1. Introduction

BuyTheSell Inc. ("BuyTheSell," "we," "us," or "our") is headquartered at 135 E 57th Street, 14th Floor, New York, NY 10022, United States.

This Privacy Notice describes how BuyTheSell handles personal data in connection with the BTS Platform — a dedicated, single-tenant event and conference management application provided to financial institution clients ("Clients"). It does not apply to BuyTheSell's marketing website.

We recognize that privacy is an ongoing responsibility. We will update this Privacy Notice as our practices evolve and will notify affected parties of material changes in accordance with applicable law.

2. Our Role: Processor and Limited Controller

BuyTheSell operates in two distinct capacities with respect to personal data.

2.1 Data Processor — Client Data

For all data that Clients and their Authorized Users input into or store within the BTS Platform ("Client Data") — including event details, attendee information, and registration data — BuyTheSell acts solely as a data processor (or service provider under applicable law). In this capacity:

• BuyTheSell processes Client Data only on documented instructions from the Client, as set out in the Master Service Agreement ("MSA").
• BuyTheSell does not independently access, use, sell, or disclose Client Data for any purpose beyond providing the Platform.
• The Client, as the data controller, is responsible for the lawfulness of processing Client Data, including obtaining any required consents from attendees and other data subjects.

Questions about how Client Data is collected, used, or retained within the Platform should be directed to the relevant Client institution, not to BuyTheSell.

2.2 Data Controller — Infrastructure Access Logs

BuyTheSell independently determines the purposes and means of processing a limited category of personal data captured at the infrastructure level: authentication and access logs. These logs are generated automatically when Authorized Users access the Platform and may include:

• Internet Protocol (IP) addresses
• Login timestamps (date and time of access and log-off)
• Session identifiers

BuyTheSell controls these logs for its own security, integrity, and operational purposes, as described in Section 4 below. In this limited capacity, BuyTheSell acts as a data controller.

3. Client Data and Client Responsibilities

Each Client is provisioned a dedicated, single-tenant Instance of the BTS Platform. All Client Data stored within that Instance belongs to and is controlled exclusively by the Client. BuyTheSell does not commingle data across client Instances.

As the data controller for Client Data, the Client is solely responsible for:

• Providing any required privacy notices to individuals whose personal data is entered into the Platform (including event attendees, registrants, and speakers).
• Establishing a lawful basis for processing personal data within the Platform under applicable law (e.g., GDPR, CCPA, or other applicable regional privacy laws).
• Responding to data subject rights requests from individuals whose personal data appears in Client Data.
• Setting and enforcing appropriate data retention and deletion policies within the Platform.

If a data subject wishes to exercise rights over personal data held within the BTS Platform, they should contact the relevant Client institution directly. BuyTheSell will assist Clients in fulfilling such requests to the extent technically feasible and as required by the MSA.

4. Infrastructure Access Logs — How We Use Them

BuyTheSell collects and processes authentication and access logs (as described in Section 2.2) for the following purposes:

BuyTheSell does not use infrastructure access logs for marketing, profiling, or any purpose unrelated to platform security and operations.

Retention: Access logs are retained for the period specified in the applicable MSA. Where the MSA does not specify a retention period, BuyTheSell will retain logs for no longer than necessary for the purposes described above and in accordance with applicable law.

5. Single-Tenant Architecture and Data Isolation

Each Client's BTS Instance is a dedicated, isolated deployment. No Client's data — including access logs attributable to that Client's Authorized Users — is accessible to or visible from any other Client's Instance.

Access logs stored within a Client's Instance are accessible to that Client. Infrastructure-level logs retained by BuyTheSell separately are accessible only to authorized BuyTheSell personnel with a legitimate operational need.

6. How We Share Personal Data

BuyTheSell does not sell personal data. BuyTheSell does not share personal data with third parties for their independent marketing or commercial purposes.

We may share the limited personal data we control (infrastructure access logs) in the following limited circumstances:

6.1 Sub-Processors

BuyTheSell engages Microsoft Azure as its cloud infrastructure provider. Microsoft Azure may process infrastructure-level data (including access logs) as part of hosting and operating the Platform. Microsoft Azure is bound by contractual data processing agreements that require it to process data only on BuyTheSell's instructions and in accordance with applicable data protection law.

BuyTheSell will inform Clients of any intended changes to its sub-processor arrangements that may affect the processing of Client Data, in accordance with the MSA.

6.2 Legal Requirements

BuyTheSell may disclose personal data if required to do so by applicable law, court order, or government authority, or where BuyTheSell believes in good faith that disclosure is necessary to protect the rights, property, or safety of BuyTheSell, its Clients, or others.

6.3 Business Transfers

In the event of a merger, acquisition, or sale of all or substantially all of BuyTheSell's assets, personal data held by BuyTheSell may be transferred to the successor entity, subject to at least equivalent privacy protections.

7. International Data Transfers

BuyTheSell and its sub-processor (Microsoft Azure) may process and store data on servers located outside of the Client's or Authorized Users' home jurisdiction. BuyTheSell takes appropriate steps to ensure that any cross-border transfer of personal data is conducted in accordance with applicable data protection law, including by entering into Standard Contractual Clauses or relying on other lawful transfer mechanisms where required.

Clients operating in the European Economic Area, the United Kingdom, or other jurisdictions with cross-border transfer restrictions should consult their MSA for specific transfer safeguards applicable to their engagement.

8. Data Subject Rights

8.1 Rights Over Client Data

Data subjects whose personal data is stored within the BTS Platform as Client Data should direct all privacy rights requests (including access, rectification, erasure, restriction, portability, and objection) to the Client institution that controls their data. BuyTheSell will support Clients in fulfilling such requests as described in the MSA.

8.2 Rights Over Infrastructure Access Logs

To the limited extent that BuyTheSell controls infrastructure access logs containing personal data attributable to an Authorized User (e.g., their IP address), that individual may exercise the following rights by contacting BuyTheSell at infosec@buythesell.com:

• Right of access — to obtain confirmation of and a copy of personal data BuyTheSell holds about them.
• Right to rectification — to correct inaccurate personal data.
• Right to erasure — to request deletion, subject to BuyTheSell's legal obligations and legitimate interests in retaining security logs.
• Right to restriction of processing — to request that BuyTheSell restrict how it processes their data in certain circumstances.
• Right to object — to object to processing based on legitimate interests.
• Right to lodge a complaint — individuals in the EEA or UK may lodge a complaint with their local supervisory authority (e.g., the ICO in the UK or the relevant EU data protection authority).

BuyTheSell will respond to valid rights requests within the timeframe required by applicable law (typically 30 days, with the possibility of extension for complex requests). Where BuyTheSell cannot fulfill a request — for example, because deletion of security logs would conflict with a legal obligation — BuyTheSell will explain the reason in writing.

9. Data Security

BuyTheSell implements appropriate technical and organizational security measures to protect the personal data it controls against unauthorized access, disclosure, alteration, or destruction. These measures include, but are not limited to, encryption in transit and at rest, access controls, and security monitoring of the infrastructure hosting the Platform.

In the event of a personal data breach involving personal data controlled by BuyTheSell (i.e., infrastructure access logs), BuyTheSell will notify affected Clients and, where required by applicable law, the relevant supervisory authority, within the timeframes prescribed by law.

The Client is responsible for the security of Client Data within its Instance, including managing Authorized User access and credentials. The respective security responsibilities of BuyTheSell and each Client are set out in the MSA.

10. Data Retention

Client Data is retained within the Client's Instance in accordance with the Client's own policies and the data retention terms set out in the MSA. Upon expiration or termination of the MSA, BuyTheSell will make Client Data available for export and will securely delete it after the wind-down period specified in the MSA.

Infrastructure access logs controlled by BuyTheSell are retained for the period specified in the applicable MSA. In the absence of a specific MSA provision, logs are retained for the minimum period necessary for the security and operational purposes described in Section 4.

11. Privacy Contact

BuyTheSell has designated a privacy point of contact for questions, concerns, or requests relating to this Privacy Notice or BuyTheSell's data processing practices. Please direct all privacy-related inquiries to:

BuyTheSell Inc. — Privacy & Information Security
135 E 57th Street, 14th Floor, New York, NY 10022
Email: infosec@buythesell.com
Phone: +1 212-627-0132

If you are located in the European Union and have an unresolved privacy concern, you may also have the right to contact your local data protection supervisory authority.

12. Changes to This Privacy Notice

BuyTheSell may update this Privacy Notice from time to time to reflect changes in our practices or applicable law. We will notify Clients of material changes via the communication channels established in the MSA. The date at the top of this notice reflects when it was last updated.

13. Responsible Disclosure

We take security and data protection seriously at BuyTheSell. If you believe you've discovered a potential vulnerability, please let us know by emailing us at security@buythesell.com.