Privacy Policy

This Privacy Policy describes how Time To Cash, Corp. ("TTCC", or "Company" or "our" or "we") collects, uses, and discloses information associated with an identified or identifiable individual (referred to in this Privacy Policy as "Personal Information") and what choices you have around this activity. If you have any questions, please don't hesitate to contact us.

We may change this Privacy Policy from time to time, including as required to keep current with applicable laws and regulations, new technologies and security standards. When we do, we will post the updated policy on our TimeToCash platform ("TTC") and other properties and assets where this Policy applies. If we change the policy in a material and retroactive manner, we will provide appropriate notice to you.

1. Applicability of this Privacy Policy

This Privacy Policy applies only to our applications, connectors, extensions, mobile sites, Apps, our use of social media sites and other solutions (collectively, the "Sites") when they are provided by us and they link to this Privacy Policy, and to other Personal Information obtained when you call, email, or otherwise communicate or interact with our Company. By accessing the Sites on any computer, mobile phone, tablet, or other device (collectively, "Device") or otherwise interacting with our Company, you agree to the terms of this Privacy Policy. If you do not agree to the policy, please do not use the Sites. We encourage you to periodically review our Privacy Policy to stay informed about how we are using the information we collect.

2. Information We Collect and Receive

We collect Personal Information through your interactions with our Sites and through your direct communications with us. The categories of Personal Information we collect, and the purposes for which we collect them, are summarized below.

Contact information — such as name, email address, personal or business address, and phone number, and other information you provide. Source: from visitors to the Sites who call us, sign up for emails or other services, or otherwise interact with us. Purpose: to communicate with and respond to visitors and our customers about our business operations, including verification of identity or to meet legal obligations. Categories of recipients: select information technology and other service providers and partners.

In some jurisdictions, such as the European Union and United Kingdom, individuals may have the right to opt in or withdraw consent for certain uses. If you reside in such jurisdictions, you may have additional rights which are detailed in "Access, Correction, & Deletion" below.

When you visit the Sites, we may collect certain non-personal information from you, including your Internet Protocol (IP) address, MAC address, browser type, operating system, device-identifying information, the specific web pages visited immediately preceding your connection, and the domain name from which you accessed the Sites. We may also use such non-personal or deidentified, aggregated information for statistical analysis, research, and other purposes.

3. Cookie Policy

A cookie is a small data text file, which is stored on the hard drive of your computer or mobile device. Each cookie is unique to your web browser. It will contain some anonymous information such as a unique identifier, website's domain name, and some digits and numbers. Cookies cannot be used to run programs or deliver viruses to your computer. At no time will our cookies collect your personally identifiable information. When you visit our Sites, we will store certain types of persistent cookies on your computer in order to authorize access to our private content and to facilitate and customize your use of our services. A persistent cookie remembers information, settings, preferences, or sign-on credentials that the user has previously saved.

Essential cookies

Essential cookies allow us to offer you the best possible experience when accessing and navigating through our platforms and using its features. For example, these cookies let us recognize that you have created an account and have logged into that account.

Functionality cookies

Functionality cookies let us operate the Sites in accordance with the choices you make. For example, we will recognize your username and remember the choices that you made to your account during future visits.

Analytical cookies

These cookies enable us and third-party services to collect aggregated data for statistical purposes on how our visitors use our Sites. These cookies do not contain or collect Personal Information and are merely used to help us improve your user experience of the Sites.

Once you leave our Sites, our persistent cookies remain on your hard drive. This helps create a convenient and faster user experience.

You are always free to decline or restrict our cookies through your browser setting. But, due to the nature of our essential cookies, some parts of our Sites may not work properly. You can find general information on the Internet about cookies and details on how to delete them from your computer and mobile devices.

4. Interest-Based Advertising

You can opt out of interest-based advertising from third-party providers who follow the Digital Advertising Alliance's Self-Regulatory Principles for Online Behavioral Advertising at www.aboutads.info/choices.

5. Your Choices

You may at any time:

• Stop receiving marketing or promotional emails, direct mail, phone, and mobile marketing communications;

• Update and correct your Personal Information; and

• Request removal of information you post on our digital properties; in some cases, we may not be able to remove your content or Personal Information, in which case we will let you know if we are unable to do so and why.

To do any of these, let us know by one of these methods:

• Follow the directions in a marketing email, direct mail, or mobile communication that you receive from us; or

• Provide your request and current contact information through one of the contact methods listed under "Contact Us" below.

6. Disclosure of Information

We may disclose information collected from and about you as follows: (1) to our related companies and service providers, to perform a business, professional, or technical support function for us; (2) to our business, sales, and marketing partners and affiliates and other third parties, only as necessary to deliver the services described in this Policy; (3) as necessary if we believe that there has been a violation of the Sites' terms of use or of our rights or the rights of any third party; (4) to respond to legal process (such as a search warrant, subpoena, or court order) and provide information to law enforcement agencies or in connection with an investigation on matters related to public safety, as permitted by law, or otherwise as required by law; and (5) in the event that our Company or substantially all of its assets are acquired, or there is a restructuring, your Personal Information may be one of the transferred assets. We may also disclose your Personal Information with your express consent. We may share aggregate, deidentified, or non-personally identifiable information about Sites' users with third parties.

7. Retention of Personal Information

We retain Personal Information that we receive for as long as necessary to fulfill the purpose(s) for which the information was collected, to provide our services and products, to pursue legitimate business purposes, to enforce our agreements, and comply with all applicable laws.

8. Security

We have taken organizational, technical, and operational steps to safeguard Personal Information, including encryption at rest and in transit, role-based access control, audit logging, and incident response. For details on our technical and organizational security measures, see TTCC's Information Security Policy.

9. Children's Privacy

The Sites are not directed to children (anyone under 18 years of age or considered a minor in their local jurisdiction), nor do we knowingly solicit or collect any Personal Information from children without verifiable parental consent, and we will promptly investigate and then delete such information from our systems if warranted. If you are a parent or legal guardian of a child and you become aware that your child has provided us with Personal Information, please contact us promptly using the contact information detailed in the "Contact Us" section below. Parents and legal guardians always have the right to inspect any information that we may have inadvertently collected from their child and have the right to have us delete it.

10. Basis for Processing Personal Information

We may process Personal Information under the following conditions:

• Consent: You provided your consent for one or more specific purposes.

• Performance of a contract: Provision of Personal Information is necessary for the performance of an agreement with you, your employer, and/or for any pre-contractual obligations.

• Legal obligations: Processing Personal Information is necessary for compliance with a legal obligation to which the Company is subject.

• Legitimate interests: When we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests.

In any case, we will gladly help to clarify the specific legal basis that applies to the processing, and whether the Personal Information is a statutory or contractual requirement, or a requirement necessary to enter into a contract.

11. Promotional Communications

We may use your Personal Information to send you updates (by email, text message, telephone, or post) about our products and services, including exclusive offers, promotions, or new products and services.

We have a legitimate interest in processing your Personal Information for promotional purposes (see above "Basis for Processing Personal Information"). This means we do not usually need your consent to send you promotional communications. However, where consent is needed, we will ask for this consent separately and clearly.

We will always treat your Personal Information with the utmost respect and never sell or share it with other organizations outside of the Company for marketing purposes.

You have the right to opt out of receiving promotional communications at any time by contacting us by using the contact information detailed in "Contact Us" below.

12. SMS and Mobile Messaging Communications

If you have provided your mobile phone number and opted in to receive text messages (SMS) from TTCC — for example, to receive service notifications, customer-support messages, or account alerts — the following terms apply to the mobile information you provide:

• No sale or sharing for marketing or promotional purposes. Your mobile information, including your phone number, SMS opt-in status, and consent records, will not be sold, rented, leased, or shared with any third party for promotional or marketing purposes.

• No third-party sharing of opt-in or consent data. The categories of Personal Information described elsewhere in this Privacy Policy that we may share with third parties exclude text-messaging originator opt-in data and consent. This information will not be shared with any third parties. We will not share your opt-in to an SMS campaign with any third party for purposes unrelated to providing you with the services of that campaign.

• Limited sharing with service providers. We may share your Personal Information — including your phone number, SMS opt-in status, and consent records — only with third parties that help us provide the messaging service, including platform providers, phone companies, mobile carriers, and any other vendors that assist us in the delivery of text messages. These third parties are contractually bound to use such information solely to provide the service to you on TTCC's behalf.

• Scope of the restriction. The restrictions on sale and sharing in this section apply to any method of transfer — sale, license, rental, lease, transfer between affiliated or friendly entities, or any other form of disclosure — for purposes other than providing you with the messaging service for which you opted in.

• How to opt out. You can opt out of receiving SMS messages from TTCC at any time by replying STOP to any TTCC message, or by contacting us using the details in "Contact Us" below. After opting out, TTCC retains your opt-out record only for the period necessary to honor the opt-out and to comply with applicable law.

13. Third-Party Websites

The Sites may contain links to third-party websites which may have privacy policies that differ from our own. We are not responsible for the activities and practices that take place on these websites. Accordingly, we recommend that you review the privacy policy posted on any external site before disclosing any Personal Information. Please contact those websites directly if you have any questions about their privacy policies.

14. Where Your Personal Information is Held

Personal Information may be held at our offices and those of our third-party service providers, representatives, and agents as described above (see "Disclosure of Information").

Some of these third parties may be based outside the European Economic Area. For more information, including on how we safeguard your Personal Information when this occurs, see "Transferring Your Personal Information Out of the EEA".

15. Transferring Your Personal Information Out of the EEA

We may transfer your Personal Information to countries other than the one in which you live, including transfers to the United States. International transfers are made on the basis of appropriate safeguards as required by GDPR Article 46, including the EU Standard Contractual Clauses where applicable, and the EU-US Data Privacy Framework where the recipient is certified.

To deliver services to you, it is sometimes necessary for us to share your Personal Information outside the European Economic Area (EEA), e.g., your information, including Personal Information, is processed at the Company's operating offices and in any other places where the parties involved in the processing are located. It means that this information may be transferred to — and maintained on — computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction.

The Company will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy, and no transfer of your Personal Information will take place to an organization or a country unless there are adequate controls in place including the security of your data and other Personal Information.

If you would like further information, please contact us using the contact details below.

16. Access, Correction, and Deletion

We respect your right to access and correct your Personal Information. You may exercise your rights, subject to applicable laws, to request that we delete or restrict access to your Personal Information. We may need to retain it for legally permitted purposes and this will be explained to you if necessary.

If you need assistance correcting or updating your Personal Information, or would like to request that we delete your Personal Information, please contact us using the contact information detailed in the "Contact Us" section below.

17. California Privacy Rights Disclosure

If you are a California resident, the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), the California Online Privacy Protection Act (CalOPPA), and certain other privacy and data protection laws, as applicable, provide you additional rights with respect to your Personal Information. California law permits our customers who are California residents to request certain information about our disclosure of Personal Information to third parties for their own direct marketing purposes during the preceding calendar year. This request is free and may be made once a year. To make such a request, please write to us at the following address:

Time To Cash, Corp.
ATTN: GENERAL COUNSEL
9150 South Dadeland Boulevard
Miami, FL 33156
legal@ttcc.ai

If you are a California resident, California law provides you with the following additional rights with respect to your Personal Information:

• The right to know what Personal Information we have collected, used, disclosed, and sold about you. You may submit a request to know by using the contact information detailed in this Section. You also may designate an authorized agent to make a request for access on your behalf.

• The right to request that we delete any Personal Information we have collected about you. You may submit a request for deletion by using the contact information detailed in this Section. You also may designate an authorized agent to make a request for deletion on your behalf.

California residents may also have the right not to be subject to automated decision-making, including profiling, where it would have a legal or similarly significant effect on them; and the right to data portability with regard to the data they provided to us. If you exercise any of these rights and submit a request to us, we may verify your identity. We also may use a third-party verification provider to verify your identity. Your exercise of these rights will have no adverse effect on the price and quality of our goods or services. At present we have not sold Personal Information about our users; nor do we have any plans to do so in the future.

18. Your Rights

We want you to be in control of how your Personal Information is used by us. Please note that our ability to access or control your Personal Information will be limited, as required or permitted by applicable law. Depending on your jurisdiction, you may have the right to be informed of, and request access to, the Personal Information we process about you; update and correct inaccuracies in that information; have the information restricted or deleted; object or withdraw your consent to certain uses of data; and lodge a complaint with your local data protection authority. You may also have the right not to be subject to automated decision-making, including profiling, where it would have a legal or similarly significant effect on you; and the right to data portability with regard to the data you provided to us. We will not discriminate against you for the exercise of these rights.

If you would like to exercise any of the rights described above, please send us a request by using the contact information in "Contact Us" below. In your message, please indicate the right you would like to exercise and your jurisdiction. We may ask you for additional information to confirm your identity and for security purposes, before disclosing the Personal Information requested to you. We reserve the right to charge a fee where permitted by law, for instance if your request to us is manifestly unfounded or excessive in our sole opinion. We may not always be able to fully address your request, for example if it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way.

19. How to Exercise Your Rights

If you would like to exercise any of your rights as described in this Privacy Policy, please contact us using the contact information detailed in the "Contact Us" section below.

Please note that you may only make a CCPA-related data access or data portability disclosure request twice within a 12-month period.

If you choose to contact us directly by phone, email, or in writing, you will need to provide us with:

• Enough information to identify you (e.g., your full name, address, and customer or matter reference number);

• Proof of your identity and address (e.g., a copy of your driver's license or passport); and

• A description of what right you want to exercise and the information to which your request relates.

We are not obligated to make a data access or data portability disclosure if we cannot verify that the person making the request is the person about whom we collected information, or is someone authorized to act on such person's behalf.

Any Personal Information we collect from you to verify your identity in connection with your request will be used solely for the purposes of verification.

20. Right to Lodge Complaints

We are transparent about the ways in which we collect and use Personal Information, and welcome your questions and concerns. We hope that we, or our designated privacy contact, can resolve any query or concern you raise about our use of your information.

If you have any concern or complaint about the way we handle your Personal Information, please contact us using the contact information detailed in the "Contact Us" section below. To the extent you believe we have not addressed your concerns or otherwise choose to do so, you have the right to lodge a complaint with a supervisory authority in the country where you reside.

If you are a United States resident, you may contact the U.S. Federal Trade Commission regarding your concerns. For more information, please see: https://www.ftc.gov/news-events/news/press-releases/2014/05/file-consumer-complaint-ftc-your-mobile-device.

The General Data Protection Regulation also gives you the right to lodge a complaint with a supervisory authority in the European Union (or European Economic Area) state where you work, normally live, or where any alleged infringement of data protection laws occurred. For more information, please see: https://commission.europa.eu/law/law-topic/data-protection/reform/rights-citizens/redress/what-should-i-do-if-i-think-my-personal-data-protection-rights-havent-been-respected_en.

21. Visitors from Outside the United States — Cross-Border Transfer

TTC is hosted in the United States. If you are visiting TTC from outside the United States, your information may be transferred to, stored, and processed in the United States or other countries in accordance with this Privacy Policy. The data protection and other applicable laws of the United States or other countries may not be as comprehensive as those laws or regulations in your country or may otherwise differ from the data protection or consumer protection laws in your country. Your information may be available to government authorities under lawful orders and law applicable in such jurisdictions. By using the Website and/or providing Personal Information to us, you consent to transfer of your information to our facilities as described in this Privacy Policy.

22. Contact Us

If you have questions about this Privacy Policy or our practices, or if you are seeking to exercise any of your statutory rights, you can contact us at the addresses provided below.

If you live in the United States or any other country outside of the European Union, European Free Trade Association (EFTA) States, or the United Kingdom, the data controller responsible for your Personal Information is Time To Cash, Corp.:

Time To Cash, Corp.
ATTN: GENERAL COUNSEL
9150 South Dadeland Boulevard
Miami, FL 33156

If you live in the European Union, EFTA States, or the United Kingdom, the data controller is Time To Cash, Corp., with the same address as above.

Our EU Representative — Under Article 27 of the GDPR, we have appointed an EU Representative to act as our data protection agent:

Instant EU GDPR Representative Ltd.
Adam Brogden — contact@gdprlocal.com
Tel: +353 1 554 9700
Office 2, 12A Lower Main Street, Lucan, Co. Dublin, K78 X5P8, Ireland

Our UK Representative — Under Article 27 of the UK Data Privacy Act, we have appointed a UK Representative to act as our data protection agent:

GDPR Local Ltd.
Adam Brogden — contact@gdprlocal.com
Tel: +44 1772 217 800
1st Floor Front Suite, 27-29 North Street, Brighton, England, BN1 1EB

Our Privacy contact:

Time To Cash, Corp.
ATTN: PRIVACY
9150 South Dadeland Boulevard
Miami, FL 33156
security@ttcc.ai

If you would like this notice in another format (for example: audio, large print, braille) please contact us at the above.