Date of last revision: 17 February, 2022

INTRODUCTION

GreySwitch Technologies Limited (GreySwitch) provides online application services for managing passive churn,
which is the loss of a customer due to failed credit card charges. All of our customers are business entities or other
organizations that use our service to better manage the timing of their charges to their customers’ credit cards
and their communications with their customers around credit card payments.

GreySwitch’s main office is in Lagos, Nigeria. We offer our services to customers worldwide.

This Privacy Policy describes our policies for personal data that we collect and use to manage our business, such as
data about visitors to our web site and our customers’ personnel.

This Privacy Policy does not cover personal data of our customers’ customers that we have access to as part of
providing our services to our customers. Our customers control personal data about their customers and are
responsible for describing their privacy practices in their published privacy policies. We use this customer-controlled
data only as permitted by our customers in our agreements with them. We have included information below to
describe our commitments to you if we have access to your data in our role as a service provider to our customers,
but you should review the privacy policy of our customer that controls your personal data to understand its privacy
practices.

HOW TO CONTACT US

Email: contact@trygreyswitch.com

Address: NO 7/9, AIBAOGUN CLOSE, MOSAN, IPAJA, LAGOS STATE, NIGERIA

Please contact us if you have any questions about the information in this Privacy Policy or our handling of your
personal data, or would like to access, correct, delete, restrict our use, or take other action with regard to your
personal data. We ask, however, that if we are in possession of your data solely as a service provider for our
customer you first contact our customer with your request.

CHANGES TO PRIVACY POLICY

We may change this Privacy Policy from time to time. We will manage your personal data in accordance with the
Privacy Policy version that was published on the date that we collected the data about you.

DEFINITIONS

The types of data we collect and our purpose for collecting it depend on how you interact with us. For example, we
collect different data about one-time website visitors than authorized users of our application services. We have used
defined terms for the different types of relationships to help us explain our privacy practices:

• customer means our application services customer; this is the business or other organization that
  establishes an account with GreySwitch for the use of our services;
• account user means an individual who interacts with us as a representative of our customer; this includes
  service users, billing contacts, and technical support contacts;
• payor means an individual who has authorized our customer to charge their credit card to pay for our
  customer’s products or services;
• visitor means an individual who visits our website, our social media pages, our offices, interacts with us
  at a trade show or other industry event, or communicates with us in some other way other than as an account
  user or payor;

These words also have certain meanings in this Privacy Policy:

• services means GreySwitch passive churn reduction services and related analytics services;
• site or website refers to trygreyswitch.com and any other website where this Privacy Policy is posted;
• we, our and us refer to GreySwitch;
• you and your refer to visitors, account users, or payors, or all of them, as indicated by the context.

DATA COLLECTION PURPOSES

We collect personal data for our business purposes:

• to operate our website;
• to improve our website and service offerings;
• to market our services;
• to manage our relationship with our customers, including account administration;
• to provide our online services to our customers;
• to provide customer support; and
• to manage our vendors.

The Section below captioned, “How We Use Data” explains how we use different categories of data for each of
these purposes.

DATA COLLECTION METHODS

Automated data collection on our website and online services platform

When you visit our site or use the GreySwitch services, our servers capture data that may be used to identify you
and your device, such as your IP address, device identifier, and information about your device such as the operating
system, time zone setting, language setting, browser settings, and browser plug-ins. Depending on your device
settings, we may also capture location information. Our servers may also capture information about your visit to our
site or services platform, such as the website you visited right before you visited our site, the time and duration of
your visit on each page on the site, and your navigation path from page to page (i.e., what you click on).

We and our third-party analytics providers may use an online tracker (such as a cookie we place on your browser) so
that we may identify you as a return visitor if you visit our site more than once. Please see How to Opt Out of Online
Data Collection below for information on how to block cookies.

Data provided by advertisers

If you arrive at our site by clicking on a link that is part of an advertisement on another site (including an
advertisement on a social media platform), the advertising service will identify the link, enabling us to associate you
with the advertising parameters we provided to the advertising service. Advertising services are responsible for the
collection, use and disclosure of the data they provide to us in accordance with their published privacy policies. See
the section below captioned Advertising Ecosystem and How to Opt Out of Online Data Collection.

Data provided by you as part of your communications with us

We collect personal data that you submit to us as part of a communication with us as a visitor or account user, such
as via chat on our site, email, submission of a web form, telephone, or in person (such as at a meeting, trade show or
other event). For example, you may communicate with us as a visitor to obtain more information about our services,
or as an account user to request technical support. The communication may include information that can be used to
identify you such as your name, job title, job function, the organization you represent, email address, phone number
as well as information about your interest in our company or our services. We do not solicit information from you as
part of these communications other than information that is useful to us in light of the purposes described above, but
if you choose to volunteer more personal information than we ask for we will collect that as part of the
communication.

Data provided by you or your organization to establish and maintain the GreySwitch account and authorize
your use of our services

Our customers are required to name billing, administrative, technical and other types of service and account users
who have authority to use our services and manage the customer’s account. We collect the name and business
contact information of these account representatives. Our customers also authorize individuals as service users. We
require each individual account representative and service user to establish their own set of account credentials
(username and password). If you use a personal payment card or other financial account to make payment
arrangements, then we may collect information relevant to the processing of the payment transaction.

Data provided by you or your organization to enable GreySwitch access to your third party accounts

To provide our services we require access to our customers’ accounts with their payment providers, email service
providers, and occasionally other third-party services. Therefore the customer is required to provide account
credentials used by their representatives on those platforms, or to grant GreySwitch dedicated (and revocable)
access.

Combinations of data collected using different methods

We use service providers such as Google Analytics, to help us associate the personal data we capture about you as
part of visitor interactions with personal data we collect about you as an account user.

HOW WE USE DATA

This section describes more specifically how our use of the data relates to the purposes for which we collected
the data.

Visitors: We use data collected about visitors:

• to operate our website – web servers, by their nature, must capture your IP address and information about
  your browser and device to display our site to you;
• to develop our website and product offerings – we use the information about visitor navigation on our site
  to help us understand what part of our website and products offerings is of interest to different kinds of
  visitors so that we can modify and improve our site content and other marketing materials to be more
  appealing to prospective customers; we may also use the information about your site visits and other visitor
  interactions to help us measure interest in our services or various features of our services;
• to show you personalized content when you visit our site – we use information about your prior visit to our
  site to customize your subsequent visits; for example, we may make more visible to you information or
  offers about products or services that appear to be of interest to you based on your navigation of our site on
  a prior visit; if you arrive at our site via an advertisement we may use that fact to make inferences about
  your interests and target content to you on that basis;
• to measure the success of our advertising efforts – we use visitor information to verify whether the ad
  services we purchase from third parties are actually resulting in visits to our site or other visitor
  interactions;
• to register you for webinars, office visits, or other online or off-line events we may host – we may use your
  name, contact email, contact address, and phone number to register you as an attendee and communicate
  with you about the event; we might target special content to event registrants when they visit our website
  based on the type of event.
• to communicate with you as part of our marketing efforts – if you provide us with contact information we
  may use it to send you communications about our company, our products or services, or related topics that
  we think you may find of interest;

Account Users: we use data collected about accounts users (alone or as combined with data collected as part
of an account user’s visitor activity (such as pre-login activity on the Site):

• to provide our online services – we use login credentials to authenticate individuals as authorized
  administrative users of our services; we use IP addresses to provide our services;
• we use contact information such as your email or physical address to send invoices and other account
  communications, authenticate individuals who request information or support on the customer’s behalf,
  and administer the customer’s account, such as processing billing information to complete customer purchases;
• to review compliance with usage terms in our services agreements and enforce the terms and conditions
  that govern our services; for example if the customer’s use of our services is limited to a certain number of
  individuals we may use personal data to help us monitor compliance with the usage restrictions;
• to help us develop our service offerings – we use information about your use of our services to measure
  interest in various features, to plan enhancements and new features, and to improve user experience;
• to communicate with you as part of our marketing efforts – we use contact information and information
  about your use of our services to send you communications about our products or services, or related topics
  that we think you may find of interest; and
• to market our services - if you provide a customer testimonial or other content for marketing purposes we
  will publish the content with your name or other identifying information that you authorize us to use; if you
  agree that we may use you as a reference, we may provide your name and contact information to
  prospective customers for our services so that they may contact you to discuss your experience with our
  services.

DATA INTEGRITY

We process personal information only for the purposes for which it was collected and in accordance with this
Privacy Policy. We regularly review our data collection, storage, and processing practices to ensure that we only
collect, store, and process the minimum personal information needed for the purpose collected. We take reasonable
steps to ensure that the personal information that we process is accurate, complete, and current, but we depend on
our account users to update their personal data as necessary.

CHOICES AND MEANS TO LIMIT USE AND DISCLOSURE OR YOUR DATA

You may limit our use and disclosure of your personal data. Please send us a request at contact@trygreyswitch.com
if you would like to know what personal data we have about you and how we use and disclose that data. You may
also submit requests to contact@trygreyswitch.com if you want to correct, delete or restrict the use of your personal
data, or if you object to our processing of your data on the grounds that we do not have a lawful basis
for that processing.

On receipt of your notice that the data we have about you is inaccurate or incomplete, we will promptly correct any
inaccurate data and ensure it is complete in light of the purposes for which we process the data.

If you wish to revoke any consent you have previously given, we will honor the revocation and will no longer rely
on that consent to process your personal data. For example, if you no longer consent to our use of your data for
marketing purposes, we will stop using the data for that purpose and notify any third party with whom we have
shared that data that they must also stop using it for that purpose.

On your request, we will promptly restrict processing of your personal data or delete your personal data except to
the extent the restriction or deletion will prevent us from complying with our legal obligations to our customer or
interfere with our reasonable record keeping as necessary to demonstrate compliance with our contracts and
applicable law.

You may request disclosure of the following specific information:

• the categories of personal information as well as the specific pieces of personal information that we have
  collected about you for our business purposes over the prior 12 months,
• the categories of sources from which we have collected that personal information,
• our purpose(s) for collecting that personal information,
• the categories of third parties with whom we have shared the personal information, such as our service
  providers, and
• whether we have sold the personal information to third parties or disclosed the information to third parties
  for a business purpose, and if so the categories of personal information and third parties.

In addition, you have the right to ask GreySwitch to delete your personal information. We will comply with your
deletion request and require our service providers to do the same, unless we plan to retain the personal information
on a legally permitted basis and we give you notice of this fact and the legal basis on which we rely.

You may make a request by sending an email or physical mail request to the addresses above.

Before responding to your request we may ask you to provide information needed to verify that you are the
consumer (or have authorization from the consumer) whose personal information is covered by the request.

We may not discriminate against you because you make a request described in this Section by denying you our
services or providing a different quality or price for our services, unless the different service or price is reasonably
related to the value provided to you by your data.

If you are under 16 years of age, you are not authorized to use our website or our services and we don’t want your
personal data.

PAYOR DATA

Our customers provide us with access to personal data about their customers who pay them with payment cards
(their “payors”) to enable us to provide our services. This includes access to our customer’s payment processor
accounts, and customer information stored within those accounts such as card expiration dates, masked card
numbers, email addresses, phone numbers, approximate locations, and customer metadata. We use this personal data
about our customers’ payors only as permitted by our customer in our agreement with them. Please contact us at the
address above if you have questions or concerns regarding our processing of the data described in this Section. We
ask, however, that you first contact our customer if you have a request to access, block, erase or take other action
with respect to data that we have solely as a data processor for our customer.

Some of our customers are subject to special data privacy laws, such as the Nigeria Data Protection Regulations
(NDPR). We make appropriate contractual commitments to our customers in support of their obligations under the
NDPR, or other data privacy and protection laws applicable to them.

DISCLOSURE

We have not sold or leased personal data, and will not sell or lease your personal data.

We will not disclose your personal data to third parties except as follows:

Legal Reasons

When we believe release is appropriate to comply with the law, to enforce our terms of use and other rights, or to
protect the rights and safety of others.

This may include exchanging information with government regulatory or law enforcement agencies, or with other
companies and organizations for fraud protection and legal compliance.

Protecting Network and Information Security

As necessary to protect our information and systems from unauthorized actions that compromise their security or
availability, such as disclosures as part of industry initiatives to identify and block malicious actors.

Sale of Business

As part of a sale of a sales of business assets where the purchaser needs the personal data to use the assets.

We may in the future sell all or part of our assets or be involved in a merger. We may provide the company that is
seeking to acquire our business with access to personal data as part of their evaluation of our business, but will
require them to maintain the personal data in confidence and use it only to evaluate our business. If we complete a
transaction, it is customary to transfer personal data that is related to the purchased business assets to the purchaser.

Service Providers

We use the services of companies like the ones listed below to collect data on our behalf or to help us analyze, store,
manage and otherwise process your personal data. Each of these companies commits in its contract with us to use
the personal data only according to our contract with them or our other instructions as necessary to support our
business. They are not authorized to use your personal data for any other purpose. They are not authorized to
disclose your personal data to others except with our permission, and only if they require the others to comply with
the same restrictions that apply to them.

• Google, Inc. – analytics
• Amazon Web Services, Inc. - infrastructure
• Advertising Ecosystem

We use online advertising services that enable a practice referred to as “online behavioural advertising.” These
services aggregate data about an individual’s behaviour on many different sites and online services and use that data
to sell targeted advertising services. Advertising service providers combine the data about an individual that they
collect from different sources and use this aggregate data to sell advertising services that target the display of ads to
web users who meet certain behavioural criteria. The advertising service providers do not disclose this aggregate
data to GreySwitch, but we are able to infer that users who interact with our ad meet the advertising criteria we
provided. Advertising providers collect this data using cookies, web server logs (its own and its advertising
customers), clear gifs and other online data collection techniques. See Online Data Collection Techniques and How
to Opt Out of Online Data Collection.

ONLINE DATA COLLECTION TECHNIQUES

All Web servers capture certain personal information, such as IP address, in order to serve the Web page visited.

Web site operators may also capture personal information using tracking devices such as cookies. A cookie is a

unique alphanumeric identifier that is placed by a web server on the browser used to view the content or use the

service at the site. Cookies are used to analyze visitors’ use of the website. For example, a website operator can

the cookie to identify the number of unique visitors to the site, whether or not those visitors are repeat visitors, and

information about the visitor’s activity on the site, device and device settings. A tracking pixel, also known as a web

bug or web beacon, is a small graphic (usually 1 pixel x 1 pixel) invisible to the eye, that is embedded in web

content or email. When content that has an embedded web beacon is viewed, the browser will request content from

a web server, which in turn will set a cookie.

HOW TO OPT OUT OF ONLINE DATA COLLECTION

You can manage browser cookies through your browser settings. The 'Help‘ feature on most browsers will tell you

how to prevent your browser from accepting new cookies, how to have the browser notify you when you receive a

new cookie, how to disable cookies, and when cookies will expire. If you disable all cookies on your browser,

neither we nor third parties will transfer cookies to your browser. If you do this, however, you may have to manually

adjust some preferences every time you visit a site and some features and services may not work.

Our servers do not recognize or respond to any “do not track” setting you may have in your browser.

COMMUNICATIONS POLICY

If you do not wish to receive our email or other communications, please send your request to
contact@trygreyswitch.com. Please note that it may take up to ten days to remove your contact information from
our marketing communications lists, so you may receive correspondence from us for a short time after you make
your request.

CHILDREN

Children are not permitted to use our site or services. We do not knowingly collect personal information from

anyone under 16. If you are under 16, do not use or provide any information on our Sites unless you have involved

your parent or guardian. If we discover that we have information about a child we will delete that information. If

you are the parent or guardian of a child and you believe we have personal data about the child without your

consent, please contact us at the address appearing at the top of this page and we will delete that information.

SECURITY

GreySwitchprotects personal data from unauthorized use, disclosure, corruption and destruction using appropriate

technical and organizational measures.

DATA RETENTION

We will retain your personal data only for as long as reasonably necessary to fulfill the purpose for which it was

collected, and to comply with our legal obligations, and will use secure means to destroy the data after that time. We

may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a

prospect of litigation in respect to our relationship with you.

INTERNATIONAL TRANSFERS

We will comply with laws applicable to the transfer of personal data across international borders. We provide

appropriate contractual commitments to our customers that require protections around transfer of personal data to

other jurisdictions.