RUCKIT INC. PRIVACY POLICY

Last modified: November 16, 2020


Purpose

Ruckit Inc. (“Ruckit” or “we”) is a commercial organization that provides software and web solutions to
companies in the ready-mix, aggregate, and bulk hauler industry through on-premise, software-as-a-service
(“SaaS”), and other web-based methods. Ruckit respects the privacy of the users of its products and
services and is committed to protecting the privacy of its users through our compliance with this privacy
policy (“Privacy Policy”). This Privacy Policy describes our practices for collecting, using, storing,
transferring, processing and disclosing personal data. Please read this Privacy Policy carefully to
understand our policies and practices regarding treatment of personal data. By accessing our website
and/or using our products or services, you consent to our collection, use, and disclosure of personal data
as described in this Privacy Policy.


How We Collect and Use Personal Data

Personal Data You Provide


Ruckit collects the personal data you provide. For example, when you sign up for an account, we may
collect information like names, e-mail addresses, physical address, phone numbers, etc. You may also
provide personal data to, for example, learn more about our products or sign up for our notifications.

Data Collected Through Our Products and Services


Ruckit obtains personal data in connection with providing its products and services, including:
(i) SaaS products or services hosted for Ruckit customers;
(ii) Web-based products or services for collaborative commerce solutions covering the entire
ordering and purchasing process in the business-to-business market sector;
(iii) On-premise software products licensed to a customer for use on their own premises through
provision of professional services;
(iv) On-premise hardware products sold to a customer for use on their own premises; and
(v) Customer support services related to SaaS, web-based and on-premise software and
hardware products.

For instance, when our customers use the products or services above, they may provide details about their
employees, including their names, job titles, e-mail addresses, login credentials, telephone numbers,
addresses, dates of birth, driver’s license numbers, and other information. Some of our web-based
solutions enable customers to submit personal data to create users of the solution, to store transaction
documents that may include some personal data of signatories or business contacts, to use geo-location,
and to store contact information associated with trading partners.

Please note that where Ruckit collects personal data through these products and services, our customers
are the Data Controller for what data is collected and how it is used and disclosed. Ruckit acts as a Data
Processor only. Any questions related to how our customers process, use or share the personal data they
collect through our products should be directed to the relevant customer.

Automatically-Collected Information


As you navigate through and interact with our websites and/or SaaS products, we may use automatic data
collection technologies to collect certain information about your equipment, actions and patterns

(“UserActivity Information”), including (i) details of your use, including traffic data, location data through geo-
location technology, logs and other communication data and the resources that you access and use and

(ii) information about your device, including your operating system, IP address, and other mobile sign-on
data.


The User Activity Information that we collect helps us to improve our websites and products, and to deliver
a better and more personalized service by enabling us to estimate usage patterns, display information you
request in your relevant time zone, and recognize you when you return to our website or product.
The technologies we use for this automatic data collection may include cookies. A cookie is a small file
placed on the hard drive of your device. We use cookies to help analyze usage, customize our services,
measure effectiveness, and promote trust and safety. Cookies are discussed further below.


How We Use the Information We Collect


Ruckit uses the information it collects for the purposes of operating effectively, providing its products and
services to customers, facilitating business between parties in the industry, and administering and
managing its relationships with customers. We also use the information we collect to process, evaluate
and respond to your requests; respond to inquiries and applications; create, administer and communicate
with you about your account (including any purchases and payments); operate, evaluate and improve
Ruckit’s business (including developing new products and services, managing communications, performing
market research, analyzing Ruckit products/services/websites, and performing accounting, auditing, billing,
reconciliation, and collection activities); ensure the safety of Ruckit network services and resources; and
comply with applicable legal requirements.


How We Disclose the Information We Collect


We may disclose information that we collect as follows:
• To our affiliates;
• To third parties, such as contractors, service providers, consultants and other agents (“Service
Providers”), that provide assistance to our business. Service Providers with whom we share such
information generally are bound by confidentiality and privacy obligations and a list of such Service
Providers can be found on our parent company website (www.commandalkon.com) under the Legal
tab (Sub-processor List);
• To fulfill the purposes for which you provided such information;
• To a buyer or other successor of Ruckit or any of our affiliates in the event of an acquisition, merger,
divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of Ruckit’s
or any of our affiliates’ equity or assets, whether as a going concern or as part of bankruptcy, liquidation
or similar proceedings, in which personal data is among the assets transferred; and
• For any other purpose disclosed by us when you provide the information.

Notwithstanding any other provisions of this Privacy Policy, we also reserve the right to access, preserve
and disclose any information we collect as we reasonably believe is necessary: (i) to respond to legal
requirements, including complying with any court order, law or legal process and responding to any
government or regulatory request, including responding to law enforcement or other government officials
in response to a verified request relating to a criminal investigation or alleged illegal activity; (ii) to enforce
or apply our policies and agreements; (iii) to detect, prevent or otherwise address fraud, security, trust and
safety or technical issues; (iv) to respond to user support requests; or (v) to protect the rights, property,
health or safety of Ruckit, our users, any third parties, or the public in general.

Third-Party Services


You may be given the opportunity to elect to access and use third-party services or applications (“Third-

Party Services”) through some of our websites and/or products. This Privacy Policy addresses only Ruckit’s
collection, use and disclosure of information collected by Ruckit. It does not apply to the practices of third
parties that we do not own, control, employ or manage, including, but not limited to, any Third-Party
Services. If you disclose your information to a Third-Party Service, different rules may apply to that third
party’s use or disclosure of the information you disclose to that third party.


Security


Ruckit takes reasonable and appropriate precautions to protect personal data from loss, misuse and
unauthorized access, disclosure, alteration and/or destruction. Although we work hard to protect your
privacy, we cannot guarantee the security of information or that your personal data or private
communications always will remain private. Unauthorized entry or use, hardware or software failure, and
other factors may compromise the security of user information.


Retention of Information


We will generally retain personal data for as long as is needed to fulfill the purposes outlined in this Privacy
Policy. However, we may retain certain information as required by applicable law (such as tax, accounting
or other legal requirements), or for legitimate business purposes. Each of the uses set forth in this Privacy
Policy constitutes a legitimate interest of Ruckit to process or use the personal data collected. If you do not
agree with this approach, you may object to Ruckit’s processing or use of your personal data by contacting
Ruckit in writing via the methods listed below in the Contact Us section.

Your Rights and Choices


Account Information & Requests


In accordance with applicable law you may have the right to access, update or delete personal data we
hold about you. This means you may have the right to: (i) be informed of the personal data we collect, how
we use it and what information we have shared with third parties, and to be provided with a copy of that
information; and (ii) have corrections made or have it deleted if such information is not accurate or
processed in violation of applicable laws. You may be able to exercise these rights by logging into your
account within the products that you use. Otherwise, to request such information directly, please submit a
written request using the details provided in the Contact Us section below.


If you are from certain territories (such as, for example, the EEA from 25 May 2018 onwards or the State
of California from 1 January 2020 onwards), you may have the right to exercise additional rights available
to you under applicable laws, including broader rights to access and erasure of your personal data, the right
to object to or restrict processing of your personal data by us or third-party Service Providers, the right to
data portability in certain circumstances, or the right to say “no” to the sale of your personal data. If you
would like to make such a request, please contact us with a written request using the details provided in
the Contact Us section. Where Ruckit relies on your consent to process personal data, you have the right
to withdraw or decline your consent at any time. Please note that this does not affect the lawfulness of the
processing based on consent prior to its withdrawal.


Remember that in certain regions, you also have the right to complain to a data protection authority (“DPA”)
about our collection and use of your personal data. For more information, please contact your local DPA.


In the event Ruckit processes information about you on behalf of a customer, please direct your privacy
inquiries and requests for access, correction or deletion of personal data to such customer.


Promotional Communications


From time to time, we may send you marketing communications about our products, in accordance with
your preferences. You may opt out of receiving promotional messages from us at any time by following the
instructions in those messages (often it will be a notice or link at the bottom of the message). If you opt

out, we may still send you non-promotional communications, such as those about your account or our
ongoing business relations. Requests to opt out of promotional communications may also be sent to Ruckit
in writing via the methods listed below in the Contact Us section.


Cookies


You can manage our use of cookies through the cookie banner that appears when you access our sites. If
you prefer, you can usually choose to set your browser to remove or reject browser cookies or to clear local
storage. You may also make any cookie management requests by contacting us in writing via the methods
listed below in the Contact Us section. Please note that if you choose to remove or reject some cookies,
this could affect the functionality of our website and services. We have an independent Cookie Policy
available on our parent company website (www.commandalkon.com) under the Legal tab.


Location Information


You can turn location-based services on and off by adjusting the settings of your mobile device. Please
note that if you choose to turn off location-based services, this could affect the full functionality of our
products and services.


International Data Transfers and Privacy Shield


Ruckit is based in the United States but we have international customers. To facilitate our operations and
to help deliver our products and services, we may transfer personal data to the U.S. and any other country
where our affiliates, vendors, consultants and service providers operate. Such countries may have laws
which are different, and potentially not as protective, as the laws of your country of residence.


When we transfer personal data abroad, we will take appropriate safeguards to protect the information in
accordance with this Privacy Policy and seek to ensure that we, along with any overseas recipients, comply
with applicable privacy laws.

If you have concerns about our compliance with this Privacy Policy, you
should contact us as indicated in the Contact Us section below.


Legal Basis for Processing (EEA)


If you are an individual from the EEA, our legal basis for collecting and using personal data will depend on
the personal data concerned and the specific context in which we collect it. However, we will normally
collect personal data from you only where: (1) we have your consent to do so, (2) where we need the
personal data to perform a contract with you (such as delivering products or providing services to you), or
(3) where the processing is in our, your employer’s, or a third party's legitimate interests and not overridden
by your data protection interests or fundamental rights and freedoms. In some cases, we may also have a
legal obligation to collect personal data or may otherwise need the personal data to protect your vital
interests or those of another person.


Children’s Privacy


Ruckit’s business is not directed toward children and Ruckit does not knowingly collect or solicit any
information from children or anyone under the age of 13. Ruckit does not knowingly allow such persons to
utilize our products or services. In the event that we learn that we have inadvertently collected personal
information from a child or someone under the age of 13, we will delete that information as quickly as
possible. If you believe that we might have any information from or about a child, please contact us via the
methods listed below on the Contact Us section.

Changes to the Privacy Policy


We may amend this Privacy Policy at any time by posting the amended Privacy Policy on our websites.
The date the Privacy Policy was last revised is identified at the top of this Privacy Policy. All amended
terms automatically take effect after they are initially posted on our website, unless a change in any
applicable law requires immediate amendment. You are responsible for periodically checking this Privacy
Policy for any changes.


Contact Us


To contact Ruckit with questions or concerns about this Privacy Policy or Ruckit’s practices concerning
personal data, please use the contact information below to make your inquiries to our parent company:


If you are a resident in the EEA, please note that if Ruckit acts as a data controller responsible for your
personal data, Ruckit is managed by our parent company Command Alkon Incorporated in the United
States. Ruckit will address all questions and complaints related to this Privacy Policy through our parent
company within a reasonable period.


E-mail:
privacy@commandalkon.com


Or write to:
Command Alkon Incorporated
Chief Privacy Officer c/o The Legal Department
1800 International Park Drive
Suite 400
Birmingham, Alabama 35243


Or call:
1-800-624-1872 (U.S. toll free)
0-800-022-9682 (International toll free)


Website:
www.commandalkon.com