Privacy Notice

Asaterra, LLC

Asaterra, LLC respects the privacy of its customers, users, website visitors, business contacts, and other individuals whose personal information may be processed through Asaterra’s services.

This Privacy Notice explains how Asaterra, LLC collects, uses, discloses, retains, and protects personal information in connection with the Asaterra website, software platform, applications, portals, dashboards, mobile interfaces, support services, and related services, collectively referred to as the “Services.”

1. Scope of This Privacy Notice

This Privacy Notice applies to personal information that Asaterra, LLC collects or processes when an individual:

• Visits an Asaterra website;
• Creates or uses an Asaterra account;
• Accesses the Asaterra Platform;
• Communicates with Asaterra;
• Requests information, support, or a demonstration;
• Participates in a meeting, training session, survey, or event;
• Receives marketing or business communications from Asaterra; or
• Otherwise interacts with Asaterra in a business or professional capacity.

This Privacy Notice does not replace the privacy, data-processing, or confidentiality terms contained in an executed customer agreement.

When Asaterra processes personal information on behalf of a customer, the customer’s agreement with Asaterra and the customer’s own privacy practices may also apply.

2. Asaterra’s Role

Depending on the circumstances, Asaterra may act as either a controller or a processor of personal information.

When Asaterra Acts as a Controller

Asaterra generally acts as a controller when it determines why and how personal information is processed, such as when Asaterra processes:

• Website visitor information;
• Account-registration information;
• Business contact information;
• Sales and marketing information;
• Support communications;
• Billing and administrative information; and
• Information used to operate, secure, and improve the Services.

When Asaterra Acts as a Processor

Asaterra generally acts as a processor or service provider when it processes personal information contained in customer data on behalf of a customer and according to that customer’s instructions.

When Asaterra acts as a processor, the applicable customer is generally responsible for determining:

• What information is collected;
• Why the information is processed;
• Who may access the information;
• How long the information should be retained; and
• How requests concerning the information should be handled.

Individuals seeking to exercise rights concerning customer-controlled data may need to direct their request to the applicable customer.

3. Personal Information We Collect

The personal information Asaterra collects depends on how an individual interacts with the Services.

A. Account and Contact Information

Asaterra may collect:

• Name;
• Business email address;
• Business telephone number;
• Username;
• Password or authentication credentials;
• Job title;
• Employer or affiliated organization;
• Department;
• User role;
• Account permissions; and
• Communication preferences.

Passwords may be stored in a protected or encrypted form or managed through an approved authentication provider. Asaterra does not intend to make user passwords viewable to Asaterra personnel.

B. Organization and Professional Information

Asaterra may collect information concerning an individual’s professional relationship with a customer or other organization, including:

• Employer;
• Facility or site assignment;
• Department or business unit;
• Job responsibilities;
• Professional qualifications;
• Assigned assets, tasks, inspections, or records;
• Approval authority; and
• Platform activity associated with the individual’s role.

C. Customer Data and Platform Content

Customers and authorized users may submit or connect information to the Platform, including:

• Facility and asset records;
• Inspection information;
• Compliance records;
• Environmental records;
• Operational data;
• Equipment and sensor data;
• Inventory records;
• Documents and photographs;
• Maintenance information;
• Tasks, notes, and comments;
• Reports and corrective-action records;
• User-generated content;
• Vendor and contractor information; and
• Other information selected by the customer.

Customer data may contain personal information about employees, contractors, vendors, customers, property owners, inspectors, or other individuals.

Customers are responsible for ensuring that they have the legal authority to provide personal information to Asaterra and to make that information available to authorized Platform users.

D. Device, Usage, and Log Information

When an individual accesses the Services, Asaterra may automatically collect technical and usage information, including:

• Internet Protocol address;
• Browser type;
• Device type;
• Operating system;
• Device identifiers;
• Login time and date;
• Pages or Platform features accessed;
• Actions taken within the Platform;
• Session information;
• Referring website;
• Error and diagnostic information;
• Authentication events;
• Audit logs; and
• Security-related activity.

This information may be used to operate, secure, troubleshoot, audit, and improve the Services.

E. Location Information

Certain Platform features may process general or precise location information when:

• The customer enables a location-based feature;
• The user grants appropriate device permissions;
• Location is associated with an inspection, facility, photograph, asset, or record; or
• Location information is required to provide a requested service.

Asaterra will process location information only as reasonably necessary to provide the applicable feature, fulfill customer instructions, maintain security, or comply with applicable requirements.

Users may be able to manage location permissions through their device or browser settings. Disabling location services may affect certain Platform features.

F. Communications and Support Information

Asaterra may collect information when an individual communicates with Asaterra, including:

• Email correspondence;
• Support requests;
• Chat communications;
• Telephone-call information;
• Meeting notes;
• Feedback;
• Survey responses;
• Training participation;
• Demonstration requests; and
• Other information provided during the communication.

Where legally permitted and with any required notice or consent, meetings or support interactions may be recorded for training, documentation, security, or quality-assurance purposes.

G. Billing and Transaction Information

Asaterra may collect business and administrative information related to customer accounts, including:

• Billing contact information;
• Company address;
• Purchase-order information;
• Subscription details;
• Invoice records;
• Payment status; and
• Transaction history.

Payment-card or banking information may be processed directly by a financial institution or third-party payment provider. Asaterra may receive limited transaction information without receiving the complete payment credentials.

H. Cookies and Similar Technologies

Asaterra’s website and Platform may use cookies, browser storage, pixels, session technologies, and similar tools to:

• Maintain authenticated sessions;
• Remember user preferences;
• Protect accounts;
• Prevent fraudulent or unauthorized access;
• Understand website and Platform usage;
• Diagnose performance issues; and
• Improve the Services.

Some cookies are necessary for the website or Platform to function. Where required by law, Asaterra will request consent before using optional cookies or similar technologies.

Users may manage certain cookie settings through their browser or any cookie-preference tool made available by Asaterra. Blocking necessary cookies may prevent portions of the Services from operating properly.

4. Sources of Personal Information

Asaterra may collect personal information from:

• The individual directly;
• The individual’s employer or affiliated organization;
• Customers and authorized Platform administrators;
• Equipment, devices, sensors, and monitoring systems;
• Third-party software platforms and integrations;
• Vendors, contractors, consultants, and service providers;
• Publicly available sources;
• Business partners;
• Websites, browsers, and mobile devices; and
• Other parties authorized to provide information to Asaterra.

5. How We Use Personal Information

Asaterra may use personal information to:

• Create and administer user accounts;
• Authenticate users and manage permissions;
• Provide, configure, and support the Services;
• Process customer data according to customer instructions;
• Display information to authorized users;
• Provide reports, alerts, tasks, analytics, and notifications;
• Respond to questions and support requests;
• Provide demonstrations, training, and customer service;
• Communicate about accounts, updates, security, and service changes;
• Process billing and maintain business records;
• Monitor performance and diagnose technical problems;
• Protect the security, confidentiality, availability, and integrity of the Services;
• Detect, investigate, and prevent fraud, misuse, unauthorized access, or unlawful activity;
• Maintain audit trails and access logs;
• Improve Platform usability, reliability, and functionality;
• Develop new products and features using appropriately controlled information;
• Comply with legal, regulatory, contractual, and recordkeeping obligations;
• Establish, exercise, or defend legal claims;
• Enforce customer agreements and Platform terms; and
• Carry out other purposes disclosed at the time information is collected.

Asaterra seeks to process personal information only when the processing is reasonably necessary, proportionate, and relevant to an identified business purpose.

6. Artificial Intelligence and Automated Features

Certain Services may use artificial intelligence, machine learning, natural-language processing, predictive analytics, automated rules, or similar technologies.

These features may process customer data and personal information to:

• Summarize records;
• Organize or categorize information;
• Identify potential patterns or exceptions;
• Generate suggested content;
• Assist with searches;
• Recommend possible actions;
• Support reporting and analysis; or
• Provide other customer-requested functionality.

Asaterra does not use customer data or personal information to train publicly available or shared artificial-intelligence models unless expressly authorized through a separate written agreement or affirmative customer instruction.

Asaterra may use deidentified or aggregated information to evaluate and improve its technology, provided the information is not reasonably capable of being associated with an identified individual or customer.

AI-generated and automated results may contain errors and should be reviewed by an authorized individual before being used to make a material decision.

7. How We Disclose Personal Information

Asaterra may disclose personal information in the following circumstances.

A. Customers and Authorized Users

Information may be made available to the customer that controls the applicable account and to users authorized by that customer.

A customer’s administrators may be able to:

• Create or disable accounts;
• Assign roles and permissions;
• Review account activity;
• Access customer data;
• Review audit records; and
• Manage information associated with users in the customer’s organization.

B. Service Providers

Asaterra may disclose personal information to vendors and service providers that assist with:

• Cloud hosting;
• Data storage;
• Authentication;
• Cybersecurity;
• Software development;
• System monitoring;
• Communications;
• Customer support;
• Analytics;
• Billing;
• Payment processing;
• Document management;
• Data backup; and
• Professional services.

These providers are permitted to process personal information only as necessary to perform services for Asaterra or as otherwise permitted by applicable law and contract.

C. Customer-Directed Integrations

When a customer enables an integration, Asaterra may exchange information with the applicable third-party platform, equipment provider, software provider, or business partner.

Information processed through a customer-directed integration may also be subject to the third party’s terms and privacy practices.

D. Professional Advisers

Asaterra may disclose information to attorneys, accountants, auditors, insurers, consultants, and other professional advisers when reasonably necessary to obtain professional services or protect Asaterra’s legitimate interests.

E. Legal and Regulatory Requirements

Asaterra may disclose information when it reasonably believes disclosure is necessary to:

• Comply with applicable law;
• Respond to a subpoena, court order, warrant, or lawful governmental request;
• Cooperate with a regulatory or law-enforcement investigation;
• Protect the rights, safety, or property of Asaterra, its customers, users, or others;
• Investigate fraud, misuse, security threats, or unlawful activity; or
• Establish, exercise, or defend legal claims.

Where legally permitted and reasonably practicable, Asaterra may notify the affected customer before disclosing customer-controlled information in response to a governmental request.

F. Business Transactions

Personal information may be disclosed or transferred in connection with a proposed or completed:

• Merger;
• Acquisition;
• Financing;
• Reorganization;
• Sale of assets;
• Change of control;
• Bankruptcy; or
• Transfer of all or part of Asaterra’s business.

Any recipient will remain subject to applicable confidentiality, contractual, and legal obligations.

8. Sale and Targeted Advertising

Asaterra does not sell personal information for monetary consideration.

Asaterra does not process personal information for cross-context behavioral or targeted advertising.

Asaterra may promote its own products and services to business contacts, subject to applicable law and the recipient’s communication preferences. Such communications are not treated as the sale of personal information.

If Asaterra materially changes these practices, this Privacy Notice and any legally required opt-out mechanisms will be updated before the new practices are implemented.

9. Customer Data

As between Asaterra and its customers, ownership and control of customer data are governed by the applicable customer agreement.

Asaterra processes customer data to:

• Provide the Services;
• Follow authorized customer instructions;
• Maintain and secure the Platform;
• Meet legal obligations; and
• Carry out other activities permitted by the applicable agreement.

Asaterra will not independently determine new purposes for processing customer-controlled personal information except as permitted by the applicable agreement or law.

A customer may direct Asaterra to return, export, retain, or delete customer data in accordance with the customer agreement and applicable legal obligations.

10. Data Retention

Asaterra retains personal information for only as long as reasonably necessary to:

• Provide the Services;
• Maintain customer accounts;
• Fulfill the purposes described in this Privacy Notice;
• Comply with customer instructions;
• Meet contractual, legal, regulatory, tax, accounting, and recordkeeping obligations;
• Maintain security and audit records;
• Resolve disputes; and
• Enforce agreements.

Retention periods may vary depending on:

• The type of information;
• The customer’s configuration or instructions;
• Contractual requirements;
• Applicable laws;
• Security needs;
• Backup schedules; and
• The existence of an actual or anticipated dispute.

Information may remain temporarily in secure backups or archives after deletion from active systems. Such information will remain protected and will be deleted or overwritten according to applicable backup-retention procedures.

Asaterra may retain aggregated or deidentified information that is not reasonably capable of being associated with an individual.

11. Data Security

Asaterra uses administrative, technical, and organizational safeguards designed to protect personal information against unauthorized access, acquisition, use, alteration, loss, destruction, or disclosure.

These measures may include, as appropriate:

• Access controls;
• Authentication requirements;
• Encryption;
• Logging and monitoring;
• Secure development practices;
• Vendor-management procedures;
• Backup and recovery controls;
• Incident-response procedures;
• Employee and contractor confidentiality obligations; and
• Periodic security reviews.

No information system or method of electronic transmission is completely secure. Asaterra cannot guarantee that unauthorized access, security incidents, or data loss will never occur.

Additional information about Asaterra’s security practices may be available in the Asaterra Security Notice or applicable customer documentation.

12. International Processing and Data Transfers

Asaterra is based in the United States and may use service providers that process information in the United States or other jurisdictions.

As a result, personal information may be processed in a jurisdiction whose privacy laws differ from those of the individual’s location.

When required, Asaterra will use contractual, technical, organizational, or other appropriate measures to support lawful cross-border transfers of personal information.

This Privacy Notice does not represent that Asaterra participates in a particular international data-transfer framework unless Asaterra has formally completed the applicable certification or adoption process.

13. Privacy Rights and Choices

Depending on where an individual resides and subject to applicable exceptions, the individual may have the right to:

• Confirm whether Asaterra processes personal information about them;
• Access personal information;
• Correct inaccurate personal information;
• Request deletion of personal information;
• Obtain a portable copy of certain personal information;
• Opt out of the sale of personal information;
• Opt out of targeted advertising;
• Opt out of certain profiling or automated decision-making;
• Withdraw consent for processing sensitive personal information;
• Appeal the denial of a privacy request; and
• Receive equal service without unlawful discrimination for exercising privacy rights.

Asaterra will not unlawfully discriminate against an individual for exercising an applicable privacy right.

These rights may not apply in every circumstance. For example, Asaterra may need to retain information to comply with a legal obligation, protect security, complete a requested transaction, maintain business records, or establish or defend legal claims.

14. How to Submit a Privacy Request

Privacy requests may be submitted by contacting:

Email: privacy@asaterra.com

The request should include sufficient information to allow Asaterra to:

• Understand the request;
• Identify the individual;
• Locate the relevant information; and
• Determine whether Asaterra or an Asaterra customer controls the information.

Asaterra may request additional information to reasonably verify the requester’s identity and authority. Asaterra will use verification information only to process and document the request.

An authorized agent may submit a request where permitted by law. Asaterra may require evidence that the agent is authorized to act on the individual’s behalf.

When Asaterra processes the information solely on behalf of a customer, Asaterra may refer the request to that customer or instruct the individual to contact the customer directly.

15. Response and Appeal Process

Asaterra will respond to a verified privacy request within the period required by applicable law.

Where permitted, Asaterra may extend the response period when reasonably necessary and will provide notice of the extension.

If Asaterra declines to take action on a request, Asaterra will provide an explanation when required and will explain how the decision may be appealed.

An appeal may be submitted to:

Email: privacy@asaterra.com

Subject: Privacy Request Appeal

The appeal should identify the original request and explain why the individual believes the decision should be reconsidered.

If an appeal is denied, Asaterra will provide information about any further complaint process required by applicable state privacy law.

16. Universal Opt-Out Signals

Where required by applicable law, Asaterra will recognize valid universal opt-out preference signals for processing activities subject to such signals.

Because Asaterra does not currently sell personal information or use personal information for targeted advertising, an opt-out signal should not materially change Asaterra’s current data practices.

17. Marketing Communications

Individuals may unsubscribe from promotional emails by using the unsubscribe link contained in the communication or by contacting Asaterra.

Even after an individual opts out of promotional communications, Asaterra may continue to send nonpromotional communications concerning:

• Account administration;
• Security;
• Support;
• Billing;
• Service updates;
• Legal notices; and
• The individual’s organization’s use of the Services.

18. Children’s Privacy

The Services are intended for business and professional use and are not directed to children.

Asaterra does not knowingly collect personal information directly from children under 13 through the Services.

Individuals under 18 should not create an Asaterra account or use the Services unless their access is expressly authorized by an appropriate organization and permitted by applicable law.

If Asaterra learns that it collected personal information directly from a child in violation of applicable law, Asaterra will take reasonable steps to delete the information.

Concerns regarding a child’s personal information may be submitted to privacy@asaterra.com.

19. Third-Party Services and Links

The Services may contain links to or integrate with websites, software, applications, equipment, and services operated by third parties.

Asaterra does not control the independent privacy practices of third parties. Individuals should review the applicable third party’s privacy notice before providing information directly to that party.

This Privacy Notice applies only to information processed by or on behalf of Asaterra.

20. Changes to This Privacy Notice

Asaterra may update this Privacy Notice to reflect changes in:

• The Services;
• Data-processing practices;
• Technology;
• Legal requirements;
• Customer needs; or
• Business operations.

The updated notice will be posted with a revised effective date.

When required by law or contract, Asaterra will provide additional notice of material changes before those changes become effective.

21. Contact Information

Asaterra, LLC operates as a virtual company and does not maintain a public customer-facing office.

Questions, requests, or concerns concerning this Privacy Notice may be directed to:

Asaterra, LLC

Privacy Email: privacy@asaterra.com

Legal Email: legal@asaterra.com

Website: asaterra.com

Formal legal notices must be provided in accordance with the applicable customer agreement.

When no separate customer agreement applies, Asaterra’s official mailing address may be provided upon request.

-- END OF PRIVACY NOTICE --