IMPACTARIS INC.

Privacy Notice

Last updated: September 7, 2026

1. Scope

This Privacy Notice explains how Impactaris Inc. (“Impactaris,” “we,” “us,” or “our”) collects, uses, discloses, retains and protects personal information in its own business operations. It covers www.impactaris.com, our public forms, accounts and portals, business development, bookings, events, direct communications and relationships with prospects, clients, partners, contractors, vendors, applicants and other business contacts. A feature-specific paragraph applies when you use that feature or enter that relationship.

This Notice does not govern personal information we process solely on a client’s documented instructions. For that information, the client’s privacy notice and the applicable services agreement and data-processing terms govern our respective responsibilities. Third-party websites, platforms and services apply their own notices to their independent activities.

“Personal information” means information that identifies or can reasonably be linked to an individual or household, including “personal data” and similar terms under applicable law. Information is excluded only when it meets the applicable legal exclusion, such as a valid standard for deidentification.

2. Who Is Responsible and How to Contact Us

Impactaris Inc., a Florida corporation, is responsible for processing covered by this Notice when it determines why and how the information is used.

Email: info@impactaris.com. For privacy matters, use the subject “Privacy Request,” “Privacy Appeal” or “Privacy Complaint,” as appropriate. You may also call 1 (888) 889-6584 and ask about a privacy request.

Mail: Impactaris Inc., Attention: Privacy, 66 West Flagler Street, Suite 900, Miami, Florida 33130, United States.

3. Information We Collect

The information we receive depends on your interaction with us. The following categories describe the information involved in the listed activities; they do not mean that we collect every item from every visitor.

• Contact and identity information: your name, business name, job title, postal address, email address, telephone number and account or online identifiers. We receive this information from you, your organization, introductions, referrals and public professional or business sources.
• Account and access information: account identifiers, organization and role, permissions, login and session information, authentication status and security events. We receive it from you, authorized account administrators and the providers supporting the relevant account or portal.
• Commercial and transaction information: services you request or consider, proposals, orders, statements of work, bookings, approvals, invoices, payment status, transaction identifiers and relationship history. We receive it from you, your organization and the parties and providers involved in the transaction.
• Communications and submitted content: form entries, messages, proposal requests, files, comments, reports, work requests, feedback, approvals and support correspondence. Calls and meetings may also involve the information described in Section 7 when the required consent has been obtained.
• Device and usage information: IP address, browser and device attributes, referring page, pages and features used, approximate location derived from IP address, session identifiers, privacy preferences, timestamps, errors and security events. Our website and technical providers receive this information when your device connects to their services.
• Professional, relationship and work information: employer, position, professional profile, qualifications, project responsibilities, performance and activity records, and partner or vendor relationship information. Sources include you, your organization, clients, referrals and public professional sources.
• Applicant information: résumés, work and education history, qualifications, portfolios, application responses, interview notes and references you provide or authorize us to obtain. Screening that requires separate notice or authorization is subject to that process.
• Billing and financial administration information: billing contacts, invoices, payment status, payment tokens and limited payment-method details, and bank, payout or tax information necessary for an authorized transaction. Payment processors and financial institutions receive payment details through their own transaction workflows.
• Interests and preferences: service interests, communication preferences, relationship stage and support notes derived from your requests and our business interactions.

Do not send complete payment-card numbers, passwords, health information, biometric identifiers, government identification numbers, information about children or other highly sensitive information through an ordinary contact form or email. Those channels are not intended for that information. Enter payment-card details only through the payment provider’s designated payment page. We do not need your full card number to respond to a billing inquiry.

4. Sources and Website Providers

We collect information directly from you through forms, bookings, email, telephone, meetings, agreements, uploads, account activity and authorized payment workflows. We also receive information from your organization or relationship sponsor; referrals; public company, government and professional sources; and providers supporting hosting, communications, scheduling, payments, accounting, security and electronic documents.

Our public website is hosted on Wix. Wix processes website requests, device and session information and information submitted through Wix-supported forms and features to deliver and support the Site. Wix’s own privacy information is available at https://www.wix.com/about/privacy. A provider’s separate notice describes its own responsibilities; it does not give us permission to disclose information for an unrelated purpose.

The Site also loads technical code from Sentry for error monitoring, CertifiedCode for navigation, and content-delivery services including Cloudflare and unpkg for interface libraries. Downloading these resources involves connection information such as an IP address, requested resource and browser details. Error reporting, where generated, is a separate technical function. These providers are described for their website delivery and technical roles, not as advertising networks.

Cookies, browser storage and technical logs are explained further in our Cookie and Tracking Technologies Notice. Website technologies and business administration systems have different purposes; visiting the public Site does not by itself enroll you in an optional campaign, create a paid subscription or authorize a call recording.

5. Why We Use Information

• Responding and developing relationships: responding to inquiries, arranging conversations, assessing needs, preparing proposals, managing introductions and evaluating client, partner, contractor, vendor or employment relationships.
• Contracting and delivering services: negotiating and administering agreements, fulfilling orders and statements of work, coordinating work, managing approvals and changes, providing support and maintaining reliable business records.
• Accounts and portals: administering an authorized account, assigning access, authenticating users, supporting role-specific features, preventing misuse, maintaining approval records and removing access when it ends.
• Billing, payments and accounting: issuing invoices, processing and reconciling payments or authorized payouts, preventing duplicate or fraudulent transactions, maintaining financial records and meeting tax obligations. Payment processors and banks may also use information for their independent legal and compliance duties.
• Security and integrity: protecting accounts and systems, investigating abuse or incidents, preserving necessary evidence, enforcing access restrictions and protecting people, property and legal rights.
• Communications: providing requested responses and service, account, transaction, security and legal messages; sending commercial communications where permitted; and maintaining preferences and opt-out records. Marketing permission is separate from contract formation or consent to an electronic record.
• Quality and improvement: diagnosing technical problems, evaluating feedback, understanding whether functions work, improving services and accessibility, and training personnel. Technical monitoring is distinct from advertising or building audiences across unrelated websites.
• Legal and corporate matters: meeting legal obligations, responding to lawful process, handling complaints, audits, insurance and claims, enforcing agreements and evaluating or completing a financing, reorganization, acquisition or other corporate transaction under appropriate confidentiality restrictions.

Software may assist authorized personnel with drafting, classification, summaries and other business tasks. This Notice does not authorize unrestricted reuse of personal information or confidential client material by a software provider. Task assistance, provider retention, human review, model training and a provider’s own product improvement are different purposes and require their own lawful basis and contractual authority. We do not authorize public generative-AI model training using confidential client material or Site personal information through ordinary website use or general acceptance of our terms.

6. Legal Bases Where Required

When applicable law requires a legal basis, we rely on the basis appropriate to the activity: steps you request before a contract and performance of a contract with you; our legitimate interests in operating and securing our business, maintaining business relationships, improving services and protecting legal rights, balanced against your rights; compliance with legal obligations; or consent for an activity that requires it. In limited emergencies, protection of vital interests or another legally available basis may apply. Providing information about another person does not remove that person’s rights or supply consent on their behalf.

Where we rely on consent, you may withdraw it prospectively through the relevant control or by contacting us. Withdrawal does not make earlier lawful processing unlawful. We do not treat ordinary commercial marketing as automatically exempt from an applicable consent or legitimate-interest assessment requirement.

7. Calls, Meetings and Capture Consent

Before an Impactaris call or meeting is recorded, transcribed, processed by AI note-taking or captured in any other way, every participant must receive notice of each actual capture mode, the tool, the recipients and the purpose, and must affirmatively consent to each mode. Remaining on a call or signing a general agreement is not affirmative consent.

If a new participant joins, or there is a material change in a disclosed capture mode, tool, recipient or purpose, all recording, transcription, AI note-taking and other capture must pause immediately. Capture may resume only after updated notice and every participant’s affirmative consent to each actual mode and the changed details. We retain the actual notice and consent evidence.

If anyone refuses, withdraws consent or cannot consent, all capture must stop, that call must end and the conversation must continue by email only. Continuing the same call without recording is not a substitute. These rules do not restrict recording, reporting or evidence activity protected by nonwaivable law.

Routine call and meeting recordings are generally retained for up to 90 days. Longer retention is limited to the minimum identified material needed for a documented lawful contract, complaint, incident, claim or binding preservation purpose, with restricted access, review and a defined deletion or release event. A general quality concern does not justify indefinite retention. A shorter mandatory biometric or other legal period, or a shorter binding personal-rights commitment, controls. A more specific lawful recording notice applies to its identified subject.

8. Cookies and Similar Technologies

The Site uses cookies, browser storage and technical requests to deliver pages and forms, maintain sessions, support security and reliability and remember relevant settings. Our Cookie and Tracking Technologies Notice explains the distinction between these functions and optional analytics, advertising and communication tracking, together with your choices.

Optional device storage or access that requires consent is subject to prior affirmative consent. You may refuse or withdraw optional consent without agreeing to another unrelated purpose. A qualifying opt-out preference signal, including Global Privacy Control where legally recognized, expresses an opt-out for the processing covered by that law; it is not consent to another use. Applicable opt-outs extend to an associated account or known profile when the law requires that treatment.

9. Who Receives Information

We disclose information for the purposes in this Notice to the following recipient categories, limited to the relevant activity:

• Website, hosting, portal and infrastructure providers supporting pages, forms, accounts, storage and delivery.
• Communications and collaboration providers supporting email, calls, meetings, messaging, scheduling, document exchange and electronic signatures.
• Payment processors, banks, accounting and tax providers supporting transactions, reconciliation, fraud prevention and reporting.
• Security, technical monitoring and support providers protecting systems, investigating errors and maintaining availability.
• Professional advisers and insurers, including legal, accounting, audit and insurance providers, subject to appropriate duties.
• Clients and other authorized relationship participants when necessary to administer an engagement, coordinate authorized work or follow a client’s lawful instructions.
• Parties to a proposed or completed corporate transaction, subject to appropriate confidentiality and legal restrictions.
• Courts, regulators, public authorities and other parties when disclosure is required by law or lawful process, or is lawfully necessary to protect rights or safety, investigate fraud, resolve a claim or address an emergency.

The information disclosed depends on the purpose: hosting and security providers receive relevant technical and account data; communication providers receive the communications they transmit or store; payment and financial providers receive transaction and administration information; and advisers or relationship participants receive only information relevant to their role. We do not authorize a service provider to use confidential Site submissions for unrelated advertising or cross-client enrichment. A provider’s independent legal, fraud-prevention or compliance duties may make it independently responsible for that limited processing.

10. Advertising, Sale and Sharing Choices

We do not use the Site for visitor retargeting or advertising-network audience building. We do not authorize our website service providers to use information we disclose for their independent cross-context behavioral advertising. Our technical monitoring and website administration are intended to operate, secure and support the Site.

Privacy laws may define “sale,” “sharing” or “targeted advertising” more broadly than a transfer for money. You may submit an applicable opt-out or limitation request to info@impactaris.com. We do not require identity verification for an opt-out, limitation request or qualifying preference signal when the law prohibits that requirement, and we request only the information needed to locate and act on the request. These rights apply to a covered practice when it occurs; they do not depend on a future policy update.

Introducing a new advertising or audience-building purpose requires the applicable notice, choices and consent before that processing. Any program that legally requires a financial-incentive or price-difference notice requires its own terms and any required opt-in; this Notice does not enroll you in such a program.

11. Sensitive Information

Our general public Site does not request sensitive information. A particular business relationship may require limited sensitive information, such as tax or payout details, through a separately authorized process. Such information is limited to the disclosed, reasonably expected purpose and applicable security, compliance and legal obligations. Unrelated uses or inferences require the legally required notice, consent or right to limit.

General website consent does not authorize prohibited health, biometric or child-data processing, replace a required separate permission, or override a mandatory minimization rule. An unexpected sensitive submission is subject to restricted assessment and lawful disposition, including necessary preservation.

This Notice does not authorize biometric identification, voice or likeness replication, or the creation of biometric templates. An activity requiring separate biometric notice, consent or a public retention and destruction policy must satisfy those requirements separately. A generic retention period below does not extend a controlling biometric destruction deadline. Disabling a model or keeping an encrypted biometric copy is not the same as permanent destruction.

12. Retention

We retain information only as long as reasonably necessary for its purpose, the governing agreement, legal and accounting duties, security or a specific legal claim. We consider the information’s nature, sensitivity, risk, purpose and applicable limits. The following are our general retention periods and criteria; shorter mandatory limits and binding data terms control.

• Prospect, inquiry and booking records: generally two years after the last meaningful interaction, unless the information becomes part of an ongoing relationship or is needed for a specific dispute or legal duty.
• Marketing preferences: until unsubscribe, invalidity or program termination. Minimal suppression evidence may remain as long as reasonably necessary to honor the opt-out.
• Executed agreements, orders, material approvals, invoices, financial evidence and material electronic-consent records: the relationship or transaction period plus seven years, unless a longer period is legally required or necessary for a specific claim. This period applies to necessary evidence, not every underlying personal record or recording.
• Portal accounts and access records: the account’s life plus up to two years. Necessary security, approval and transaction evidence follows the applicable category above or below.
• Service working files, reports, submissions and uploads: the relationship period and any period required by the governing agreement or a specific legal, tax, dispute, security or professional duty. Transient material is deleted sooner when no longer needed.
• Routine call and meeting recordings: generally up to 90 days, subject to the narrower preservation and shorter-limit rules in Section 7.
• Unsuccessful applicant records: generally two years after the hiring decision, subject to applicable employment law and a specific claim-preservation duty.
• Necessary, minimized security-event evidence: generally 12 to 24 months where justified by the security purpose. Raw diagnostics, complete form submissions, transcripts, health information and biometric materials do not automatically receive that period and remain subject to their own shorter purpose-based limits.
• Copyright complaints, legal complaints and rights-request records: generally seven years after closure, limited to necessary evidence, or longer where a specific legal hold, recurring matter or legal requirement justifies it.

A binding legal hold or mandatory retention duty affects only the identified information, lawful purpose and necessary period. Access is restricted and the basis is reviewed; the information is deleted when the duty ends unless another lawful basis requires retention. Protected backups follow a secure cycle, are unavailable for ordinary use and receive deletion instructions again if restored. Backup retention does not override an earlier mandatory destruction duty unless the law permits the particular preservation basis.

We may retain properly deidentified information only when deidentification is authorized and satisfies applicable legal and technical requirements, including required commitments and recipient restrictions. Hashing alone does not necessarily deidentify information. Deidentification does not override a controlling return or deletion instruction or enlarge rights in confidential material.

13. Security and Incident Reporting

We use safeguards designed to protect personal information in light of its nature and risk. Access restrictions, secure configuration, encryption in transit, provider controls and retention practices are part of this approach. No transmission or storage system is completely secure, and we cannot guarantee prevention of every unauthorized attempt.

If you believe an account or information may be compromised, contact info@impactaris.com with the subject “Security Concern.” Do not send passwords or complete payment-card details. If an incident triggers a legal notification duty, we will notify affected persons and authorities as required. Client-controlled information is also subject to the relevant services and data-processing terms.

14. Children

The Site is directed to adults and business users. People under 18 may not create accounts, enter contracts or submit personal information through the Site. We do not knowingly collect personal information online from children under 13. A parent or guardian who believes a child submitted information may contact info@impactaris.com so we can investigate and take appropriate action.

An adult-use statement does not replace legally required parental data consent when a law applies to a particular activity. A model, performance or other media permission also does not replace that process.

15. Your Privacy Rights

Depending on your location, the information, the relationship and applicable law, you may have rights to:

• Confirm processing and access or know your personal information, including covered categories, specific information, sources, purposes and recipients.
• Correct inaccurate information, request deletion and obtain a portable copy of covered information.
• Opt out of a covered sale, sharing, targeted advertising or certain profiling, and limit certain uses or disclosures of sensitive information.
• Withdraw consent, object to processing or request restriction.
• Appeal a qualifying denial and complain to a competent privacy regulator or supervisory authority.
• Exercise your rights without unlawful discrimination.

Rights are subject to the exceptions allowed by the applicable law. For example, necessary information may remain to complete a requested transaction, secure systems, comply with a legal duty, protect legal rights or honor an opt-out. Business-contact, workforce, small-business or health-related status does not create a blanket exemption from every privacy law.

16. Requests, Verification and Appeals

Email info@impactaris.com with the subject “Privacy Request,” call 1 (888) 889-6584 and ask about a privacy request, or write to the address in Section 2. Identify the right you wish to exercise and provide enough information to locate the relevant records. Your state or country helps us determine the applicable procedure. Do not send a password, full payment-card number, government identification number or unnecessary sensitive information. You do not need to create an account to contact us or submit a request.

We request identity or authority evidence only when the particular right permits or requires it, using necessary and proportionate information. We do not impose prohibited verification on sale or sharing opt-outs, sensitive-information limitation requests or qualifying preference signals. If verification is lawfully required but cannot be completed, we explain the resulting limitation or denial as required.

An authorized agent may act for you where permitted. Authority evidence and any direct confirmation depend on the request type; we do not impose routine consumer reconfirmation where prohibited. Applicable power-of-attorney rules remain available.

We respond within the time required by applicable law and explain a permitted extension when necessary. We charge a fee only when the applicable law permits one. An appealable denial will explain the appeal process. You may appeal by replying to the determination or emailing info@impactaris.com with the subject “Privacy Appeal.” Our response will identify any further complaint route required by law.

17. U.S. State Privacy Rights

California residents have the rights granted by California law when the law applies to Impactaris and the information involved. The information categories, sources, purposes, recipient categories and retention criteria in this Notice explain our ordinary business activities. California’s former general business-contact and workforce exemptions are not treated as continuing exemptions.

Where California’s Shine the Light law applies, a resident with an established business relationship may request the information the law provides about covered disclosures for a third party’s direct marketing. Send the request to info@impactaris.com with the subject “California Privacy Request.”

Residents of other U.S. states may exercise the rights their applicable state law provides through Section 16. Legal scope, exceptions, response periods, agent rules and appeals differ. A qualifying universal opt-out mechanism or preference signal receives the browser, device and associated-account treatment required by the law that applies. It does not authorize another purpose.

18. International Processing

Impactaris is established in the United States. Information you provide to us is processed in the United States, and our hosting, communication and other service providers may process information through their international operations. Data-protection laws may differ from those where you live. Wix’s privacy notice identifies its international processing practices.

Where a transfer is subject to a legal restriction, the applicable adequacy decision, contractual safeguards or other lawful transfer route must support that transfer. This Notice is not itself a transfer mechanism and does not waive your rights. You may contact us for information about the safeguards applicable to your information and for a copy or explanation where the law entitles you to one, with appropriate protection for confidential information.

Where applicable data-protection law gives you rights to access, correction, erasure, restriction, portability, objection, withdrawal of consent or a complaint to a supervisory authority, use the contact details in Section 2. You may object to direct marketing where that right applies. Processing undertaken solely for a client follows the client’s role and the applicable services, data-processing and transfer terms.

19. Profiling and Automated Decisions

Our business records can include service interests, relationship stage and communication preferences inferred from interactions, for the relationship and support purposes described above. Automated assistance does not remove the obligations that apply to the underlying information or decision.

This Notice does not provide consent for a solely automated decision with legal or similarly significant effects, or for any other decision-making activity requiring separate notice, explanation, review, opt-out or consent. Those protections must be provided before a covered activity. Where the law gives you a right to an explanation, meaningful human review, an appeal or an opt-out, you may exercise it through Section 16.

20. Third-Party Sites and Social Platforms

Third-party sites and services apply their own privacy notices. When you interact with Impactaris through a social platform, both the platform and Impactaris may receive information associated with the interaction. A choice made with the platform does not necessarily apply to information already lawfully held by Impactaris, and a request to us does not control the platform’s independent processing.

21. Changes to This Notice

We may update this Notice to reflect changes in law, services, technology, providers or practices. The date above identifies this version. We provide additional notice or obtain consent when required for a material change. We do not use a quiet retroactive change to authorize a materially different use of previously collected information when another legal basis or consent is required.

This Notice provides information about privacy; it does not itself create a new services contract or substitute for affirmative consent. An applicable signed agreement and a specific lawful consent retain their separate effect.

22. Questions and Complaints

Contact info@impactaris.com or write to Impactaris Inc., Attention: Privacy, 66 West Flagler Street, Suite 900, Miami, Florida 33130, United States. If the UK controller complaints regime applies, we acknowledge a complaint within 30 days, investigate, keep the complainant informed and communicate the outcome without undue delay. The 30-day period is an acknowledgment period, not an automatic resolution deadline.

You may complain to a privacy regulator or supervisory authority where applicable law gives you that right. Contacting us first can help resolve a concern, but is not a condition that waives or postpones a regulatory right.