Your California Privacy Rights Notice

The California Consumer Privacy Act of 2018, as amended (collectively, the "CCPA"), defines "personal information" broadly as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. This California Consumer Privacy Act Notice also uses that definition for personal information.

a. Categories and Sources of Personal Information We Collect

Please see "What Information Do We Collect and How Do We Collect It?" and "Cookies and Other Technologies; Do Not Track" in our Privacy Policy to understand the categories of personal information we collect from or about you and the categories of sources from which we obtain personal information.

Please see "What Information Do We Collect and How Do We Collect It?" and "Cookies and Other Technologies; Do Not Track" in our Privacy Policy to understand the categories of personal information we have collected from or about consumers in the preceding twelve (12) months and the categories of sources from which we have obtained personal information in the preceding twelve (12) months.

b. Our Collecting, Using, and Disclosing or Sharing Personal Information

We disclose or share personal information from or about you with our service providers, third parties, and/or other parties for business purposes, such as operational purposes and other purposes related to providing you with the products and services you seek from us. We provide more information about the business purposes or commercial purposes for which we disclose or share personal information in "How We Use the Information We Collect" and "With Whom Do We Disclose or Share Your Information?" in our Privacy Policy. We may disclose or share any of the categories of personal information listed in "What Information Do We Collect and How Do We Collect It?," "Cookies and Other Technologies; Do Not Track," "How We Use the Information We Collect," and "With Whom Do We Disclose or Share Your Information?" in our Privacy Policy for business purposes or commercial purposes.

Please see "How We Use the Information We Collect" and "With Whom Do We Disclose or Share Your Information?" in our Privacy Policy to understand the business purposes or commercial purposes for which we have collected personal information in the preceding twelve (12) months.

We have disclosed or shared personal information for business purposes in the preceding twelve (12) months as described in "How We Use the Information We Collect" and "With Whom Do We Disclose or Share Your Information?" in our Privacy Policy. Any of the categories of personal information listed in "What Information Do We Collect and How Do We Collect It?," "Cookies and Other Technologies; Do Not Track," "How We Use the Information We Collect," and "With Whom Do We Disclose or Share Your Information?" in our Privacy Policy may have been disclosed or shared for business purposes in the preceding twelve (12) months.

We may disclose or share personal information from or about you with the categories of third parties as described in "How We Use the Information We Collect" and "With Whom Do We Disclose or Share Your Information?" in our Privacy Policy. We may disclose or share any of the categories of personal information listed in "What Information Do We Collect and How Do We Collect It?," "Cookies and Other Technologies; Do Not Track," "How We Use the Information We Collect," and "With Whom Do We Disclose or Share Your Information?" in our Privacy Policy.

Please see "How We Use the Information We Collect" and "With Whom Do We Disclose or Share Your Information?" in our Privacy Policy to understand the categories of third parties with whom we have disclosed or shared personal information in the preceding twelve (12) months.

We disclose or share personal information with our service providers, third parties, and/or other parties, including with certain sponsors and exhibitors in connection with registration for a course, conference, or webinar and to help us market or advertise to you. Please see "How We Use the Information We Collect," "Cookies and Other Technologies; Do Not Track," and "With Whom Do We Disclose or Share Your Information?" in our Privacy Policy.

California law may characterize our disclosing or sharing of the following categories of personal information as a sale of personal information (including in the preceding twelve (12) months)

• with certain sponsors and exhibitors in connection with registration for a course, conference, or webinar: identifiers such as full name, postal address, email address, job title, and employer's name; and
• with online advertising service providers, third parties, and/or other parties to help us market or advertise to you: identifiers such as email address, online activity such as internet or other electronic network activity information, including, but not limited to, browsing activity, search queries, search terms, and information regarding your interaction with websites, applications, or advertisements, and inferences about any of the information above that may relate to your preferences or other matters.

Please see "Cookies and Other Technologies; Do Not Track," "What Information Do We Collect and How Do We Collect It?," "How We Use the Information We Collect," and "With Whom Do We Disclose or Share Your Information?" in our Privacy Policy to understand the commercial purposes for which we may have sold personal information under California law in the preceding twelve (12) months.

We do not knowingly collect or sell the personal information of consumers under sixteen (16) years of age.

c. Your Rights and Choices

Your Rights To Know

You have the right to request that we disclose certain information to you about our collection, use, disclosure, and sale of your personal information in the preceding twelve (12) months. Once we receive and confirm your request to know, we will disclose the following to you.

• The categories of personal information we collected about you
• The categories of sources for the personal information we collected about you
• Our business purpose or commercial purpose for collecting or selling that personal information
• The categories of third parties with whom we share that personal information
• The specific pieces of personal information we collected about you (also called a request to know data portability request)
• If we sold or disclosed or shared your personal information for a business purpose, two separate lists disclosing
  • sales, identifying the personal information categories that each category of recipient purchased, including categories of third parties, and disclosures or sharing for a business purpose, identifying the personal information categories that each category of recipient obtained, including categories of third parties

Your Deletion Rights

You have the right to request that we delete any of your personal information that we collected from you and retained, in certain circumstances. Once we receive and confirm your request to delete, we will delete from our records and direct our service providers to delete from their records your personal information, in certain circumstances.

Exercising Requests To Know and Requests To Delete

To exercise the request to know and request to delete rights described above, please submit a verifiable consumer request to us via Contact Us or via toll-free telephone at (800) 827–4242. Only you or a person registered with the California Secretary of State that you authorize to act on your behalf may make a verifiable consumer request related to your personal information.

A verifiable consumer request must

• provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized agent and
• describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

You may only make a request to know twice within a twelve (12)-month period.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm that the personal information relates to you.

We will use personal information provided in a verifiable consumer request to verify the requestor's identity or authority to make the request.

Response Timing and Format

We endeavor to respond to requests to know and requests to delete within forty-five (45) calendar days. If we require more time (up to an additional forty-five (45) calendar days), we will provide you with notice and an explanation of the reason that we will take more than forty-five (45) calendar days to respond to the request.

We will deliver our written response via postal mail or via email, at your option.

The response we provide will also explain the reasons we cannot comply with a verifiable consumer request (including regarding a request to delete, whether we have complied with that request), if applicable.

Any disclosures we provide will only cover the twelve (12)-month period from the date that we receive the request to know.

For request to know data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance, including via email.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded.

Your Rights to Opt out and Opt in

You have the right, at any time, to request that we not sell your personal information to third parties ("request to opt out"). Consumers who request to opt in to personal information sales may request to opt out of future sales at any time.

To exercise the request to opt out right described above, you (or your authorized agent) may submit a request to opt out to us via Contact Us or as outlined on the following page: [Do Not Sell My Personal Information].

We will comply with a request to opt out as soon as feasibly possible and no later than fifteen (15) business days from the date we receive the request.

Once you make a request to opt out, we will wait at least twelve (12) months before asking you to reauthorize personal information sales. However, you may change your mind and request to opt in to personal information sales at any time via Contact Us.

We will use personal information provided in a request to opt out to review and comply with the request.

Please also see https://www.privacyrights.info/ or https://optout.privacyrights.info with respect to service providers, third parties, and/or other parties regarding online tracking and targeting and that participate in the opt-out tool.

Nondiscrimination

You have the right not to receive discriminatory treatment by us for the exercise of the privacy rights conferred by the CCPA. Unless permitted by the CCPA, we will not

• deny you goods or services;
• charge you different prices or rates for goods or services, including through granting discounts or other benefits or imposing penalties;
• provide you a different level or quality of goods or services; or
• suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

California Civil Code Section 1798.83 permits individuals who are California residents to request from a business, with which the California residents have an established business relationship, certain information about the categories of personal information the business has shared with third parties for those third parties' direct marketing purposes and the names and addresses of the third parties with whom the business has shared such information during the immediately preceding calendar year. You can make one request each year by writing to us at the following postal address.

International Risk Management Institute, Inc.
ATTN: Customer Success Department
12222 Merit Dr., Ste. 1600
Dallas, TX 75251

You must include the following in your writing.

• The statement "Your California Privacy Rights"
• Your name, postal address, city, state, and zip code

You also may include your email address in your writing.

We will respond to you at your postal address or, at our option, your email address if you provided your email address in your writing.

If you have questions about our Privacy Policies, Notices, or privacy practices, please contact us using the contact information noted in "How To Contact Us" in our Privacy Policy.

We reserve the right to update or modify this Notice, including without limitation, the California Consumer Privacy Act Notice, at any time and from time to time. Please review this Notice periodically and especially before you provide any information or data. This Notice was made effective on the date indicated above.