1. Warm Welcome from TRAILD

Welcome to TRAILD and thank you for visiting us!

We provide businesses with our platform (the “TRAILD Platform”) and with the TRAILD services, which include data extraction, risk assessment and interpretation services (“TRAILD Services”) with respect to invoice information.

We provide this Privacy Policy to give you a better understanding of our privacy practices when you use the TRAILD Services, access the TRAILD Platform or the TRAILD website located at traildsoftware.com (our “website”) or otherwise interact with TRAILD, including: what information we collect about you, what we use it for and who we share it with. It also explains your rights and what to do if you have any concerns about your personal information.

2. Introduction

In this Privacy Policy, “TRAILD”, “our” “we” or “us” means Traild Pty Ltd (ACN 627 799 982) – the owner and operator of TRAILD and its related bodies corporate. References to “you” means you, the person whose personal information has been processed by TRAILD.

Depending on where you are located, you may be subject to jurisdiction specific laws and regulations. This Privacy Policy is intended to provide you with the information that we are required to provide you with, wherever you are located. We will look after your personal information carefully wherever you are located, but you may not be able to exercise all of the rights set out below if you are resident in a jurisdiction where such rights do not exist.

Where our platform contains links to third-party websites, these sites are not governed by this Privacy Policy. We are not responsible for their operation and their privacy practices so please check those.

3. Types of Data and Information We Collect

3.1 Personal Information

‘Personal information’ when used in this Privacy Policy means any information that can be used (either alone or together with other available information) to identify a living person.

We collect personal information from our Authorised Users and others to enable us to carry out the TRAILD Services and provide the TRAILD Platform.

When a Customer signs up for or uses TRAILD or the TRAILD Services, we will collect personal information relating to its Authorised User(s). The type of personal information we collect includes their username, first and last name, phone number and e-mail address.

We may also collect personal information about the customers or suppliers of our Customers in the course of us providing the TRAILD Services or the TRAILD Platform to Customers (“Third Party Personal Information”). We will process this information solely to provide the Customer with our products and services and in accordance with the EULA and any data processing agreement entered into with our Customer. The Customer is the controller of such personal information and must ensure that it has obtained and provided it to us in accordance with all applicable law and the terms of the EULA. Your personal

information will only be used and stored for the purpose(s) for which it was collected and not for any other purpose. The purposes are set out below.

3.2 Log Data

When you use our platform or visit our website, our servers may record information including information that your browser automatically sends whenever you visit a website, or that your mobile app automatically sends when you’re using it (“log data”). This log data includes device identifiers, device type, geo-location information, connection information, statistics on page views, traffic to and from our platform, mobile network information, time, date, referring URL, the type of operating system and browser, ad data, IP address, server address, date and time of your visit to our website, information of documents you download, pages visited, search terms, cookie information and standard web log data.

The log data may be processed for the purposes of operating our platform, providing our services, ensuring our security, maintaining back-ups of our databases and communicating with you.

3.3 Cookies and Other Similar Technologies

To capture log data, we may use cookies and similar technologies like pixels, web beacons and local storage to collect and store personal and non-personal information about how you use TRAILD. For detailed information about the cookies we collect and what they do, please see our Cookie Notice below.

Cookies are files that store information on the device on which you are using or accessing our platform. Cookies also retain your details and preferences, so you can easily continue your browsing session upon return to our platform.

On our website and when using the TRAILD Services, a notification banner will appear allowing you to manage your consent to collect cookies (cookie banner). If you do not want to activate cookies, you can opt-out of receiving them by declining them on the cookie banner, although you may find that some parts of our platform will consequently have limited functionality and personalisation if you do so.

3.4 Third Party Analytics Tools

Third-party analytics tools collect non-personal information such as how often you visit our platform, the web pages you visit, add-ons, and other analytics data that assists us in improving our services. These tools might include Google Analytics, Google AdWords conversion tracking, Google Tag Manager, or Facebook Ads conversion tracking. Third-party cookies may be placed on your computer by a service provider to us, for example, to help us understand how our platform is being used. Third-party cookies may also be placed on your device by our business partners to advertise the service to you elsewhere on the Internet. We reserve our rights to modify, add or remove any third-party analytics tools.

4. Legal Basis and purposes of our Data Processing (In Other Words, Why We Collect Your Data)

We are required to identify a legal justification (also known as a lawful basis) for collecting and using your personal information. These include:

· Contract: to fulfil our contract with you

· Legitimate Interests: to pursue our legitimate interests (our justifiable business aims) but only if those interests are not outweighed by your other rights and freedoms (e.g. your right to privacy)

· Legal Obligation: to comply with a legal obligation that we have

· Consent: do something for which you have given your consent.

The table below sets out the lawful basis we rely on when we use your personal information and the specific purpose for use of your personal information. If we intend to use your personal information for a new reason that is not listed in the table, we will update this Privacy Policy.

We may anonymize the personal information we collect (so it can no longer identify you) and then combine it with other anonymous information so it becomes aggregated data. Aggregated data helps us identify trends in the use of our platform. Data protection law does not govern the use of aggregated data and the various rights described below do not apply to it.

Where we need to collect your personal information (for example, in order to fulfil a contract we have with your employer), failure to provide us with your personal information may mean that we are not able to provide you with the services. Where we do not have the information required about you to fulfil an order, we may have to cancel the service ordered.

5. If You Choose Not to Provide Your Information to Us

We respect your privacy and personal choice when it comes to your data. You can choose not to provide us with your personal information. However, this may mean that:

· we will not be able to provide you or your employer with the TRAILD Services or the TRAILD Platform, or be limited in how we can do so

· we will not be able to interact with you

· we may be unable to process and open an account for you

· we will not be able to properly investigate or resolve any complaint you submit

6. Other Ways We Collect, Use and Disclose Your Information

Use and disclosure of your information will only be made in accordance with applicable law.

6.1 Collection from Third Parties

To use your information in accordance with this Privacy Policy, we may also collect your personal information from third parties, including your employer as the Customer, our service providers and organizations with whom we have an agreement to share information for security and fraud prevention purposes.

6.2 Disclosure of Personal Information

We take reasonable steps to ensure that personal information is only accessible by people who have a genuine “need to know” as well as “right to know”.

We may disclose personal information to the following parties:

· our employees, related bodies corporate and the employees of those entities

· our business partners

· third parties and contractors who provide services to us, including customer enquiries and support services, manufacturing services, shipping and freight services, debt-recovery functions, information technology service providers, marketing and advertising services

· payment systems operators

· any third parties authorized by you to receive information held by us

· government, regulatory and law enforcement agencies as required, authorized or permitted by law

· our professional advisers, such as our accountants or legal advisors where we require specialist advice to help us conduct our business

· any actual or potential buyer of our business

Your personal information may be transferred overseas or stored overseas for a variety of reasons (such as to our data hosting and IT service providers based overseas).

6.3 Automated Individual Decision-Making

If you reside in the European Union, United Kingdom or EFTA States, you shall have the right not to be subject to a decision based solely on automated processing, including profiling, as long as the decision is not necessary for entering into, or the performance of, a contract between us, or is not authorised by Union or Member State law to which we are subject, or is not based on your explicit consent. If you wish to exercise your rights please contact us.

7. Transfers overseas

7.1 Australian residents:

If your personal information is sent to a recipient in a country with data protection laws which are at least substantially similar to the APP, and where there are mechanisms available to you to enforce protection of your personal information under that overseas law, we will not be liable for a breach of the APP if your personal information is mishandled in that jurisdiction. If your personal information is transferred to a jurisdiction which does not have data protection laws as comprehensive as Australia’s, we will take reasonable steps to secure a contractual commitment from the recipient to handle your information in accordance with the APP or to a substantially similar standard.

7.2 EU/UK residents:

If you are located in the European Economic Area, the United Kingdom, or Switzerland (the “GDPR Area”), and we provide any personal information about you to our entities outside the GDPR Area and/or any non-GDPR Area service providers or suppliers, we will take appropriate measures to ensure that the recipient protects your Personal Data adequately in accordance with this Privacy Policy and all applicable laws. These measures may include one or more of the following:

· Ensuring that there is an adequacy decision in respect of the country to which the personal information is being transferred, which means that the applicable authority of the GDPR Area has concluded that the laws and practices of the destination country provide adequate protection for personal information.

· The use of standard contractual arrangements with the recipient of personal information which have been approved by the European Commission or the United Kingdom government as appropriate.

· The EU-U.S. Data Privacy Framework (“EU-U.S. DPF”) and the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”).

8. Data retention

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for.

To decide how long to keep personal information (also known as its retention period), we consider the volume, nature, and sensitivity of the personal information, the potential risk of harm to you if an incident were to happen, whether we require the personal information to achieve the purposes we have identified or whether we can achieve those purposes through other means (e.g. by using aggregated data instead), and any applicable legal requirements (e.g. minimum accounting records for tax authorities).

We may keep identity and contact data, information about payments received from you and certain other data (specifically, any exchanges between us by email or any other means) for up to seven years after the end of our contractual relationship with you.

If you browse our website, we keep personal information collected through our analytics tools for only as long as necessary to fulfil the purposes we collected it for.

If you have registered an interest in our platform or services, or you have subscribed to our mailing list, we keep your details until you ask us to stop contacting you.

9. Data Security

9.1 Anonymity, Destruction and De-identification

We will allow our users to transact with us anonymously or by using a pseudonym wherever that is lawful and practicable.

We destroy or permanently de-identify personal information which is no longer needed in accordance with applicable law, unless we are otherwise required or authorized by law to retain the information for a period of time.

9.2 Data Quality and Security

We take reasonable precautions to ensure that the personal information we collect, use, store and disclose is accurate, complete, relevant and up-to-date. However, the accuracy of that information depends to a large extent on the information users provide. That’s why we recommend that you:

· let us know if there are any errors in your personal information

· keep us up-to-date with changes to your personal information such as your name or address

You may change your personal details by using the relevant facility on our platform or by contacting us (contact details provided in clause 11).

While we try our best to ensure your personal information is protected from loss, misuse, unauthorized access, modification or disclosure (via measures such as firewalls, data encryption, virus detection methods, and password restricted access), we cannot guarantee the absolute security of your personal information (it’s the Internet after all!). In the event of a data breach, we will attend to the reporting requirements that apply to us. We cannot accept responsibility for the misuse, loss or unauthorized access to, your personal information where the security of information is not within our control.

9.3 Notifiable Data Breach Scheme (NDBS) and GDPR notification rules

If you reside in Australia, in the event that there is a data breach and we are required to comply with the NDBS under the Privacy Act, we will take all reasonable steps to contain the suspected or known breach where possible and follow the process set out in this clause.

If we have reasonable grounds to suspect that the data breach is likely to result in serious harm to any individuals involved, then we will take all reasonable steps to ensure an assessment is completed within 30 days of the breach or sooner if possible. We will follow the guide published by the Office of the Australian Information Commissioner (if any) in making this assessment. If we reasonably determine that the data breach is not likely to result in serious harm to any individuals involved or any remedial action we take is successful in making serious harm no longer likely, then no notification or statement will be made.

In the case of a personal information breach that affects an EU citizen, we shall without undue delay and where feasible, not later than 72 hours after having become aware of the breach, notify you and the Information Commissioner’s Office, unless the breach is unlikely to result in a risk to your right and privacy.

10. Your Legal Rights and Choices You Have About Your Information

You have specific legal rights in relation to your personal information, which may vary by jurisdiction.

10.1 The following list sets out your legal rights if you are resident in Australia

You may contact us or update your settings to correct, delete or update your personal information. We may, in accordance with the APP, refuse to provide you with access to your personal information if, for instance, granting you such access would have a negative impact on the privacy of another person.

You can ask us to stop using your information, including when we use your information to send you marketing emails or push notifications. These communications may be sent in various forms, including mail, over the phone, via SMS or via email, in accordance with applicable marketing laws. If you opt out of receiving marketing messages from us, we may still send you newsletters and updates about your account. We only send you marketing material if you’ve agreed to it, but if you’d rather we don’t, you can easily unsubscribe at any time.

You may have your information, where technically feasible, sent to another organization, where we hold this information with your consent or for the performance of a contract with you.

We will not normally charge a fee for processing a request unless the request is complex or is resource intensive. We do, however, reserve the right to charge an administration fee if an individual requests access to their personal information more than once in a 3-month period.

10.2 The following list sets out your legal rights if you are resident in the European Economic Area or in the UK

We will do our best to comply with the below, even where we are not legally required to do so. If you wish to exercise any of the rights listed below, please contact legal@traildsoftware.com.

· Access: You must be told if your personal information is being used and you can ask for a copy of your personal information as well as information about how we are using it to make sure we are abiding by the law.

· Correction: You can ask us to correct your personal information if it is inaccurate or incomplete. We might need to verify the new information before we make any changes.

· Deletion: You can ask us to delete or remove your personal information if there is no good reason for us to continuing holding it or if you have asked us to stop using it (see below). If we think there is a good reason to keep the information you have asked us to delete (e.g. to comply with regulatory requirements), we will let you know and explain our decision.

· Restriction: You can ask us to restrict how we use your personal information and temporarily limit the way we use it.

· Objection: You can object to us using your personal information if you want us to stop using it. If we think there is a good reason for us to keep using the information, we will let you know and explain our decision.

· Portability: You can ask us to send you or another organization an electronic copy of your personal information.

· Complaints: If you are unhappy with the way we collect and use your personal information, please contact us using the applicable contact details set out above. We will do our best to resolve your concerns. If we are unable to do so, you may be able to complain to a regulator, depending on your location (see the end of this Privacy Policy for details).

We can decide not to take any action in relation to a request where we have been unable to confirm your identity (this is one of our security processes to make sure we keep information safe) or if we feel the request is manifestly unfounded or excessive. We may charge a fee where we decide to proceed with a request that we believe is unfounded or excessive. If this happens we will always inform you in writing.

10.3 The following sets out your legal rights if you are resident in California

The California Consumer Protection Act (“CCPA”) as amended and applied by the California Privacy Rights Act (“CPRA”) provides consumers (California residents) with specific rights regarding the processing of their personal information (which may also be referred to as personal data). If you are a California resident, you may be subject to the following provisions.

(a) Categories of personal information Collected

As defined by CCPA, the personal information categories collected by TRAILD are:

· business contact information, including identifiers such as name, email address, address, and phone number

· commercial information, such as records of products or services purchased and other transactional data

· Internet or other network or device activity details, such as technical data about your use of our website or applications

· geolocation data, such as your approximate location based on IP address

With regard to personal information provided by you, from third-parties, or from your interactions with our software or applications, we may retain personal information for as long as is needed for the purpose(s) for which it was collected and no longer than is relevant and reasonably necessary. Our retention periods vary based on business, legal and regulatory needs.

(b) Purposes for Collection

TRAILD may collect the categories of personal information described above for business and operational purposes, marketing and commercial purposes, security purposes, and legal and compliance purposes, as further described above. In the preceding 12 months, and where applicable, we may have disclosed each of these categories to our service providers, affiliates, partners and resellers in line with the applicable purpose(s) as described above.

(c) Categories of personal information Sold/Shared

The categories listed in section 3 above.*

* Please note that the definition of ‘sell’ under the CCPA is broad and includes circumstances where TRAILD provides personal information to its service providers (including professional advisors or third-party SaaS vendors) that provide services required for TRAILD to operate the TRAILD Platform and provide the TRAILD Services. TRAILD does not ‘sell’ personal information in any way other than this narrow definition.

(d) Sensitive personal information

In the preceding twelve (12) months, TRAILD has not collected, shared, or sold any sensitive personal information as described in the CCPA, nor does it intend to collect such sensitive personal information. If You believe such personal information of this nature has been shared, processed or collected by Us, please let us know using the channels mentioned below.

(e) Your Rights under the CCPA

· You have the right to know what personal information we collect, use, disclose, share and sell about you.

· You have the right to request we correct personal information we collect and maintain about you if such Personal Data is inaccurate.

· You have the right to request we delete personal information we collect and maintain about you.

· You have the right to opt-out of the sale or sharing of your personal information. TRAILD shares personal information as described above, which may be considered a “sale” of personal information under the CCPA.

· You have the right to limit the use or disclosure of your sensitive personal information. TRAILD does not collect, share, or sell sensitive Personal Data.

· You have the right not to receive discriminatory treatment from TRAILD for exercising your privacy rights under the CCPA.

· You have the right to designate an authorized agent to make a request on your behalf when exercising your privacy rights under the CCPA.

To opt-out of the sharing of your personal information, please submit a request when prompted on our Website or contact us directly at legal@traildsoftware.com. Opting out of sharing your personal information with any third-parties may result in some of the features, benefits, or custom-made solutions that we provide through the Services being affected.

If you are an authorized agent making a request on behalf of a California consumer, please email your request to legal@traildsoftware.com and provide us the first name, last name, and email address of the California consumer you are making the request for. If you do not provide the requested information, we may not be able to identify the California consumer and process the request. The information you provide will be used only to help verify and process the request. We reserve the right to request you demonstrate evidence of your authorization, either by providing us with a signed permission form or a copy of your power-of-attorney document granting you such authority. You may also write us and request via traditional mail to Traild Inc, 260 Newport Center Drive, Suite 100 Newport Beach, CA 92660, Attn. Legal Department.

If we obtained your personal information from a customer or third-party acting on your behalf, you should contact the company or person you provided your information to. If you would no longer like to be contacted by one of our customers or would like to have your personal information corrected, updated, amended, or removed, please contact the customer/business that you interact with directly.

11. Changes to Our Policy

We may change this Privacy Policy from time to time in our sole discretion and if we do, we’ll post any changes on this page. If you continue to use our platform after those changes are in effect, you agree to the new Privacy Policy and all changes made. If the changes are significant, we may provide a more prominent notice. We will request your consent to the changes only if this is expressly required by law.

12. Contact Us

If you have any feedback or questions about this Privacy Policy, any privacy related dealings with us or a possible breach of your privacy or would like further information about our information management practices, you can contact us at legal@traildsoftware.com or at the following addresses:

USA

Traild Inc

260 Newport Center Drive, Suite 100

Newport Beach, CA 92660

Australia and rest of world

Traild Pty Ltd

Floor 1, 5 Errol St

Prahran VIC 3181

If you wish to raise a concern about our use of your information you have the right to do so with your local supervisory authority.

If you are resident in the United Kingdom you can complain to the UK Information Commissioner’s Office: https://ico.org.uk/make-a-complaint/data-protection-complaints/data-protection-complaints/If you are resident in the European Economic Area you can complain to the Data Protection Commission in Ireland: https://forms.dataprotection.ie/contact

If you are resident in Australia you can complain to the Office of the Australian Information Commissioner (OAIC): https://www.oaic.gov.au/

© 2025 TRAILD Pty Ltd ALL RIGHTS RESERVED.

This Privacy Policy was last updated on 13 February 2025

Cookie Notice

1. Different types of cookies

Session vs. persistent cookies: cookies have a limited lifespan. Cookies which only last a short time or end when you close your browser are called session cookies. Cookies which remain on your device for longer are called persistent cookies (these are the type of cookies allow websites to remember your details when you log back onto them).

First party vs third party cookies: cookies placed on your device by the website owner are called first party cookies. When the website owner uses other businesses’ technology to help them manage and monitor their website, the cookies added by the other business are called third party cookies.

Below is a summary of the categories of cookies that may be collected on our websites:

· Strictly necessary cookies: Strictly necessary cookies are essential in order to enable users to move around the website and use its features, such as accessing secure areas of the website.

· Performance cookies: Performance cookies are cookies used to gather data to enhance the performance of a website.

· Functionality cookies: Functionality cookies are used to remember customer selections that change the way the site behaves or looks. You may opt-out of these cookies, but it will impact your experience on the website, and you may need to repeat certain selections each time you visit.

· Analytical cookies: Analytical cookies are used to understand how visitors interact with the website. These cookies help provide information on metrics the number of visitors, bounce rate.

· Targeting cookies or advertising cookies: Targeting cookies are used to deliver content relevant to your interests They are also used to limit the number of times you see certain marketing materials, as well as help measure the effectiveness of those marketing materials. If you do not provide consent for targeting cookies, your computer or internet-enabled device will not be tracked for marketing-related activities.

2. What do we use cookies for?

We use cookies:

· to track how visitors use our website

· to record whether you have seen specific messages we display on our website

· to keep you signed into our website

· where we post content and links to content, to capture and analyze information such as number of views and shares

3. What Cookies do we use?

The cookies we use are:

We can only use cookies with your permission (you will be prompted by a message when you first visit our website, also known as a cookie banner, where you can choose to accept or decline our cookies).

You can update your settings on our website.

You can choose to decline cookies but if you turn off necessary cookies, some pages and functions on our website may not work properly. You can also manage cookies through your browser settings or device settings (your user manual should contain additional information).

You can also delete cookies directly with the relevant third parties (for example, you can disable Google Analytics on their website).

If you have any questions about our cookies, or how we otherwise use your personal information, please visit our Privacy Policy for further details.