Privacy Notice

Effective Date: 03/24/2026

Cart Government Solutions LLC is committed to the responsible collection, use and care of the personal data of its customers and website users. This Global Privacy Notice for customers and website users (“Privacy Notice”) provides information on our practices for collecting, using, maintaining, and disclosing information we may collect from you or that you may provide when you use or access our services, including websites, products, mobile applications, or other sites that display this Privacy Notice or otherwise engage with us (the “Services”).

If you are in a jurisdiction that recognizes the concept of a data controller, the data controller is Cart Government Solutions LLC . If you have a query about how your personal data is being used, you can contact the data controller at people@cart.com

Please read this Privacy Notice carefully. If any term in this Privacy Notice is unacceptable to you, please do not use our Services or provide us with any personal data.

This Privacy Notice does not apply to any products, services, websites, mobile applications, or content (including advertising) offered by third parties or that may be linked to or from the Services. Data collected by these third parties is covered by their own privacy policies.

1. Information Collection Practices

Personal Data You Disclose to Us

Depending on your relationship with us, we may collect, process, disclose, and maintain your personal data in a number of ways including, but not limited to: when you access or use our Services, such as by visiting our websites, and branded pages and applications; register an account with us and/or purchase products our products; communicate with us including through messaging platforms such as text message, live chat, social media, and email or otherwise provide us with information including via direct marketing campaigns, sweepstakes and competitions; or submit a review regarding our Services.

The categories of personal data we collect may include:

• Basic identifiers and personal details. We may collect certain contact and identifying information, including name, postal and email address, telephone number, business contact information, gender, date of birth, country/state of residence, account credentials including username and password and profile information, your consultant/representative ID number[3.1], and similar identifiers. Where you log in to your account with us using your third-party social media account details, or otherwise interact with us via social media, we may also receive certain profile information about you from your social media provider, such as your profile picture, likes, location, and product preferences. We will use the information we receive only for the purposes that are described in this Privacy Notice or that are otherwise made clear to you on the relevant Services. Please note that we do not control, and are not responsible for, other uses of your personal data by your third-party social media provider. We recommend that you review their privacy notice to understand how they collect, use, and share your personal data, and how you can set your privacy preferences on their sites and apps.
• Commercial information. We may obtain information on the products and services that you have shown an interest in or purchased, including product preferences, purchase details (products, color, size, quantity, price), methods of payment and/or any communications we have received about your order or purchase, as well as any fraud checks or flags raised about your transactions, payment card refusals, suspected crimes, complaints and/or claims.
• Internet or other similar network activity. When you access or use the Services, we may collect certain information about your device and network activity, including, for example, IP address, browsing history, search history, and information regarding your interactions with a website, application, or advertisement. For more information, see “Information Automatically Collected” below.
• Communication data. We may record our communications with you, including phone calls and texts, email, social media, and chat communications, as well as interactions in-person at our stores. We may also collect your communication contact preferences.
• Views and opinions. We may collect any feedback, survey responses, and other information included within your interactions with us or otherwise provided via the Services.
• Geolocation data. We may request access or permission to track location-based information from your device, either continuously or while you are using our Services. How much information we collect depends on the type and settings of the device you use to access the Services. If you wish to change our access or permissions, you may do so in your device’s settings. However, if you choose to opt out of sharing your location with us, you may not be able to use certain aspects of the Services.
• Inferences drawn from other personal data. Depending on how you interact with us, we may collect and develop certain inferences about you, including your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. We receive these inferences indirectly from you (e.g., from observing your actions on our Services) or from third parties, such as a data analytics provider.
• Sensitive personal data. We limit the circumstances where we collect and process information that may be considered sensitive under applicable law. In some instances, you may have requested services or products that do not directly involve the collection of any sensitive or special categories of data, but may imply or suggest your religion, health or other special categories of data, such as skin concerns and adverse events from you which may include information on your health and or ethnicity. We may also collect information regarding your precise geolocation and/or your racial or ethnic origin. We will only collect, process, disclose, and store such data in accordance with this Privacy Notice and applicable law.

Information Automatically Collected

Similar to many companies, when you interact with our Services, including websites and applications, we may use automatic data collection technologies to collect and log certain information about your equipment, browsing actions and patterns, and network activity. Such information may include: your unique device identifier, device model and manufacturer, domain name, browser type and version, browsing history, search history, information about your visit to our website or application (including products viewed, purchased or search for), details of any website which has referred you to our website, application, or advertisement, location and time zone setting, browser plug-types and versions, operating system and platform, page responses times and errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, keystrokes typed, and mouseovers), the amount of time you spend viewing or using the our website or application and the pages visited, the number of times you return, or other click-stream or site usage data and mouseovers) and methods used to browse away from the page. If you are using our mobile application, we may also collect location-based information from your mobile device.

Cookies and Other Automated Technology

The technologies we use for automatic data collection include browser cookies, flash cookies, web beacons, pixels, and software development tools (collectively, “Cookies”). Cookies are small text files that are stored by your web browser when you visit a website. We may store Cookies on your device when you use our Services. These technologies help us speed up your future activities and improve your experience by remembering the information that you have already provided to us. Third parties operating on our behalf may also use these technologies to provide us with information regarding your use of our Services, as well as to help us manage and display advertisements, tailor advertisements to your interests, or send abandoned shopping cart reminders (depending on your communication preferences). You may block or delete these technologies from your device. However, by disabling such technologies, you may not have access to the entire set of features of our Services. For more information about these technologies, including links to web browser instructions for disabling and managing such technologies, visit https://optout.networkadvertising.org/.

Specific information about how we use such technologies and how you can manage our use of certain Cookies is set out in our Cookie Notice

Please note that where the placement of Cookies involves the processing of personal data, the legal basis for processing personal data in connection with strictly necessary Cookies is our legitimate interest in the functioning of our Services. For the processing of personal data in connection with other Cookies, including performance Cookies and targeting Cookies, we obtain your consent where required by applicable law. You can revoke your consent at any time by visiting our cookie management tool available on our Services and changing your preferences.

Google Analytics

We may share your information with Google Analytics to track and analyze the use of the Services. Access by U.S. authorities to the data stored by Google cannot be ruled out. To opt out of being tracked by Google Analytics across the Services, visit https://tools.google.com/dlpage/gaoptout. You may also manage our use of analytics cookies by visiting our cookie management tool here. For more information on the privacy practices of Google, please visit the Google Privacy & Terms page.

Information Collected From Other Sources

We may receive your personal data from other sources, including our business and promotional partners such as in connection with our loyalty or rewards program, social media platforms, or individuals who purchase goods or services to be delivered to you (such as gifts or gift cards). We also may obtain information you have made publicly available, including from websites and online services you use, consumer research platforms, and/or business contact databases.

2. How We Use Your Information

We process your personal data for a variety of reasons, depending on how you interact with our Services, including for legitimate business and commercial purposes and in accordance with the legal bases further described in Section 3. In particular, we may use your personal data:

• To provide the Services, including to provide you with any products or services you purchase from us;
• To facilitate account creation and authentication and otherwise manage your accounts with us;
• To fulfill and manage your orders, payments, returns, and exchanges made through the Services, including administrative management of your contract with us, delivery of goods, and payment processing, as well as to arrange for shipping, handling of returns, refunds, and warranties, and maintaining a record of the purchases you make;
• To assist with the registration and provision of any contests or promotions, including to enable you to participate in any campaigns, petitions and similar activities (including our loyalty programs);
• To respond to inquiries, provide customer support, and communicate with you, including to provide service communications related to your account or transactions with us, or otherwise to provide you with information you have requested;
• To notify you of changes to our products or services, or changes to regulatory requirements that may affect our products or services or your use of them;
• To send you marketing and promotional communications and provide you with personalized content, information, brochures, coupons, samples, and offers that may be of interest to you, including copies of our newsletter and information about our products, store launches, partnerships and in-store events;
• To perform our duties in the context of our commercial or business relationship with you;
• To improve and manage our Services and your user experience, including by researching and evaluating our Services, products, and marketing, and understanding your use of our Services including through session replay;
• To comply with our legal obligations, respond to legal requests, and exercise, establish, or defend our legal rights;
• To maintain the safety, security, and integrity of our Services, products and services, databases, other technology assets, and business;
• For any other purpose with your consent.

3. Legal Basis

We process your personal data on the following legal basis:

• If it is necessary for pursuit of, or to safeguard, the legitimate interests of Cart Government Solutions LLC, provided that these interests are not overridden by your interests or fundamental rights and freedoms.
• If it is necessary to fulfill our contractual obligations. The extent and purpose of our use of your personal data depends on the contract that we have concluded with you.
• If it is required to comply with our legal obligations. These obligations may arise from applicable provisions of national or regional (European) laws or regulations, including regarding commerce, trade, and tax.
• If you consent to our use of your personal data. If you have given us your prior consent, we will use your personal data in a manner consistent with the scope of that consent.

4. How We Disclose and Share Your Information

We may disclose your personal data as follows and as otherwise described in this Privacy Notice:

• Service Providers and Vendors. We may disclose your personal data to our service providers and vendors that perform services for us, including customer care center operators, providers of technical services, email and chat service providers, payment processors, loyalty or rewards program providers, fraud prevention vendors, analytics providers, advertising partners, and other service providers.
• Affiliates and Subsidiaries. We may share your information with our affiliates, including our parent company and any subsidiaries, joint venture partners, or other companies that we control or that are under common control with us.
• Business Partners. We may share your information with our business partners to offer you certain products, services, or promotions.
• Legal Purposes. We may disclose your information to third parties, including authorized government agencies, where required by law, court order, or subpoena if we believe disclosure is in accordance with, or required by, applicable law or legal process or where necessary to prevent, detect, or prosecute criminal offenses, or to protect the rights, property, and safety of Cart Government Solutions LLC or others.
• Business Transfers or Reorganization. We may share or transfer your personal data in the course of any direct or indirect reorganization process including, but not limited to, mergers, acquisitions, divestitures, bankruptcies, and sales of all or part of our business to another company.
• Professional Advisors. We may disclose your information to accountants, auditors, lawyers, and other outside professional advisors, subject to appropriate contractual obligations of confidentiality.
• Your Consent. We may disclose your information to third parties with your consent or at your direction.

We may also process and disclose information to third parties if the information has been de-identified or aggregated in a way so it cannot be used to identify you.

5. How Long We Store Your Information

We store your personal data processed for the purposes stated in this Privacy Notice and for the duration of our business relationship with you. Once our business relationship with you has ended and your data is no longer required for these purposes, we will delete your data, unless your data is required also for other purposes set out in this Privacy Notice, and/or is necessary to fulfil applicable legal or regulatory obligations. When determining the retention period, we take into account criteria, such as the type of services requested by or provided to you, the nature and length of our relationship with you, use of our Services, and the impact on the functionality of the Services if we delete your personal data.

6. International Data Transfers

We may also transfer your personal data from your country or jurisdiction to other countries or jurisdictions in accordance with this Privacy Notice and applicable law.

• For international data transfers subject to EEA, UK and Swiss law: We primarily use European Union and/or Swiss Commission Standard Contractual Clauses, and, where necessary, the UK Addendum or the UK International Data Transfer Agreement. Where applicable, we may also rely on the self-certification of service providers or vendors under the EU-U.S. and/or Swiss-U.S. Data Privacy Framework and its UK Extension.
• For international transfers between other jurisdictions: We may rely on other legal mechanisms for international transfers, as appropriate under applicable law.

7. How We Protect Your Information

We implement appropriate and reasonable technical, physical, and organizational measures designed to protect the security of any personal data we process and comply with applicable law. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. Although we will do our best to protect your personal data, transmission of personal data to and from our Services is at your own risk. You should only access the Services within a secure environment.

8. Children

Our Services are designed and intended for adults. However, due to the nature of our Services, we may collect certain information about children under the age of majority in their state or country of residence. In such cases, our collection and processing of information about children will be based on consent from a parent or guardian in accordance with the applicable law. If you learn that a child has, in violation of this Privacy Notice, registered for email newsletters, or otherwise provided their personal data, please report it to us using the contact information provided in Section 13. If we become aware that a child has provided personal data without parental or guardian permission, we will terminate that account and delete all personal data provided by that individual to the extent feasible and as soon as practicable. Depending on the country you are based, we may use your personal data to carry out age verification checks and enforce any such age restrictions.

9. Your Rights

Promotional Emails. You can unsubscribe from our marketing and promotional communications emails at any time by clicking on the unsubscribe link in the marketing and promotional emails that we send [or by logging into your account and managing your contact preferences].[14.1] Please note that if you opt out of marketing communications, we may still contact you with non-promotional communications, such as those about ongoing business relations or administrative messages (e.g., updates on online orders).

Promotional SMS/Text Messages. You can unsubscribe from our marketing and promotional SMS messages by texting “STOP” or similar revocation language as permitted under applicable law to the short code or phone number from which the promotional SMS messages are sent. After you send the SMS opt-out message to us, we will send you an SMS message to confirm that you have been unsubscribed from our promotional SMS messages.

Push Notifications/Alerts. If you have permitted one of our mobile applications to send you push notifications or alerts, you can deactivate these messages at any time in the notification settings on your mobile device.

10. Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online.

11. Third-Party Links/Sites

Our Services may contain content, services, advertising, and materials that link to external websites. We do not endorse and are not responsible for the content of any such external website. Please refer to the terms and conditions and privacy policies of the external website for more information.

12. Changes to This Privacy Notice

We may update this Privacy Notice periodically and will revise the date at the top of the Privacy Notice to reflect the date when such update occurred. Continued use of the Services after such change constitutes acceptance of the new Privacy Notice. We encourage you to periodically review this page for the latest information on our privacy practices.

13. How to Contact Us

If you have any questions or comments about this Privacy Notice or our data collection and processing practices more generally, you may contact us at:
people@cart.com

14. Notice of Financial Incentives

We may offer you various incentives, including special offers, discounts, rewards, and coupons pursuant to certain rewards and loyalty programs (each, a “Rewards Program”), throughout the year for providing us with your personal information. Categories of personal information that may be collected pursuant to a Rewards Program, include, but are not limited to, [identifiers (e.g., name, date of birth, phone number, Rewards Program account information, and a valid email address), financial information (e.g., credit card number or other payment information), commercial information (e.g., payment receipts), internet or other electronic network activity information (e.g., browsing history or search history on the Services), and geolocation data.]

We may disclose the personal information collected pursuant to the Rewards Program to the categories of third parties listed in Section 4 “How We Disclose and Share Your Information” including Rewards Program partners such [insert]. We do not disclose personal information collected in connection with a Rewards Program to data brokers. We may also sell and/or process and share this information (as those terms are defined by applicable law) with third parties for targeted advertising purposes.

We do not assign a monetary value to the data we collect, but based on a good-faith estimate, we believe the value received from your personal information is reasonably equal to the value of the benefit we offer you pursuant to a Rewards Program. This estimate is not specific to any specific individual who participates in a Rewards Program (a “Member”) and may vary by Member. We have calculated such value by taking into consideration, without limitation, relevant factors related to the estimated value of such information to us, as set forth under California Law (and defined below).

If eligible, you may opt in to a Rewards Program by following the instructions set forth in a Rewards Program’s terms and conditions and, if applicable, by creating a member account on the Rewards Program’s website. Material terms of participating in a Rewards Program, including all terms and conditions concerning the collection, use, and retention of a Member’s personal information, are set forth in the applicable terms and conditions, this Privacy Notice, and/or our Terms and Conditions and should be carefully reviewed prior to participation in a Rewards Program.

You have the right to cancel your membership and participation in a Rewards Program at any time. To opt out of a Rewards Program, including the receipt of marketing emails provided pursuant to your status as a Member of a Rewards Program, please follow the instructions set forth in the Rewards Program’s applicable terms and conditions or contact us via the methods described in Section 13 “How to Contact Us.” Please note, exercising your right to delete personal information pursuant to applicable law (and as described in this Privacy Notice), may impact our ability to provide you with some or all aspects of a Rewards Program because we will no longer be able to associate you with any points, rewards, or other events, promotions, or offers provided via the Rewards Program.

15. Additional Information for Residents of California

The California Consumer Privacy Act, as amended by the California Privacy Rights Act (Civil Code Section 1798.100, et seq.) (“California Law”), provides eligible California residents with specific rights with respect to our collection, retention, disclosure, selling, sharing, and use of personal data, also known as personal information. This section on Additional Information for Residents of California supplements this Privacy Notice and applies solely to eligible residents of the State of California. Any terms used but not defined in this section have the same meaning as defined in California Law.

Collection and Use of Personal Information

In the preceding twelve (12) months, we may have collected the categories of personal information from the sources discussed in Section 1 “Information Collection Practices.” The business or commercial purpose for collecting that information is disclosed in Section 2 “How We Use Your Information.”

Disclosure of Personal Information

In the preceding twelve (12) months, we may have disclosed your personal information for a business or commercial purpose described in Section 2 “How We Use Your Information” to the third parties described in Section 4 “How We Disclose and Share Your Information.”

[Please note that we only use and disclose sensitive personal information as permitted under California Law and without the purpose of inferring characteristics about a consumer.]

Sales and Shares of Personal Information

Category	Business or Commercial Purpose	Categories of Third Parties to Whom Personal Information was Disclosed That May be Considered a “Sale”/“Sharing”[19.1] Under California Law
Identifiers.	To provide you with personal advertising and content	Advertisers and advertising networks
Internet or other similar network activity.	To provide you with personal advertising and content	Advertisers and advertising networks

We do not knowingly sell or share the personal information of consumers under 16 years of age.

Your Rights Under California Law

California Law provides eligible residents with specific rights regarding their personal information. The following section describes your California Law rights and explains how to exercise those rights. Your California Law rights include the:

• Right to Know or Access: Request that we disclose to you what personal information we have collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom the business discloses personal information, and the specific pieces of personal information we have collected about you.
• Right to Delete: Request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions.
• Right to Correct Inaccurate Personal Information: Request that we correct any of your personal information that we maintain about you that is inaccurate.
• Right to Opt Out of Sales or Sharing of Personal Information: We do not sell your personal information for monetary profit. However, we may engage in certain information disclosure activities that may be considered “sales” or “sharing” under California Law. If we sell your personal information to or share such information with third parties, you may have the right to opt out of the sale or sharing of such information. [To exercise the right to opt out, you (or your authorized representative) may submit a request to us by visiting the Do Not Sell or Share My Personal Information link on the homepage.
  If you have an opt-out preference signal enabled (e.g., the Global Privacy Control), you will automatically be opted out of the sale or sharing of your information, but we may ask you to confirm your preference if you have previously consented to the sale or sharing of your Personal Information. To download and use a browser supporting the opt-out preference signal, please visit https://globalprivacycontrol.org/orgs. If you choose to use the opt-out preference signal, you will need to enable it for each supported browser or browser extension you use.]
• [Right to Limit the Use and Disclosure of Sensitive Personal Information: Limit how we use and disclose your Sensitive Personal Information. To exercise the right to limit, you (or your authorized representative) may submit a request to us by visiting the Limit the Use and Disclosure of My Sensitive Personal Information[23.1] link on the homepage.]
• Right to Non-Discrimination: We will not discriminate against you for choosing to exercise any of your rights. If you exercise certain rights, understand that you may be unable to use or access certain features of the Services.

How to Exercise Your Rights

To exercise these rights, you can contact us by:

• Submitting a request through our interactive webform
• Contacting us at people@cart.com

Request Verification

We may require you to prove your identity to exercise certain rights. Depending on your request, we may ask for information such as your name, telephone number, email address, and/or date of last communication with us. We may also ask you to provide a signed declaration confirming your identity. We will only use personal information provided in your consumer request to verify your identity or authority to make the request. Only you, your parent, guardian (if you are under 13 years or age), conservator, a person to whom you have given power of attorney, or an authorized agent may make a verifiable consumer request related to your personal information. You may, however, make a verifiable consumer request on behalf of your minor child if necessary. Your verifiable consumer request must provide sufficient information that allows us to reasonably verify that you are the person about whom we collected personal information or an authorized representative. We cannot respond to your request if we cannot verify your identity or authority to make the request. You may only make a verifiable consumer request for your right to access twice within a 12-month period.

California “Shine The Light” Law

California Civil Code Section 1798.83, also known as the “Shine The Light” law, permits our users who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us by using the contact details provided in Section 13 “How to Contact Us.”

16. Additional Information for Residents Other U.S. State Privacy Rights

Eligible residents of states in which there is a comprehensive privacy law in effect, including Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia[26.1], also have rights with respect to the personal data that we collect about them. This section supplements this Privacy Notice and applies solely to eligible residents of U.S. states with applicable comprehensive privacy laws in effect to the extent Cart Government Solutions LLC is subject to those laws. Any terms not defined in this section have the same meaning as defined under applicable law. Subject to certain exceptions, if you are an eligible resident of one of these states with laws that apply to Cart Government Solutions LLC, you have certain privacy rights which may include, depending on your state of residency:

• Right to Know/Access: You have the right to confirm whether we process your personal data and access such personal data. You also have the right to obtain your personal data in a portable, and to the extent reasonably feasible, readily usable format that you can transmit without hinderance. In addition, Delaware and Maryland residents have the right to obtain a list of the categories of third parties to which we have disclosed their personal data, and Minnesota and Oregon residents have the right to receive a list of specific third parties to which we have disclosed any personal data.
• Right to Delete: You have the right to request that we delete the personal data you have provided to us or that we have otherwise obtained about you.
• Right to Correct: You have the right to request that we correct inaccuracies in your personal information, taking into account the nature of the personal data and the purposes of the processing of your personal data.
• Right to Opt Out: You have the right to opt out of the processing of your personal data for the purposes of (i) targeted advertising, (ii) the sale of your personal data, and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects. Please note that we do not engage in such profiling as defined under applicable law, but we may sell or use your personal data for targeted advertising purposes as described in Section 2 “How We Use Your Information.”
• Right to Appeal: You have the right to appeal our decision with regard to your request to exercise any rights described herein.

The exact scope of these rights may vary by state. You do not need to create an account with us to exercise your state privacy law rights. To exercise the rights described in this Section, including your opt-out rights, please submit a consumer request to us by: To exercise these rights, you can contact us by:

• Submitting a request through our interactive webform
• Contacting us at people@cart.com

17. Additional Information for EEA/UK Residents

If you are a resident of the EEA/UK (or if the GDPR or the UK GDPR are otherwise applicable to you), this Section describes our practices and your rights under the GDPR und the UK GDPR, whereby references to the GDPR in this section include the UK GDPR. This Section provides rights and other terms relating to your personal data that are in addition to those provided in this Privacy Notice. These additional rights and other terms are only available to EEA/UK residents (or individuals to whom the GDPR is otherwise applicable) whose personal data we are processing.

Overview of the Processing of Your Personal Data

The following table summarizes our processing of your personal data as described in as further described in this Privacy Notice.

Processing Purpose(s)	Data Categories	Legal Basis
To provide the Services	Basic identifiers and personal details, financial information, commercial information, internet or other similar network activity, communication data, views and opinions, geolocation data, inferences drawn from other personal data, sensitive personal data	Performance of a contract or consent (if required under applicable law)
To facilitate account creation, authentication, and administration	Basic identifiers and personal details, financial information, commercial information, internet or other similar network activity	Performance of a contract
To fulfill and manage your orders, payments, returns, and exchanges made through the Services	Basic identifiers and personal details, financial information, commercial information	Performance of a contract
To assist with the registration and provision of any contests or promotions	Basic identifiers and personal details, financial information, commercial information	Performance of a contract
To respond to inquiries, provide customer support, and communicate with you	Basic identifiers and personal details, communication data, views and opinions	Performance of a contract
To notify you of changes to our products or services, or changes to regulatory requirements that may affect our products or services	Basic identifiers and personal details	Performance of a contract
To send you marketing and promotional communications	Basic identifiers and personal details	Consent
To perform our duties in the context of our commercial or business relationship with you	Basic identifiers and personal details, commercial information	Performance of a contract
To improve and manage our Services and your user experience	Basic identifiers and personal details, commercial information, internet or other similar network activity, communication data, views and opinions, geolocation data, inferences drawn from other personal data	Consent or legitimate interest in improving our Services
To comply with our legal obligations, respond to legal requests, and exercise, establish or defend our legal rights	Basic identifiers and personal details, financial information, commercial information, internet or other similar network activity, communication data, views and opinions, geolocation data, inferences drawn from other personal data, sensitive personal data	Comply with our legal obligations
To maintain the safety, security, and integrity of our Services	Basic identifiers and personal details, internet or other similar network activity	Consent or legitimate interest in maintaining our Services
Strictly necessary cookies	Internet or other similar network activity	Legitimate interest in providing our Services as requested by you
Non-strictly necessary cookies	Basic identifiers and personal details, internet or other similar network activity	Consent
For any other purpose with your consent	Basic identifiers and personal details, financial information, commercial information, internet or other similar network activity, communication data, views and opinions, geolocation data, inferences drawn from other personal data, sensitive personal data	Consent

Your EEA/UK Resident Specific Rights

If you are a resident of the EEA/UK (or if the GDPR or the UK GDPR are otherwise applicable to you), subject to certain exceptions, you have certain rights regarding the personal data we hold about you.

• Right to Object: You have the right to object to certain types of processing of your personal data, including processing for direct marketing purposes. You may also have the right to object where you data is being processed for purposes of our legitimate interests.
• Right to Access: You have the right to access your personal data and to request a copy of the personal data undergoing processing.
• Right to Data Portability: You have the right to obtain from us, under certain circumstances, your personal data in a structured, commonly used and machine-readable format and to transfer this personal data to another controller or, if technically feasible, to have it transferred by us.
• Right to Restrict: You have the right, under certain circumstances, to block or restrict our processing of your personal data.
• Right to Rectification: If your personal data is inaccurate or incomplete, you have the right to request rectification or completion of your personal data. Where exercising this right, please let us know if, and to what extent, your data stored by us has changed, so that we can rectify or update it accordingly.
• Right to Erasure/Deletion: You have the right, under certain circumstances, to request the erasure of your personal data from our systems.
• Right to Withdraw Consent: If our processing of your personal data is based on your consent, you have the right to withdraw that consent at any time with effect for the future. Your withdrawal of consent will not, however, affect the lawfulness of the previous processing of your data based on such consent.
• Right Not to Be Subject to Automated Decision-Making: You have the right not to be subject to a decision based solely on automated processing which produces legal effects concerning you or significantly affects you in a similar way.

If you would like to exercise or discuss any of these rights, please contact us as set forth in Section 13 “How to Contact Us” above.

If you are unsatisfied with our handling of personal data, you also have the right to lodge a complaint with the competent data protection authority. A list of the relevant data protection authorities can be found here.

18. Additional Information for Residents of Other Jurisdictions

To the extent you are located in a non-U.S. jurisdiction with laws that are applicable to Cart Government Solutions LLC, including Mexico and Canada, this Section shall apply to you.

As provided in this Privacy Notice, Cart Government Solutions LLC may share your personal data with third parties to provide the Services or as otherwise described herein. Please note that some of these third parties may be located outside of your country of residence or location and therefore, your personal information may be transferred abroad. For further information regarding our data processing and disclosure practices, please see “How We Use Your Information” and “How We Disclose and Share Your Information” above.

Depending on your location or country of residence, and subject to certain exceptions and limitations, you have may certain rights regarding the processing of your personal data under applicable law, including the right to:

• (i) access your personal data in our possession and know the details of its processing;
• (ii) rectify your personal data if it is inaccurate, incomplete, or has not been updated in accordance with applicable law;
• (iii) cancel or delete the personal data maintained about you;
• (iv) withdraw your consent when our processing of your data is based on such consent; or
• (v) oppose or restrict the processing of your personal data for specific purposes.

While we encourage you to get in contact with us first to try and resolve your concerns, you may also have the right to file a complaint regarding our data protection practices with a supervisory authority/privacy regulator in your country/province of residence.

To exercise any of the above-mentioned rights, please contact our Data Protection Officer using the contact information provided in “How to Contact Us” above. Please note, in order to comply with applicable law, prior to fulfilling your request, we may require you to provide additional information and documentation including information necessary to verify your identity.