1. OUR APPROACH TO PRIVACY

1.1 CiteRight Inc. (“CiteRight“, “we“, “our“, or “us“) is committed to protecting your privacy. This Privacy Policy sets out how we collect, store, process, transfer, share and use data that identifies or is associated with you (“personal information“) and information regarding our use of cookies and similar technologies.

1.2 CiteRight operates a legal research automation solution available via our website (our “Website“) located at www.citeright.netand delivered via a mix of locally-installed and cloud-based components that we make available (the “CiteRight Service“).

1.3 This privacy policy applies to the CiteRight Service.

1.4 Before accessing or using the CiteRight Service, please ensure that you have read and understood our collection, storage, use and disclosure of your personal information as described in this privacy policy. By accessing or using the CiteRight Service, you are accepting and consenting to the practices described in this privacy policy.

2. PERSONAL INFORMATION WE COLLECT ABOUT YOU AND HOW WE USE IT

2.1 Information you give to us. We collect personal information about you when you voluntarily submit information directly to us by filling in forms on our Website or Service or by corresponding with us by phone, email or otherwise. This includes information you provide when you register to use our Website, subscribe to the CiteRight Service, participate in any discussion boards, forums or other social media functions on our site or enter a competition, promotion or survey and when you report a problem with our Website, or use some other feature of the CiteRight Service as available from time to time.

2.2 If you choose not to provide personal information, we may not be able to provide the CiteRight Service to you or respond to your other requests.

2.3 Information we receive from other sources. We may receive personal information about you from individuals or corporate entities which are subscribers to the CiteRight Service (“Subscribers“) where you are to be designated a user of the CiteRight Service. We may receive personal information about you if you use any of the other websites we operate or the other services we provide from time to time. We also work closely with third parties (including, for example, subcontractors in technical, payment and delivery services, advertising networks, analytics providers, search information providers, credit reference agencies) and may receive information about you from them, subject to your agreements with them.

2.4 The table at Annex 1 sets out the categories of personal information you provide to us and that we receive from other sources and how we use that information. The table also lists the legal basis which we rely on to process the personal information and information as to how we determine applicable retention periods.

2.5 We also automatically collect personal information about you indirectly about how you access and use the CiteRight Service and information about the device you use to access the CiteRight Service.

2.6 The table at Annex 2 sets out the categories of personal information we collect about you automatically and how we use that information. The table also lists the legal basis which we rely on to process the personal information and information as to how we determine applicable retention periods.

2.7 We may link or combine the personal information we collect and/or receive about you and the information we collect automatically. This allows us to provide you with a personalised experience regardless of how you interact with us.

2.8 We may anonymise and aggregate any of the personal information we collect (so that it does not identify you). We may use anonymised information for purposes that include testing our IT systems, research, data analysis, improving the CiteRight Service and developing new products and features. We may also share such anonymised information with others.

3. DISCLOSURE OF YOUR PERSONAL INFORMATION

3.1 We may share your personal information with any member of our group, which includes our subsidiaries. We will not share your personal information with any third parties except as described in this privacy policy or in connection with the Service. We may share your information with selected third parties, including:

• Business partners, vendors, suppliers and subcontractors who perform services on our behalf (these companies are authorized to use your personal information only as necessary to provide these services to us);
• Analytics and search engine providers that assist us in the improvement and optimization of our Website;
• Credit reference agencies for the purpose of assessing your credit score where this is a condition of us entering into a contract with you;
• Payment processors for the purpose of fulfilling relevant payment transactions;
• Third parties in connection with a business transaction. Personal information may be disclosed to third parties in connection with a transaction, such as a merger, sale of assets or shares, reorganisation, financing, change of control or acquisition of all or a portion of our business. If we are involved in a merger, acquisition, or sale of all or a portion of its assets, you will be notified via email and/or a prominent notice on our Website of any change in ownership or uses of your personal information, as well as any choices you may have regarding your personal information.

3.2 In certain situations, we may be required to disclose personal information in response to lawful requests by public authorities, including to meet law enforcement requirements.

3.3 If we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms and conditions of service and other agreements; or to protect the rights, property, or safety of CiteRight, our customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection and credit risk reduction.

3.4 Publicly accessible blogs. Our Website includes publicly accessible blogs or community forums. Any information you provide in these areas may be read, collected and used by others who access them. This includes information posted on our public social media accounts. To request removal of your personal information from our blog or community forum, contact us at privacy@citeright.com. In some cases, we may not be able to remove your personal information, in which case we will let you know if we are unable to do so and why.

3.5 Testimonials. With consent, we may display personal testimonials of satisfied customers on our site, along with other endorsements. If you wish to update or delete your testimonial, you can contact us at privacy@citeright.com.

4. MARKETING AND ADVERTISING

4.1 From time to time we may contact you with relevant information about the CiteRight Service and our other products and services. Most messages will be sent electronically. For some messages, we may use personal information we collect about you to help us determine the most relevant information to share with you.

4.2 If you do not want to receive such messages from us, you will be able to tell us by selecting certain boxes on forms we use when we first collect your contact details, or by following the unsubscribe link at the bottom of our emails.

5. STORING AND TRANSFERRING YOUR PERSONAL INFORMATION

5.1 Security. All information you provide to us is stored on secure servers in a controlled environment with limited access. Any payment transactions will be encrypted in transit using SSL technology. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our Service, you are responsible for keeping this password confidential. Subscribers should not share their password with anyone.

5.2 While no transmission of information via the internet is completely secure, we take reasonable measures to protect your personal information. We cannot guarantee the security of your personal information transmitted to our Website; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorized access.

5.3 International Transfers of your Personal Information. The personal information we collect may be transferred to and stored in countries outside of the jurisdiction you are in where we and our third party service providers have operations. If you are located in the European Union (“EU“), your personal information will be processed outside of the EU including in the United States; these international transfers of your personal information are made pursuant to appropriate safeguards, such as standard data protection clauses adopted by the European Commission. If you wish to enquire further about these safeguards used, please contact us using the details set out at the end of this privacy policy.

6. RETAINING YOUR INFORMATION

6.1 We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of our legitimate business interests and satisfying any legal or reporting requirements.

6.2 To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and the applicable legal requirements.

7. REFERRAL PROGRAM

7.1 We may, from time to time, operate a referral program for our Service; you may choose to provide us with names and email addresses of individuals who you feel would be interested in learning more about our products and services in exchange for rewards. We will store the contact details in order to track the success of our referral service. The referred individual may request that their contact details be removed from our database and they may also contact us at any time at privacy@citeright.com to make the request.

7.2 Where you provide us with names and email addresses of such individuals as set out above, you will obtain the prior consent of those individuals and provide them with the information as to how we handle their personal information as described in this privacy policy.

8. YOUR RIGHTS IN RESPECT OF YOUR PERSONAL INFORMATION

8.1 In accordance with applicable privacy law, you have the following rights in respect of your personal information that we hold:

• Right of access and portability. The right to obtain access to your personal information along with certain information, and to receive that personal information in a commonly used format and to have it ported to another data controller.
• Right to rectification. The right to obtain rectification of your personal information without undue delay where that personal information is inaccurate or incomplete.
• Right to erasure. The right to obtain the erasure of your personal information without undue delay in certain circumstances, such as where the personal information is no longer necessary in relation to the purposes for which it was collected or processed.
• Right to restriction. The right to obtain the restriction of the processing undertaken by us on your personal information in certain circumstances, such as where the accuracy of the personal information is contested by you, for a period enabling us to verify the accuracy of that personal information.
• Right to object. The right to object, on grounds relating to your particular situation, to the processing of your personal information, and to object to processing of your personal information for direct marketing purposes, to the extent it is related to such direct marketing.

8.2 If you wish to exercise one of these rights, please contact us using the contact details at the end of this privacy policy. Upon request, we will provide you with information about whether we hold any of your personal information. You may access, correct or request deletion of your personal information by logging into your account, or by contacting us at privacy@citeright.com. We will respond to your request within 30 days.

8.3 If you reside in the European Union (EU), CiteRight is the controller of your personal information for purposes of European data protection legislation. You also have the right to lodge a complaint to your local data protection authority. Information about how to contact your local data protection authority is available at ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.

9. COOKIES AND SIMILAR TECHNOLOGIES

9.1 Our Service uses cookies and similar technologies (collectively referred to as cookies) to distinguish your from other users of our Service. This helps us to provide you with a good service. This helps us enhance and personalize your user experience, to monitor and improve our Website and services, and for other internal purposes. As is true of most websites, we gather certain information automatically. This information we may collect is described in detail in Annex 2.

9.2 We use the following types of cookies:

• Strictly necessary cookies. These cookies are required for the essential operation of our Service such as to authenticate you and prevent fraudulent use.
• Analytical/performance cookies. These cookies allow us to recognise and count the number of visitors and to see how visitors move around our Service when they are using it. This helps us to improve the way our Service works, for example, by ensuring that you can find information easily.
• Targeting cookies. These cookies record your visit to our Service, the pages you have visited and the links you have followed. We will use this information to make our Service and the advertising displayed on it more relevant to your interests. We may also share this information with third parties for this purpose.
• 9.3 Please note that third parties (including, for example, advertising networks and providers of external services like web traffic analysis services) may also use cookies, over which we have no control. These cookies are likely to be analytical/performance cookies or targeting cookies.

9.4 You block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including strictly necessary cookies) you may not be able to access all or parts of our site.

9.6 Social Media. Our Website includes social media features, such as Facebook Like button and widgets such as the Share button. These features may collect your IP address, which page you are visiting on our Website, and may set a cookie to enable the feature to function properly. Social media features and widgets are hosted on our site or by a third party, and your interactions with these features are governed by the privacy policy of the company providing it.

10. LINKS TO THIRD PARTY SITES

10.1 The CiteRight Service may, from time to time, contain links to and from third party websites. If you follow a link to any of these websites, please note that these websites have their own privacy policies and that we do not accept any responsibility or liability for their policies. Please check the individual policies before you submit any information to those websites.

10.2 Some of the pages on our Website may utilize framing techniques to serve content to/from our partners while preserving the look and feel of our Website. Please be aware that you are providing your personal information to these third parties and not to CiteRight.

11. OUR POLICY TOWARDS CHILDREN

11.1 The CiteRight Service is not directed at persons under 16 and we do not intend to collect personal information from children under 16 in our capacity as a controller. If you become aware that a child has provided us with personal information without appropriate consent, then please contact us using the details below so that we can take the appropriate steps in accordance with our legal obligations and this privacy policy.

12. CHANGES TO THIS POLICY

12.1 We may update this privacy policy from time to time and so you should review this page periodically. When we change this privacy policy in a material way, we will update the “last modified” date at the end of this privacy policy. Changes to this privacy policy are effective when they are posted on this page.

13. NOTICE TO YOU

13.1 If we need to provide you with information about something, whether for legal, marketing or other business related purposes, we will select what we believe is the best way to get in contact with you. We will usually do this through email or by placing a notice on our Website. The fact that we may send notices to you will not stop you from being able to opt out of certain types of contact as described in this privacy policy.

14. CONTACTING US

14.1  Regardless of your location, any questions, comments and requests regarding this privacy policy are welcome and should be addressed to our Data Protection Officer, Aaron Wenner, at privacy@citeright.com. Communication can also be addressed to:

CiteRight Inc.

Suite 1002, 10 Dundas St E

Toronto, ON

M5B 2G9

14.3 This privacy policy was last modified on October 5, 2018.

ANNEX 1 – PERSONAL INFORMATION WE COLLECT

We collect the following pieces of personal information about you.

Contact information and basic personal details

This includes your name, phone number, address, location, IP address, e-mail address.

How we use it

• We use this information to communicate with you, including sending statements, news, alerts and marketing communications.
• We use this information to deal with enquiries and other requests made by or about you, including customer service issues, relating to the CiteRight Service.
• We use this information to operate, maintain and provide to you the features and functionality of the CiteRight Service.

Legal basis for processing

• The processing is necessary for communicating with you effectively and responding to your queries.
• The processing is necessary for the performance of a contract and to take steps prior to entering into a contract (namely our Terms of Service).

Correspondence and comments

When you contact us directly, e.g. by email, phone, mail, or when you interact with customer service, we will record your comments and opinions.

How we use it

• To address your questions, issues and concerns and resolve your customer service issues.

Legal basis for processing

• The processing is necessary for communicating with you effectively for the purposes of resolving your issues.

Payment information.

Details such as your credit card or other financial information including credit scores obtained from credit reference agencies.

How we use it

• We use this information to facilitate payment for use of the CiteRight Service, to assess your credit score and to detect and prevent fraud.

Legal basis for processing

• The processing for assessing your credit score and facilitating payment is necessary for the performance of our contract with you (namely our Terms of Service).
• The processing is necessary for our legitimate interests, namely the detection and prevention of fraud.

All personal information set out above.

How we use it

• We will use all the personal information we collect to operate, maintain and provide to you the features and functionality of the CiteRight Service, to monitor and improve the CiteRight Service, our Website and business, for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes, to keep the Website safe and secure and to help us develop new products and services.

Legal basis for processing

• The processing is necessary to administer and improve the CiteRight Service, our business and develop new services.

ANNEX 2 – PERSONAL INFORMATION COLLECTED AUTOMATICALLY

Information about how you access and use the CiteRight Service

For example, the website from which you came and the website to which you are going when you leave our Website, your social media profiles, how frequently you access the CiteRight Service, the time you access the CiteRight Service and how long you use it for, whether you open emails or click the links contained in emails, whether you access the CiteRight Service from multiple devices, and other actions you take on the CiteRight Service.

We also gather information, which may include Internet protocol (IP) addresses, browser type, internet service provider (ISP), referring/exit pages, operating system, date/time stamp, and/or clickstream data.

How we use it

We use this information to:

• monitor the CiteRight Service and how it is used in order to and improve our business and help us develop new products and services.

Legal basis for processing

• The processing is necessary for our legitimate interests, namely: to conduct relevant analysis to improve the CiteRight Service generally.

Information about your device

We also collect information about the computer, tablet, smartphone or other electronic device you use to connect to the CiteRight Service. This information can include details about the type of device, unique device identifying numbers, operating systems, browsers and applications connected to the CiteRight Service through the device, your Internet service provider or mobile network, your IP address.

How we use it

We use this information to:

• enable the CiteRight Service to be presented to you on your device; and
• operate, maintain and provide to you the features and functionality of the CiteRight Service.
• We also use this information to monitor and improve the CiteRight Service and business, and to help us develop new products and services.

Legal basis for processing

• The processing is necessary for the performance of a contract and (namely our Terms of Service).
• The processing is necessary for our legitimate interests, namely: to tailor the CiteRight Service to the user and to improve the CiteRight Service generally.

‍