Privacy Policy – GDPR

GDPR AND THE EU-US (AND UK EXTENSION) DATA PRIVACY FRAMEWORK

Revised September 9, 2024

This information about GDPR and the EU-US (and UK Extension) Data Privacy Framework supplements our North America Privacy Policy. It describes our legal bases for collection of personal data that is subject to GDPR obligations and our commitment to the EU-U.S. (and UK Extension) Data Privacy Framework.

To the extent subject to GDPR, we base the processing of your information on the following legal bases:

• Your consent, if you have given us such consent (art. 6 (1) (a) GDPR),
• The initiation or execution of a contract with you (art. 6 (1) (b) GDPR),
• The fulfilment of legal obligations (art. 6 (1) (c) GDPR),
• The implementation of our legitimate interests (art. 6 (1) (f) GDPR)

Nakamoto Forestry North America complies with the EU-U.S. (and UK Extension) Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, as set forth by the U.S. Department of Commerce. Nakamoto Forestry North America adheres to the EU-U.S. (and UK Extension) Data Privacy Framework Principles (EU-U.S. DPF Principles) regarding the processing of personal data received from the European Union and the United Kingdom in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF. In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF, Nakamoto Forestry North America commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-US.DPF and the UK Extension to the EU-U.S. DPF. Under the DPF, you may invoke binding arbitration by delivering notice to us and following the procedures and subject to conditions set forth in Annex I of Principles. Under the DPF we acknowledge that we may be liable for onward transfers to third parties. We acknowledge that we are subject to investigatory and enforcement powers of the Federal Trade Commission (FTC). If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, please visit dataprivacyframework.gov.

Specifically, Articles 13 and 14 of the GDPR and the EU-US (and UK Extension) Data Privacy Framework provisions require us to disclose the following elements in a privacy notice:

• Contact Details: The contact details for our data protection officer to update, access or delete your personal information, or to opt out from sales, please email [email protected] or call (503) 512-6780;
• Purpose. The purposes for collecting and processing personal data can be found in the North America Privacy Policy and the Supplemental Policy for California Residents;
• Legal Basis for Processing Data. The legal basis for the processing can be found above as well as in the North America Privacy Policy and the Supplemental Policy for California Residents;
• Legitimate Interests. For a detailed description of our legitimate interests for collecting data and the legal basis for data processing, see North America Privacy Policy and the Supplemental Policy for California Residents;
• Recipients of the Personal Data. The recipients of the persona data re indicated above and the North America Privacy Policy and the Supplemental Policy for California Residents;
• Data Categories. The categories of personal data that we collect from sources other than the data subjects, see North America Privacy Policy and the Supplemental Policy for California Residents;
• Data Transfers. The personal data may be transferred outside of the jurisdiction. For more information and the data transfer mechanism used to legalize the transfer see North America Privacy Policy and the Supplemental Policy for California Residents;
• Retention Duration. The length of time we use the personal data and the criteria we use to determine retention periods, see North America Privacy Policy and the Supplemental Policy for California Residents;
• Required Disclosures. In order for us to perform contracts and keep you informed you are required to provide such data, otherwise we may not be able to contract you if we need to provide notice or provide you such information about our organization that may concern you;
• Auto-Decision Logic. We do not use automated decision-making, including profiling, the auto-decision logic used, and the consequences of this processing for the data subject. For details, see North America Privacy Policy and the Supplemental Policy for California Residents;
• Additional Rights. If applicable, additional rights may be enjoyed by data subjects, including the right to access data, correct data, object to or restrict data processing, the right to erasure also known as the right to be forgotten, the right to withdraw consent, and the right to data portability, for details, see North America Privacy Policy and the Supplemental Policy for California Residents; and
• Recourse. Recourse is available regarding the data subject’s right to withdraw consent and file a complaint with the local supervisory authority.