Drome Privacy Policy

1. What is Personal Information?

For the purposes of this Privacy Policy, "personal information" refers to any information relating to an identified or identifiable natural person, such as an identification number, physical, physiological, mental, economic, cultural, or social identifiers (for example, name, address, or date of birth). It also includes information related to an identifiable individual's health care or status.

2. What Does Drome Do?

Drome owns and operates a website with related services and content (collectively, the "Drome Services") that provide, among other things, information about, and numerous tools and features that allow you to create, publish and use, web-based applications with an interactive graphics engine ("Your Platforms").

3. What Personal Information Do We Collect?

When you access or use the Drome Services with an account, we collect a variety of personal information that you submit voluntarily to us through your use of the Drome Services, including:

• your email address;
• payment information;
• how you heard about Drome, if you choose to tell us;
• where the visit in which you signed up came from: the campaign details in the link you followed (such as the platform and campaign name), the first Drome page you visited and the website that referred you; and
• any other personal information submitted to us in connection creating, publishing and using Your Platform(s).

We also collect certain information automatically when you access or use the Drome Services, with or without an account. This information includes, but is not limited to, the internet protocol address (IP address) used to access the Drome Services and other related information such as the type of operating system, time and duration on the Drome Services and page requests. We use this information to monitor the Drome Services' performance and to maintain, manage and improve our operations, and as otherwise described in this Privacy Policy.

We use "cookies": small data files placed on your device. Some are strictly necessary to operate the Drome Services, such as keeping you signed in, letting you preview your unpublished sites and remembering your cookie and display preferences. These are always on.

Only if you agree to analytics cookies, we use PostHog, a third-party analytics provider, to understand how the Drome Services are used and to diagnose bugs. With your consent, PostHog records the pages you visit and the actions you take in the Drome Services, session replays (recordings of how you use the Drome Services in your browser) and errors you encounter. When you are signed in, this information is linked to your account. You can withdraw this consent at any time in the cookie preferences section of this page, and we stop collecting analytics from that point.

We do not use advertising cookies, and we do not sell your personal information or share it with advertising networks.

For more information about cookies, and how to disable cookies, visit https://www.allaboutcookies.org and, for more information about our cookies and your choices, please use the cookie preferences section on this page.

When a visitor submits a contact form on a site built with Drome, we collect what the visitor enters in the form (for example, a name, an email address and a message), send it by email to the site's owner and keep it for 90 days. The site's owner, not Drome, decides what the form asks for and how they use the replies.

4. Why Do We Collect Personal Information?

We collect the personal information identified above for the purpose of operating, managing, maintaining and improving our operations relating to the Drome Services, which includes:

• providing you with access to and use of the Drome Services and to perform all of our other obligations and exercise our rights under the terms of use of Drome (the "Terms of Use");
• monitoring the performance of, and performing quality control activities with respect to, the Drome Services;
• helping us manage, maintain and improve our operations relating to the Drome Services by:
  • obtaining comments, suggestions and feedback;
  • conducting surveys or polls; and
  • obtaining testimonials;
• evaluating, improving and personalizing the user experience of the Drome Services;
• measuring which of our marketing brings people to Drome, by counting signups per campaign (we don't use this to build a profile of you);
• protecting the data collected, stored or otherwise processed by the Drome Services by, among other things, monitoring, detecting, investigating and remedying any suspected or actual breaches of our Terms of Use, this Privacy Policy or any of our policies and procedures relating thereto;
• giving notice of any data security breaches or legal proceedings;
• giving notice of any changes to this Privacy Policy; and
• any other reasonable purpose for which consent is obtained.

5. How Do We Use and Disclose the Personal Information We Collect?

We use the personal information we collect for the purposes described in this Privacy Policy, and we disclose the personal information we collect:

• to our directors, officers, employees, independent contractors, affiliates and other parties who require such information to assist us with fulfilling the purposes described in this Privacy Policy;
• to third-party service providers as described in this Privacy Policy;
• as permitted or required by applicable law or regulatory requirements;
• when required to comply with valid legal processes such as search warrants, subpoenas, court orders or other legally valid inquiries or orders;
• during emergency situations or where necessary to protect the safety of a person or group of persons; and
• for any additional purposes for which we have obtained your consent to the use or disclosure of your personal information.

In addition, from time to time, we process personal information that you submit to us to create derivative data that is aggregated and de-identified (i.e., data that cannot identify you as an identifiable individual) ("Anonymized Content"). All Anonymized Content is and shall be owned by Drome.

In addition to the third-party service providers mentioned above, we may also engage third-party service providers to help us operate, manage, maintain and improve the Drome Services by, among other things, hosting components of the Drome Services, storing data, providing back-up services, supplying content and/or obtaining customer feedback.

As at the date hereof, our third-party service providers are:

• Amazon Web Services, which hosts the Drome Services and the sites you publish, stores your data and sends our emails;
• Stripe, which processes payments;
• PostHog, which provides product analytics, only with your consent; and
• Google, when you choose to sign in with Google.

Personal Information may be processed and stored by Drome or its third-party service providers, as permitted by applicable law, and, as at the date hereof, personal information is stored and processed in the United States, where, in certain circumstances, it may be accessed by the courts, law enforcement and national security authorities of the United States. Third-party service providers may only use and/or disclose personal information to the extent required to perform their designated functions and in accordance with applicable law. In addition, we will endeavour to ensure that they provide privacy and security protections which are comparable to those provided by Drome. For more information about the way in which our third-party service providers treat personal information, please contact our Privacy Officer.

We and our third-party service providers may use and/or disclose your personal information without your knowledge or consent where we are permitted or required by applicable law or regulatory requirements to do so. In particular, we and our third-party service providers may disclose personal information referred to herein in response to a search warrant, subpoenas, court orders or other legally valid inquiry or order (which may include lawful access by governmental authorities, courts or law enforcement agencies), to other organizations in the case of investigating a breach of an agreement or contravention of law or detecting, suppressing or preventing fraud, or as otherwise required or permitted by applicable laws.

In addition, we may disclose or otherwise transfer personal information to another party in connection with a prospective or completed business transaction, including an asset or share sale, merger, amalgamation, plan of arrangement or some other form of business combination (including transfers made as part of insolvency or bankruptcy proceeding) involving any of Drome's assets or shares or as part of a corporate reorganization or other change in corporate control; provided, however, that such party is bound by appropriate agreements or obligations and required to use or disclose the personal information in a manner consistent with the use and disclosure provisions of this Privacy Policy.

6. Consent is Important to Us

It is important to us that we collect, use or disclose personal information where we have consent to do so. Depending on the sensitivity of the personal information, consent may be implied, deemed (using an opt-out mechanism) or express. Express consent can be given orally, electronically or in writing. Implied consent is consent that can reasonably be inferred from an action or inaction.

We assume that an individual has consented to our reasonable collection and use of personal information consistent with the purposes for which the information was given, when the individual initiates contact with us or voluntarily provides personal information to us. If you provide us with personal information about another individual, we rely on you to obtain all necessary consents to permit us to collect, use and disclose the personal information for the purposes for which the information was collected and as set out in this Privacy Policy.

You may change or withdraw your consent at any time by contacting our Privacy Officer at the email address set out at the end of this Privacy Policy, subject to legal or contractual obligations. However, it is important to note that we may not be able to destroy or alter our archival/backup data, or secure the removal of personal information where it has been disseminated or used by third-parties.

We may collect, use or disclose personal information without your knowledge or consent where we are permitted or required to do so by applicable law or regulatory requirements.

All communications with respect to the withdrawal or variation of consent should be in writing and addressed to our Privacy Officer.

7. How is Personal Information Protected?

We are committed to protecting personal information that we collect, store or otherwise process from improper or unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction.

We have implemented administrative, technical, physical and procedural safeguards in order to protect against such unauthorized behavior, taking into account the sensitivity of the information in question. These safeguards include passwords, encryption and other technologies. However, Drome cannot prevent all possible improper or unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction of personal information and, subject to applicable laws, will not be responsible for any damages or liabilities relating thereto.

We will make commercially reasonable efforts, where required by law, to notify all of the applicable parties in the event of any improper or unauthorized access, collection, use, disclosure, copying, modification, disposal or destruction, without delay.

The security of personal information is important to us. Please advise our Privacy Officer immediately if you become aware of any incident involving the loss of or unauthorized access to or disclosure of personal information that we collect, store or otherwise process.

8. How is Personal Information Retained?

Drome has policies and procedures in place regarding the retention of personal information. In general, Drome retains personal information as required to provide access to and use of the Drome Services and by applicable laws.

When you delete your account, we delete your profile, sites, pages, media and custom domains, and close your customer record with our payment processor. We keep an internal record that an account was deleted, identified only by an internal ID, and our payment processor keeps billing records as the law requires.

9. How can Personal Information be Accessed, Updated or Corrected?

Subject to certain limited exceptions prescribed by law, you may submit a request to access, update or correct your personal information. To review, verify or correct your personal information, please submit a written request to our Privacy Officer.

You can also download a copy of your personal information, or delete your account and its data, at any time from the Account page of your Drome dashboard.

When making any such request, please note that we may request specific information to enable us to confirm your identity and determine whether you have the right to access, update or correct the personal information relating to such request.

The right to access the personal information that we hold about you is not absolute. There are instances where applicable law or regulatory requirements allow or require us to refuse to provide some or all of the personal information that we hold about you. In addition, your personal information may have been destroyed, erased or made anonymous in accordance with our record retention obligations and practices. In the event that we cannot provide you with access to your personal information, we will endeavor to inform you of the reasons why, subject to any legal or regulatory restrictions.

We may charge a fee to access personal information; however, we will advise you of any fee in advance. If you require assistance in preparing your request, please contact our Privacy Officer.

10. Inquiries or Concerns?

If you have any questions about this Privacy Policy or concerns about how we manage personal information, please contact our Privacy Officer by telephone, in writing or by e-mail. We will endeavor to answer your questions and advise you of any steps taken to address the issues raised by you. If you are dissatisfied with our response, you may be entitled to make a written submission to the Privacy Commissioner responsible for your jurisdiction.

11. Privacy Officer

We have appointed a Privacy Officer to oversee compliance with this Privacy Policy. The contact information for our Privacy Officer is privacy@drome.site, or by mail at #3175 - 246 Stewart Green SW, Calgary, Alberta T3H 3C8, Canada.

12. Revisions to this Privacy Policy

We may amend this Privacy Policy from time to time in order to reflect changes in our legal or regulatory obligations or in the manner in which we deal with personal information. We will post any amended version of this Privacy Policy on our Website, with the date it was last updated at the top. If a change is significant, for example a new purpose for your personal information or a new third-party service provider, we will also tell you by email or in the Drome Services before it takes effect.

13. Interpretation of this Privacy Policy

Any interpretation associated with this Privacy Policy will be made by our Privacy Officer. This Privacy Policy includes examples but is not intended to be restricted in its application to such examples; therefore, where the word "including" is used, it shall mean "including without limitation".

This Privacy Policy does not create or confer upon any individual any rights or impose upon Drome any rights or obligations outside of, or in addition to, any rights or obligations imposed by Canada's federal and provincial privacy laws, as applicable. Should there be, in a specific case, any inconsistency between this Privacy Policy and Canada's federal and provincial privacy laws, as applicable, this Privacy Policy shall be interpreted, in respect of that case, to give effect to, and comply with, such privacy laws.