TechnologyMatch Privacy Policy

Effective Date: July 6, 2026

Version: 1.0

Last updated: July 6, 2026

1. INTRODUCTION

The Launchpad Group Inc. dba TechnologyMatch ("TechnologyMatch," "we," "us," or "our") operates the following products and services (collectively, the "Services"): (a) the TechnologyMatch Platform (Marketplace); (b) appointment setting services; (c) MatchIQ™, a legacy sales coaching platform serving current customers; and (d) the TechnologyMatch Evolve Suite, which currently includes Evolve Coach and Evolve Edge (both launching), with Evolve Momentum, Evolve Studio, Evolve Signal, and Evolve Guide in development. This Privacy Policy governs the collection, use, disclosure, and protection of personal information across all Services.

This policy applies to all users of the Services, including distributors, partners, system administrators, developers, and visitors to any TechnologyMatch website. References to "Platform" throughout this document encompass all Services unless otherwise specified. This Privacy Policy is incorporated by reference into the TechnologyMatch Terms of Use for each applicable Service (including the MatchIQ™ Terms of Use, Evolve Coach Terms of Use, and Evolve Edge Terms of Use & Subscription Agreement). In the event of a conflict between this Privacy Policy and a Service-specific Terms of Use, the Service-specific Terms of Use controls for that Service.

Privacy governance. Day-to-day privacy compliance is managed by the Privacy Officer identified in Section 16. Material changes to this Privacy Policy — including changes that affect data subject rights, data sharing practices, cross-border transfer mechanisms, or legal basis for processing — require review and written approval by outside legal counsel before taking effect.

2. INFORMATION WE COLLECT

2.1 Account Information

When you create an account, we collect:

• Full name and email address
• Mailing address (city, state/province, ZIP/postal code, country)
• Job title and organization name
• Phone number (optional)
• Multi-factor authentication settings (when enabled)

2.2 CRM Synchronized Data

The Platform automatically syncs data from your connected CRM, including:

• Campaign Data: Campaign names, dates, goals, status, tracker codes
• Opportunity Data: Opportunity names, stages, amounts, close dates, sales team members
• Contact Data: Names, email addresses, phone numbers, job titles, addresses
• Account Data: Company names, industries, revenue, employee counts
• Lead Data: Lead status, qualification scores, survey responses, appointment details
• Call Recordings: Audio files, transcripts, recording metadata
• Custom Fields: Any additional fields mapped in your CRM configuration

2.3 Usage Data

We automatically collect:

• Login timestamps and IP addresses
• Pages viewed and features accessed
• API calls and usage patterns
• Device and browser information, including device type, operating system, browser type and version, and unique device identifiers
• Session duration and interaction logs

2.4 Call Recording Data

For opportunities with call recordings, we collect:

• Audio files (stored in secure cloud storage)
• Transcripts generated by AI processing services
• Sentiment scores and key moments
• Recording duration and metadata
• Participant information from your CRM

2.4.1 Call Recording Consent

MatchIQ™ and Evolve Coach require that all participants in a recorded call provide informed consent before recording begins. Where applicable law requires all-party consent (including in California, Florida, and other two-party consent jurisdictions), subscribers must obtain affirmative consent from all participants prior to initiating any recording. Recording begins only after consent is obtained and logged; the consent event itself need not be captured in the audio file.

Consent may be obtained verbally, through a pre-call platform notification, through a written acknowledgment, or through another mechanism that satisfies applicable law in the jurisdiction where the recorded individual is located. Subscribers are responsible for determining the required consent method for each jurisdiction in which they operate and for ensuring their consent process meets applicable standards.

Consent records. For each recorded call, a consent log entry must be created and retained by the subscriber for a minimum of five (5) years from the date of consent. Subscribers are solely responsible for maintaining their own consent records; TechnologyMatch does not collect or store subscriber consent logs. Consent log entries should include the date and time consent was obtained, the method by which it was obtained, and sufficient participant identification to connect the entry to the recorded call. Audio recordings are subject to the retention periods in Section 5 of this Policy (up to twelve (12) months from date of upload for MatchIQ™ and Evolve Coach) and are not required to be retained for the full five-year consent record period.

2.4.2 Voice Data and Biometric Considerations

Depending on the jurisdiction in which a call is recorded or in which a recorded individual is located, voice recordings and AI-derived voice characteristics may qualify as biometric data under applicable privacy or biometric-specific laws. Several U.S. states and municipalities have enacted biometric privacy laws that impose consent, retention, and destruction obligations on entities that collect or process such data.

TechnologyMatch processes voice recordings as a service provider on behalf of its subscribers. Subscribers are responsible for: determining which biometric privacy laws apply in the jurisdictions where they operate; obtaining any required consent before uploading recordings of individuals subject to those laws; and maintaining any publicly required biometric data retention and destruction policy. TechnologyMatch: (a) does not sell, lease, trade, or profit from voice recordings or AI-derived voice characteristics; (b) retains voice recordings only for the periods specified in Section 5 of this Policy; and (c) will cooperate with subscribers in responding to biometric privacy rights requests from individuals.

2.5 Chatbot and AI Search Data

The TechnologyMatch website uses an AI-powered chatbot and AI-assisted search functionality. When you interact with these features, we may collect:

• Search queries and chatbot conversation inputs
• Data indexed from vendor solutions into our vector database
• Interaction metadata (timestamps, session identifiers)

This data is used to enhance accuracy and relevancy of chatbot responses, improve our services, and analyze usage patterns. We employ encryption in transit and at rest and continuous monitoring to protect this data. This data is not used to train generalized AI models or shared with third parties beyond what is necessary to operate the service.

2.6 Calendar and Third-Party Integration Data

Where you choose to integrate a third-party calendar or productivity service (such as Microsoft 365/Teams or Google Calendar) with the TechnologyMatch Platform, we may collect details of scheduled events, participant information, and related notes. Calendar integration is entirely optional and requires your explicit consent. You may revoke consent and disconnect your calendar at any time through your account settings; all calendar data access ceases upon disconnection.

Google User Data. Any data accessed through Google APIs is handled in strict compliance with the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Google user data is used only to provide the features you explicitly enable.

2.7 Cookies and Tracking Technologies

We use cookies and similar tracking technologies including web beacons, pixel tags, clear GIFs, and scripts to track activity on our Services and store certain information. Cookies may be Session Cookies (deleted when you close your browser) or Persistent Cookies (remaining on your device until they expire or you delete them). We use both types:

• Necessary / Essential: Session cookies essential to authenticate users, prevent fraud, and provide requested services. Cannot be disabled without affecting core functionality.
• Functionality / Preferences: Persistent cookies that remember your choices (login details, language, display preferences).
• Statistics / Analytics: Persistent cookies that collect anonymized data about how visitors use our Services. Loaded only after consent.
• Marketing: Persistent cookies used to deliver relevant advertising and measure campaign effectiveness. Loaded only after consent.

Non-essential cookies will not fire until affirmative consent is obtained through our cookie consent management platform (CMP), which provides granular category-level controls. A complete cookie inventory including cookie name, provider, purpose, duration, and first/third-party classification is maintained and available upon request by contacting privacy@technologymatch.com.

Do Not Track (DNT). Some browsers offer a Do Not Track ("DNT") feature. Because there is currently no industry-wide consensus on how to interpret DNT signals, TechnologyMatch does not alter its data collection practices in response to DNT signals at this time. We continue to monitor DNT standards and will update this position if a legally actionable standard is adopted.

Global Privacy Control (GPC). TechnologyMatch is implementing Global Privacy Control (GPC) signal detection across its websites. Once fully implemented, a GPC signal sent from a California resident's browser will be treated as a valid opt-out of the sale or sharing of personal information under CPRA for that device. California residents may also contact privacy@technologymatch.com to submit an opt-out request.

3. HOW WE USE YOUR INFORMATION

3.1 Primary Purposes

We use your information to:

• Provide access to the Platform and its features
• Sync and display campaign, lead, and opportunity data
• Generate AI-powered insights and sentiment analysis
• Provide call recording playback and transcription
• Enable API access and data exports
• Send system notifications and alerts
• Authenticate users and manage access permissions
• Facilitate scheduling and meeting coordination (where calendar integration is enabled)

3.2 AI Processing

We use AI processing services to transcribe call recordings, analyze sentiment, generate summaries and insights, and extract action items. AI processing occurs in our AI service provider's infrastructure. TechnologyMatch does not disclose specific third-party AI providers but ensures they are subject to data protection obligations consistent with this Policy. TechnologyMatch does not use Customer Data, recordings, transcripts, or AI-generated output to train, retrain, improve, fine-tune, or develop generalized AI or machine learning models, and does not incorporate Customer Data into shared or pooled training datasets.

Coaching use only; no employment decisions. AI-generated output is a coaching and informational tool only. Platform output — including scores, grades, and evaluations — is expressly prohibited from use as the basis for or a contributing factor in any employment decision, including termination, demotion, discipline, compensation changes, or hiring. Users are solely responsible for applying human judgment to all AI output before taking any action.

Algorithmic bias. TechnologyMatch does not warrant that AI output is free from errors or algorithmic bias, including outcomes that may disproportionately affect individuals based on protected characteristics. Human oversight is required before acting on any AI-generated output.

AI model updates. TechnologyMatch may update, modify, or replace AI systems from time to time. For material changes to core scoring or analysis methodology, at least thirty (30) days' prior written notice will be provided.

AI regulatory assessment. Several U.S. and international jurisdictions have enacted or are enacting laws governing the use of automated and AI-driven decision systems, particularly in employment and high-stakes contexts. TechnologyMatch is actively assessing the applicability of these laws to its products and will update this Policy with any applicable compliance commitments as that assessment is completed.

End-user notification. Customers are responsible for notifying individuals whose calls are analyzed through the Platform that output is generated by automated AI systems, and that such notification complies with applicable AI disclosure laws.

3.3 Analytics and Improvement

We use aggregated, anonymized data to monitor Platform performance, identify bugs, analyze usage patterns, improve user experience, and generate internal metrics. TechnologyMatch may develop and retain anonymized, de-identified derivative insights from Platform output ("Resultant Data") such as aggregated scoring patterns and usage statistics, provided Resultant Data cannot reasonably be used to identify any individual. De-identification meets the CPRA standard under Cal. Civ. Code § applicable legal standards for de-identification. TechnologyMatch prohibits re-identification attempts. Resultant Data is not subject to deletion obligations upon account termination.

3.4 Email Marketing

We may use your contact information to send newsletters, product updates, and marketing communications. You may opt out at any time using the unsubscribe link in any email or by contacting privacy@technologymatch.com. We use third-party email service providers to manage and send marketing communications. These providers process your contact information solely to deliver communications on our behalf and are contractually prohibited from using it for their own purposes.

3.5 Security and Compliance

We process information to detect and prevent fraud or unauthorized access; enforce our Terms of Service; comply with legal obligations including U.S. export control laws and OFAC sanctions programs (TechnologyMatch does not knowingly process personal information for or on behalf of persons on any U.S. prohibited parties list); respond to lawful requests from authorities; and protect our rights and property.

4. HOW WE SHARE YOUR INFORMATION

4.1 No Sale of Data

We do not sell, rent, or trade your personal information to third parties for marketing purposes.

4.2 Within the Platform

Access to your data is strictly controlled based on role and organization:

• Distributor Super Admins: Can view all campaigns and partners within their distributor organization
• Distributor Users: Can only view assigned campaign trackers
• Partner Admins: Can view their own organization's campaigns and leads
• Partner Users: Can view only assigned leads
• Other Organizations: Have zero visibility into your data

On the TechnologyMatch Platform (Marketplace), certain profile information and content may be visible to other registered users or the general public based on your account settings. Detailed analytics and exact match results are available only to authenticated users with appropriate access. You control what information appears on your profile through your account settings.

4.3 Service Providers

We share data with third-party service providers who process it on our behalf:

These providers are contractually obligated to protect your data and use it only for specified purposes. Data Processing Agreements (DPAs) are in place with all third-party processors, including Amazon Web Services, Inc., Google LLC, Functional Software, Inc. d/b/a Sentry, Salesforce, Inc., and ZoomInfo Technologies Inc. DPA documentation is available to enterprise customers upon request. TechnologyMatch remains liable for sub-processor performance and will provide thirty (30) days' advance notice of material sub-processor changes.

4.4 Payment Processing

TechnologyMatch uses Stripe, Inc. as its third-party payment processor. TechnologyMatch does not store or collect your payment card details — card information is provided directly to Stripe and is governed by Stripe's Privacy Policy (https://stripe.com/privacy). Stripe adheres to PCI-DSS standards as managed by the PCI Security Standards Council.

4.5 Legal Requirements

We may disclose information if required by law, including to comply with subpoenas, court orders, or government requests; protect our rights, property, or safety; investigate fraud or security issues; and enforce our Terms of Service.

4.6 FCRA — Not a Consumer Report

Platform output, including AI-generated scores, evaluations, briefs, and related analysis, is not a "consumer report" as defined under the Fair Credit Reporting Act (FCRA). Platform output may not be used as a factor in any determination of an individual's eligibility for credit, insurance, employment, housing, or tenant screening. Users who do so violate the applicable Terms of Use and assume sole responsibility for any resulting claims.

4.7 Business Transfers

If TechnologyMatch is acquired, merged, or sells assets, your information may be transferred to the acquiring entity. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

5. DATA RETENTION

5.1 Active Accounts

We retain your data in accordance with the following retention periods: (a) Account Information — Duration of account plus 3 years post-termination; (b) Call Recording Audio Files and Transcripts (MatchIQ™ and Evolve Coach) — up to twelve (12) months from date of upload; (c) AI Analysis Outputs (MatchIQ™ and Evolve Coach) — up to twelve (12) months from date of processing; (d) Usage and Access Logs — 12 months; (e) Call Recording Consent Log Entries — 5 years from date of consent (maintained by subscribers; see Section 2.4.1); (f) TM Marketing Email Consent Records (CASL) — 3 years from date of consent; (g) Financial and Contract Records — 7 years; (h) Legal Hold Data — Until released by legal counsel.

5.2 Inactive Accounts

• MatchIQ™ accounts: ninety (90) days post-cancellation read-only access, consistent with the MatchIQ Terms of Use. Evolve Coach accounts: ninety (90) days post-cancellation read-only access, consistent with the Evolve Coach Terms of Use.
• Evolve Edge accounts: thirty (30) days post-closure, consistent with the Evolve Edge Terms of Use.
• All other Services: thirty (30) days unless a longer period is required by law or legal hold.
• After the applicable period, data is permanently deleted unless legally required to retain.

5.3 Call Recordings

For MatchIQ™ and Evolve Coach, call recordings and transcripts are retained up to twelve (12) months from date of upload, regardless of account status. Upon cancellation, a ninety (90) day post-cancellation read-only period applies, subject to the twelve (12) month upload-date limit. Retention periods for Evolve Edge and all other Services are specified in the applicable Terms of Use.

5.4 Legal Holds

We may retain data longer if required by law, regulation, or litigation.

6. DATA SECURITY

6.1 Technical Measures

• Encryption at Rest: Industry-standard encryption for data at rest
• Encryption in Transit: Industry-standard encryption for all data in transit
• Access Controls: Role-based permissions, multi-tenant database isolation
• Authentication: Token-based authentication, API key security, MFA support
• Monitoring: Real-time intrusion detection, security logging

6.2 Organizational Measures

• Employee access is limited to those with a legitimate need
• Regular security audits and penetration testing
• Incident response plan for data breaches. In the event of a breach affecting your personal information, TechnologyMatch will notify you and applicable regulatory authorities as soon as practicable and within the timeframe required by applicable law. TechnologyMatch targets seventy-two (72) hours as its standard internal response trigger. Notification will include the nature of the breach, categories of data affected, and steps taken to address it.
• Annual security training for staff

Security limitation. While we strive to use commercially reasonable means to protect your personal information, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

6.3 Your Responsibilities

• Use strong, unique passwords
• Enable multi-factor authentication (MFA) when available
• Keep your credentials confidential
• Report suspected security incidents immediately

7. SOURCES OF PERSONAL INFORMATION

We obtain personal information from the following sources:

• Directly from you: Information you provide when creating an account, completing forms, communicating with us, or using Platform features.
• Automatically from your device: Usage Data, cookies, and device identifiers collected automatically as you interact with our Services.
• From your connected systems: Data synchronized from your CRM, calendar integrations, or other connected tools that you authorize.
• From service providers: Information received from third-party vendors such as payment processors and analytics providers in connection with services they provide on our behalf.
• From other users: Information about you that other users of the Platform submit in the course of using the Services.

8. YOUR PRIVACY RIGHTS

8.1 Access and Portability

• Access your personal information
• Request a copy of your data in a portable format (CSV, JSON)
• Download data via the Platform's export features or API

8.2 Correction and Deletion

• Correct inaccurate or incomplete information
• Request deletion of your personal information (subject to legal retention requirements)
• Deactivate your account at any time

8.3 Restriction, Objection, and Consent Withdrawal

• Restrict processing of your personal information in certain circumstances
• Object to automated decision-making (Note: Our AI provides insights only; no automated decisions affect individual rights)
• Withdraw consent at any time for consent-based processing (e.g., cookies, calendar integration) without affecting the lawfulness of prior processing

8.4 Exercising Your Rights

Email:privacy@technologymatch.com

Subject Line: "Privacy Rights Request — [Your Name and Applicable Service]"

We will respond within the timeframe required by applicable law. Where no specific statutory period applies, we will respond within forty-five (45) calendar days. We will acknowledge receipt of your request promptly and notify you in writing if an extension is required before the initial period expires.

9. GDPR COMPLIANCE (EU/EEA Users)

9.1 Legal Basis for Processing

• Contract Performance (Art. 6(1)(b)): Account creation and management; Platform delivery.
• Legitimate Interests (Art. 6(1)(f)): Analytics, performance monitoring, security, fraud prevention.
• Legal Obligation (Art. 6(1)(c)): Legal holds and compliance.
• Consent (Art. 6(1)(a)): Call recording and AI analysis; cookies. Where call audio analysis constitutes biometric data processing under GDPR Article 9, explicit consent under Art. 9(2)(a) is required separately.

9.2 Data Transfers

For transfers of personal data from the EEA, UK, or Switzerland to the United States, TechnologyMatch utilizes EU Standard Contractual Clauses (SCCs) under Commission Decision 2021/914/EU, Module 2 (Controller to Processor), and/or the EU-US Data Privacy Framework (DPF) where applicable sub-processors hold current DPF certification, as the legal mechanism for such transfers.

9.3 EU/UK Representative (GDPR Article 27)

TechnologyMatch is appointing a paid third-party EU/UK Data Protection Representative as required by GDPR Article 27 and UK GDPR. In the interim, GDPR inquiries from EU/EEA and UK residents may be directed to gdpr@technologymatch.com. Once appointed, the representative's legal name, EU address, and contact details will be published here.

9.4 Supervisory Authority

EU/EEA residents have the right to lodge a complaint with their local data protection supervisory authority.

10. CCPA/CPRA COMPLIANCE (California Residents)

10.1 Categories of Personal Information Collected

In the preceding twelve (12) months, TechnologyMatch has collected the following categories of personal information from California residents as defined under CCPA/CPRA:

* Collected through MatchIQ™ and Evolve Coach in connection with subscriber-uploaded call recordings. TechnologyMatch processes this data as a service provider on behalf of its subscribers.

10.2 California Privacy Rights

• Know, Access, Correct, Delete: Right to know what we collect; request access, correction, or deletion (subject to exceptions).
• Opt-Out: Opt out of the sale or sharing of personal information by adjusting cookie preferences, via GPC signal, or by contacting privacy@technologymatch.com.
• Limit Sensitive PI: Limit use and disclosure of sensitive personal information.
• Non-Discrimination: Not be discriminated against for exercising these rights.

10.3 Do Not Sell or Share

We do not sell personal information. Sharing of certain usage data with analytics providers may constitute "sharing" under CPRA's expanded definition. California residents may opt out of such sharing by: (a) adjusting cookie preferences through our consent management platform; (b) enabling a Global Privacy Control (GPC) signal in their browser once GPC detection is live on our websites; or (c) contacting privacy@technologymatch.com with subject line "Do Not Sell or Share — California Opt-Out." Opt-out requests are honored within 15 business days.

TM as CCPA/CPRA service provider. When processing California resident personal information on behalf of a customer, TechnologyMatch acts as a "service provider" under CCPA/CPRA and: (a) will not sell or share such information; (b) will not retain, use, or disclose it outside the contracted purposes; (c) will notify the customer if TechnologyMatch cannot comply; and (d) will cooperate with customer rights request responses.

10.4 Exercising CCPA Rights

Email:ccpa@technologymatch.com

We will verify your identity before processing requests.

11. OTHER U.S. PRIVACY RIGHTS

11.1 Florida Digital Bill of Rights

Florida's Digital Bill of Rights applies to TechnologyMatch as a company headquartered in Florida. Florida residents have the right to confirm, access, correct, delete, and obtain a portable copy of their personal data, and to opt out of targeted advertising, sale, and profiling with legal or similarly significant effects. Sensitive data including voice recordings and AI sentiment analysis requires explicit consent. To exercise Florida rights: privacy@technologymatch.com, subject line "Florida Privacy Rights Request."

11.2 Additional State Privacy Laws

TechnologyMatch honors the privacy rights of residents of Colorado, Connecticut, Texas, Virginia, and all other states with enacted comprehensive privacy legislation. Rights generally include access, correction, deletion, portability, and opt-out of targeted advertising and profiling. Contact privacy@technologymatch.com with your state of residence and specific request. We respond within the timeframe required by your applicable state law.

11.3 TCPA, CAN-SPAM, and CASL

Where TechnologyMatch communicates via email, telephone, or SMS, we comply with the Telephone Consumer Protection Act (TCPA), the CAN-SPAM Act, and Canada's Anti-Spam Legislation (CASL). Automated or prerecorded calls and texts require prior express written consent. TCPA consent records are retained for a minimum of five (5) years. Canadian marketing commercial electronic messages (CEMs) are sent only to individuals who have provided CASL-compliant consent. CASL marketing email consent records are retained for three (3) years from date of consent — a separate obligation from the five-year call recording consent records described in Section 2.4.1. All marketing emails include a functional unsubscribe mechanism. Email unsubscribe requests are processed within ten (10) business days as required by the CAN-SPAM Act and CASL — note this statutory deadline differs from the fifteen (15) business day period for CPRA Do Not Sell or Share requests in Section 10.3, which is a separate right under different law. To opt out of SMS: reply STOP.

Employee monitoring disclosure. Several U.S. states require employers to provide written notice to employees before monitoring or recording telephone calls or electronic communications. MatchIQ™ and Evolve Coach subscribers who are employers are responsible for determining which employee monitoring notice requirements apply in the jurisdictions where they operate and for providing those disclosures before using the Platform to analyze employee calls. TechnologyMatch provides this notice as a compliance reference only.

12. MINORS' PRIVACY

TechnologyMatch requires all account holders to be at least eighteen (18) years of age. The Services are not directed to minors. We do not knowingly collect personal information from any individual under 18 without verifiable parental or guardian consent. If we become aware that a minor has provided personal information, we will delete it promptly.

Note on regulatory age thresholds: certain privacy laws set lower minimum thresholds for specific obligations — the Children's Online Privacy Protection Act (COPPA) applies to children under 13, and GDPR Article 8 applies to children under 16 in EU/EEA jurisdictions. TechnologyMatch's eighteen (18) year account requirement is stricter than these statutory minimums. The MatchIQ™ and Evolve Coach Terms of Use separately prohibit uploading or processing recordings of any individual under 18 without verifiable parental or guardian consent.

13. INTERNATIONAL DATA TRANSFERS

13.1 Data Locations

• Primary: Primary cloud infrastructure, United States
• AI Processing: AI service provider infrastructure, United States
• Monitoring: Error monitoring service provider, United States

13.2 Transfer Mechanisms

For EEA/UK/Switzerland-to-US transfers, TechnologyMatch relies on EU Standard Contractual Clauses (SCCs, Commission Decision 2021/914/EU, Module 2) and/or the EU-US Data Privacy Framework (DPF) where sub-processors hold current DPF certification.

14. THIRD-PARTY LINKS

The Platform may contain links to third-party websites or services (e.g., Salesforce, training videos, partner websites). We are not responsible for the privacy practices of these third parties. Please review their privacy policies before providing any information.

15. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website with a revised "Last Updated" date. Where required by applicable law, we will provide additional notice. Material changes require prior review and written approval by outside legal counsel before publication. Continued use of the Services after changes are posted constitutes acceptance of the updated Policy.

16. CONTACT INFORMATION

The Launchpad Group Inc. dba TechnologyMatch

Address: 300 S Orange Ave, Suite 1000-66, Orlando, FL 32801

Privacy Officer: Alysa Sheckler, Chief Operating Officer

Email:privacy@technologymatch.com

Website:https://technologymatch.com

Legal Inquiries:legal@technologymatch.com

GDPR Inquiries (EU/EEA):gdpr@technologymatch.com

CCPA Inquiries (California):ccpa@technologymatch.com

17. PIPEDA COMPLIANCE (Canadian Residents)

17.1 Applicability

Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) applies to TechnologyMatch's collection, use, and disclosure of personal information of Canadian individuals in the course of commercial activity. PIPEDA is supplemented by provincial legislation in Alberta (Alberta PIPA), British Columbia (BC PIPA), and Quebec (Law 25, addressed in Section 18). TechnologyMatch acts as a service provider under each applicable provincial Act with respect to personal information processed on a customer's behalf; customers remain responsible for obtaining required consents.

17.2 Designated Privacy Officer

Alysa Sheckler, Chief Operating Officer | Privacy Officer

Email: privacy@technologymatch.com | Website: https://technologymatch.com

17.3 PIPEDA Principles

TechnologyMatch adheres to the ten Fair Information Principles set out in Schedule 1 of PIPEDA, including accountability, consent, limiting collection, accuracy, safeguards, openness, and individual access. Canadian individuals may access their personal information, challenge its accuracy, and direct complaints to the Privacy Officer. Unresolved complaints may be escalated to the Office of the Privacy Commissioner of Canada at www.priv.gc.ca.

17.4 Breach of Security Safeguards

Under PIPEDA, TechnologyMatch will notify the Office of the Privacy Commissioner of Canada (OPC) as soon as feasible of any breach of security safeguards that creates a real risk of significant harm to an individual, and will notify affected individuals where required. Breach records are maintained for a minimum of 24 months.

18. QUEBEC LAW 25 COMPLIANCE (Quebec Residents)

18.1 Applicability

Quebec's Law 25 applies to TechnologyMatch with respect to personal information collected from Quebec residents through any TechnologyMatch website, platform, or Service. Law 25 has been fully in force since September 22, 2023. Where Law 25 and PIPEDA conflict, the stricter obligation applies.

18.2 Designated Person Responsible

Pursuant to Law 25, TechnologyMatch has designated Alysa Sheckler, Chief Operating Officer, as the person responsible for personal information protection. Contact: privacy@technologymatch.com.

18.3 Privacy Impact Assessments

Law 25 requires TechnologyMatch to conduct Privacy Impact Assessments (PIAs) before implementing any project that presents a privacy risk and before transferring personal information outside Quebec. TechnologyMatch conducts PIAs for high-risk processing activities, including AI-based call analysis involving Quebec residents and cross-border transfers to third-party processors. PIA records are maintained by the Privacy Officer and available to the Commission d'accès à l'information upon request.

18.4 Consent for Sensitive Information

Law 25 requires explicit consent for sensitive personal information including biometric information and information of a highly personal nature. Voice recordings and AI-derived sentiment analysis and behavioral scores are sensitive under this definition. For Quebec residents, TechnologyMatch obtains explicit, informed consent before collecting, using, or disclosing such information. Consent may be withdrawn at any time by contacting privacy@technologymatch.com.

18.5 Quebec Privacy Rights

In addition to Section 8 rights, Quebec residents have: (a) Right to Data Portability — receive personal information in a technologically structured format or transfer it to a designated organization; (b) Right to De-indexing — request cessation of dissemination or de-indexing of hyperlinks where dissemination causes injury or the information is no longer necessary; (c) Right to Automated Decision-Making Disclosure — where a decision based exclusively on automated processing produces legal or significant effects, the right to be informed, request human review, and present views. To exercise Quebec rights: privacy@technologymatch.com, subject line "Quebec Privacy Rights Request." Responses will be provided within thirty (30) days as required by Quebec Law 25.

18.6 Cross-Border Transfers from Quebec

Before communicating personal information outside Quebec, TechnologyMatch conducts PIAs and enters written agreements with receiving processors. Data processing agreements with AWS, Google, and Sentry require recipients to provide protection equivalent to Quebec standards.

18.7 Complaints

Unresolved complaints may be filed with the Commission d'accès à l'information (CAI) at www.cai.gouv.qc.ca.

19. GDPR OPERATIONAL OBLIGATIONS

19.1 EU Representative (Article 27)

TechnologyMatch is appointing a paid third-party EU/UK/Swiss Data Protection Representative as required by Article 27 GDPR and UK GDPR. In the interim, GDPR inquiries may be directed to gdpr@technologymatch.com. Once appointed, the representative's legal name, EU address, and contact details will be published here and at https://technologymatch.com/privacy-policy.

19.2 Records of Processing Activities (Article 30)

TechnologyMatch is establishing an internal Register of Processing Activities (ROPA) as required by GDPR Article 30, documenting each processing activity, lawful basis, data categories, recipients, retention periods, and transfer mechanisms. Once complete, the ROPA will be maintained by the Privacy Officer and made available to supervisory authorities upon request.

19.3 Standard Contractual Clauses

For EU/EEA-to-US transfers, TechnologyMatch utilizes Standard Contractual Clauses (SCCs) adopted by the European Commission (Decision 2021/914/EU), Module 2 (Controller to Processor), as the legal mechanism for such transfers.

19.4 Data Subject Request Process

TechnologyMatch has implemented an operational workflow for responding to GDPR data subject requests (DSRs) under GDPR Articles 15–22. The Privacy Officer receives requests, verifies the identity of the requestor before processing, and provides a substantive response within one calendar month (extendable to three months with written notice for complex requests). The workflow covers all systems including CRM, secure cloud storage, AI processing outputs, and error monitoring logs. To submit a DSR: privacy@technologymatch.com, subject line "GDPR Data Subject Request — [Right Being Exercised]."