California, Utah, Colorado, Connecticut, Virginia, Oregon and Texas Supplemental QA Group Privacy Notice

A. INTRODUCTION

This California, Utah, Colorado, Connecticut, Virginia, Oregon and Texas Supplemental QA Group Privacy Notice (the “Supplement”) applies to the QA Group Website (“Website”) and the cloud-based technology learning platform also accessible through that Website, the video players used to view QA courses, and the mobile applications made accessible by QA (“Platform”), and together with the Website, collectively, the (“Site”), all owned and operated by the QA Group, including but not limited to QA Limited, QA USA, Inc., a Delaware limited liability company, and QAHE Limited (“QA”, “we”, or “us”). This Supplement supplements our QA Group Privacy Policy. Please read the Supplement in conjunction with our QA Group  Privacy Policy Capitalized words not defined in this Supplement will have the definition provided to them in the QA Group Privacy Policy. This Supplement takes precedence, where applicable, over the QA Group Privacy Policy with respect to your Personal Information for California, Utah, Colorado, Connecticut, Virginia, Oregon and Texas residents if there is a conflict between the two.
In this Supplement, when we talk about “Personal Information,” we mean information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

B. CALIFORNIA

I. Overview

This notice is intended to describe our practices and your rights under the California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act (“CPRA”) (Civil Code Section 1798.100, et seq.) (collectively “California Law”). These additional rights and other terms are only available to California residents about whom we collect Personal Information. To learn more about QA’s privacy principles, see QA Group Privacy Policy.

II. What Personal Information We Collect

You have the right to know what kinds of Personal Information QA is collecting. We collect the following categories of Personal Information about consumers:

For more information on the Personal Information we collect, please see the “Personal Data We Collect” section of our QA Group Privacy Policy.

III. How We Collect and Use Your Personal Information

You have the right to know how Personal Information is obtained, how it is used, and our business purposes for that use. We collect each of the categories of your Personal Information listed above as described in the “Personal Data We Collect” section of our QA Group Privacy Policy.  We may use each of the categories of Personal Information described above for the business purposes described in the “How We Use Your Personal Data” section of our QA Group Privacy Policy.

IV. How We Disclose, Share, and Sell Your Personal Information

You have the right to know if your personal information is disclosed, shared, or sold to any third parties. In addition to the information provided below, more information is available in the “Reasons We Share Personal Data” section of our QA Group Privacy Policy.

a. Disclosures

We may disclose your Personal Information with third parties for business or commercial purposes with the following categories of third parties:

• Internally: QA may disclose your Personal Information with affiliates, business partners, employees, and other parties to provide you with support and other services.
• With Our Service Providers and Contractors: We sometimes retain third parties to perform certain business-related functions such as sending e-mail on our behalf, payment processing, or conducting market research. When we employ another company to perform a function of this nature, we only provide them with the Personal Information that they need to perform their specific function. We also share user engagement information derived from our Platform with third parties. For example, when you view a course related to a specific technology vendor, we share information such as the number of course minutes viewed, Role and Skill IQ levels, hands-on course engagement, and other related information with that technology vendor. These third parties are not permitted to use your Personal Information that we share with them for any purpose other than as required for them to provide services to us.
• Advertisers and Advertising Networks: Our website may include social media plug-ins (such as the Facebook “like” button), widgets (such as the “Share” button), or other tools made available by third parties such as social media companies that may result in data being collected or shared between us and the third parties for various purposes including to select and serve personalized advertisements to you and others. These third parties may set and access their own cookies, web beacons, and embedded scripts on your device, and they may otherwise collect or have access to Personal Information about you, including unique personal identifiers such as an IP address, and they may share that data with us. Your interactions with these third parties are governed by the third parties’ privacy policies over which we have no influence.
• Business Plans and Company Partnership Subscriptions: We partner with certain third parties to provide our services to their employees or their group members. As part of such partnerships, a third party may pay for the subscription for its employees or group members or otherwise contract with QA to make your subscription available to you, and QA may share Personal Information about your use of our services with the third party. If your subscription was provided by your employer or group sponsor (including Company Partnerships as defined in QA Group Privacy Policy) we may share Personal Information you provide, or Personal Information we may otherwise collect through your registration and use of our services, with such third party. This Personal Information may include course viewing history, course viewing time, course or assessment completion, course quality ratings and feedback, certifications, performance-related metrics, and other Personal Information.
• Corporate Mergers and Acquisition Activity: In the event that QA or its affiliates acquires or is acquired by another business operation, or in the event of a reorganization, merger, or other similar event, your Personal Information may be shared with the acquiring, acquired, or resulting entities and their affiliates including for the purposes of operating and managing your account as well as for providing you with additional products and services offered by the acquiring, acquired, or resulting entities.
• Legal Requirements: In certain situations, QA may be required to disclose your Personal Information in response to lawful requests by governmental agencies and supervisory authorities, including to meet security or law enforcement requirements. We reserve the right to disclose your Personal Information as required by applicable law and when we believe that disclosure is necessary to protect our rights or to comply with a judicial proceeding, court order, or similar legal process served on us or our Site.
• With Your Consent or Authorization: We may disclose your Personal Information to anyone for whom you have authorized disclosure of Personal Information in this Supplement.
• Other: We may disclose your Personal Information for any other purpose disclosed by us when you provide the Personal Information.

b. Selling and Sharing

You have the right to know whether your Personal Information is being sold or shared. We do not sell your Personal Information for monetary or other valuable consideration. However, we do engage in certain information disclosure activities that may be considered “sales” or “sharing” under California Law. We may share or sell the following Personal Information:

We do not knowingly sell or share the Personal Information of consumers under 16 years of age.

1. Your Rights and Choices under California Law
2. Right to Know

You have the right to request that we disclose certain information to you about our collection and use of your Personal Information. Once we receive and verify your request, we will disclose to you:

• The categories of Personal Information we collected about you;
• The categories of sources for the Personal Information we collected about you;
• Our business or commercial purpose for collecting, selling, or sharing that Personal Information;
• The categories of third parties with whom we disclose that Personal Information; and
• The specific pieces of Personal Information we collected about you (also called a data portability request).

You may only make a Right to Know request twice within a 12-month period.

1. Right to Delete

You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and verify your request, we will use commercially reasonable efforts to delete (and, where required, direct our service providers, contractors, and third parties to whom we have sold or shared your Personal Information to delete) your Personal Information from our records, unless an exception under California Law applies. We may also deny your deletion request if the Personal Information is required to complete the transaction for which the information was collected or to provide you with requested goods or services.

1. Right to “Opt-out” of the Sale or Sharing of Personal Information

If QA sells or shares Personal Information about you to third parties, you may have the right to opt out and request that QA not sell or share your Personal Information.

Once you make a verified opt-out request, we will wait at least twelve (12) months before asking you to reauthorize Personal Information sales.

However, if at a later time, you wish to allow us to share or sell your Personal Information to third parties, you must opt into such sharing or sales, and may do so by contacting us. If a transaction requires the sharing or sale or transmission of your Personal Information in order to complete the transaction, we will notify you and provide instructions on how you can opt in.

1. Right to Correct Inaccurate Personal Information

You have the right to request that we correct any of your Personal Information that we maintain about you

1. Right to Non-Discrimination and Non-Retaliation

We will not discriminate against you for choosing to exercise any of your rights. If you exercise certain rights, understand that you may be unable to use or access certain features of the Services. Unless permitted by applicable law, we will not: (i) deny you goods or services; (ii) charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties; (iii) provide you a different level or quality of goods or services; or (iv) suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

1. Rights in relation to minors

QA does not knowingly collect or sell the personal data of children under the age of 16 without their consent, or children under the age of 13 without the consent of their parent or legal guardian.

1. Exercising Your California Law Privacy Rights

You do not need to create an account with us to exercise your California Law privacy rights. To exercise the rights described above, please submit a request to us by contacting us:

• via email at: privacy@qa.com; or
• via mail at our Physical Address:

530 Fifth Avenue,

Suite 703, New York,

NY 10036.

For attention: Data Protection Officer

To exercise your right to know, delete, or correct your Personal Information as described above, we need to verify your identity or authority to make the request and confirm the Personal Information relates to you. We may deny your request if we are unable to verify your identity. These requests may be made only by you, your parents, guardian (if you are under 18 years or age), conservator, a person to whom you have given power of attorney pursuant to California Probate Code sections 4000 to 4465, or an authorized agent. As permitted under California Law, we may request that an individual submitting a request on behalf of a consumer submit proof that they are an authorized agent of the subject consumer, as well as verify the consumer’s identity. To protect your Personal Information, we reserve the right to deny a request from an agent that does not submit adequate proof that you authorized them to act for you.

VII. Response Timing and Format

Once we have verified a request from a California consumer, we will confirm receipt of the request within 10 days and explain how we will process the request. We will then respond to the request within 45 days. We may require an additional 45 days (for a total of 90 days) to process your request, but in those situations, we will provide you with a response and explanation for the reason it will take more than 45 days to respond to the request. Our responses will include required information under California Law.

VIII. Data Retention

We may retain all categories of your Personal Information described above for as long as needed to carry out the purposes described herein or as otherwise required by applicable law. Unless we are required or permitted by law to keep your Personal Information for a longer period of time, when your Personal Information is no longer necessary to carry out the purposes for which we process it, we will delete your Personal Information or keep it in a form that does not permit identifying you. When determining the retention period, we take into account various criteria, such as the nature of the use of the Site, your general relationship with us, the impact on our ability to provide you the Site if we delete your Personal Information, mandatory retention periods provided by law and the statute of limitations, and our use of your Personal Information for aggregated market research.

1. COLORADO, CONNECTICUT, UTAH, VIRGINIA, OREGON AND TEXAS

For users residing in Colorado, Connecticut, Utah, Virginia, Oregon and Texas, you also have rights with respect to the Personal Information that we collect about you. In addition to the rights that are available to residents of California, if you are a resident of one of these states, you may also have the right to:

• Opt out of the processing of your Personal Information for the purposes of targeted advertising and for profiling in furtherance of decisions, including, for residents of Connecticut, solely automated decisions, which produce legal or similarly significant effects; and
• Appeal any decision or indecision related to the exercise of any right the consumer is granted under the applicable state law.

If you would like to exercise any of your rights under applicable law (including the right to appeal), please contact us:

• via email at: privacy@qa.com; or
• via mail at our Physical Address:

530 Fifth Avenue,

Suite 703,

New York,

NY 10036.

For attention: Data Protection Officer