EEA/GDPR Privacy Notice

Effective Date: March 1, 2025

General Data Protection Regulation (GDPR)

SCALIBIT.COM (SCALIBIT, we, us) believes it is important that you understand how SCALIBIT collects, stores, shares and uses information from and about our Site visitors, subscribers, customers and vendors.

SCALIBIT supports the GDPR and all SCALIBIT services comply with its provisions.

GDPR (EU, UK, and Switzerland).

This EU/UK GDPR Privacy Notice (Notice), our Cookie Policy and other legal notices posted on this website www.scalibit.com (Site), describes our collection, use and disclosure of personal data.

• (i) collected through the Site, or

• (ii) when you subscribe to, or otherwise use our online services (Services), or

• (iii) in the course of our business activities conducted elsewhere, whenever we act as the controller of that data and when its processing is governed by EU General Data Protection Regulation or the UK General Data Protection Regulation (together, the "GDPR").

This Notice does not apply to the information collected, stored, shared, or distributed by third-party sites. This Notice may be updated from time to time.

For the purposes of applicable data protection law, SCALIBIT is the controller of any personal data collected from you on the Site, through the Services, or otherwise for the purpose of conducting or developing our business with customers and vendors. For the purposes of this Notice, personal data means any information relating to an identified or identifiable person.

SCALIBIT acts as a Data Controller only for customer account, billing, authentication, and communication-related information collected during registration and service use. We do not act as a Data Controller or a Data Processor for any data stored or transmitted on customer-managed or self-managed servers, including but not limited to Virtual Machines (VPS, VDS, Dedicated Cloud Servers), Cloud Services (Cloud Hosting, Cloud Servers, Cloud Backup), Cloud Compute (Standard Performance, High Performance, High Frequency), Optimized Cloud Compute (General Purpose, CPU Optimized, Memory Optimized, Storage Optimized), and Dedicated Servers or Bare Metal systems.

For managed environments (such as Shared Web Hosting: cPanel Hosting, CWPpro Hosting, WordPress Hosting) or technical support cases where SCALIBIT personnel may require limited access to customer data, SCALIBIT may act as a temporary Data Processor under the terms of our Data Processing Addendum (DPA).

For clarity, SCALIBIT does not access, review, or process any customer-stored data on unmanaged servers or instances. Customers are solely responsible for the data they upload, process, or store within their hosting environments. SCALIBIT’s role in these cases is limited to providing and maintaining the underlying infrastructure and network services.

1. Information We Collect Automatically

When you visit our Site, or use our Services, our server automatically collects certain browser or device generated information, including but not limited to:

• Your domain,

• Your IP address,

• Your date, time and duration of your visit,

• Your browser type,

• Your operating system,

• Your page visits,

• Information from third parties,

• Other information about your computer or device,

• Internet traffic.

In some cases this information constitutes personal data, We do not use this automatically collected information to try to identify you by name, and we do not associate it with the information you provide voluntarily, as detailed below.

2. Information You Provide

In order to access or use certain portions of the Site or Services, or enjoy the full functionality of the Site or Services, or otherwise in conducting business with us or seeking to conduct business with us, you may be prompted to provide certain personal data to us in the following ways:

• Persons who subscribe to our Services will be prompted to provide their name, their address, their e-mail, their phone number, and any other necessary billing information.

• Persons who complete registration forms to sign up for membership on our Site will be prompted to provide their e-mail address.

• Site visitors, and prospective and current suppliers and subscribers, may provide personal data when filling in forms (for example, a 'Contact us' form) on our Site or at a trade show or anywhere else we conduct business; by downloading documentation from our Site; by subscribing to newsletters or other communications; by corresponding with us by phone, e-mail or otherwise providing contact details. In these cases, typically, the personal data you give us may include name, business affiliation, business address, telephone number, and email address, and any personal details required to resolve any inquiries or complaints.

This personal data is required to enter into a contract with you (such as in anticipation of a supply agreement, or to learn about our Services) or to perform a contract with you (such as to provide Services), and failure to provide any information may result in our inability to provide requested Services or products.

3. Information From Other Sources

We may also obtain fraud & risk scoring data about you from third parties, namely MaxMind and Kount.

4. Cookies

Our Site uses cookies. More information about our use of cookies can be found in our cookie policy https://www.scalibit.com/legal/cookie-policy.

5. Use of Personal Data

The following is an overview of our purposes for using your personal data. Additional details on how we process your personal data may be provided to you in a separate notice or contract.

All processing and use of your personal data is justified by a "condition" for processing. In the majority of cases, processing will be justified on the basis that:

• The processing is necessary to perform a contract with you (such as if you subscribe to our Services) or take steps to enter into a contract at your request (such as to fill an order), or to provide product information you have requested,

• The processing is necessary for us to comply with a relevant legal obligation, such as keeping accounting records,

• The processing is in our legitimate interests, which are not overridden by your interests and fundamental rights. Our legitimate interests are to use subscriber, Site user, supplier and customer data to conduct and develop our business activities with them and with others while limiting the use of their personal data to purposes that support the conduct and development of our business; or

• You have consented to the processing,

We use the personal data we collect to:

• Provide you with Services you have subscribed for, or otherwise requested,

• Provide you with documentation or communications which you have requested,

• Administer and manage performance of purchase or sales agreements with our suppliers and customers,

• Provide after-sales support,

• Correspond with users to resolve their queries or complaints,

• Market our services to persons whose Services have expired or otherwise been cancelled,

• Engage you about events, promotions, the Site and SCALIBIT's products and services,

• Process, evaluate and complete certain transactions involving the Site, and more generally transactions involving SCALIBIT's products and services,

• Operate, evaluate, maintain, improve and develop the Site (including by monitoring and analysing trends, access to, and use of the Site for advertising and marketing),

• To increase your (and other users') experience according to tracked interests, to analyze and target potential new markets, and for other marketing purposes.

• Protect and ensure safety of the Site, SCALIBIT confidential and proprietary information, and SCALIBIT employees,

• Manage, protect against and investigate fraud, risk exposure, claims and other liabilities, including but not limited to violation of our contract terms or laws or regulations,

For security, anti-fraud, or regulatory compliance purposes, SCALIBIT may request identity verification (such as government-issued ID, passport, or business registration documents). This verification process is performed only through secure and official SCALIBIT communication channels (for example, your Client Portal or support ticket system).

We also use non-personal data and aggregate information, such as that collected automatically, to customize our marketing efforts or to customize the use of our site for an aggregate group of customers.

SCALIBIT will not sell or rent your personal data to third parties.

6. Disclosure of Personal Data to Third Parties

We may disclose personal data about Site visitors, users of our Services, or our suppliers or customers to our affiliates, service providers, and trusted third parties if justified by a legal basis (such as performance of a contract or legitimate interests), including for the following legitimate business purposes:

• To identify, contact, or bring legal action against someone who may be violating our Terms of Service, Acceptable Use Policy, or other user policies,

• To protect ourselves, our subscribers, and the general public, and to enforce our legal rights.

• Share your personal data with third parties in connection with potential or actual sale of our company or any of our assets, or those of any affiliated company, in which case personal data held by us about our users may be one of the transferred assets.

• In connection with certain essential purposes described in Section 5 (e.g., to manage, protect against and investigate fraud, risk exposure, claims and other liabilities).

• To third party vendors we use for online and email advertising campaigns, who may provide cookies, pixel tags, or similar technologies for use on the Site or other websites, subject to your consent where required by GDPR.

6.1 Disclosure to Authorities and Legal Requests

SCALIBIT may disclose Customer Data, Service Details, account information, or associated IP address data to competent authorities or legally authorized bodies — including but not limited to law enforcement agencies, prosecutor’s offices, courts, or data protection regulators — when such disclosure is required to comply with applicable EU, UK, or Swiss laws, regulations, or enforceable legal requests. All disclosures are handled strictly within the scope of Article 6(1)(c) and 6(1)(f) of the GDPR, upon receipt of an official and verifiable request, and are limited to the minimum data necessary to fulfill the specific legal obligation or legitimate purpose.

SCALIBIT carefully reviews each request to ensure that it is lawful, proportionate, and specific in scope, in line with the principles of data minimization and accountability (Articles 5 and 24 GDPR). Whenever permitted by law, SCALIBIT will make reasonable efforts to notify the affected Customer or Data Subject prior to disclosure, especially where the data or account may be directly impacted by such a request.

Detailed records of all such disclosures are maintained to ensure transparency, auditability, and compliance with applicable data protection obligations, as well as accountability under Article 5(2) of the GDPR.

7. International Transfer of Personal Data

SCALIBIT operates globally with servers, data centers, and trusted service partners located in multiple jurisdictions — including the United States, Europe, and Asia. As part of its operations, SCALIBIT may transfer personal data from the European Economic Area (EEA), the United Kingdom (UK), or Switzerland to countries outside these regions where data protection laws may not offer the same level of protection.

Such transfers are conducted only where necessary for legitimate business purposes, including the provision of Services, technical support, billing, infrastructure management, and compliance operations. SCALIBIT ensures that these transfers are carried out in compliance with the requirements of Articles 44–49 of the General Data Protection Regulation (GDPR) and equivalent provisions of the UK GDPR and the Swiss Federal Data Protection Act.

If you are in the UK or the European Economic Area ("EEA") (including the European Union ("EU")) and your personal data is transferred outside the UK or outside of the EEA (as applicable) to other SCALIBIT affiliates or to third-party service providers, SCALIBIT will take steps to ensure that your personal data receives the same level of protection as if it remained within the UK or EEA.

• If we transfer UK data to the EEA, this is covered by the UK's decision that EEA countries provide adequate protection for personal data.

• If we transfer EEA data to the UK, this is covered by the European Commission’s adequacy decision confirming that the UK provides adequate protection for personal data.

• If we transfer UK or EEA data to other countries (including the United States), not subject to an equivalent adequacy decision, we will take appropriate steps to protect your personal data to the same degree. This may include entering into data transfer agreements using valid Standard Contractual Clauses (“SCCs”) with our suppliers and business partners, and applying appropriate supplementary safeguards. We currently rely on SCCs for our transfers to the USA, including to our group companies.

Where applicable, SCALIBIT applies appropriate organizational and technical measures to ensure an adequate level of protection for personal data during such transfers — including the use of Standard Contractual Clauses (SCCs), technical and organizational security measures, and other lawful mechanisms approved by competent supervisory authorities. SCALIBIT also performs Transfer Impact Assessments (TIAs) to evaluate potential risks associated with each transfer.

SCALIBIT continuously monitors legal developments and updates its international transfer mechanisms as required to maintain compliance with evolving data protection frameworks across the EU, UK, and Switzerland.

You have a right to obtain details of the mechanism under which your personal data is transferred outside of the EEA or UK by contacting gdpr@scalibit.com.

SCALIBIT remains committed to transparency and ensures that all data subjects are informed about how and where their personal data may be processed, stored, or transferred as part of its global infrastructure operations.

SCALIBIT reserves the right to share any information that you provide which is not deemed personal data or is not otherwise subject to contractual restrictions.

8. Children

The Site is not for use by children under the age of 18 years and SCALIBIT does not knowingly collect, store, share or use the personal data of children under 18 years. If you are under the age of 18 years, please do not provide any personal data, even if prompted by the Site to do so. If you are under the age of 18 years and you have provided personal data, please ask your parent(s) or guardian(s) to notify SCALIBIT and SCALIBIT will delete all such personal data.

9. Marketing E-Mails

Where lawful to do so, and subject to your consent where required, we may communicate with you by e-mail to tell you about our products and services. If you wish to opt-out of receiving marketing communications, please use the 'unsubscribe' link provided in our emails.

If you are a subscriber to our Services, we may send you periodic announcements including the details of our existing and new programs. You may opt out of these announcements by filling out the form at https://www.scalibit.com/contact-us/. or by clicking the opt-out link at the bottom of these emails. If you opt out of these marketing emails, you may still receive system notices and other information that is specifically related to your subscription account.

10. Security

We take appropriate technical and organizational measures, including data encryption, to protect the transmission of all sensitive end-user information. We make reasonable efforts to ensure the integrity, confidentiality, and availability of our network and systems.

However, no method of transmission over the Internet or method of electronic storage is completely secure. While we take all reasonable steps to prevent unauthorized access, disclosure, alteration, or destruction of data, we cannot guarantee that our security measures will prevent all security breaches or illegal access by third parties.

You acknowledge and agree that you provide information to SCALIBIT at your own risk to the extent that such breaches may occur despite our reasonable security measures.

11. Retention of Your Personal Data

We apply a general rule of keeping personal data only for as long as required to fulfil the purposes for which it was collected. In general, we retain your personal data for a period of time corresponding to a statute of limitation, for example to maintain an accurate record of your dealings with us. However, in some circumstances we may retain personal data for other periods of time, for instance where we are required to do so in accordance with legal, tax and accounting requirements, or if required to do so by a legal process, legal authority, or other governmental entity having authority to make the request, for so long as required.

With respect to marketing, we retain your personal data for 18 months after your last request for service or other contact you initiate.

12. External Links

The Site may contain links to third party sites. Since SCALIBIT does not control nor is responsible for the privacy practices of those Sites, we encourage you to review the privacy policies of these third party sites. This Notice applies solely to personal data collected by our Sites or in the course of our business activities.

13. Your Rights

• Right to withdraw consent - where applicable, you have the right to withdraw your consent at any time. For example, if you wish to opt-out of receiving electronic marketing communications, you can change your settings in your account on the Site, use the 'unsubscribe' link provided in our emails or otherwise contact us directly and we will stop sending you communications.

• Right of access, rectification and erasure - you have the right to request access to and obtain a copy of any of your personal data that we may hold, to request correction of any inaccurate data relating to you and to request the deletion of your personal data under certain circumstances. You can see and update most of this data yourself online, or by contacting us directly at https://www.scalibit.com/contact-us/

• Data portability - where we are relying (as the legal basis for processing) upon your consent, or the fact that the processing is necessary to perform a contract to which you are party or to take steps at your request prior to entering a contract, and the personal data is processed by automatic means, you have the right to receive all such personal data which you have provided us in a structured, commonly used and machine-readable format, and also to require us to transmit it to another controller where this is technically feasible.

• Right to restriction of processing - you have the right to restrict our processing of your personal data (that is, allow only its storage) where:

• - You contest the accuracy of the personal data, until we have taken sufficient steps to correct or verify its accuracy;

• - Where the processing is unlawful but you do not want us to erase the personal data;

• - Where we no longer need your personal data for the purposes of the processing, but you require such personal data for the establishment, exercise or defence of legal claims; or

• - Where you have objected to processing justified on legitimate interest grounds (see below), pending verification as to whether we have compelling legitimate grounds to continue processing.

• Where your personal data is subject to restriction we will only process it with your consent or for the establishment, exercise or defence of legal claims.

• You also have the right to lodge a complaint with the supervisory authority of your habitual residence, place of work or place of alleged infringement, if you consider that the processing of your personal data infringes applicable law.

• Right to object to processing (including profiling) based on legitimate interest grounds - where we are relying upon legitimate interests to process personal data, you have the right to object to that processing. If you object, we must stop that processing unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights and freedoms, or we need to process the personal data for the establishment, exercise or defence of legal claims. Where we rely upon legitimate interest as a basis for processing we believe that we can demonstrate such compelling legitimate grounds, but we will consider each case on an individual basis.

• Right to object to direct marketing (including profiling) - you have the right to object to our use of your personal data (including profiling) for direct marketing purposes, such as when we use your personal data to invite you to our promotional events.

In certain cases, SCALIBIT may request identity verification or supporting documentation (such as a government-issued ID, passport, business registration certificate, tax identification, or other relevant proof) to confirm account ownership, prevent fraud or abuse, ensure compliance with applicable laws (including but not limited to anti-abuse, anti-fraud, anti-money-laundering, and security verification requirements), or verify the legitimacy of a transaction or service request.

This verification is conducted solely through secure and official SCALIBIT channels — such as your Client Portal or authorized support ticket system — and only by SCALIBIT personnel authorized to handle such information. All submitted information is processed exclusively for verification purposes, stored with strict security controls, and may be retained as required by applicable EU, UK, or Swiss data protection laws or for legitimate business purposes, including cooperation with competent supervisory authorities or law enforcement when necessary.

Such information will never be used for profiling, marketing, or any unrelated processing activities, and access to it is strictly limited according to the principles of data minimization and confidentiality under Article 5 of the GDPR.

Please contact us as indicated in Contact Information https://www.scalibit.com/contact-us/ if you wish to exercise any of your rights, or if you have any inquiries or complaints regarding the processing of your personal data.

14. Changes to this Notice

We reserve the right to modify this Notice at any time. If we decide to change our Notice, we will post the updates in the Site and in any other place we deem appropriate, so that you are aware of what personal data we collect, how we process it, and under what circumstances, if any, we disclose it.

If we make material changes to this Notice, we will notify you here, by email, or by means of a notice via our Site, at least ten (10) calendar days before the changes take effect, unless otherwise specified in the respective notification.

15. Contact Information

If you have additional questions regarding your rights under the GDPR, please refer to the SCALIBIT Privacy Notice and contact us at gdpr@scalibit.com.