;
• The duration of the business or customer relationship;
• Customer instructions and contractual requirements;
• The sensitivity and volume of the information;
• Provider settings and contracted service terms;
• Security and fraud-prevention needs;
• Applicable statutes of limitation;
• Legal, accounting, tax, audit, or regulatory requirements; and
• Whether information can be aggregated, de-identified, or deleted.

Typical retention considerations include:

• Business inquiries and relationship records: retained while a relationship is active, for reasonable follow-up, and for appropriate business, legal, or recordkeeping purposes;
• Marketing preferences: retained until consent is withdrawn or an objection is received, with a limited suppression record maintained afterward;
• Website analytics: retained according to VendrNova's configuration and the applicable provider's plan, settings, and agreement;
• Session replay: if enabled, retained for the configured operational period and deleted or allowed to expire when no longer reasonably necessary;
• Translation and localization data: retained according to the translation project, caching requirements, provider settings, and applicable agreement;
• Repaint form submissions: retained in the receiving VendrNova email or business systems for inquiry follow-up, relationship management, and appropriate recordkeeping;
• Security and access logs: retained for periods appropriate to detecting, investigating, and documenting security incidents;
• Customer accounts and service data: retained according to customer agreements, customer instructions, backups, security needs, and legal obligations;
• Recruiting information: retained for the recruiting process and for an appropriate period afterward, subject to applicable law; and
• Privacy-request records: retained to document the request and response, demonstrate compliance, and prevent fraud.

Deletion from backups may occur on a delayed cycle where immediate deletion is not technically feasible, provided the information remains protected and is not restored for ordinary business use.

VendrNova may retain aggregated or de-identified information when it is no longer reasonably capable of being associated with an identifiable individual.

VendrNova uses administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

Depending on the systems and information involved, safeguards may include:

• Role-based access controls;
• Authentication protections;
• Encryption in transit and, where appropriate, at rest;
• Logging and monitoring;
• Vulnerability and patch management;
• Backup and recovery procedures;
• Vendor security reviews;
• Confidentiality obligations;
• Security training;
• Incident-response procedures;
• Form-field masking and translation exclusions; and
• Data-minimization and retention controls.

No Internet transmission, storage system, or security program is completely secure. You are responsible for protecting your credentials and promptly notifying VendrNova if you suspect unauthorized account activity.

VendrNova and its providers may process information in the United States, Germany or other locations in the European Union, India, and other countries where the providers or their subprocessors operate.

For example:

• Google may process information through its global infrastructure;
• Rybbit's cloud analytics infrastructure may process information in Germany or elsewhere through its subprocessors;
• MultiLipi and its translation subprocessors may process Website content and technical information in India or other locations;
• Repaint may process Website hosting and form information through its infrastructure and service providers; and
• Other VendrNova providers may process information in the countries where they operate.

Privacy laws in these countries may differ from those where you live.

Where applicable law requires a recognized international-transfer safeguard, VendrNova may use or require:

• Contractual data-protection terms;
• Standard contractual clauses or an applicable addendum;
• A legally recognized adequacy mechanism;
• Data-transfer risk assessments;
• Technical and organizational safeguards; or
• Another mechanism permitted by applicable law.

Depending on where you live and the law that applies, you may have the right to:

• Confirm whether VendrNova processes your personal information;
• Request access to personal information;
• Request correction of inaccurate information;
• Request deletion of personal information;
• Request a portable copy of certain information;
• Object to or restrict certain processing;
• Withdraw consent;
• Opt out of marketing communications;
• Opt out of qualifying sale, sharing, targeted advertising, or profiling;
• Appeal a decision concerning a privacy request; and
• Complain to an applicable privacy or data-protection authority.

These rights are not absolute. Exceptions may apply when information must be retained to comply with law, complete a transaction, protect security, exercise legal rights, or satisfy another lawful purpose.

Submitting a request

To submit a privacy request, email:

contact@vendrnova.com

Please include:

• Your name;
• The email address associated with your interaction;
• Your relationship with VendrNova;
• The right you wish to exercise;
• The jurisdiction in which you reside; and
• Enough information to identify the relevant records.

Do not send identity documents or highly sensitive information unless VendrNova specifically requests them through an appropriate method.

Verification

VendrNova may need to verify your identity and authority before completing a request. Verification requirements will be proportionate to the request and the sensitivity of the information.

Authorized agents

Where applicable law permits an authorized agent to submit a request, VendrNova may require evidence of the agent's authority and may contact the individual directly to verify the request.

Appeals

If VendrNova denies a request and applicable law provides a right to appeal, you may appeal by emailing contact@vendrnova.com with the subject line:

Privacy Request Appeal

Customer-controlled data

If VendrNova processes your information on behalf of an enterprise customer, VendrNova may direct you to that customer and assist the customer as required by the applicable agreement and law.

Residents of certain U.S. states may have additional privacy rights when the applicable law covers VendrNova's processing.

The categories of personal information VendrNova may collect include:

• Identifiers;
• Customer-record information;
• Commercial information;
• Internet or electronic-network activity;
• Approximate geolocation information;
• Professional or employment-related information;
• Communications;
• Inferences derived from interactions; and
• Other information voluntarily provided by an individual.

The categories collected are described more fully in Section 3. Sources are described in Section 4, purposes are described in Section 5, provider-specific processing is described in Section 7, recipient categories are described in Section 9, and retention criteria are described in Section 14.

VendrNova does not discriminate against an individual for exercising an applicable privacy right. Exercising a right may affect functionality when the requested information is necessary to provide a service.

Some privacy laws contain exemptions or limitations for employment information, business-to-business information, data processed on behalf of another business, or organizations below statutory thresholds. Nothing in this Privacy Policy claims that a particular privacy law necessarily applies or does not apply to VendrNova or a specific interaction.

The Website is directed primarily to business users in the United States. Visitors from other countries may nevertheless access it.

If applicable data-protection law covers VendrNova's processing, individuals may have rights including:

• Access;
• Correction;
• Erasure;
• Restriction;
• Portability;
• Objection;
• Withdrawal of consent; and
• The right to complain to a supervisory authority.

When VendrNova relies on legitimate interests, an individual may object to processing in circumstances provided by law. Individuals may object to direct marketing at any time.

Where consent is legally required for cookies, analytics, translation-related technologies, or session replay, VendrNova will provide a consent choice before activating the applicable optional technology.

VendrNova may use candidate information to:

• Evaluate qualifications;
• Communicate about opportunities;
• Arrange interviews and assessments;
• Verify information and references where permitted;
• Make hiring decisions;
• Maintain recruiting records;
• Comply with legal obligations; and
• Consider candidates for future opportunities where appropriate.

Submitting an application does not guarantee an interview or employment.

VendrNova will not request highly sensitive employment information through a general Website contact form. A separate candidate privacy notice may provide more detailed information.

VendrNova's Website and services are designed for businesses and professional users. They are not directed to children under 13, and VendrNova does not knowingly collect personal information from children under 13.

If you believe a child has provided personal information to VendrNova, contact us at contact@vendrnova.com.

The Website may link to third-party websites, platforms, services, or integrations.

VendrNova does not control the independent privacy or security practices of those third parties. This Privacy Policy does not apply to information processed independently by a third party.

You should review the third party's privacy notice before providing personal information.

VendrNova may update this Privacy Policy to reflect changes in its services, technology, providers, legal obligations, or business practices.

When this Privacy Policy changes, VendrNova will update the "Last Updated" date.

If a change materially affects how previously collected personal information is used, VendrNova will provide additional notice or obtain consent where required.