Privacy Policy – B2B

1. Introduction

This Privacy Policy describes how Nick Academy, owned and operated by K.F.F.E Kids Fun Exploration Experience Ltd. ("KFFE", "we", "us" or "our"), collects, uses and discloses personal data in connection with the Nick Academy website and with our activity vis-a-vis business, commercial and institutional users who browse the site or contact us through it.

This commercial Nick Academy website (the "Site") is intended for a business, commercial and institutional audience, including representatives of distributors, marketers, agents, business partners, resellers, educators, schools, educational institutions, local authorities and other professional parties ("you" or "your") seeking to evaluate, promote, market, distribute, purchase, implement or make institutional or business use of Nick Academy products (the "Services").

When you contact us through the Site, including by means of a contact request form, we aim to collect and process only the information required for handling the inquiry, making contact, scheduling a demonstration of Nick Academy or of the application, and answering questions.

"Personal data" or "personal information" means information that identifies, relates to, describes, or that can reasonably be linked to an identified or identifiable natural person, including representatives, employees, contact persons, educators, marketers, distributors and other users acting on behalf of or for a corporation, institution or business or institutional entity that uses the Services or contacts us in connection with them.

If we make material changes to this Privacy Policy, we will notify you (where appropriate) and will endeavor to obtain your renewed consent, if required.

Qualification regarding the privacy policy of this marketing site

For clarity, this Privacy Policy applies to browsing the Site and to inquiries submitted to us through it, and does not apply to actual use of the Nick Academy application or of the end services provided through it, to which separate, dedicated privacy policies, privacy notices or privacy documents may apply, according to the type of use, the manner of use, the type of user and their age, including with respect to minors. The marketing site that is the subject of this Privacy Policy is not intended for children, and we do not knowingly collect personal information from children through it. The Nick Academy application, intended for children ages 6-12, operates under separate privacy, safety and data governance protections, in accordance with the nature of the service and applicable law.

For example, with respect to use of the Nick Academy application by minors, KFFE participates in the PRIVO Kids Privacy Assured program under Safe Harbor certification pursuant to COPPA, operated by PRIVO, an independent body that oversees the protection of children's privacy online. Any reference to the certification, its validity or its scope is subject to the terms of the program and to PRIVO's determinations, as they may be from time to time.

If you have questions regarding children's privacy, you may contact us using the contact details set out in this policy, and where necessary also directly to PRIVO at: privacysupport@privo.com.

2. What personal data do we collect?

We collect personal data from you in the following categories:

Information you provide to us

When you fill in a contact request form on the Site or contact us in connection with the Services, we may collect the following details:

• Your full name;
• A description of your role at the corporation or institution;
• The name of the corporation or institution; and
• A contact phone number.

Other data we collect automatically through the Site

We collect certain information automatically when you use the Site in order to operate, maintain, secure and improve it, as well as to measure performance and understand how it is used. This information may include, among other things, IP address, browser type, operating system, pages you visited, browsing duration, site usage data, and similar technical data. This information is collected by means of cookies, similar technologies and site analytics tools. For more information, please see our Cookies Policy.

3. Your choices – providing information

You are under no legal obligation to provide us with any information, but in certain cases we will need information, including personal information, in order to contact you, schedule a demonstration, respond to your inquiry, manage the business or institutional relationship with you, or provide you with information about the Services.

If the processing is based on your consent, including for the purpose of receiving marketing communications, you may withdraw your consent at any time. In addition, you may choose not to provide us with certain information, but in such a case we may not be able to handle your inquiry or provide you with certain information or services.

If you do not wish to receive marketing communications from us, you may withdraw your consent or request removal from mailing lists at any time, in accordance with applicable law.

4. How we use personal data

We process personal data in connection with the Site and with inquiries received through it for the following purposes:

• To get back to you following your inquiry and to handle contact requests;
• To schedule a demonstration of Nick Academy or of the application, provide information about the Services and answer questions;
• To operate, run, maintain, secure and improve the Site and the Services;
• To measure, analyze and understand the use of the Site, including on an aggregated and anonymous basis;
• To comply with the legal, regulatory and compliance obligations applicable to us;
• To send you marketing offers or mailings only if you have given your express consent, in accordance with law;
• To manage the business, commercial or institutional relationship with you or with the entity you represent, including in connection with your interest in the Services;
• To perform operational, statistical and product analyses to improve the Site and the Services; and
• To protect our rights, our systems, our users and the security of the Site and the Services.
• Security, fraud prevention and risk management purposes.

We aim to ensure that all data we process remains accurate, complete and relevant to the stated purposes for which it was processed. We do not sell, rent, lease or disclose personal information to third parties in exchange for monetary or other valuable consideration for commercial purposes. We will not send you commercial or marketing offers unless we have been expressly authorized to do so, where required under applicable law.

5. Sharing and disclosure

Service providers and other parties

We share personal data with our service providers and with other professional parties as needed, for the purposes set out in this Privacy Policy.

We may transfer personal data to:

• Hosting and cloud providers for storing the Site and the information;
• Site analytics tools, including Google Analytics, for measuring the Site's performance and understanding its use;
• Lead management and customer relationship management (CRM) systems for handling inquiries, getting back to interested parties, scheduling demonstrations and managing the business or institutional relationship;
• Legal, business, accounting and other professional advisors, as needed;
• Affiliated companies, business partners or suppliers who assist us in operating the Site or managing our activity, subject to necessity and applicable law;
• Competent authorities, courts or law enforcement bodies, where we are required to do so by law, court order or legal process;
• Third parties where required to protect our rights, our property, the security of our systems, or users and others.

We do not sell your personal data to third parties for commercial purposes. In addition, we may disclose or transfer personal data in the context of a corporate transaction, including a merger, share acquisition, asset acquisition, reorganization or similar transaction, in which the personal data may be included in the transferred assets, all subject to applicable law. We may also transfer or disclose personal data if we are required to do so to comply with a legal, regulatory, contractual, audit or compliance obligation, in the course of a legal or regulatory proceeding or investigation, or if required to enforce our rights, protect our rights, property or safety, or the rights, property or safety of others. For the avoidance of doubt, KFFE may transfer, share or disclose non-identifying, anonymous or aggregated information at its discretion and subject to applicable law.

6. Where do we store your data?

We store your personal data in several locations around the world.

We store your personal data on servers owned or controlled by KFFE, or processed by third parties on behalf of KFFE, using recognized cloud service providers (see the next section regarding international transfers).

7. International data transfers (EU Data Subjects)

We transfer personal data within and to the European Economic Area (EEA), to the US, to Israel and to additional locations, while maintaining appropriate safeguards.

Personal data of the European Union and the United Kingdom is transferred, stored and processed at a destination outside the European Economic Area (EEA). This includes transfer to our headquarters in Israel, a jurisdiction considered adequate by the European Commission, as well as to the US, which is currently not considered adequate. Where your data is transferred outside the EEA, we will take all steps reasonably necessary to ensure that your data is subject to appropriate safeguards, including entering into data protection agreements requiring the data recipients to comply with data protection laws and adequate data security. Transfers to Israel are made on the basis of an adequacy decision of the European Commission. Transfers to the US are made on the basis of the Standard Contractual Clauses published by the European Commission, on a contractual basis. For more information about these safeguards, please contact us as set out below.

We transfer personal data to locations outside the EEA, including, in particular, to the US and Israel, in order to:

• Store or back up the information;
• Enable us to provide you with the Services and perform our contract with you;
• Comply with legal, audit, ethical or compliance obligations that require us to make such transfer;
• Facilitate the operation of our group's business, where it serves our legitimate interests and we have not found that they are overridden by your rights;
• Serve our customers in multiple jurisdictions; and
• Operate our affiliated companies efficiently and optimally.

8. Data retention

General. We retain personal data in accordance with our data retention policy, where required in order to handle inquiries, manage business or institutional relationships, operate the Site, meet our obligations, protect our rights and manage our business.

KFFE will retain personal data it processes only for as long as required, in our view, to achieve the purposes for which the data was collected, and as necessary to comply with legal, regulatory, accounting, security and other obligations, resolve disputes and enforce agreements.

Inquiry data, contact data and site usage data will be retained for the period reasonably required for handling the inquiry, managing the business or institutional relationship, operating the Site, business records, security and compliance. Thereafter, the data will be deleted, anonymized or retained in aggregated form, where permitted under applicable law. Some data may also be retained in backups or on our service providers' servers until deleted in accordance with the relevant retention cycles.

9. Cookies, tracking technologies and site analytics

KFFE does not sell personal information and does not use visitors' personal information for targeted advertising without their consent, where such consent is required under applicable law.

The Site is intended for business, commercial and institutional users. We use cookies, similar technologies, local storage means, including Local Storage, and site analytics tools to enable functionality, ensure security, measure performance, understand the use of the Site and improve it.

We use the following categories of cookies, storage means and similar technologies:

• Essential cookies and storage means required for the operation, security, accessibility and core functionality of the Site;
• Cookies, storage means and analytics tools that help us understand the use of the Site, measure performance and improve the Site and the Services, and, if required by applicable law, will be activated only subject to your consent;
• Third-party cookies, storage means or similar technologies, if we use external services for the operation of the Site, its accessibility, measuring its performance or understanding its use.

Further information about our use of cookies, local storage means, similar technologies and site analytics tools, as well as the options available to you in that regard, is set out in our Cookies Policy, to which reference may be made. Among other things, these technologies may be used to remember whether a component, notice or window has already been displayed to you on the Site, to temporarily store information you entered until its submission is completed, and to store display and accessibility preferences you selected. Functional cookies and local storage means used for the operation of the Site, functionality, security or accessibility are not used, in themselves, for advertising, targeting or marketing tracking. Some of the cookies or similar technologies may be operated by third-party providers, which are also subject to their own privacy policies.

10. Data security

We take data security very seriously, invest in security systems and train our team. In the event of a breach, we will notify the appropriate parties as required by law.

We take great care in implementing, enforcing and maintaining the security of the personal data we process. KFFE implements, enforces and maintains security measures, technologies and policies to prevent unauthorized or accidental access to, or destruction, loss, modification, use or disclosure of, personal data. We also take steps to monitor compliance with this policy on an ongoing basis. We use industry-standard SSL (Secure Socket Layer) encryption for the transfer of personal data. We also take industry-standard steps to ensure that our Site, application and Services are secure. Additional security measures include, among others, firewalls and physical access controls to buildings and files.

However, please note that no security measure is perfect or impenetrable, and we cannot guarantee that unauthorized access, leaks, viruses and other data security breaches will never occur.

Within KFFE, we limit access to personal data to team members who: (i) need access so that KFFE can fulfill its obligations, including under its agreements, and as described in this Privacy Policy; and (ii) have been appropriately trained, from time to time, with respect to the requirements applicable to the processing, handling and treatment of the personal data; and (iii) are subject to confidentiality undertakings, where required under applicable law.

KFFE will act in accordance with its policy and with applicable law to promptly notify the relevant authorities and data subjects in the event that personal data processed by KFFE is lost, stolen, or subject to unauthorized access, all in accordance with applicable law and under the guidance of a competent authority. KFFE will promptly take reasonable remedial measures.

11. Privacy rights

Depending on the law applicable to your personal data, you may have certain rights with respect to your personal data, including rights of access, rectification, erasure, restriction of processing, objection to processing, data portability and information rights, all in accordance with applicable law. We will honor any lawful request to exercise these rights.

Data subjects whose data is subject to the GDPR have rights under the GDPR and under local laws, including, in various circumstances, rights to data portability, the right of access to data, rectification of data, objection to processing, and erasure of data. Where processing is based on consent, you have the right to withdraw your consent at any time.

Residents of certain countries or jurisdictions, including the European Union, the United Kingdom or certain US states, may have additional rights under applicable privacy laws.

If we process personal data in connection with an inquiry or with a business, commercial or institutional relationship with you or with the entity you represent, certain requests to exercise privacy rights may also need to be made in coordination with that entity, as applicable and in accordance with applicable law.

In appropriate cases, and subject to applicable law, we may not be able to fully comply with a request where doing so would harm the rights of others, trade secrets, legal privilege, compliance requirements, data security, or other contractual or legal obligations.

To exercise applicable rights, you may do so by contacting KFFE. Please note that KFFE may be required to carry out a process to identify the data subject exercising their rights. KFFE may keep records of the exercise of these rights for compliance and audit purposes. Please note that personal data may be deleted or retained in aggregated form without linkage to identifiers or personal data, in accordance with technical and commercial capability. Such information may continue to be used by KFFE.

Data subjects in the European Union have the right to lodge a complaint with a data protection supervisory authority in their place of habitual residence. If the supervisory authority does not handle the complaint, you may have a right to an effective judicial remedy.

If you have questions or requests regarding privacy, the processing of personal data or the exercise of your rights, you are welcome to contact us as described below.

12. General

Our policies and procedures are constantly evolving and improving, and we welcome any suggestion for improvement, question, complaint or comment regarding this Privacy Policy. You are welcome to contact us (details below) and we will make an effort to respond within a reasonable time.

You may contact us at any time regarding your personal data, including to exercise rights, request information or update details in connection with your browsing of the Site or your inquiries to us through it.

You may contact KFFE's privacy protection representative at: support@nick.academy.