Privacy Policy

PRIVACY POLICY

Genzeon Corporation

Effective Date: November 2, 2026 | Last Updated: November 2, 2026

1. Introduction

At Genzeon Corporation, your privacy is of utmost importance to us. We are committed to maintaining the confidentiality, integrity, and security of your personal information. This Privacy Policy explains how we collect, use, disclose, and protect the information you provide when you use any of the websites listed below, together with any related services or interactions.

Our primary goals in processing your personal information include:

• Enhancing the user experience on our platform by understanding customer needs and preferences.
• Providing timely support and responding to inquiries or service requests.
• Improving our products and services to meet the evolving demands of our users.
• Conducting necessary business operations, such as billing and account management.

We do not have a designated Data Protection Officer (DPO) but remain fully committed to addressing your privacy concerns. Should you have any questions or require further information, please contact us at privacy@genzeon.com or +1 (610) 441-7318.

This Privacy Policy covers the following websites, including their subdomains:

• genzeon.com — the corporate website of Genzeon Corporation.
• genzeon.one — operated under the Genzeon Platforms brand.
• moxiesystems.com — operated under the Moxie and Moxie Retail brands.
• complianceprosolutions.com — operated under the CompliancePro Solutions brand.

In this Privacy Policy, “our websites” means each of the websites listed above, and a reference to “our website” should be read as referring to whichever of them you are using.

Genzeon Corporation is the controller responsible for the personal information collected through Genzeon.com and Genzeon.one websites, Moxie Systems, Inc. is the controller for moxiesystems.com and CompliancePro Solutions LLC, is the controller for complianceprosolutions.com. You may send any request or question about any of them to privacy@genzeon.com.

Each of these websites is required to publish this Privacy Policy, or a policy consistent with it, together with a current Cookie Policy identifying the tracking technologies that website uses. Where a website uses a technology not described in Section 8, that technology must be identified in that website’s Cookie Policy before it is deployed.

2. Information We Collect

We collect the following types of personal data:

• Personal Information (including but not limited to Applicant data): Name, email address, phone number, job title, company name, and any other details you provide voluntarily through forms, surveys, emails, or direct communications.
• Business Information: Data about your organization, its operations, and services to better tailor our solutions to your needs.
• Usage Data: IP address, browser type, operating system, pages visited, time spent on pages, and other diagnostic data.
• Device ID and Browser Information: Identifiers associated with the device and browser you use to access our website.
• IP-based Location: General location derived from your IP address used for geolocation-based consent management.
• Interaction Logs: Records of how you interact with our website and consent banner.
• Cookies and Tracking Technologies: Data collected through cookies, web beacons, and similar technologies.

3. Categories of Personal Information We Collect and Disclose

This section describes the categories of personal information we collect, using the category names set out in California law, together with the sources we obtain it from and the parties we disclose it to. It covers the preceding twelve months. “Shared” means disclosed to an advertising partner for cross-context behavioral advertising or targeted advertising.

• Identifiers — name, email address, telephone number, IP address, and cookie and device identifiers. Collected directly from you and automatically from your device. Disclosed to our CRM provider, our consent management provider, and the content delivery, font, mapping, video and bot-protection providers identified in Section 8. Used to respond to inquiries, provide and maintain our services, send marketing communications (with your consent), manage your consent choices, and for authentication, security and fraud prevention.
• Professional or employment information — job title, company name, and industry. Collected directly from you through our web forms. Disclosed to our CRM provider. Used to respond to inquiries, offer tailored solutions, and provide and maintain our services.
• Commercial information — the services you enquire about, content you download, and events you register for. Collected directly from you. Disclosed to our CRM provider. Used to respond to inquiries, offer tailored solutions, and provide and maintain our services.
• Internet or other electronic network activity — pages viewed, the page that referred you, your browser and operating system, and your interaction with our consent banner. Collected automatically. Disclosed to the providers identified in Section 8. Used to operate and secure our websites, manage your consent choices, and display videos and interactive content.
• Geolocation data — the approximate city or region derived from your IP address. Collected automatically from your device. Disclosed to our consent management providers. Used to determine which consent options to present to you.
• Inferences — inferred professional attributes and inferred interest in our services, previously derived from advertising and analytics technologies that have since been removed from our websites. We no longer collect this category. This entry is retained only for the twelve-month lookback period required by California law and should be removed once that period has elapsed.

We collect each of these categories for the purposes described in Section 5, and we will not use or disclose personal information for a purpose materially different from those described here without first giving you notice.

We have not sold personal information for monetary consideration in the preceding twelve months. Advertising and analytics technologies that may have constituted “sharing” for cross-context behavioral advertising have been removed from our websites, and no technology currently in use discloses personal information to an advertising platform. Because the disclosure period required by California law looks back twelve months, this statement is retained until that period has elapsed. The look back period is the twelve (12) months immediately preceding the date of your request.

4. Sensitive Personal Information

We do not seek to collect sensitive personal information through our website. We do not ask website visitors for precise geolocation, government identifiers, financial account credentials, racial or ethnic origin, religious or philosophical beliefs, union membership, health information, biometric or genetic data, or information about sex life or sexual orientation, and we ask that you do not submit such information through our web forms or by email.

We do not use or disclose sensitive personal information for any purpose beyond those permitted under California law without a right to limit, and we do not sell or share sensitive personal information. Where the law of your state requires your consent before we process sensitive data, we will obtain that consent first.

[Genzeon to confirm: if any Genzeon web property collects information relating to an individual’s own health, or collects demographic information through recruitment, this section must instead identify that information, state the purpose it is used for, and explain how to exercise the right to limit its use. Information relating to an individual’s health may also bring Genzeon within the Washington My Health My Data Act, which requires a separate consumer health data privacy policy linked distinctly from the homepage.]

5. How We Use Your Information

We use the information we collect for the following purposes:

• Providing, operating, and maintaining our services.
• Responding to inquiries and offering tailored solutions.
• Sending newsletters, updates, and marketing communications (with your explicit consent).
• Improving our website’s functionality and user experience through analytics and performance tracking.
• Displaying videos and interactive content on our website.
• Conducting data analytics to refine our offerings.
• Ensuring compliance with legal obligations and safeguarding our rights.
• Authentication, security, and fraud prevention.
• Tag management and consent management via our Consent Management Platform (CMP).

6. Sharing Your Information

Your data is shared only under specific circumstances, including:

• Service Providers: Trusted partners who assist in delivering our services, such as cloud hosting providers, analytics tools, video hosting services, CRM platforms, and recruitment systems. These partners are bound by confidentiality and data processing agreements. Some advertising partners, including LinkedIn and Google, act as independent controllers of the information they receive rather than as our service providers, and process it under their own terms and privacy policies. They are identified in Section 8.
• Legal Requirements: When mandated by law or necessary to protect our legal rights.
• Business Transfers: In the event of a merger, acquisition, or sale of company assets, your information may be transferred to the new ownership entity.

We do not sell your personal information for money. We do not currently sell or share personal information as those terms are defined under U.S. state privacy laws. Section 3 describes the preceding 12-month period.

We do not currently use advertising or retargeting technologies on our websites. The LinkedIn Insight Tag, Google Analytics, Google Ads conversion and remarketing tags, and the other marketing technologies previously deployed have been removed and are not loaded. If any such technology is reintroduced, this Privacy Policy and the relevant Cookie Policy will be updated to identify it, and the opt-out mechanisms described in Section 9 will be in place, before it is deployed.

We do not knowingly sell or share the personal information of consumers under 16 years of age. We do not sell or share sensitive personal information. We do not disclose your personal information to third parties for their own independent marketing purposes.

7. Cookies and Tracking Technologies

We use cookies and similar tracking technologies on our websites. Functional and marketing technologies are not loaded until you have made a choice through our consent banner. A limited number of strictly necessary technologies load before you make a choice, because our websites cannot be delivered without them — these include our consent management platform and the content delivery networks that serve core site assets, and they are identified in Section 8.

A consent banner is displayed to all visitors on their first visit, wherever they are located. The privacy law that applies in your location determines which consent options the banner presents to you, and whether non-essential technologies load before you make a choice. On genzeon.one, every technology currently in use is classified as strictly necessary or functional, so no technology on that website is held back pending your choice.

Depending on your location, the banner allows you to:

Accept all cookies

Reject non-essential cookies, so that only strictly necessary cookies are used

Choose which categories you allow, where your local law provides for category-level choice

Opt out of the sale and sharing of personal information, where your local law provides for an opt-out

You can change a choice you made earlier at any time using the privacy button in the lower corner of any page on our websites.

We use the following categories (not every category is used on every website):

Essential: necessary for the website to work, including the consent banner itself, security and bot protection, and delivery of core page assets. These do not require consent and cannot be refused.

Functional: support features of the website beyond its core delivery — embedded video and maps, web fonts, forms, job listings, and, where used, measurement of how the website is used.

Marketing: associated with advertising networks. Where any are in use, the information disclosed to our advertising partners may constitute a “sale” or a “share” of personal information under US state privacy laws.

For more information, see the Cookie Policy published on the website you are using: https://www.genzeon.com/cookie-policy/ for genzeon.com, https://genzeon.one/legal/cookies/ for genzeon.one, and https://moxiesystems.com/cookie-policy for moxiesystems.com.

8. Advertising, Analytics, and Tracking Partners

We use the third-party technologies described below across the websites covered by this Privacy Policy. Not every technology is used on every website; the Cookie Policy published on each website lists the technologies that website uses. These entries reflect a technical audit of our websites completed in September 2026. Where an entry states that a technology loads only after consent, it is not loaded until you have consented to the relevant category. Not every technology described below is currently deployed. Some are included so that this Privacy Policy is already accurate if they are reintroduced; where a technology is not currently in use on a website, it is not listed in that website’s Cookie Policy.

LinkedIn Insight Tag (LinkedIn Corporation and LinkedIn Ireland Unlimited Company)

The LinkedIn Insight Tag collects your IP address, the page you are viewing, the page that referred you, the time of your visit, your device and browser characteristics, and LinkedIn cookie identifiers that allow LinkedIn to recognize you if you are a LinkedIn member. LinkedIn uses this information to measure the results of our advertising, to allow us to show advertising to people who have visited our website, and to give us aggregated professional demographics about our audience, such as job function, seniority, company size, and industry. LinkedIn acts as an independent controller of this information and processes it under its own privacy policy. This disclosure constitutes “sharing” for cross-context behavioral advertising under California law and “targeted advertising” under other state laws. You can opt out through our cookie preference center, through LinkedIn’s own control at https://www.linkedin.com/psettings/guest-controls/retargeting-opt-out, or in your LinkedIn Ad Settings if you are a member.

Google Analytics 4 (Google LLC)

We use Google Analytics 4 to understand how visitors use our website. It sets first-party cookies that generate a pseudonymous identifier, and records the pages you view, the events you trigger, your approximate location derived from your IP address, and your device and browser type. We have enabled the following Google Analytics Advertising Features: [Genzeon to complete — for example Google Signals, Remarketing, and Demographics and Interests Reporting; if none are enabled, say so instead]. Where these features are enabled, first-party cookies such as the Google Analytics cookie and third-party Google advertising cookies are used together to build audiences and report demographics. You can opt out through our cookie preference center, through your Google Ads Settings, or by installing the Google Analytics opt-out browser add-on at https://tools.google.com/dlpage/gaoptout.

HubSpot (HubSpot, Inc.)

We use HubSpot to host the contact forms on our websites and as our customer relationship management system. The system follows the cookie policy of the website it is embedded to. The forms have GDPR consent activated as well as reCAPTCHA. HubSpot will only process information of visitors who have agreed to these consent. The system processes this information as our service provider under a data processing agreement. When a visitor submits a form, HubSpot receives the information you entered into the form, together with the address of the page the form was submitted from, and your IP country address . We do not use HubSpot’s website analytics or visitor tracking script, so HubSpot does not set a visitor identification cookie on our websites and does not record the pages you viewed before or after submitting a form. This applies to genzeon.com, complianceprosolutions.com and moxiesystems.com. The contact form on genzeon.one is not hosted by HubSpot — see the Web3Forms entry below.

Consent management (Usercentrics GmbH)

Our consent management platform is provided by Usercentrics GmbH, Germany. It sets a strictly necessary cookie that records your cookie choices, and uses the approximate location derived from your IP address to determine which consent options to present to you. This cookie is required in order to honor your preferences and cannot be disabled. Usercentrics records the time of your consent interaction, which version of the banner was presented to you, the action you took, and whether you granted or denied consent for each configured service. It does not record your browsing activity, form submissions, search terms or keystrokes.

Google reCAPTCHA Enterprise (Google LLC)

We use reCAPTCHA Enterprise to protect the contact form on genzeon.com from automated abuse. reCAPTCHA receives your IP address, your browser and device characteristics, the address of the page, and behavioral signals generated while you complete the form, including mouse movement, touch events and typing rhythm. It does not receive the content of the fields you complete. Google processes this information under its own privacy policy.

Google Fonts (Google LLC)

Our websites load typefaces from Google Fonts. When a page loads, Google receives your IP address, your browser type and the address of the page you are viewing. No cookie is set by this service.

YouTube (Google LLC)

Some pages embed YouTube videos. When an embedded video loads, YouTube receives your IP address, your browser type, the address of the page containing the video and the identifier of the video, and may set Google cookies on your device. On genzeon.com, embedded videos are not loaded until you consent to the relevant cookie category. On genzeon.one, video thumbnail images are loaded from Google’s image host when the page is displayed, which means Google receives your IP address, browser type and the address of the page even if you do not play a video.

Content delivery and network infrastructure (Cloudflare, Inc. and jsDelivr)

Core site assets such as icon libraries and layout frameworks are served from third-party content delivery networks. When an asset is requested, the network receives your IP address, your browser type and the address of the page you are viewing. These assets are required in order to render our websites, and no cookie is set by these services. Separately, moxiesystems.com is served through Cloudflare’s network infrastructure, which means Cloudflare receives your IP address, your browser type and the address of every page you request on that website in order to deliver it to you. This is part of how the website is hosted and cannot be disabled through the consent banner. genzeon.one is also served through Cloudflare’s network infrastructure, and the email addresses published on that website are protected using Cloudflare’s email obfuscation service, which routes the address through Cloudflare when a visitor selects it.

Website statistics and image delivery (Automattic Inc.)

complianceprosolutions.com uses the WordPress.com Stats service and the WordPress.com image delivery network, both operated by Automattic Inc. Automattic receives the full address of each page you view — including, where you use the site search, the search term contained in that address — together with the address of the page that referred you, your IP address, your browser type and your screen size.

Cloudflare Web Analytics (Cloudflare, Inc.)

genzeon.one uses Cloudflare Web Analytics to measure how our website is used. It records page views, the page that referred you, your browser type, your device type and your approximate location derived from your IP address. It does not set cookies, does not identify you individually, and does not track you across other websites. This measurement script loads when the page loads. [Genzeon to confirm whether this service is to be retained, and if so to add it to the consent management platform.]

Web3Forms (Web3Forms)

The contact form on genzeon.one is handled by Web3Forms rather than HubSpot. When you submit that form, Web3Forms receives the information you entered — your name, email address, company, the area you are interested in and your message — together with the address of the page you submitted it from. [Genzeon to confirm the data processing terms in place with Web3Forms, where the information is processed, and how long it is retained.]

Do Not Track

Some browsers offer a “Do Not Track” setting. There is no common industry standard for interpreting Do Not Track signals, and we do not currently respond to them. We do honor the Global Privacy Control signal, as described in Section 9.

We do not currently deploy advertising or analytics partners that collect personally identifiable information about your online activities over time and across different websites. If we introduce such a technology, this Privacy Policy will be updated to identify it before it is deployed. Cloudflare Web Analytics, described above, measures traffic to our own websites only. It does not use cookies and does not follow visitors across other websites.

A full list of the individual cookies each website sets, including their names, providers, and durations, is available in the Cookie Policy published on that website: https://www.genzeon.com/cookie-policy/ for genzeon.com, https://genzeon.one/legal/cookies/ for genzeon.one, https://moxiesystems.com/cookie-policy for moxiesystems.com, and https://www.complianceprosolutions.com/cookie-policy.

9. Your Privacy Choices

You have the following choices about how we use tracking technologies and disclose information to advertising partners. We will not discriminate against you for exercising any of them.

• Cookie preference center. Select “Cookie Preferences” in our website footer to accept or reject analytics, functional, and advertising cookies by category, and to change a choice you made earlier.
• Opt out of sale, sharing, and targeted advertising. Use the “Your Privacy Choices” link in our website footer, or email privacy@genzeon.com. You do not need to create an account, and we will not ask you to verify your identity in order to process an opt-out request.
• Global Privacy Control. We recognize and honor the Global Privacy Control signals as a valid request to opt out of the sale and sharing of personal information and of processing for targeted advertising. These signals apply to the browser and device you set them on, so you will need to enable the signal in each browser you use. If you have already recorded a choice through our consent banner, that choice takes precedence over the signal, and you can change it at any time using the Privacy Settings link in our website footer.
• Nevada residents. Nevada law gives consumers the right to direct a website operator not to sell certain covered information. To review and make such a request to the covered information we have collected about you, email privacy@genzeon.com with the subject line “Nevada Opt-Out.” We notify you of material changes to this Privacy Policy as described in Section 19.
• Marketing email. Use the unsubscribe link in any marketing message, or email privacy@genzeon.com. We will honor your request within ten business days.

10. Data Storage and Security

Personal information is stored in secure servers located in the United States. We implement advanced security measures including:

• Encryption of sensitive data during transmission.
• Secure storage with access controls and authentication mechanisms.
• Regular monitoring of our systems to detect vulnerabilities.
• Data Processing Agreements (DPAs) with the third-party service providers that process personal information on our behalf. Partners that act as independent controllers, including advertising platforms, are governed by their own terms rather than by a DPA with us.

11. How Long We Keep Your Information

We keep personal information only for as long as it is needed for the purpose it was collected for, and then delete it or de-identify it. Where a fixed period is not practicable, we decide how long to keep information using the criteria set out below.

• Contact and enquiry data: if you enquire but do not become a customer, for 24 months after our last contact with you. If you or your organization become a customer, for the duration of our business relationship and for up to 10 years afterwards (or longer where local law requires), so that we can respond to follow-up enquiries and meet our contractual, accounting, and tax record-keeping obligations.
• Marketing contact data: until you unsubscribe, or after 24 months during which you do not engage with our communications, whichever happens first. After you unsubscribe, we keep only the minimum information needed (such as your email address) on a suppression list so that we do not contact you again.
• Web3Forms processes contact form submissions on our behalf and does not keep them after sending them to us. Emailed copies then follow the contact and enquiry data period.
• Cookies and advertising identifiers: for the lifetime of each individual cookie, as set out in our Cookie Policy.
• Records of your consent choices: Our consent platform retains records for a rolling twelve months and they are retrieved one visitor at a time.
• Recruitment data: 12 months (6 months for candidates in the European Union) after a hiring decision is made, unless you agree that we may keep it for longer (up to 2 years).
• Security and server logs: 12 months, to protect our website and systems and to detect and investigate security incidents.
• Backups: information deleted from our live systems may remain in encrypted backups for up to 12 months..

Where we are required to keep information in order to comply with a legal obligation, resolve a dispute, or enforce our agreements, we will keep it for as long as that requirement lasts.

This section does not apply to personal information, including protected health information under the US Health Insurance Portability and Accountability Act (HIPAA), that we process on behalf of our customers when providing our services. We keep that information in accordance with our agreements with those customers and applicable law.

12. International Data Transfers

As a global organization, your data may be transferred to and processed in countries outside your country of residence, including the United States. We ensure that any such transfers comply with applicable data protection laws.. The third-party services identified in Section 8 — including Google, HubSpot, Cloudflare, jsDelivr, Zoho, Arcade, MUX, Segment, Spotify and Sentry — may process data in the United States and other jurisdictions. Our consent management provider, Usercentrics GmbH, processes data within the European Union. Web3Forms, which handles contact form submissions on one of our websites, may also process data outside your country of residence.

Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to the United States, we rely on the European Commission’s Standard Contractual Clauses together with any supplementary measures required, or on the recipient’s certification under the EU-US Data Privacy Framework and its UK Extension where that applies. You may obtain a copy of the safeguards we rely on, where applicable, by contacting us at privacy@Genzeon.com.

13. Your Rights Under GDPR (EU/EEA Visitors)

If you are located in the European Union or European Economic Area, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of Access (Art. 15 GDPR): Request access to the personal information we hold about you.
• Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete personal information.
• Right to Erasure (Art. 17 GDPR): Request deletion of your personal information where a ground in Art. 17(1) GDPR applies, such as where it is no longer necessary for the purpose it was collected or you withdraw your consent (subject to exceptions in Art. 17(3).
• Right to Restriction of Processing (Art. 18 GDPR): Request restriction of processing under certain conditions.
• Right to Data Portability (Art. 20 GDPR): Receive your data in a structured, machine-readable format (and where technically feasible, have it transmitted to another controller), where we process it by automated means on the basis of your consent.
• Right to Object (Art. 21 GDPR): Object to processing of your personal information, including for direct marketing.
• Right to Withdraw Consent (Art. 7(3) GDPR): Withdraw consent at any time without affecting prior lawful processing.
• Right to Lodge a Complaint (Art. 77 GDPR): Lodge a complaint with a supervisory authority in the Member State of your habitual residence, your place of work, or the place of the alleged infringement.

We respond to GDPR requests without undue delay and in any event within one month of receipt. We may extend that period by up to two further months where necessary, taking into account the complexity and number of requests, and we will tell you within the first month if we do so. We do not charge a fee for responding unless a request is manifestly unfounded or excessive (Art. 12(3) and (5) GDPR).

Right to object to direct marketing. You have the right to object at any time to the processing of your personal information for direct marketing, and we will stop that processing when you do so (Art. 21(2)–(3) GDPR). You also have the right to an effective judicial remedy against a supervisory authority or against us (Arts. 78 and 79 GDPR).

Only where the GDPR applies, we process personal data on the following legal bases (Art. 6(1) GDPR):

• Responding to inquiries and offering tailored solutions: performance of a contract or steps taken at your request before entering into a contract (Art. 6(1)(b)), or our legitimate interest in responding to business enquiries (Art. 6(1)(f)).
• Providing our services, billing and account management: performance of a contract (Art. 6(1)(b)), and compliance with legal obligations such as tax and accounting record-keeping (Art. 6(1)(c)).
• Marketing communications: your consent (Art. 6(1)(a)).
• Analytics, functional and advertising cookies and similar technologies, if used: your consent (Art. 6(1)(a)), as required by Article 5(3) of Directive 2002/58/EC (ePrivacy Directive) and national law.
• Security, authentication and fraud prevention, including bot protection: our legitimate interest in keeping our websites and systems secure (Art. 6(1)(f)).
• Records of your consent choices: our legal obligation to be able to demonstrate consent (Arts. 6(1)(c) and 7(1)), or our legitimate interest in evidencing compliance (Art. 6(1)(f)).
• Recruitment: steps taken at your request before entering into a contract (Art. 6(1)(b)), or our legitimate interest in assessing candidates (Art. 6(1)(f)).
• Compliance with legal obligations and protection of our legal rights: Art. 6(1)(c) and our legitimate interest in protecting our legal rights (Art. 6(1)(f)).

Where we rely on legitimate interests, they are the interests described above, and you may object as described in this Section 13. Where we rely on consent, you may withdraw it at any time.

Recipients, retention and transfers. We disclose personal data to the recipients and categories of recipients described in Sections 3, 6 and 8. Retention periods are set out in Section 11, and transfers outside the European Economic Area are described in Section 12.

Whether providing data is required; automated decisions. Providing personal data through our forms is voluntary, but if you do not provide the information we request we may be unable to respond to your inquiry or provide our services. We do not use automated decision-making, including profiling, that produces legal or similarly significant effects concerning you.

14. Your Rights Under CCPA/CPRA (California Residents)

If you are a resident of California, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) provide you with the following rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected, the sources, purposes, and third parties with whom it is shared.
• Right to Delete: Request deletion of personal information we have collected about you.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Limit: Request that we limit the use of your sensitive personal information.
• Right to Opt-Out: Opt out of the sale or sharing of personal information, including sharing for cross-context behavioral advertising. See Section 9, Your Privacy Choices.
• Right to Non-Discrimination: You have the right not to be discriminated against for exercising your privacy rights.

To submit a request, email privacy@genzeon.com, call +1 (610) 441-7318 or 855-913-2225, or use the request form at https://genzeon.complianceprohealth.com/report/hotline/. We will acknowledge your request within 10 business days and respond within 45 days. Where reasonably necessary we may extend that period by a further 45 days, and will tell you why within the first 45 days.

Before we respond to a request to know, delete, or correct, we will verify your identity using information already in our possession, and we will tell you if we are unable to do so. We do not require you to verify your identity in order to process an opt-out request. You may use an authorized agent to submit a request on your behalf, in which case we may ask the agent for written permission signed by you, and may ask you to confirm the agent’s authority with us directly.

If we decline to act on your request, you may appeal within 60 days of our response by emailing privacy@genzeon.com with the subject line “Privacy Request Appeal” and a brief explanation of why you believe our decision was incorrect. If your appeal is denied, you may lodge a complaint with the California Privacy Protection Agency or the California Attorney General.

15. Your Rights Under US State Privacy Laws

If you are a resident of a state with comprehensive data privacy laws, you have the rights set out below under your state’s comprehensive privacy law. California residents should see Section 14. The precise scope of each right varies by state.

These rights include:

• Right to confirm and access: confirm whether we process your personal data, and obtain a copy of it.
• Right to correct inaccuracies in the personal data we hold about you.
• Right to delete personal data that you provided to us or that we obtained about you.
• Right to data portability, in a portable and readily usable format, where technically feasible.
• Right to opt out of targeted advertising, of the sale of personal data, and of profiling in furtherance of decisions that produce legal or similarly significant effects. See Section 9, Your Privacy Choices.
• Right to information about recipients: Oregon and Minnesota residents may request a list of the specific third parties to which we have disclosed personal data; residents of other states may request the categories of those third parties.
• Right to question a profiling decision: Minnesota residents may question the result of profiling, be informed of the reason for it, and learn what action might secure a different outcome.
• Right to withhold consent for sensitive data: in most of these states we will not process sensitive data without your consent. See Section 4.

To exercise these rights, email privacy@genzeon.com with the subject line “State Privacy Request,” or use the request form at https://genzeon.complianceprohealth.com/report/hotline/.We will verify your identity as described in Section 14 and respond within 45 days, subject to one extension of a further 45 days. You may use an authorized agent to submit a request on your behalf.

If we decline to act on your request, you may appeal by emailing privacy@genzeon.com with the subject line “Privacy Request Appeal” and a brief explanation of why you believe our decision was incorrect. We will respond in writing within 45 days with our decision and the reasons for it. If we deny your appeal, you may submit a complaint to your state Attorney General, and we will provide a direct link to the relevant complaint mechanism in our response.

16. Direct Marketing and Communications

We may use your personal information to send you direct marketing communications about our products, services, and promotions. We will obtain your explicit opt-in consent before sending marketing communications where required by law. Every marketing communication will include a clear unsubscribe option. We do not sell or rent your contact details to other companies for their own marketing. We may use the following channels:

• Email
• Telephone and SMS, where you have given us the consent required by applicable law.

You can manage your communication preferences using the unsubscribe link in our marketing emails at any time, or by emailing privacy@genzeon.com. We will honor your request within ten business days.

17. Children’s and Teens’ Privacy

Our services are not directed at children, and we do not knowingly collect personal information from anyone under the age of 13. We do not knowingly sell or share the personal information of consumers under 16 years of age, and we do not knowingly process the personal data of a consumer we know to be between 13 and 16 for targeted advertising without their consent. We do not knowingly direct targeted advertising to any consumer we know to be under 18. If you believe that a child has provided us with their personal data, please contact us immediately at privacy@genzeon.com, and we will take steps to delete it promptly.

18. Third-Party Websites

Our website may contain links to third-party websites. We are not responsible for the privacy practices or content of these external sites. We encourage you to review the privacy policies of any third-party sites you visit before sharing any personal information.

19. Updates to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our practices or regulatory requirements. Any updates will be posted on this page with the revised effective date. We review this Privacy Policy at least once every twelve months and update it as needed. Where material changes are made, we will notify users and seek fresh consent where required. We encourage you to review this policy regularly.

20. Contact Us

For questions, concerns, or to exercise your rights under this Privacy Policy, please contact us:

• Email: privacy@genzeon.com
• Phone: +1 (610) 441-7318
• Address: 559 W. Uwchlan Ave, Suite 120, Exton, PA 19341

This Privacy Policy reflects Genzeon’s commitment to transparency, security, and respect for your personal information. Thank you for trusting us with your data.

1. Introduction
2. Information We Collect
3. Categories of Personal Information We Collect and Disclose
4. Sensitive Personal Information
5. How We Use Your Information
6. Sharing Your Information
7. Cookies and Tracking Technologies
8. Advertising, Analytics, and Tracking Partners
9. Your Privacy Choices
10. Data Storage and Security
11. How Long We Keep Your Information
12. International Data Transfers
13. Your Rights Under GDPR (EU/EEA Visitors)
14. Your Rights Under CCPA/CPRA (California Residents)
15. Your Rights Under US State Privacy Laws
16. Direct Marketing and Communications
17. Children’s and Teens’ Privacy
18. Third-Party Websites
19. Updates to This Privacy Policy
20. Contact Us