Supplemental GDPR and UK GDPR

Transparency Notice If you are located in the European Economic Area (EEA) or the United Kingdom (UK), the following additional information applies regarding the processing of your personal data:

1.  Identity of the Controller
The controller of your personal data is the applicable URUS entity with which you interact, receive Services from, apply for employment with, or otherwise engage. Applicable data controllers may include:

• URUS Group LP
• Valley Agricultural Software Inc.
• Alta Genetics Inc.
• Alta Genetics USA LLC
• Trans Ova Genetics LLC
• The Saskatoon Colostrum Company Ltd.
• GENEX Cooperative
• Leachman Cattle LLC
• Vytelle Holdings Inc.
• AgriWebb Pty Ltd

2.  Categories of personal data
The categories of personal data processed may include:

• Identity and contact information
• Business relationship information
• Financial and payment information
• Technical and online information
• Employment and applicant information
• Compliance and legal information
• Sensitive data where permitted by law
• Communications data

3.  Purposes and Legal Bases
URUS processes personal data for the purposes identified above in Item 2 and on one or more of the following legal basis:

• Performance of a contract;
• Compliance with legal obligations;
• Legitimate interests pursued by URUS or a third party;
• Consent where required by applicable law;
• Protection of vital interests;
• Establishment, exercise, or defense of legal claims

4.  Legitimate Interests
Where processing is based on legitimate interests, those interests may include:
• Operating and improving the Services;
• Information security and fraud prevention;
• Customer relationship management;
• Direct marketing of similar products and services where permitted by law;
• Internal reporting and business administration;
• Corporate transactions and restructuring activities.

5.  Recipients of personal data
URUS may disclose personal data to:

• Affiliates;
• Service providers;
• Professional advisers;
• Recruitment providers;
• Research and commercial partners;
• Governmental, supervisory, and law enforcement authorities;
• Potential acquirers in connection with corporate transactions.

6.  International Transfers
personal data may be transferred outside the EEA or UK, including to the United States and Australia. Where required, URUS implements appropriate safeguards including:

• Standard Contractual Clauses;
• UK International Data Transfer Agreements;
• Adequacy decisions;
• Binding Corporate Rules; or
• Other legally recognized safeguards. 

7.  Retention personal data is retained for the periods described in Section 8 “Data retention” of our Privacy Policy and thereafter only as necessary to comply with legal obligations, resolve disputes, enforce agreements, or protect legal rights.

8.  Rights Subject to applicable law, you may have rights to:

• Access;
• Rectification;
• Erasure;
• Restriction;
• Data portability;
• Objection;
• Withdrawal of consent;
• Not be subject to decisions based solely on automated processing producing legal or similarly significant effects.

9.  Complaints
You have the right to lodge a complaint with the supervisory authority in your country of residence, place of work, or place of the alleged infringement.

Supplemental Terms: Australia

If you are located in Australia, the following additional terms apply to you:

1.  Applicable Law
This supplement applies to personal data subject to the Australian Privacy Act 1988 (Cth), as well as similar acts enacted at the state and territory level.

2.  Your rights
If you are dissatisfied with our response to your request for access to, or correction of, your personal data or your privacy complaint, you may contact the Office of the Australian Information Commissioner by email at enquiriesoaic.gov.au, telephone at +61 1300 363 992 or mail at GPO Box 5218 Sydney NSW 2001.

3.  Transacting anonymously
Where practicable, we will give you the option of not identifying yourself or using a pseudonym when interacting with us. You acknowledge that if you do not provide us with your personal data, we may be unable to provide you with access to certain sections of the Services or effectively respond to your query.

Supplemental Terms: Brazil

If you are located in Brazil, the following additional terms apply to you:

1.  Applicable Law
This supplement applies to personal data subject to Brazil’s Lei Geral de Proteção de Dados (LGPD).

2.  Legal Bases
URUS may process personal data on the basis of:

• Consent;
• Contract performance;
• Legal or regulatory obligations;
• Exercise of rights in judicial, administrative, or arbitration proceedings;
• Legitimate interests;
• Protection of credit.

3.  Rights
Data subjects may request:
• Confirmation of processing;
• Access;
• Correction;
• Anonymization;
• Blocking;
• Deletion;
• Data portability;
• Information about data sharing;
• Withdrawal of consent.

4.  Regulatory Authority
Complaints may be submitted to the Brazilian National Data Protection Authority (“ANPD”).

Supplemental Terms: Canada

If you are located in Canada, including in the province of Quebec, the following additional terms apply to you:

1.  Applicable Law
This supplement applies to personal data subject to Canada’s Personal Information Protection and Electronic Document Act (PIPEDA) and applicable provincial privacy laws, including Quebec Law 25.

2.  Cross-Border Transfers
Your personal data may be transferred outside Canada and become subject to foreign laws.

3.  Individual Rights
Subject to applicable law, you may request:

• Access;
• Correction;
• Withdrawal of consent;
• Information regarding international transfers.

4.  Quebec Residents
Quebec residents may have additional rights including:
• Data portability;
• De-indexing/right to cessation of dissemination where legally applicable;
• Rights relating to automated decision-making.

5.  Information Regarding Commercial Electronic Messages in Canada
If you do not want to be on our mailing lists, you may opt out at any time by either updating your preferences on our various website, or by contacting us at:

URUS Group LP
2323 Crossroads Drive, Suite 500
Madison, Wisconsin 53718 USA
Attn: Data Protection and Privacy Officer
Phone: +1 608-509-9632
Email: [email protected]

Supplemental Terms: People’s Republic of China

If you are located in the People’s Republic of China, the following additional terms apply to you:

1.  Applicable Law
This supplement applies to personal data subject to the People’s Republic of China Personal Information Protection Law (PIPL) and other applicable laws and regulations.

2.  Personal Information
We Collect We may collect identification information, contact information, account information, transaction information, device and technical information, communications information, employment-related information, and other personal information necessary to provide our products and services.

3.  Sensitive Personal Information
Where applicable, we may process sensitive personal information, including financial information, location information, health information, biometric information, or other categories recognized as sensitive under applicable law. We will obtain separate consent where required.

4.  How We Use Personal Information
We process personal information to provide products and services, manage accounts, communicate with users, improve offerings, maintain security, conduct internal business operations, and comply with legal obligations.

5.  Legal Basis for Processing
We process personal information pursuant to consent, contractual necessity, lawful human resources management, legal obligations, emergency situations, publicly disclosed information processed within a reasonable scope, and other lawful basis permitted by applicable law.

6.  Sharing and Disclosure
We may share personal information with service providers, affiliates, professional advisors, regulators, and government authorities as permitted or required by law.

7.  Entrusted Processing
Where third parties process personal information on our behalf, we require them to process information only in accordance with our instructions and applicable legal requirements.

8.  Cross-Border Transfers
Where personal information is transferred outside China, we will comply with applicable cross-border transfer requirements, including obtaining separate consent where required and implementing legally required safeguards.

9.  Retention
We retain personal information only as long as necessary for the purposes described in our Privacy Policy or as required by law.

10.  Security Measures
We implement appropriate technical, administrative, and organizational measures to protect personal information.

11.  Your Rights Under PIPL
Subject to applicable legal limitations, you may have rights to know, access, copy, correct, supplement, delete, restrict processing, withdraw consent, request explanations of processing rules, and request account cancellation where applicable.

12.  Automated Decision-Making
Where automated decision-making is used, we will provide transparency and fairness and permit individuals to exercise applicable rights under law.

13.  Personal Information of Minors
We provide enhanced protection for personal information of minors under age 14 and obtain parental or guardian consent where required.

14.  Personal Information Protection Impact Assessments
We conduct impact assessments where required by law, including for sensitive personal information processing and cross-border transfers.

15.  Contact Information

URUS Group LP
2323 Crossroads Drive, Suite 500
Madison, Wisconsin 53718 USA
Attn: Data Protection and Privacy Officer
Phone: +1 608-509-9632
Email: [email protected]

16.  China Representative (if applicable)
If required by law, we will designate a representative in China and provide contact information in this section.

Supplemental Terms: European Economic Area (EEA)

If you are located in the EEA, the following additional terms apply to you:

1.   Applicable Law
This supplement applies to personal data subject to the General Data Projection Regulation (GDPR).

2.  Representative
If required under Article 27 GDPR, URUS shall appoint an EEA Representative and publish the representative’s contact details.

3.  Supervisory Authorities
Individuals may lodge complaints with their local supervisory authority.

4.  Automated Decisions
Where automated decision-making covered by Article 22 GDPR occurs, URUS will provide information regarding the logic involved, significance, and expected consequences.

5.  International Transfers
Individuals may request information regarding transfer safeguards applicable to their personal data.

Supplemental Terms: India

If you are located in India, the following additional terms apply to you:

1.  Applicable Law
This supplement applies to personal data subject to India’s Digital Personal Data Protection Act (DPDP Act), 2023, the Digital Personal Data Protection Rules, 2025, and other applicable Indian privacy and data protection requirements, in each case as brought into force and amended from time to time. The DPDP Act applies to digital Personal Data processed in India, including data collected offline and subsequently digitized, and may also apply to processing outside India when connected with offering goods or services to individuals in India.
If the European Union General Data Protection Regulation, United Kingdom General Data Protection Regulation, or another applicable European data protection law also applies to a particular processing activity, the applicable provisions of the Global Privacy Policy and any EEA/UK privacy supplement will continue to apply.

2.  Relationship to the Global Privacy Policy
This Supplement should be read together with the Global Privacy Policy.
The Global Privacy Policy describes, among other matters:

• the categories of Personal Data we collect;
• the sources from which we obtain Personal Data;
• the purposes for which we process Personal Data;
• the persons and organizations with whom we disclose Personal Data;
• the countries in which Personal Data may be processed;
• our retention and security practices;
• our use of cookies and similar technologies; and
• how to contact us.

If there is a conflict between this Supplement and the Global Privacy Policy concerning Personal Data subject to Indian data protection law, this Supplement will control to the extent of the conflict. If the GDPR also applies, we will comply with whichever applicable requirement provides the relevant individual with the greater protection, unless compliance with that requirement would conflict with applicable Indian law.

3.  India Data Fiduciary
For purposes of applicable Indian data protection law, the Data Fiduciary responsible for your Personal Data is:

URUS Group LP 2323 Crossroads Drive, Suite 500
Madison, Wisconsin 53718 USA
Attn: Data Protection and Privacy Officer
Phone: +1 608-509-9632
Email: [email protected]

Where more than one URUS Group entity determines the purposes and means of processing, the applicable entity or entities will be identified in the Global Privacy Policy, at the point of collection, or in an activity-specific notice.
If we have been designated as a Significant Data Fiduciary under the DPDP Act, the contact details of our Data Protection Officer are provided below.

4.  Defined Terms
For purposes of this Supplement:

• “Child” means an individual who has not completed eighteen years of age, unless a different definition applies under another law governing the particular processing.
• “Consent Manager” means a person registered with the Data Protection Board of India that enables a Data Principal to give, manage, review, or withdraw consent through an accessible, transparent, and interoperable platform.
• “Data Fiduciary” means a person that, alone or together with others, determines the purpose and means of processing Personal Data.
• “Data Principal” means the individual to whom Personal Data relates. Where applicable, this includes a parent or lawful guardian acting for a Child and a lawful guardian acting for a person with a disability.
• “Personal Data” means data about an individual who is identifiable by or in relation to that data.
• “Processing” includes a wholly or partly automated operation performed on digital Personal Data, such as collection, recording, organization, structuring, storage, adaptation, retrieval, use, alignment, sharing, disclosure, dissemination, restriction, erasure, or destruction. The DPDP Act expressly addresses notice, consent, certain legitimate uses, general Data Fiduciary obligations, children’s data, Significant Data Fiduciaries, individual rights, cross-border transfers, and exemptions. Where the GDPR applies, terms such as “controller,” “processor,” “data subject,” “personal data,” and “special categories of personal data” have the meanings assigned under the GDPR.

5.  Personal Data and Purposes of Processing
We process the categories of Personal Data and for the purposes described in:

1. the Global Privacy Policy;
2. this Supplement;
3. any notice displayed at or before the point of collection;
4. an applicable agreement or service description; and
5. any additional activity-specific privacy notice provided to you.

Where Indian law requires consent, the collection notice will provide an itemized description of the Personal Data requested and the specific purpose for which it will be processed. It will also identify the goods, services, functionality, or uses enabled by the processing, where applicable.
We will not process Personal Data for a new purpose that is incompatible with the notice provided to you unless:

• we first provide any additional notice required by law; • we obtain fresh consent where required;
• the processing is permitted as a legitimate use or under another applicable exception; or
• the processing is otherwise authorized or required by law.

The DPDP Act requires a notice that is understandable independently of other information and that clearly identifies the relevant Personal Data, processing purpose, resulting goods or services, withdrawal method, rights mechanism, and complaint channel.

6.  Grounds for Processing
Processing under Indian law

We will process Personal Data under the DPDP Act where:

• you have given valid consent for a lawful and specified purpose;
• the processing constitutes a legitimate use permitted under applicable Indian law;
• the processing is necessary to comply with a judgment, order, legal obligation, or regulatory requirement;
• the processing is necessary to respond to a medical emergency, disaster, public-order matter, or other circumstance recognized by law; or
• an exemption or other lawful authorization applies.

A reference in the Global Privacy Policy to a GDPR legal basis does not, by itself, establish authority to process Personal Data under Indian law.

Processing where the GDPR also applies
Where the GDPR applies, we rely on one or more of the following legal bases, as appropriate:

• your consent;
• performance of a contract with you or steps taken at your request before entering into a contract;
• compliance with a legal obligation;
• protection of vital interests;
• performance of a task in the public interest or exercise of official authority; or
• our legitimate interests or those of a third party, provided those interests are not overridden by your rights and interests.

If special-category Personal Data is processed under the GDPR, we will also identify an applicable condition under Article 9. If criminal-conviction or offense data is processed, we will comply with Article 10 and applicable national law. The GDPR regulates automated and nonautomated processing within filing systems and establishes controller transparency, accountability, individual-rights, and transfer requirements.

7.  Consent
Where we rely on consent under Indian law, consent will be:

• freely given;
• specific;
• informed;
• unconditional;
• unambiguous;
• limited to the Personal Data necessary for the stated purpose; and
• provided through a clear affirmative action.

We will not treat silence, inactivity, preselected boxes, general acceptance of unrelated terms, or failure to opt out as valid consent where affirmative consent is required.
Consent requests will be presented separately or in a manner that allows them to be clearly distinguished from unrelated terms. We will not make a service conditional on consent to unrelated processing unless the processing is necessary to provide that service or is otherwise permitted by law.

8.  Withdrawal of Consent
You may withdraw consent at any time by:

• using the privacy settings in your account;
• selecting the withdrawal or preference-management link provided with the relevant service;
• using an applicable registered Consent Manager;
• emailing [email protected]; or
• contacting the Grievance Officer identified below.

Withdrawing consent will be as easy as giving consent. Withdrawal will not affect the lawfulness of processing performed before the withdrawal became effective.
After receiving a valid withdrawal request, we will stop the affected processing and instruct our Data Processors to stop processing the relevant Personal Data unless continued processing is required or permitted by law. If the Personal Data is necessary to provide a requested product, service, or feature, withdrawal may limit or prevent our ability to provide it. We will explain any material consequence at or before withdrawal where reasonably practicable.
Where both the DPDP Act and GDPR apply, withdrawal will be effective under both frameworks to the extent processing is based on consent. Processing supported by a separate lawful basis may continue if permitted by applicable law and appropriately disclosed.

9. Children’s Personal Data
General rule

For purposes of the DPDP Act, a Child is an individual under eighteen years of age.
Unless an applicable exemption applies, we will obtain verifiable consent from the Child’s parent or lawful guardian before processing the Child’s Personal Data. We will take reasonable technical and organizational measures to verify:

• the identity and age of the person providing consent; and
• that the consenting person is the Child’s parent or lawful guardian.

Verification may be conducted using reliable identity or age information already held by us, voluntarily provided identity details, an authorized digital identity token, or another legally permitted method. We will collect only the verification information reasonably necessary for that purpose.

Prohibited processing

Unless permitted by an applicable exemption, we will not:

• process a Child’s Personal Data in a manner likely to cause a detrimental effect on the Child’s well-being;
• track or behaviorally monitor a Child;
• direct targeted advertising to a Child; or
• use a Child’s Personal Data to create advertising or behavioral profiles.

Age-assurance statement

By providing a date of birth or other age information, you confirm that the information is accurate. If you are under eighteen years of age, your parent or lawful guardian must complete our parentalconsent process before you use any service that involves the processing of your Personal Data.

GDPR overlay

Where both the GDPR and DPDP Act apply to an online service offered directly to a Child, we will apply the stricter applicable age-verification and parental-authorization requirement. GDPR treatment of a child’s consent to an information-society service may vary by EEA Member State, but this does not reduce India’s under-eighteen requirement when the DPDP Act applies.
Verifiable parental consent, restrictions on detrimental processing, and restrictions on tracking, behavioral monitoring, and targeted advertising form core protections for Children under the DPDP framework, subject to prescribed exemptions.

10.  Persons with Disabilities Acting Through Lawful Guardians
Where a person with a disability cannot lawfully act independently and a guardian exercises rights or provides consent on that person’s behalf, we may verify:

• the guardian’s identity;
• the identity of the Data Principal; and
• the guardian’s legal authority under applicable guardianship or disability law.

We will limit the information collected for verification to what is reasonably necessary and permitted by law.

11.  Data Principal Rights
Subject to applicable law, a Data Principal may request:

1. Access and information: A summary of the Personal Data being processed and relevant processing activities, together with information concerning persons or entities with whom the Personal Data has been shared where required by law.
2. Correction: Correction of inaccurate or misleading Personal Data.
3. Completion: Completion of incomplete Personal Data.
4. Updating: Updating of Personal Data that is no longer current.
5. Erasure: Erasure of Personal Data that is no longer needed for the specified purpose, unless retention is required or permitted by law.
6. Consent withdrawal: Withdrawal of consent for consent-based processing.
7. Grievance redressal: Submission and resolution of a complaint concerning our processing.
8. Nomination: Nomination of another individual to exercise applicable rights in the event of death or incapacity.
9. Complaint: Submission of a complaint to the Data Protection Board of India after using the applicable internal grievance process. The DPDP Act provides rights concerning access to processing information, correction, completion, updating, erasure, grievance redressal, and nomination.

12.  Additional Rights Where the GDPR Applies

If the GDPR applies to the relevant processing, you may also have the right to:

• object to processing based on legitimate interests or direct marketing;
• restrict processing;
• receive qualifying Personal Data in a structured, commonly used, machine-readable format;
• transmit qualifying Personal Data to another controller;
• obtain information about applicable international-transfer safeguards;
• object to or obtain safeguards regarding certain solely automated decisions;
• lodge a complaint with an applicable EEA or UK supervisory authority; and
• withdraw consent without affecting prior lawful processing.

GDPR rights may be subject to statutory conditions and exceptions. The GDPR provides broader rights in certain respects, including portability, restriction, objection, erasure, breach information, and safeguards relating to automated decision-making.

13.  Submitting and Verifying a Request

Requests may be submitted through:

URUS Group LP 2323 Crossroads Drive, Suite 500
Madison, Wisconsin 53718 USA
Attn: Data Protection and Privacy Officer
Phone: +1 608-509-9632
Email: [email protected]

Please provide sufficient information for us to:

• identify you;
• identify the relevant account, product, or interaction;
• understand the right you wish to exercise; and
• reasonably verify that you are the Data Principal or an authorized representative.

We may request additional information if reasonably necessary to verify identity, prevent fraud, protect another person’s privacy, or confirm an agent’s authority. We will not require Personal Data that is disproportionate to the request.
We may refuse, limit, or defer a request where permitted by law, including where compliance would adversely affect another person’s rights, conflict with a legal obligation, compromise security, undermine an investigation, or require erasure of information we are legally required to retain. Where appropriate and legally required, we will explain the basis for our decision.

14.  Grievance Redressal and Response Timelines
We maintain a readily available grievance-redressal mechanism.
Internal service levels
Unless a shorter period is required by applicable law, we will endeavor to:

• acknowledge a privacy request or grievance within fifteen calendar days;
• request any reasonably necessary verification or clarification promptly;
• resolve routine requests within sixty calendar days; and
• resolve all grievances within the maximum period prescribed by applicable Indian law.

India statutory timeline

We will respond to and resolve grievances within the period prescribed under the DPDP Act and applicable DPDP Rules.
Before escalating a grievance to the Data Protection Board of India, you may be required to exhaust the grievance-redressal process offered by us.

GDPR timeline

Where the GDPR applies, we will respond to a qualifying rights request without undue delay and ordinarily within one month after receipt. That period may be extended by up to two additional months where permitted due to the complexity or number of requests. If extended, we will notify you within the initial one-month period and explain the reason.

Controlling deadline

Where both Indian law and GDPR apply, we will use the shorter applicable response period unless a lawful extension applies.

15. Data Retention and Erasure
We retain Personal Data only for as long as necessary to:

• fulfill the specified processing purpose;
• provide the relevant product or service;
• maintain security, fraud-prevention, and audit records;
• comply with legal, tax, employment, accounting, regulatory, and contractual obligations;
• establish, exercise, or defend legal claims; or
• satisfy another lawful retention requirement.

When consent is withdrawn or the stated purpose is no longer served, we will erase the relevant Personal Data and cause our Data Processors to erase it unless retention is required or permitted by law. Applicable statutory log-retention, cybersecurity, sectoral, tax, employment, and litigation-hold requirements will take priority over an erasure request to the extent required by law.
Where GDPR also applies, our retention periods and criteria will reflect storage limitation, purpose limitation, data minimization, applicable limitation periods, and the necessity of retaining the Personal Data for each disclosed purpose.

16.  Cross-Border Transfers and Localization
Transfers from India
Personal Data may be processed in India and in other countries where URUS Group, its affiliates, Data Processors, cloud providers, professional advisers, or business partners operate.
We may transfer Personal Data outside India only where the transfer is permitted under applicable Indian law. We will comply with any conditions imposed by the Central Government concerning the transfer of Personal Data to a foreign country, territory, entity, or class of entities.
We may also maintain Personal Data in India where localization is required by:

• a Central Government notification;
• the Reserve Bank of India or another financial regulator;
• health, telecommunications, insurance, employment, cybersecurity, or other sector-specific law;
• a governmental or judicial direction; or
• a binding contractual or regulatory obligation.
Nothing in this Supplement is intended to represent that all Personal Data must be stored in India. Rather, we will apply data-localization requirements to the relevant data, system, entity, or regulated activity where Indian law requires local storage, local copies, access controls, or restrictions on offshore processing.

Transfers subject to the GDPR

Where Personal Data subject to GDPR is transferred from the EEA, UK, or Switzerland to India or another country without an applicable adequacy determination, we will use a lawful transfer mechanism, as applicable, such as:

• European Commission Standard Contractual Clauses;
• the UK International Data Transfer Agreement or UK Addendum;
• an applicable adequacy decision;
• Binding Corporate Rules;
• an approved certification or code mechanism; or
• a legally permitted derogation for a specific transfer.

Where required, we will assess the laws and practices of the destination country and implement supplementary contractual, organizational, or technical safeguards.

17.  Grievance Officer and Data Protection Contacts

India Grievance Officer
URUS Group LP 2323 Crossroads Drive, Suite 500
Madison, Wisconsin 53718 USA
Attn: Data Protection and Privacy Officer
Phone: +1 608-509-9632
Email: [email protected]

Data Protection Officer
If URUS Group has been designated as a Significant Data Fiduciary, or where appointment is otherwise required:

URUS Group LP 2323 Crossroads Drive, Suite 500
Madison, Wisconsin 53718 USA
Attn: Data Protection and Privacy Officer
Phone: +1 608-509-9632
Email: [email protected]

The Data Protection Officer or other authorized contact will be based in India where required by applicable Indian law and will serve as the contact point for questions concerning processing and rights.

EU or UK Representative
Where required by GDPR Article 27 or the corresponding UK provision:

URUS Group LP 2323 Crossroads Drive, Suite 500
Madison, Wisconsin 53718 USA
Attn: Data Protection and Privacy Officer
Phone: +1 608-509-9632
Email: [email protected]

18.  Security and Personal Data Breaches
We maintain reasonable technical and organizational security safeguards appropriate to the nature, scope, context, and risks of processing. These may include:

• encryption, masking, tokenization, or pseudonymization;
• identity and access management;
• logging and monitoring;
• network and application security;
• backup and recovery controls; • vulnerability and patch management;
• vendor security requirements;
• incident-response procedures;
• employee confidentiality obligations; and
• privacy and security training.

If a Personal Data breach occurs, we will provide notices to the Data Protection Board of India, affected Data Principals, GDPR supervisory authorities, or affected individuals where and within the time required by applicable law. We may provide information in phases as facts become available.
Where multiple regimes apply, we will use a coordinated incident-response process that satisfies each applicable notification standard.

19.  Automated Processing and Artificial Intelligence
We may use automated systems or artificial intelligence to support fraud detection, security, analytics, customer service, product improvement, recruitment, or other purposes described in the Global Privacy Policy. Where GDPR applies and a decision is based solely on automated processing that produces legal or similarly significant effects, we will provide the information and safeguards required by applicable law, which may include:

• meaningful information about the logic involved;
• information about the significance and anticipated consequences;
• an opportunity to express your point of view;
• human review; and
• the ability to contest the decision.

Where we are a Significant Data Fiduciary under Indian law, we will conduct any required due diligence concerning algorithmic software used to host, display, disseminate, modify, or otherwise process Personal Data, including measures intended to reduce risks to Data Principals.

20.  Languages and Accessibility
This Supplement and applicable collection notices will be provided in clear, plain, and reasonably accessible language. You may request an applicable notice, consent request, or rights interface in:

• English; or
• any language listed in the Eighth Schedule to the Constitution of India that we are required to make available under applicable law.

Language request: [email protected]
Where translations are provided, we will take reasonable steps to ensure that the translated version accurately communicates:

• the Personal Data requested;
• each processing purpose;
• the relevant goods, services, or features; • how to withdraw consent;
• how to exercise rights;
• how to submit a grievance; and
• how to complain to the Data Protection Board.

The DPDP framework requires notices and consent interfaces to be understandable, accessible, and available in English or an applicable Eighth Schedule language. If there is an inconsistency among translated versions, the version that provides the Data Principal with the greater applicable protection will be used to the extent permitted by law. The English version will not override a mandatory right or disclosure accurately communicated in another required language.
We will also take reasonable measures to make privacy information and request channels accessible to individuals with disabilities.

21.  Complaints to Regulators
We encourage you to contact our Grievance Officer first so that we can attempt to resolve your concern. After exhausting the applicable internal grievance process, you may submit a complaint to the Data Protection Board of India.
If GDPR applies, you may also lodge a complaint with the competent supervisory authority in the EEA country or UK jurisdiction where you live, work, or believe the violation occurred.

22.  Data Principal Responsibilities
When providing Personal Data or exercising rights, you should:

• comply with applicable law;
• provide authentic and accurate information;
• avoid impersonating another person;
• avoid suppressing material information when submitting documents or identifiers;
• furnish only information that is reasonably necessary; and
• avoid submitting frivolous or knowingly false grievances or complaints.

Nothing in this section limits a right that cannot lawfully be waived.

23.  Changes to this Supplement
We may update this Supplement to reflect:

• changes in law or regulatory guidance;
• commencement of additional DPDP Act or DPDP Rules provisions;
• changes in our processing activities;
• changes in our organizational structure; or
• improvements to our privacy program.

We will post the revised Supplement with a new “Last Updated” date. Where required, we will provide additional notice or obtain fresh consent before materially changing consent-based processing.

Supplemental Terms: Italy

If you are located in Italy, in addition to the information in the EEA Supplement, the following additional terms apply to you:

1.  Applicable Law
This Italy Supplement applies to the processing of personal data of individuals located in Italy and supplements the URUS Global Privacy Policy. In the event of any conflict between this Supplement and the Global Privacy Policy, this Supplement shall control with respect to the processing of personal data subject to Italian law.
This Supplement is provided pursuant to Regulation (EU) 2016/679 and Legislative Decree No. 196/2003, as amended by Legislative Decree No. 101/2018 (“Italian Privacy Code”).

2.  Identity of the Controller
For individuals located in Italy and for the products and services covered by this Privacy Policy, the controller of personal data is:

Alta Italia S.r.l.

If multiple URUS entities jointly determine the purposes and means of processing, those entities may act as joint controllers in accordance with Article 26 GDPR. Upon request, you may obtain additional information regarding the allocation of responsibilities between joint controllers.

3.  Data Protection Officer
You may contact our Data Protection Officer regarding any matter relating to the processing of your Personal Data:

URUS Group LP 2323 Crossroads Drive, Suite 500
Madison, Wisconsin 53718 USA
Attn: Data Protection and Privacy Officer
Phone: +1 608-509-9632
Email: [email protected]

If URUS appoints a local EU contact point, such contact details will be published on our website.

4.  Direct Marketing
Where required under applicable law, including the GDPR, the Italian Privacy Code, and applicable electronic communications laws, URUS will obtain your consent before sending electronic marketing communications.
Where permitted by applicable law, URUS may send communications concerning products or services similar to those previously purchased or requested by you.
You may object to marketing communications at any time by:

• clicking the unsubscribe link contained in the communication;
• updating your account preferences; or
• contacting URUS using the contact details provided in the Privacy Policy.

Your objection to marketing communications will be honored free of charge.

5.  Cookies and Similar Technologies
URUS uses cookies and similar technologies as described in the Privacy Policy and the applicable Cookie Notice.
For visitors located in Italy:

• non-essential cookies and similar tracking technologies will be used only after obtaining any consent required by applicable law;
• cookie preferences may be modified at any time through the cookie preference center made available on the relevant URUS website; and
• refusal of optional cookies will not prevent access to the website, except where a particular cookie is strictly necessary for the provision of a requested service.

Additional information regarding cookies, retention periods, third-party providers, and preference management is available in the URUS Cookie Notice.

6.  Special Categories of Personal Data
Where URUS processes special categories of Personal Data concerning individuals located in Italy, such processing will occur only where a lawful condition under Article 9 GDPR and applicable provisions of the Italian Privacy Code applies.
Such processing may occur, for example, in connection with:

• employment obligations;
• workplace health and safety requirements;
• disability accommodations;
• legal claims; or
• explicit consent where required by law.

7.  Supervisory Authority
Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with the competent supervisory authority.
For Italy, the competent supervisory authority is:

Garante per la Protezione dei Dati Personali
Piazza Venezia 11
00187 Rome, Italy
Website: https://www.garanteprivacy.it

You may also lodge a complaint with the supervisory authority of your habitual residence, place of work, or the place of the alleged infringement, where permitted by law.

8.  Language
Where required by applicable law or where services are specifically directed to individuals located in Italy, URUS may make this Supplement available in Italian. In the event of inconsistency between translated versions, the version required by applicable law shall govern.

Supplemental Terms: Japan

If you are located in Japan, the following additional terms apply to you:

1.  Applicable Law
This supplement applies to personal data subject to Japan’s Act on the Protection of Personal Information (APPI).

2.  Foreign Transfers
Where personal data is transferred outside Japan, URUS will provide information required under APPI regarding transfer safeguards where applicable.

3.  Requests
Subject to applicable legal exceptions, individuals may request:

• Disclosure;
• Correction;
• Addition;
• Deletion;
• Suspension of use;
• Suspension of third-party sharing.

Supplemental Terms: Mexico

If you are located in Mexico, the following additional terms apply to you:

1.  Applicable Law
This supplement applies to personal data subject to the Mexican Federal Law on Protection of personal data Held by Private Parties.

2.  ARCO Rights
Individuals may exercise rights of:

• Access;
• Rectification;
• Cancellation;
• Opposition.

3.  Consent
Where required by law, consent may be obtained for specific processing activities.

Supplemental Terms: New Zealand

If you are located in New Zealand, the following additional terms apply to you:

1.  Applicable Law
This supplement applies to personal data subject to the New Zealand Privacy Act 2020.

2.  Overseas Disclosure
Where personal data is disclosed outside New Zealand, URUS takes reasonable steps to ensure comparable privacy protection.

3.  Complaints
Individuals may contact the New Zealand Privacy Commissioner.

Supplemental Terms: Singapore

If you are located in Singapore, the following additional terms apply to you:

1.   Applicable Law
This supplement applies to personal data subject to Singapore’s personal data Protection Act (PDPA).

2.  Consent
Processing may occur with consent or in reliance upon applicable statutory exceptions.

3.  Withdrawal
Individuals may withdraw consent, subject to legal and operational limitations.

4.  Transfers
URUS will take reasonable steps to ensure comparable protection when personal data is transferred outside Singapore.

Supplemental Terms: South Africa

If you are located in South Africa, the following additional terms apply to you:

1.  Applicable Law
This supplement applies to personal data subject to South Africa’s Protection of Personal Information Act (POPIA).

2.  Rights
Data subjects may:

• Access personal data or personal information;
• Request correction;
• Object to processing;
• Submit complaints to the Information Regulator under POPIA.

3.  Cross-Border Transfers
URUS will use appropriate safeguards when transferring personal data or personal information outside South Africa.

Supplemental Terms: United Kingdom (UK)

If you are located in the United Kingdom, the following additional terms apply to you:

1.  Applicable Law
This supplement applies to personal data subject to the United Kingdom’s General Data Protection Regulation (UKGDPR). References in our Privacy Policy to GDPR include the UKGDPR where applicable.

2.  Complaints
Individuals may submit complaints to the UK Information Commissioner’s Office (ICO).

3.  International Transfers
URUS may rely upon:

• UK International Data Transfer Agreements (IDTAs);
• UK Addenda to SCCs; or
• UK adequacy regulations.

Supplemental Terms: United States

Depending on where you reside in the United States, the following terms may apply to you.

 1.  Collection, use, and disclosure of personal data