Your California Privacy Rights Notice

The California Privacy Rights Act ("CPRA") defines "personal information" broadly as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household and includes "sensitive personal information," which the CPRA also defines. This California Privacy Rights Act Notice also uses such CPRA definitions for personal information and sensitive personal information.

a. Categories and Sources of Personal Information We Collect

Please see "What Information Do We Collect and How Do We Collect It?" and "Cookies and Other Technologies; Do Not Track" in our Privacy Policy to understand the categories of personal information we collect from or about you and the categories of sources from which we obtain personal information.

We generally do not want to gather sensitive personal information about you, including the following.

• Government-issued IDs (such as your driver's license, passport, or Social Security number)
• Your precise geolocation
• Your racial or ethnic origin
• Your religion or philosophical beliefs
• Your union membership
• The content of your private communications (other than messages you may send to us)
• Your health, biometric, or genetic information or data
• Your sexuality (information about your sex life or sexual orientation)

However, California law defines account credentials (for example, password) and payment information (for example, payment card information) as sensitive personal information, but we collect that information only for the accounts you create directly with us and not for any other account you may have with a different party.

Finally, there are situations when we may request certain of the above information (for example, dietary restrictions at one of our conferences), but you can decline to provide such information. Outside those situations, we prefer that you never provide us with these types of information.

Please see "What Information Do We Collect and How Do We Collect It?" and "Cookies and Other Technologies; Do Not Track" in our Privacy Policy to understand the categories of personal information we have collected from or about consumers in the preceding twelve (12) months and the categories of sources from which we have obtained personal information in the preceding twelve (12) months.

Please see "Retention" in our Privacy Policy regarding the criteria used to determine the time period intended for retaining each category of personal information, including without limitation, sensitive personal information.

b. Our Collecting, Using, and Disclosing Personal Information

We disclose personal information from or about you with our service providers, third parties, and/or other parties for business purposes, such as operational purposes and other purposes related to providing you with the products and services you seek from us. We provide more information about the business purposes or commercial purposes for which we disclose personal information in "What Information Do We Collect and How Do We Collect It?," "Cookies and Other Technologies; Do Not Track," "How We Use the Information We Collect," "To Whom Do We Disclose Your Information?," "Storage," and "Retention" in our Privacy Policy. We may disclose any of the categories of personal information listed in "What Information Do We Collect and How Do We Collect It?," "Cookies and Other Technologies; Do Not Track," "How We Use the Information We Collect," and "To Whom Do We Disclose Your Information?" in our Privacy Policy for business purposes or commercial purposes.

Please see "What Information Do We Collect and How Do We Collect It?," "Cookies and Other Technologies; Do Not Track," "How We Use the Information We Collect," "To Whom Do We Disclose Your Information?," "Storage," and "Retention" in our Privacy Policy to understand the business purposes or commercial purposes for which we have collected personal information in the preceding twelve (12) months.

We have disclosed personal information for business purposes and have disclosed personal information for business purposes to third parties in each case in the preceding twelve (12) months as described in "What Information Do We Collect and How Do We Collect It?," "Cookies and Other Technologies; Do Not Track," "How We Use the Information We Collect," "To Whom Do We Disclose Your Information?," "Storage," and "Retention" in our Privacy Policy. Any of the categories of personal information listed in "What Information Do We Collect and How Do We Collect It?," "Cookies and Other Technologies; Do Not Track," "How We Use the Information We Collect," and "To Whom Do We Disclose Your Information?" in our Privacy Policy may have been disclosed for business purposes in each case in the preceding twelve (12) months.

We may disclose personal information from or about you with the categories of third parties as described in "What Information Do We Collect and How Do We Collect It?," "Cookies and Other Technologies; Do Not Track," "How We Use the Information We Collect," and "To Whom Do We Disclose Your Information? in our Privacy Policy. We may disclose any of the categories of personal information listed in "What Information Do We Collect and How Do We Collect It?," "Cookies and Other Technologies; Do Not Track," "How We Use the Information We Collect," and "To Whom Do We Disclose Your Information?" in our Privacy Policy.

Please see "What Information Do We Collect and How Do We Collect It?," "Cookies and Other Technologies; Do Not Track," "How We Use the Information We Collect," and "To Whom Do We Disclose Your Information?" in our Privacy Policy to understand the categories of third parties to whom we have disclosed personal information in the preceding twelve (12) months.

We disclose personal information to our service providers, third parties, and/or other parties, including certain sponsors and exhibitors in connection with registration for a course, conference, or webinar, and certain online service providers, third parties, and/or other parties to help us market or advertise to you. Please see "What Information Do We Collect and How Do We Collect It?," "Cookies and Other Technologies; Do Not Track," "How We Use the Information We Collect," and "To Whom Do We Disclose Your Information?" in our Privacy Policy.

California law may characterize our disclosing of the following categories of personal information as a sale or sharing of personal information (including in the preceding twelve (12) months) to

• certain sponsors and exhibitors in connection with registration for a course, conference, or webinar: identifiers such as full name, postal address, job title, and employer's name; and
• certain online service providers, third parties, and/or other parties to help us market or advertise to you: identifiers such as email address, Internet, or other electronic network activity information, including, but not limited to, browsing activity, search queries, search terms, and information regarding your interaction with websites, applications, or advertisements, and inferences about any of the information above that may relate to your preferences or other matters.

Please see "What Information Do We Collect and How Do We Collect It?," "Cookies and Other Technologies; Do Not Track," "How We Use the Information We Collect," and "To Whom Do We Disclose Your Information?" in our Privacy Policy to understand the commercial purposes for which we may have sold or shared personal information under California law in the preceding twelve (12) months.

We do not knowingly "sell" or "share" (as those terms are defined by the CPRA) the personal information of consumers under sixteen (16) years of age.

c. Your Rights and Choices

Your Rights To Know

You have the right to request that we disclose certain information to you about our collection, use, disclosure, sale, and sharing of your personal information during the applicable period of time. Once we receive and confirm your request to know, we will disclose the following to you.

• The categories of personal information we collected about you
• The categories of sources for the personal information we collected about you
• Our business purpose or commercial purpose for collecting or selling such personal information
• The categories of third parties to whom we share such personal information
• The specific pieces of personal information we collected about you (also called a request to know data portability request)
• If we sold or disclosed your personal information for a business purpose, two separate lists disclosing
  • sales, identifying the personal information categories that each category of third party purchased or obtained through sale, and disclosures for a business purpose, identifying the personal information categories that each category of third party obtained through disclosure

Your Deletion Rights

You have the right to request that we delete any of your personal information that we collected from you and retained, in certain circumstances. Once we receive and confirm your request to delete, in certain circumstances, we will delete from our records, and notify any service providers or contractors, and notify all third parties with which we have sold or shared your personal information, of the need to delete your personal information.

Your Correction Rights

If we maintain inaccurate personal information about you, you have the right to request that we correct such inaccurate personal information, in certain circumstances. Once we receive and confirm your request to correct, in certain circumstances, we will correct the personal information at issue on our existing systems and instruct any service providers and contractors that maintain the personal information at issue pursuant to their written contract with us to make the necessary corrections in their respective systems.

Exercising Requests To Know, To Delete, and To Correct

To exercise requests to know, to delete, and to correct, please submit a verifiable consumer request to us via Contact Us or via toll-free telephone at (800) 827–4242. Only you or a person registered with the California Secretary of State that you authorize to act on your behalf may make a verifiable consumer request related to your personal information.

A verifiable consumer request must

• provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized agent; and
• describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

You may only make a request to know twice within a twelve (12)-month period.

We need to verify your identity or authority to make the request and confirm that the personal information relates to you.

We will use personal information provided in a verifiable consumer request for purposes of verification and will not further disclose the personal information, retain it longer than necessary for purposes of verification, or use it for unrelated purposes.

Response Timing and Format

We endeavor to respond to requests to know, to delete and to correct within forty-five (45) calendar days. If we require more time (up to an additional forty-five (45) calendar days), we will provide you with notice and an explanation of the reason that we will take more than forty-five (45) calendar days to respond to the request.

We will deliver our written response via postal mail or via email, at your option.

The response we provide will also explain the reasons we cannot comply with a verifiable consumer request (including regarding a request to delete or a request to correct, whether we have complied with such request), if applicable.

Any disclosures we provide will cover the twelve (12)-month period from the date that we receive the verifiable consumer request, provided that you may request that we disclose the required information beyond the twelve (12)-month period with respect to personal information collected on or after January 1, 2022, and we will provide such information unless doing so proves impossible or would involve a disproportionate effort.

For request to know data portability requests, we will provide your personal information in a format that is easily understandable to the average consumer, and to the extent technically feasible, in a structured, commonly used, machine-readable format, which also may be transmitted to another entity at your request without hindrance, including via email.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded.

Your Right To Opt-Out of and Opt-In to Sale/Sharing

You have the right, at any time, to request that we neither sell to nor share with third parties your personal information ("request to opt-out of sale/sharing").

You (or your authorized agent) may submit a request to opt-out of sale/sharing to us via Contact Us or as outlined on the following page: [Do Not Sell or Share My Personal Information].

We will comply with a request to opt-out of sale/sharing as soon as feasibly possible and no later than fifteen (15) business days from the date we receive the request.

Once you have opted out of the sale or sharing of your personal information, except as allowed by CPRA regulations, we will wait at least twelve (12) months before asking you to consent to the sale or sharing of your personal information.

We will use personal information provided in a request to opt-out of sale/sharing for purposes of complying with the request.

Please also see https://www.privacyrights.info/ or https://optout.privacyrights.info with respect to AddThis.

Your Right To Limit Sensitive Personal Information Use

California law gives you the right to request that we limit the use of your sensitive personal information. We do not use any sensitive personal information to make inferences about you and use sensitive personal information only for reasons permitted by the CPRA and the CPRA regulations.

Nondiscrimination

You have the right not to receive discriminatory treatment by us for the exercise of the privacy rights conferred by the CPRA. Unless permitted by the CPRA, we will not

• deny you goods or services;
• charge you different prices or rates for goods or services, including through granting discounts or other benefits or imposing penalties;
• provide you a different level or quality of goods or services;
• suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services; or
• retaliate against an employee, applicant for employment, or independent contractor for exercising their rights under the CPRA.

California Civil Code Section 1798.83 permits individuals who are California residents to request from a business, with which the California residents have an established business relationship, certain information about the categories of personal information the business has disclosed to third parties for those third parties' direct marketing purposes and the names and addresses of the third parties with whom the business has disclosed such information during the immediately preceding calendar year. You can make one request each year by writing to us at the following postal address.

International Risk Management Institute, Inc.
ATTN: Customer Success Department
12222 Merit Dr., Ste. 1600
Dallas, TX 75251

You must include the following in your writing.

• The statement "Your California Privacy Rights"
• Your name, postal address, city, state, and zip code

You also may include your email address in your writing.

We will respond to you at your postal address or, at our option, your email address if you provided your email address in your writing.

If you have questions about our Privacy Policies, Notices, or privacy practices, please contact us using the contact information noted in "How To Contact Us" in our Privacy Policy.

We reserve the right to update or modify this Notice, including without limitation, the California Privacy Rights Act Notice, at any time and from time to time. Please review this Notice periodically and especially before you provide any information. This Notice was made effective and/or last updated on the date indicated above.