Please read this Privacy Policy (hereinafter referred to as the “Policy”) carefully as it contains important information regarding how, when, and why Rings AI Inc collects, uses, and stores your personal data, with whom it may share it, as well as to inform you about your rights as a data subject and the measures taken to protect your personal data, in connection with Rings AI Inc’s processing over its website, platform, and services.‍

Accessing and/or using Rings AI Inc’s website, platform, and services by any person imposes the obligation to comply with the provisions set forth in the Terms and Conditions.

The website https://www.ringsxrm.com/ (hereinafter referred to as the “Website”) and the platform https://app.joinrings.com/ (hereinafter referred to as the “Platform”) are owned and managed by Rings AI Inc, a company incorporated by USA laws, headquartered at 1632 1 st Ave, 20235, New York, NY 10028, USA.

1. APPLICABILITY

This Policy regarding the processing of personal data only applies to the processing activities performed by Rings AI Inc and shall be complemented with the Terms of Use.

The Website may contain information about or links to other websites that are outside Rings AI Inc’s custody and/or control. Carefully read and review the privacy policies of each of those websites when you browse on them to get an understanding of how your personal data is being used and shared by those third-party websites.

2. DEFINITIONS

The terms used within this Policy have the same meanings as those mentioned in Terms of Use, unless otherwise mentioned in this Policy.

• “Rings AI”, "we”, “us” or “our” means Rings AI Inc and any of its affiliates that are providing the Website, Platform, and services.

• “Users” means any natural person or any customer’s employees, representatives, consultants, contractors, or agents who are using the Services for customer’s benefit.

• “You” or “your” means current or potential customer of Rings AI, as a User of the Website, Platform, and Services provided by Rings AI.

• “Services” means all of our web-based websites (including this website), applications, tools and platforms that you have subscribed to or that we otherwise make available to you, and are developed, operated, and maintained by us, accessible via the Website, the Platform or another designated URL, and any ancillary products and services, including any consulting services, that we provide to you either for a fee or free of charge; Services or other products or features made available by us to you on an unpaid trial or free basis are considered free Services.

• “Personal data” means any information relating to an identified or identifiable natural person;

• “Processing” means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

• “Processing activity(ies)” means one or more operations that relate to one of the different stages that the processing of personal data may involve.

• “Controller” means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. For the purposes of this Policy, Rings AI acts as Controller.

• “Data subject” means an identified or identifiable natural person. An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

• “Consent” of the data subject means any freely given, specific, informed and unambiguous indication of the user's wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her.

3. COLLECTING PERSONAL DATA

In general, the personal data we process is collected directly from you, as a data subject. However, there may be situations where your personal data is collected indirectly from social media, from the website of the company you represent, from your employer as a contact person, from a third party who recommended you or from various public platforms (for example ad platforms).

When we, as the Controller, do not receive the personal data directly from you, we will inform you within the legal term about our processing of your personal data.

If you provide us with personal data belonging to other individuals (for example, colleagues), you have the responsibility to inform them about how we process their personal data for the purposes mentioned below, as well as regarding their rights related to the processed personal data. You are also responsible to ensure that you rely on the appropriate legitimate ground for collecting and sharing the personal data, such as obtaining the consent of the individuals concerned, when this consent is required by the law for processing of their personal data, such as collection, use, storage and transfer.

‍4. CHILDREN AND SPECIAL DATA

Our Website and Services are not directed at children. We do not knowingly or intentionally collect personal data from children who have not reached the level of maturity in their country and who are not able to assume obligations in accordance with the applicable legislation.

If you are the holder of parental responsibility of a child who has not reached the level of maturity in the country of residence and you believe your child has provided us with personal data, please contact us to request the erasure of their personal data and we will act upon your request in accordance with the legal requirements.

We do not collect nor is our intention to collect personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation, or personal data relating to criminal convictions and offences or related security measures, excepting the situations expressively regulated by the law.

5. PROCESSED PERSONAL DATA, PURPOSES, LEGAL GROUNDS AND RETENTION PERIODS

Below you will find information about the purposes for which we process your personal data, the categories of personal data we collect for those purposes, the legal grounds on which we carry out the processing activities and the periods of time we store the personal data in relation to the purposes of the processing.

Where the lawful basis for the processing is the data subject's consent, you may withdraw your consent at any time without constraint and without affecting the lawfulness of the processing prior to its withdrawal.

We will inform you and, where the lawful basis is your consent, we will ask for your freely-given consent if we intend to process your personal data for a new purpose that is materially different from that for which the personal data was initially collected.

Depending on the nature of our relationship or interaction, we will process your personal data for the following purposes:

5.1 Purpose: Book a demo to learn more about the Platform and Services‍

Personal data categories: first name, last name, (corporate) e-mail, any other personal data provided in the booking request, date/time of booking request, voice and/or video (if the conversation is carried out via live chat applications), other personal data contained in the communications.

Legal basis: our legitimate interest to provide Services to our users.

Retention period: personal data will be stored for a period of 5 years calculated from the date of the booking. At the end of the storage period, the personal data will be deleted or anonymized.

5.2 Purpose: Creation and authentication of user accounts in the Platform to provide Services

Personal data categories: first name, last name, (corporate) e-mail, password, company name, user role.

Legal basis: our legitimate interest to provide the Services to our users.

Retention period: personal data will be stored for as long as you are an active user of the Platform. Account activity is determined on a case-by-case basis, depending on the user role. At the end of the account activity, personal data will be deleted or anonymized. ‍

5.3 Purpose: Managing user accounts in the Platform to provide Services

Personal data categories: first name, last name, (corporate) e-mail, password, company name, user role.

Legal basis: the performance of the contractual agreement with our Platform users.

Retention period: personal data will be stored for as long as you are an active user of the Platform. Account activity is determined on a case-by-case basis, depending on the user role. At the end of the account activity, personal data will be deleted or anonymized.

5.4 Purpose: Building your profile in the Platform to enable optional Platform functionalities in order to provide Services

Personal data categories: additional e-mail addresses, phone numbers, address information (country, state/province, city), photograph, birthday, links to social media accounts (e.g. LinkedIn, Twitter, Facebook), bio/description, relationships with other Platform users and prospects, company affiliations, activities (e-mails sent/received, email contents and attachments, meetings scheduled), interests, notes.

Legal basis: your freely-given consent; you may withdraw your consent at any time without constraint and without withdrawal of consent affecting the lawfulness of the processing prior to its withdrawal.

Retention period: personal data will be stored for as long as you are an active user of the Platform or until you withdraw your consent, whichever comes first. At the end of the storage period, personal data will be deleted or anonymized.

5.5 Purpose: Collating prospect data to provide Services to our users

Personal data categories: first name, last name, (corporate) e-mail addresses, company name, address information (country, state/province, city), photograph, birthday, links to social media accounts (e.g. LinkedIn, Twitter, Facebook), bio/description, relationships with other Platform users and prospects, company affiliations, user-related activities (e-mails sent/received, meetings scheduled), user-related notes.

Legal basis: our legitimate interest to provide the Services to our users.

Retention period: personal data will be processed until the data subject opposes to this processing, or requests that their data be erased. However, we can proceed to the deletion of personal data when we decide that it is no longer relevant for achieving the purpose. At the end of the storage period, personal data will be deleted or anonymized.

5.6 Purpose: Send e-mail communications and respond to requests, questions, and complaints in order to ensure provision of the Services

Personal data categories: first name, last name, (corporate) e-mail, (corporate) phone number, e-mail signature, voice and/or video (if the conversation is carried out via live chat applications), other personal data contained in the communication/request.

Legal basis: our legitimate interest to effectively provide our Services, by informing users of Platform functionalities and by resolving customer service-related queries/requests.

Retention period: personal data will be stored for a period of 5 years calculated from the date of resolution of the request or complaint. At the end of the storage period, the personal data will be deleted or anonymized.

5.7 Purpose: Monitoring, testing, and configuring of Platform for security and compliance reasons, and to ensure Platform functionality

Personal data categories: as applicable on a case-by-case basis, depending on the type of audit/test: first name, last name, (corporate) e-mail, IP address, machine number/name and other unique machine identifiers, event level details such as username, dates/times, as long as these are linked to person's (user)name, log files as long as these are linked to a person’s (user)name/e-mail.

Legal basis: our legitimate interest to configure the network and systems we manage, to ensure their functionality and security, and to perform checks and technical support.

Retention period: personal data will be stored for a period of 3 years calculated from the date when the audit/test has been completed. At the end of the storage period, the personal data will be deleted or anonymized.

5.8 Purpose: Keeping logs to ensure confidentiality, integrity and availability of the Platform

Personal data categories: log information, including first name, last name, (corporate) e-mail, password, company name, user role, login dates/times, alias/username, IP address, machine number/name and other unique machine identifiers, event level details such as dates/times as long as these are linked to person's name/username.

Legal basis: our legitimate interest to ensure data confidentiality, integrity and availability.

Retention period: personal data will be stored for a period of 3 years calculated from the date when the log entry was created. At the end of the storage period, the personal data will be deleted or anonymized.

5.9 Purpose: Prevent, identify, investigate and respond to fraud incidents or data breaches

Personal data categories: data in production and/or back-up data, as applicable on a case-by-case basis, depending on the incident: first name, last name, (corporate) e-mail, password, company name, user role, login dates/times and other log information as long as these are linked to person's name/email.

Legal basis: our legitimate interest to comply with the provisions of the law, to identify the causes that led to the incidents, to take the necessary remedial measures and to prevent future similar incidents.

Retention period: personal data will be stored for a period of 5 years after the moment of the incident resolution/closure. At the end of the storage period, personal data will be deleted or anonymized.

6. TRACKING TECHNOLOGIES

Our website uses cookies, plug-ins and other online identifiers (collectively referred to as “cookies”) in order to ensure functional browsing or to provide a better browsing experience, to perform statistical analysis regarding accessed information, or to provide you with custom content and advertising appropriate to your preferences and interests.Detailed information regarding the cookies we use may be found by clicking on the “Consent Preferences” link, available in the footer of our Website.

7. AUTOMATED DECISION MAKING, INCLUDING PROFILING

We do not make decisions based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

8. DISCLOSURE AND TRANSFER OF PERSONAL DATA

We may transfer your personal data, to the extent that this is necessary, to the following categories of recipients: companies from the same group, service partners, subcontractors, payment providers, archiving companies, IT service providers, software or hardware vendors, market research companies, marketing companies, public authorities, court or arbitral tribunals, as well as competent authorities to investigate criminal offenses.We do not make decisions based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

Personal data may be disclosed or transferred to the categories of recipients mentioned above in order to provide our Services at the highest quality level, ensure the intervention of specialists by outsourcing parts of our business or to provide access to services and benefits according to our business partnerships, or to ensure compliance with the specific legal obligations to which we are subject according to the activity carried out.

In the event that personal data is transferred to third countries we will apply the technical and organizational measures required by law and we will inform you about the transfer in accordance with the legal requirements.

9. SECURITY OF PERSONAL DATA

The security of your personal data is important to us. Therefore, we maintain a variety of appropriate technical and organizational measures to protect your personal data from loss, misuse, and unauthorized access or disclosure. We limit access to personal data to employees or contractors who we believe reasonably need to retrieve that information to provide our Services. Considering the current state of technology, we have implemented reasonable physical, technical and procedural safeguards designed to protect your personal data, such as limiting access, encrypting, anonymizing, or storing it on secure media.

It is very important that you, as a data subject, know the risks and take the measures to protect your personal data, for example by checking the sources of information, avoiding access to suspicious or unknown links, regularly changing passwords and using appropriate anti-virus and anti-malware solutions.

10. YOUR RIGHTS AND HOW TO EXERCISE THEM

The law grants data subjects enforceable and effective rights concerning their personal data which can be exercised under particular conditions.

You have the following rights regarding your personal date:

• Right to be informed: You have the right to be informed regarding the processing of your personal data, as we are doing through this Policy.

• Right of access: You have the right to obtain confirmation whether or not we process your personal data, as well as information on the specifics of the processing activities, and get access to that personal data.

• Right to rectification: You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

• Right to erasure: You have the right to obtain from us without undue delay the erasure of your personal data, to the extent that the legal requirements are met. Personal data will be erased when the legal requirements are met.

• Right to restriction of processing: If the applicable legal provisions are met, you have the right to obtain the restriction of processing of your personal data.‍

• Right to data portability: If the applicable legal provisions are met, you have the right to receive your personal data which you have provided to us, in a structured, commonly used and machine-readable format, and the right to transmit those data to another Controller.‍

• Right to object: In certain situations, such as when we process personal data based on legitimate interest, you have the right to object to the processing of your personal data. In the event of unjustified opposition, as Controller we are entitled to further process your personal data.

• ‍Right to object to commercial communication: You may also object to the processing of your personal data for the purpose of sending commercial messages.‍

• Right not to be subject to decisions based solely on automated processing, including profiling: If the applicable legal provisions are met, you have the right not to be subject to a decision based solely on automatic processing, including profiling, which has legal effects on you or affects you similar to a significant extent.‍

• Right to Opt-Out of Sale or Sharing of Personal Data: If we sell your personal data to third parties or share it with third parties for cross-context behavioral advertising, you have the right, at any time, to stop us from selling or sharing your personal data.‍

• Right to address to the Supervisory Authority: You have the right to file a complaint with the competent Supervisory Authority on any violation of your rights regarding the processing of your personal data. If you want to contact the Supervisory Authority from your place of residence in EU, you may find the contact details at https://edpb.europa.eu/about-edpb/about-edpb/members_en. ‍

• Consent withdrawal: To the extent that we process your personal data based on your given consent, you can withdraw your consent at any time, without affecting the lawfulness of the processing based on the consent prior to its withdrawal.

Except for the right to contact the Supervisory Authority, which you can exercise using the contact details indicated above, you can exercise your legal rights by contacting our Data Protection Officer by e-mail at dpo@rings.ai.

We will respond to your requests without undue delay and in any case within one month of receiving the request. This period may be extended by two months where necessary, taking into account the complexity and number of requests. We will inform you of any such extension within one month of receiving your request, stating the reasons for the delay.

In the event that we do not take action on your request, we will inform you, without undue delay and no later than one month after the receipt of your request, of the reasons for not taking action. In such a case, you have the possibility to lodge a complaint with the competent Supervisory Authority or to take a legal action.

11. EUROPEAN UNION REPRESENTATIVE

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons regarding the processing of personal data and on the free movement of such data (GDPR), our designated representative in the European Union is Mr. Alexandru Ganea. If you are based in the European Union, you may contact directly our representative by e-mail at eurep@rings.ai.

12. DATA PRIVACY FRAMEWORK

Rings AI Inc complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Rings AI Inc has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Rings AI Inc has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/.

Rings AI Inc commits to process only the types of personal data which are adequate and limited to what is necessary for the purposes for which the personal data are to be processed, as mentioned in Section 5 above, and to ensure the strict application of the DPF Principles to processing involving the respective types of personal data. Any disclosure, passing on or making available of personal data by Rings AI Inc is subject to the terms mentioned in Section 8 above. Rings AI Inc shall remain liable under the DPF Principles if its agent processes personal data in a manner inconsistent with the DPF Principles, unless Rings AI Inc proves that it is not responsible for the event giving rise to the damage. Rings AI Inc grants individuals the right to access their personal data by contacting Rings AI Inc at: dpo@rings.ai.

If personal data covered by this Policy is to be used for a new purpose that is materially different from that for which the personal data was originally collected or subsequently authorized, as mentioned in Section 5 above, or is to be disclosed to a third party in a manner not specified in Section 8 of this Policy, Rings AI Inc will provide you with an opportunity to choose whether to have your personal data so used or disclosed. Requests to opt out of such uses or disclosures of personal data should be sent to us at dpo@rings.ai. Certain personal data, such as information about medical or health conditions, racial or ethnic origin, political opinions, religious or philosophical beliefs, is considered "special data", as further described in Section 4 of this Policy. If special data is collected, Rings AI Inc will not use special data for a purpose other than the purpose for which it was originally collected or subsequently authorized by you unless Rings AI Inc has received your affirmative and explicit consent (opt-in).

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Rings AI Inc commits to resolve DPF Principles-related complaints about our collection and use of your personal information. EU individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF should first contact Rings AI Inc through the designated representative in the European Union, as mentioned in Section 11 above, at: eurep@rings.ai. UK and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF should first contact Rings AI Inc at: dpo@rings.ai.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Rings AI Inc commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Gibraltar Regulatory Authority (GRA) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF.

The Federal Trade Commission (FTC) has jurisdiction over Rings AI Inc’s compliance with the EU- U.S. Data Privacy Framework (EU-U.S. DPF) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF).

If you consider that your complaint was not resolved under the DPF mechanism, you may have the possibility, under certain conditions, to invoke binding arbitration through the Data Privacy Framework Panel. For additional information related to binding arbitration, please visit https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf.

In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or Law Enforcement requirements.

‍13. UPDATES

This Policy is subject to periodic reviews and updates to ensure that it always corresponds to reality, and it is in line with the applicable legal requirements. For this reason, please regularly consult this Policy to keep up to date with any changes. Any major changes to this Policy will be notified accordingly.

14. CONTACT

If you have any questions or concerns regarding the processing of your personal data, this Policy or how it applies, or you wish to exercise any of your rights, you can contact our Data Protection Officer as follows:

Email: dpo@rings.ai
Website form: https://www.ringsxrm.com/data-subject-access-request
Phone: (US) 917-274-7640
Post mail: Attn: DPO, Rings AI Inc, 1632 1st Ave, 20235 New York, NY 10028, United States