PAPER MAGAZINE PRIVACY NOTICE

1. Introduction

ENTtech Media Group, LLC, owner of Paper Magazine and www.papermag.com, and our subsidiaries or affiliates, ("we, us") value your privacy and respect for all laws and regulations that apply to our processing of personal data or personal information about you that we may receive or collect.

This Privacy Policy sets out what information we collect, how we use it, and how we share it, in connection with the services that we provide including our website and publications ("Services"). By using our Services, you accept our use of information as described in this Policy.

This Privacy Policy only applies to our own practices – other companies or individuals, even if they are linked to or advertised on our Services, may have differing practices and policies and you should check these before interacting with them or providing personal information to them.

2. What information do we collect?

In providing our Services we may process the information that identifies you directly or information relating to devices that you use, including:

• Information you voluntarily provide, which may include your name, email address, address, phone number and/or payment details;
• Technical data that our systems collect relating to your device when you use our Services, such as: device or system information e.g., type of phone, operating System (OS), and IP address, Mobile Device Identifier, e.g., UDID, Android ID;
• Information obtained from social networks, mobile platforms, and our affiliates, vendors, advertisers, or other providers of data.

Information that you provide to us may include personal information about other people: e.g. if you participate in a promotion or contest, or submit news stories, or nominations. If you do so, you represent that you have the necessary legal rights to provide such information to us.

The following table summarizes how we collect, use and share personal information, and describes our practices during the past 12 months. The legal bases for processing relate to you only where you are located in the EU Area (i.e. the European Union, the European Economic Area, the UK, or Switzerland):

In general we may share information with third parties:

• To protect the rights or property of our users, our, its affiliates, our advertisers, or our vendors and service providers;
• To implement or enforce our company policies, our Terms and Conditions of Use, our Copyright Complaint Procedures, or agreements that we may enter into with you;
• To respond to subpoenas, legal process or government or law enforcement requests, or investigations;
• To act in response to an emergency or situation that threatens the life, health, or security of an individual;
• To assist in the investigation of a violation (or presumed violation) of law, or if we believe in good faith that the law requires or authorizes such disclosure; or
• In connection with any proposed or actual sale, lease, merger, assignment, re-organization, or financing of all or any portion of our business.

Like most online service providers, we use cookies, web beacons, and similar technologies to collect information automatically, deliver Services, tailor your experience, monitor how our Services are used, and improve their performance, to measure, analyze and report on website traffic.

Our services are partially funded by advertising and so, additionally, we, our advertisers, third-party advertising providers, and other third-parties may place cookies, web beacons, and other similar technologies on your device to personalize your experience, collect information about your preferences, collect location information, and/or deliver customized advertising content and measure its effectiveness.

A "cookie" is a small text file stored on your device that helps us recognize repeat visitors and other information mentioned in this section. You can read more information about cookies here: https://www.allaboutcookies.org/

Web beacons are also known as "web bugs," pixel tags, or clear GIFs. These are small, transparent graphic images that are placed on a web page or in an email and used to monitor the activity of the user accessing that web page or email.

You may configure your web browser to reject some or all cookies or delete any cookies that you have accepted in the past. Some of our Services may not work fully, or your experience may be less personalized if you do so.

4. Additional Information if you are a California resident

This section applies only to California residents. It describes how we collect, use and share Personal Information of California residents in connection with the Services, and your rights with respect to that Personal Information. In this section, "Personal Information" means information protected by the California Consumer Privacy Act of 2018 ("CCPA").

As a California resident, you have the specific rights listed below which we will respect as required by law:

Information. You can request the following information about how we have collected and used your Personal Information during the past 12 months:

• the categories of Personal Information that we have collected;
• the categories of sources from which we collected Personal Information;
• the business or commercial purpose for collecting and/or selling Personal Information;
• the categories of third parties with whom we share Personal Information;
• the categories of third parties to whom the Personal Information was sold or disclosed for a business purpose;
• the business or commercial purpose for collecting and/or selling Personal Information.

Access: You can request a copy of the Personal Information that we have collected about you during the past 12 months.

Deletion: You can ask us to delete the Personal Information that we have collected from you.

"Do Not Sell": If we sell your Personal Information, you can opt-out to stop this. Or if we know that you are younger than 16 years old, we will ask for your permission (or if you are younger than 13 years old, your parent's or guardian's permission) to sell your Personal Information before doing so. At present we do not sell any personal information within the meaning of applicable California laws.

Nondiscrimination: You are entitled to exercise the rights described without us penalizing you, e.g. by denying you Services; increasing the price of Services; decreasing Service quality; or suggesting that we may penalize you in these ways.

You may exercise your rights described above by contacting us at the addresses set out at the end of this Policy.

We may not be able to process your request if (a) you do not provide us with sufficient detail regarding it; (b) we cannot identify you sufficiently; or (c) the request is subject to an exception under applicable law.

We will need to verify your identity in order to process requests for exercise of your rights, and we reserve the right to confirm your California residency. To verify your identity, we may require you to provide government identification, verify your email, give a declaration as to your identity under penalty of perjury, and/or provide additional information such as a device or cookie ID.

California "Shine the Light Act": If you reside in California and have an established business relationship with us, you may have the right to receive information about how we share certain personal information with our affiliates or third parties, such as our advertisers. Such requests should be made in writing as indicated at the end of this Policy.

5. Additional information if you are located in Europe

Data Controller: The Data Controller of the personal information we process is: Paper Communications, Inc. You may contact us using the details at the end of this Policy.

Recipients of the data: Our platform and the personal information processed within it are hosted on our behalf on servers located in the USA. We also provide data to other companies in our corporate group and technical service providers outside the EU Area that require access to data in order to assist us in providing our Services. In particular, we work with reputable external data processors, to which we provide certain data which may include personal information , in order to provide our platform and services, including for the purposes of storage, analysis, development, testing, personalised advertising, etc., and who are not permitted to use data processed on our behalf for any other purpose.

If we do this, we will have in place safeguards that enable transfers from the EU Area to take place legally which may include a decision from the EU Commission indicating that the place of receipt has adequate data protection laws, or standard contractual clauses approved by the EU Commission or another Supervisory Authority. A copy of these documents can be provided if we receive a valid request.

Data retention: We retain the data only as long as necessary for the purposes described in this Policy. When we no longer need to use the data for such purposes (or for us to comply with our legal or regulatory obligations), then we will either remove it from our systems or delete all personally identifying elements so that the data cannot be traced back to any identifiable person. Information relating to cookie IDs and personalized advertising is normally kept for up to 13 months. If you have an account or subscription then we will retain the associated data for as long as your account or subscription is live and for a reasonable period as required resolve any possible future legal claims.

Legal rights: EU Area data subjects have various legal rights in relation to their data including:

• to ask for access to it ("access")
• to ask for errors in it to be corrected ("rectification")
• to ask for it to be erased (the "right to be forgotten")
• if not erased, then to ask us to restrict its processing
• to object to its processing for specific purposes (e.g. marketing)
• to ask for a copy to take to another service provider ("data portability").

Where we process any data based on consent that you have given in the past, then you are always allowed to withdraw your consent at any time, but any processing that took place before such withdrawal will still be legal.

We are always available through the contacts at the end of this Policy to help with the exercise your rights or to resolve any issues or doubts you may have in relation to processing of your personal information. If you believe that your rights have not been respected at any time then you also have a right to complain to the Data Protection Supervisory Authority in your country to ask them for a resolution.

6. How is your information kept secure?

We and our vendors and service providers take extensive measures in line with applicable laws and good industry practices to protect the security of the information we process. While we are always considering improvements and will investigate all potential issues discovered, no security measures are 100% perfect, and we are not able to give any guarantees that information will never be breached or lost.

7. Do we process children's information?

We do not knowingly collect personal information regarding children under 13 years of age. If you believe that we may have done so then please contact us. If we discover that we have inadvertently collected personal information online from children under 13, we will endeavor to delete or anonymize such information as soon as possible.

8. Can we change this Policy?

We may change this Policy from time to time, for example due to changes in applicable law or regulations, technology, or our business. We will post any changes to this page and may use other means to draw these to your attention (e.g. if you have a magazine or newsletter subscription we may use your contact details for those Services). By using our Services following a change to this Policy, you accept the version then in effect.

9.How can you contact us?

If you have questions or comments regarding this Policy, please contact us at:

ENTtech Media Group, LLC.

Attn: Privacy Manager

322 8th Ave floor 3 suite 1, New York, NY 10001, United States

privacy@paperentertainment.com

o ENTtech Media Group LLC obtains your consent in accordance with the policies and technical specifications of the IAB Europe Transparency & Consent Framework. It uses the Consent Management Platform n°92.
You can change your choices at any time by clicking here.

o Deposit of cookies by Sirdata
Sirdata is a data marketing company that allows its Customers to provide Users with relevant offers tailored to their interests.
The Data collected by Sirdata are kept for a maximum period of 365 days, depending on the purpose of the processing, in accordance with the laws in force and the principle of minimisation.
For more information: https://www.sirdata.com/privacy/
You wish to disable the collection of your data by Sirdata: https://www.sirdata.com/object/

Last updated: February 16, 2020

© ENTtech Media Group, LLC 2020, all rights reserved.