EZParts Marketplace Privacy Notice

EZ Management Solutions, Inc., a Delaware corporation d/b/a EZ-Suite ("Company", "EZ", "we", "our", or "us") respects your privacy and is committed to protecting it through our compliance with this Notice. This Notice describes how we collect, process, retain, and disclose personal data about you when providing services to you through our website located at www.ezparts.com and the EZParts marketplace platform and related services that link to this Notice (our "Services") and our practices for using, maintaining, protecting, and disclosing that information. This Notice applies to certain vehicle recycling facilities and dismantlers located in certain U.S. states and Canadian provinces who are pre-approved by EZ and who are also members in good standing of the Team PRP Co-op ("Yards"). This Notice also applies to automobile repair shops (“Shops”) who use the Services to search for and/or purchase auto parts from these Yards. Shops further include third parties who access or use the Services on behalf of or in relationship to an automobile repair shop (for example, an insurance adjuster). The Services are intended for Yards and Shops (either of which we may refer to herein as “you” or “your”) and no other person.

This Notice applies only to information we collect:

• Through the Services.
• In communications, including email, text, chat, and other electronic messages, between you and the Services.

It does not apply to information collected by:

• Us offline or through any other means, including on any other website operated by Company or any third party that does not link to this Notice; or
• Any third party, including through any application or content (including advertising) that may link to or be accessible from or through the Services. This includes the separate services, websites, and terms of any Yard, Shop, Team PRP, or payment processor with which you interact in connection with a transaction.

We may provide additional or different privacy notices that are specific to certain features, services, activities, parties, or jurisdictions.

Please read this Notice carefully to understand our policies and practices regarding your information and how we treat it. By interacting with our Services or providing us with your information, you agree to the collection, use, and sharing of your information as described in this Notice. This Notice may change from time to time (see Changes to This Privacy Notice). Your continued use of the Services after we make changes as described here is deemed to be acceptance of those changes, so please check the Notice periodically for updates.

This Notice is intended to be read together with, and is cross-referenced from, the EZParts marketplace Shop Terms of Use and Yard Terms of Use. The "Shop Data" and "Yard Data" defined in those Terms of Use may each include personal data governed by this Notice.

The Marketplace and the Parties

The EZParts marketplace is an online platform on which Yards list and sell automotive parts ("Parts") and Shops search for and purchase Parts. The contract of sale for any Part is directly between the Shop and the Yard. EZ operates the platform to facilitate transactions but does not otherwise participate in the transactions between Yards and Shops. Because of this structure, completing a transaction requires us to share certain information among the participants in the transaction, as described in Who We Disclose Your Information To.

Children's and Minors' Data

The Services are intended for businesses and their authorized personnel, and each individual who accesses the EZParts marketplace must be at least 18 years of age. Our Services are not intended for, and we do not knowingly collect any personal data from, children under the age of 18. If we learn we have collected or received personal data from a child under 18 years old, we will delete that information.

The Personal Data That We Collect or Process

"Personal data" is information that identifies, relates to, or describes, directly or indirectly, you as an individual, such as your name, email address, telephone number, or business address. Because the Services are offered to businesses, much of the information we collect relates to a business and its personnel; where that information can be used to identify an individual, we treat it as personal data.

The types and categories of personal data we may collect or process include:

• Account and contact information, including individual name, business name, business address, business email address, phone number, job title or role, username and password, and other contact information you provide us.
• For Yards, registration information required to access the EZParts marketplace, including the Yard's legal name, business address, tax identification number, and primary contact.
• Order and transaction information, including Parts ordered, order history, shipping and delivery details, and communications about Orders.
• Payment-related information. Payments are processed by a third-party payment processor through a payment function hosted on the Services. We do not collect or store full payment card numbers or bank-account details; the payment processor collects that information directly.
• Device and technical information, including your IP address, operating system, browser type, and other device information.
• Communications and support information, including messages, support requests, and correspondence between you and us.

The tax identification number we collect from Yards is a business tax identification number (such as an employer identification number) used to identify the Yard as a business. We do not intentionally collect government identifiers that identify an individual (such as a Social Security number). If we collect any information that is "sensitive" under applicable law, we will handle it as that law requires.

We may also collect:

• Statistics or aggregated information. Statistical or aggregated data does not directly identify a specific person, but we may derive non-personal statistical or aggregated data from personal data. For example, we may aggregate personal data to calculate the percentage of users accessing a specific Services feature.
• Technical information. Technical information includes information about your internet connection and usage details about your interactions with the Services, such as clickstream information to, through, and from our Services (including date and time), Parts that you view or search for, page response times, download errors, length of your visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), or methods used to browse away from a page.

If we combine or connect non-personal statistical or technical data with personal data so that it directly or indirectly identifies an individual, we treat the combined information as personal data.

How We Collect Your Personal and Other Data

You Provide Information to Us

We collect information about you when you interact with our Services, such as when you register for or update an account, place or fulfill an Order, or communicate with us.

Automatically Through Our Services

As you navigate through and interact with our Services, we may use automatic data collection technologies to collect information that may include personal data. Information collected automatically may include usage details, IP addresses, operating system, and browser type, and information collected through cookies.

Using automatic collection technologies helps us to improve our Services and to deliver a better and more reliable experience. The technologies we use for this automatic data collection may include cookies. A cookie is a small file placed on your device when you interact with the Services. We use only cookies that are necessary to operate the Services and to support their basic functionality and performance. We do not use advertising or marketing cookies or third-party advertising trackers. You may refuse to accept or disable cookies by activating the appropriate setting on your browser or device. However, if you select this setting, you may be unable to access certain features of the Services.

From Other Sources

We may receive personal data about you from the third-party payment processor that processes Marketplace transactions, and Shops and Yards may provide information about each other in connection with an Order. We do not receive personal data about you from Team PRP.

How We Use Your Information

We use information that we collect about you or that you provide to us, including any personal data, to:

• Provide you with the Services and any content, features, information, products, or services that we make available through the Services, including operating the EZParts marketplace and matching Shops with Yards.
• Create, manage, and secure your account.
• Facilitate, fulfill, and manage Orders, deliveries, and payments, including generating shipping labels and enabling invoicing between the Shop and the applicable Yard.
• Provide customer support and respond to your inquiries.
• Fulfill any other purpose for which you provide the information.
• Improve our Services, including by analyzing your information and creating aggregated and de-identified data to develop, maintain, analyze, improve, optimize, measure, and report on our Services and their features and how users interact with them, including features that use artificial intelligence or machine learning.
• Carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection.
• Provide security, prevent and investigate fraud, and enforce our Terms of Use and other agreements.
• Comply with applicable law and legal process.
• In any other way we may describe when you provide the information.
• For any other purpose with your consent.

Marketing communications. We do not currently send marketing or promotional communications through the Services. We may send you transactional or service messages, such as Order confirmations and account, security, or support notices. If we begin sending marketing communications, we will provide the ability to opt out as required by applicable law, including the U.S. CAN-SPAM Act and Canada's Anti-Spam Legislation (CASL). We do not currently send marketing text messages or push notifications.

Aggregated and De-Identified Data

We may compile, use, and disclose aggregated and de-identified data derived from use of the EZParts marketplace for any purpose, including to develop, improve, and market our products and services. When we hold information in aggregated or de-identified form, we maintain and use it in that form and do not attempt to re-identify it, except as needed to determine whether our de-identification processes satisfy applicable legal requirements.

Who We Disclose Your Information To

We may disclose aggregated and de-identified information about our users, and information that does not identify any individual, without restriction.

We may also disclose personal data that we collect or you provide as described in this Notice:

• To the other party to your transaction. To complete a transaction you request, we share Order and contact information between the Shop and the applicable Yard as needed to fulfill and invoice the Order.
• To Team. Team PRP is a recycler consortium in which Yards are members. Yards may share personal information with PRP outside of the Services, including as part of existing off-line business operations involving auto part sales and shipping. EZ may also disclose Yard transactional and profile data collected through the EZParts marketplace to Team PRP for Team PRP's own business purposes, including quality assurance within the Team PRP co-op, member services, analytics, communications with Team PRP members, Team PRP marketing, and evaluating the performance of the Team PRP co-op. We do not disclose cookie data to Team PRP, and we do not disclose personal data to Team PRP for cross-context behavioral or targeted advertising. For how this disclosure is treated under U.S. state privacy laws, see Your U.S. State Privacy Rights.
• To our payment processor, to process payments for transactions on the EZParts marketplace.
• To contractors, service providers, and other third parties we use to support our organization (such as hosting, information technology, and analytics providers).
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of EZ's assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal data held by EZ is among the assets transferred.
• To fulfill the purpose for which you provide it.
• For any other purpose disclosed by us when you provide the information.
• With your consent.

We may also disclose your personal data:

• To comply with any court order, law, or legal process, including to respond to any government or regulatory request.
• To enforce or apply the applicable terms of use and other agreements, including for billing and collection purposes.
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of our organization, our users, or others, including for fraud protection and risk reduction.

Your Rights and Choices About Your Information

This section describes mechanisms you can use to control certain uses and disclosures of your information and rights you may have under applicable law, depending on where you live.

Cookies and other tracking technologies. You can set your browser to refuse all or some browser cookies or other tracking technology files, or to alert you when these files are being sent. If you disable or refuse cookies or similar tracking files, some Services features may be inaccessible or not function properly. Some browsers include a "Do Not Track" (DNT) setting; because there is not a common understanding of how to interpret the DNT signal, our Services may not respond to all browser DNT signals.

Some browsers and browser extensions support the Global Privacy Control ("GPC"), a signal used to opt out of certain data "sales" or "sharing." Our Services do not currently respond to GPC or other browser "do not sell" preference signals. If you wish to opt out of the disclosure described in Your U.S. State Privacy Rights, you may contact us as described in that section.

Your U.S. State Privacy Rights

Depending on their state of residency, consumers may have certain rights related to their personal data. To the extent you are a consumer residing in such a state, the following rights may apply:

• Access and Data Portability. You may confirm whether we process your personal data and access a copy of the personal data we process. To the extent feasible and required by state law, data will be provided in a portable format.
• Correction. You may request that we correct inaccuracies in your personal data that we maintain, taking into account the information's nature and processing purpose.
• Deletion. You may request that we delete personal data about you that we maintain, subject to certain exceptions under applicable law.
• Opt Out of Sale and Targeted Advertising. Some state privacy laws give you the right to opt out of the "sale" of your personal data and of processing for targeted advertising. We do not sell your personal data for money, and we do not share or process it for cross-context behavioral or targeted advertising. However, as described in Who We Disclose Your Information To, we disclose certain Yard data to Team PRP for Team PRP's own business purposes. Because some states define a "sale" to include disclosures made for other valuable consideration (not only for money), this disclosure to Team PRP may be considered a "sale" under those laws. If you reside in a state that provides an opt-out right and you wish to opt out of this disclosure, you may contact us at privacy@ezparts.com.

Important: The exact scope of these rights varies by state. There are also several exceptions where we may not have an obligation to fulfill your request.

To exercise any of these rights, please email us at privacy@ezparts.com and include “Privacy Request” in the subject line. We will take reasonable steps to verify your identity before responding, which may include confirming information associated with your account, and we will respond within the time periods required by applicable law. You may use an authorized agent to submit a request on your behalf, and we may require verification of the agent's authority. To appeal a decision regarding a rights request, please email us at privacy@ezparts.com with the subject line "Privacy Rights Appeal," and we will review the appeal and inform you of our decision.

How We Protect Your Personal Data

We use commercially reasonable administrative, physical, and technical measures designed to protect your personal data from accidental loss or destruction and from unauthorized access, use, alteration, and disclosure. However, no website, system, electronic storage, or online service is completely secure, and we cannot guarantee the security of your personal data. In particular, email, texts, and chats sent to or from the Services may not be secure, and you should carefully decide what information you send to us via such channels. Any transmission of personal data is at your own risk.

The safety and security of your information also depends on you. You are responsible for taking steps to protect your personal data, including safeguarding any account credentials.

How We Retain Your Personal Data

We keep the categories of personal data described in this Notice for as long as reasonably necessary to fulfill the purposes described or as otherwise legally permitted or required, such as maintaining and improving the Services, operating our organization, complying with our legal obligations, resolving disputes, archival purposes, and for safety, security, performance monitoring, and fraud prevention.

California Privacy Rights

The EZParts marketplace is not currently offered to residents of California, and this Notice is not directed to California residents. Before we offer the Services to California residents, we will add a California-specific section addressing the California Consumer Privacy Act, as amended, including any applicable "sale"/"sharing" opt-out, sensitive-personal-information, and consumer-request disclosures.

Canada Privacy Rights (PIPEDA)

This section provides additional information for users in Canada. We handle personal information in accordance with the federal Personal Information Protection and Electronic Documents Act ("PIPEDA") and substantially similar provincial privacy laws, as applicable. Under Canadian privacy law, "personal information" means information about an identifiable individual. Personal information does not include the business contact information of an individual that we collect, use, or disclose solely to communicate with that individual in connection with their employment, business, or profession.

The extent that EZ’s collection, processing, or disclosure of this business information may be covered by PIPEDA, the following disclosures are provided to comply with this law.

Consent. We collect, use, and disclose personal information with your knowledge and consent, except where the law permits or requires otherwise. By providing personal information to us or using the Services, you consent to the collection, use, and disclosure of that information as described in this Notice. You may withdraw your consent, subject to legal or contractual restrictions and reasonable notice, by contacting us using the information below; if you withdraw consent, we may be unable to provide certain Services, and we will explain the impact to you.

Purposes and disclosures. We use and disclose personal information for the purposes described in this Notice, including to operate the EZParts marketplace, fulfill and invoice Orders, and provide support. As described above, we disclose personal information to the other party to a transaction, to Team PRP (to generate shipping labels and deliver ordered Parts), to our payment processor, and to service providers that support our operations under obligations of confidentiality and limited use.

Cross-border transfer. We may process, store, and transfer your personal information in and to the United States and other countries whose privacy laws may differ from those in Canada. While personal information is located in another country, it may be accessible to that country's governments, courts, law enforcement, and regulatory agencies under that country's laws. When we engage a service provider, we require that its privacy and security practices adhere to this Notice and applicable Canadian privacy law. You may contact us for more information about our practices regarding service providers outside Canada.

Access and correction. Subject to exceptions under applicable law, you have the right to request access to the personal information we hold about you and to request correction of information that is inaccurate or incomplete. We may request information to verify your identity before responding.

Accountability and complaints. We have procedures to receive and respond to complaints or inquiries about our handling of personal information and our compliance with this Notice and applicable privacy law. To make a request or raise a concern, please contact Jim McKinney, President of EZ Management Solutions, Inc. and designated Privacy Officer, using the information in Contact Information below.

Changes to This Privacy Notice

We may update this Notice from time to time, and we will provide notice of any such changes as required by law. The date this Notice was last updated is identified at the top. We will notify you of changes by updating the "last updated" date and posting the updated Notice on the Services, consistent with the notice provisions of the applicable Terms of Use.

Governing Law

This Notice and any dispute relating to it or to our privacy practices are governed by the laws of the State of Ohio, without regard to its conflict-of-laws principles, consistent with the EZParts marketplace Shop Terms of Use and Yard Terms of Use. This governing-law provision does not limit any mandatory rights or protections you may have under the privacy laws of your state or province, which continue to apply regardless of this provision.

Contact Information

To exercise your rights or ask questions or comment about this Notice or our privacy practices, contact us at:

EZ Management Solutions, Inc. d/b/a EZ-Suite

Attn: Jim McKinney

630 Lexington Ave., Suite 1A, Mansfield, Ohio 44907

privacy@ezparts.com