3. Cross-Border Transfers. For transfer of your personal information from a European country to a country that is not considered adequate, adequate measures have been put in place.

We participate in the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the United Kingdom (“UK”) Extension to the EU-U.S. DPF and the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”) as set forth by the U.S. Department of Commerce. We have certified to the U.S. Department of Commerce that we adhere to the EU-U.S. Data Privacy Framework Principles (“EU-U.S. DPF Principles”) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the UK (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. We have certified to the U.S. Department of Commerce that we adhere to the Swiss-U.S. Data Privacy Framework Principles (“Swiss-U.S. DPF Principles”) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this Privacy Policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the applicable Data Privacy Framework (“DPF”) Principles shall govern. To learn more about the DPF program, and to view our certification, please visit https://www.dataprivacyframework.gov/. EU, UK and Swiss individuals with inquiries or complaints regarding our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF should first submit a support request at admin@imcomingapp.com for users of the ImComing or contact customer service from within any of our other services or products. We have further committed to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs), the UK Information Commissioner’s Office (ICO) and the Gibraltar Regulatory Authority (GRA) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to any complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF that we do not otherwise satisfactorily address with you directly. Under certain conditions, as more fully described at https://www.dataprivacyframework.gov/s/article/ANNEX-I-introduction-dpf?tabset-35584=2, you can pursue binding arbitration when other dispute resolution procedures have been exhausted.

Please see this Privacy Policy regarding:

• the types of personal data we collect,

• the purposes for collection and use of such personal data,

• the types of third parties to which we can provide personal data and the purposes for which we can do so; and

• the right of individuals to access their personal data and the choices and means we offer individuals for limiting the use and disclosure of their personal data.

When we receive personal data and then transfer it to a third party acting as an agent on our behalf, we have certain liability under the applicable DPF Principles if the agent processes the personal data in a manner inconsistent with the applicable DPF Principles, unless we prove we are not responsible for the event giving rise to the damage.

We are subject to the investigatory and enforcement powers of the U.S. Federal Trade Commission (“FTC”). The FTC has jurisdiction over our compliance with the EU-U.S. DPF, the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF. We may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.