COMMERCE LOGIC - TOLLOGIC™ PRIVACY POLICY

Effective as of July 21st, 2023, Commerce Logice LLC, its affiliates and subsidiaries (collectively “Commerce” or “we” or “us” or “our”) have updated our Privacy Policy (“Policy”). This Policy applies to all Commerce entities except where a Commerce subsidiary, company, or affiliate has published its own separate privacy policy.

I. Introduction

Tollogic provided by Commerce is a web-based fleet toll management and analytics software platform that is available to Commerce customers after they have accepted the Tollogic End User Agreement and Terms of Service. This software platform, together with a partner telematics device installed in a customer vehicle, enabled customers to manage tolling of fleet vehicles and driver information in a consolidated place to manage fleet tolling and provide analytics to make more informed decisions regarding their fleet. For the purposes of this Policy, personal data means information or data related to an identified or identifiable person. A person is considered identifiable if they can be identified directly, or indirectly, by reference to an identification number or to one or more factors that indicate their identity. Our website may contain links to other websites that are operated by third parties. This Policy does not apply to those websites. We strongly suggest that you carefully review the privacy policies and statements of any third-party websites to properly understand their information practices.

II. Information Provided to Commerce

Information in Tollogic is either entered by you when setting up your account, or is collected when you drive a vehicle connected to the Tollogic solution. To use Tollogic, you or another representative from your organization must set up a Tollogic account and provide us with certain information such as name, address, phone number, email address, company name, company website, and company billing details. We also collect information about subscribed vehicles within a Tollogic account(s). Tollogic provides customers with the ability to obtain, among other types of data, tolling station data, GPS vehicle location data, and mapping information. GPS coordinates can be provided to a third party service provider to obtain mapping information without identifying a particular vehicle, customer, or driver. We only process personal data about a driver operating a vehicle connected to the Tollogic solution when that customer enters the driver’s personal data in Tollogic or a Tollogic telematics partner platform, and only in accordance with the customer’s written instructions or as required by applicable law.

III. Sharing of Information

a) Service Providers. Commerce may share information, including personal data, with our third party service providers that we engage for providing hosting, for maintenance of our websites, applications, backup, storage, payment processing, analytics, and other services. We do not allow our service providers with whom we share personal data to use that information for marketing or any other purpose other than in connection with the services they provide to Commerce. b) Complying with the Law and Law Enforcement Requests. In some circumstances, we may receive a request from public authorities to disclose personal data in response to a legally binding request to meet national security or law enforcement requirements. As applicable, we may disclose personal data to comply with subpoenas, court orders, or legal process, or to enforce our legal rights and defend against legal claims. In some cases, we may also share personal data if we believe that illegal or fraudulent activity is or has taken place so that we can investigate, prevent, and take appropriate action regarding such activities that may pose a potential threat to the physical safety of any person, violations of our customer agreements, or to comply with the law. If your personal data becomes subject to a legal disclosure requirement and we are permitted to do so, we will attempt to notify you of said disclosure, if we have current contact information on file. c) Success Stories. From time to time, we may post success stories on our website or in other publicly distributed material that contains personal data. In such cases, we obtain your written consent before posting your name or other personal data within the success story. d) Commerce Internal Sharing. We may share information, including your personal data, within Commerce group of employees, contractors, or vendors on a need-to-know basis strictly for no other purpose than in connection with the services being provided to or from Commerce. e) Sharing with Consent. We may also share information with third parties when you have provided us with your consent to do so.

IV. International Transfers of Data

Commerce stores data on cloud servers globally in partnership with our tier-1 cloud data partner. Commerce stores data in servers primarily located in North America. However, data (including personal data) may be transferred across national boundaries for load balancing, availability, or other reasons.

V. Correcting, Updating, and Removing Your Information

Customers may change or update the information associated with their Tollogic accounts by logging into these services and editing their profile. You may request to have personal data that we maintain returned or removed by contacting your reseller or Commerce directly at hello@commerce-logic.com. Commerce reserves the right to validate requests to ensure legitimacy. Valid requests will typically be handled within 30 days. An individual who seeks access to, or wishes to correct, amend, or delete inaccuracies in personal data stored or processed by Commerce may have to direct such inquiries to the appropriate customer who has access to Tollogic and acts as the data controller. Customers may, if required, then make a request to Commerce who will act on valid requests within 30 days. We retain personal data that we store and process on behalf of customers, resellers, and website visitors for as long as necessary to provide the Tollogic solution. Information (including personal data) will be retained and used as necessary to enable us to comply with our legal obligations, resolve disputes, support our customers, and to comply with and enforce our agreements.

VI. Data Retention

Commerce will retain your personal data for as long as needed to fulfill the purposes for which the data was provided. Commerce will delete or anonymize your personal data when we no longer have a legitimate business need for it or in compliance with applicable law. If it is no longer possible to delete it because, for example, it has been backed up in archives, then we will securely store the personal data and isolate it from further processing until deletion is possible. For personal data that we process on behalf of customers’ users, we will retain such personal data in accordance with the instructions provided to us in the terms of our agreement with them, subject to applicable laws.

VII. Children’s Personal Data

We do not knowingly or intentionally collect or process any personal data from children under the age of 13. If you are under the age of 13, do not submit any personal data through our website or the Tollogic solution. Parents and legal guardians are encouraged to monitor their children’s internet use and assist in helping us enforce this Policy by teaching their children never to provide personal data through our website or the Tollogic solution. If you have reason to believe that we may have been sent personal data of a child under the age of 13, contact us at hello@commerce-logic.com and we will use reasonable efforts to delete such information.

VIII. Changes to This Policy

If we make any changes to this Policy, we will post an updated policy on our website. You should periodically review this page for the latest information on our privacy practices.The updated Policy will become effective as of the date stated in the Policy and following any additional steps we may be required to take under applicable law.

IX. Assignment of Transfer

If Commerce was to enter into discussions regarding the sale or divestment of all or substantially all of our business, stock, or assets with another entity, we may assign or transfer this Policy as well as your account and related data (including personal data) in accordance with applicable law.