WEBSITE PRIVACY POLICY

Privacy Notice for www.pangeamade.com

Effective Date, 2026

Last Updated, 2026

This Policy applies to www.pangeamade.com and any web pages, forms, online features, and communications that link to or reference this Policy (the “Site”).

Controller / Publisher Pangea Made, Inc., 2920 Waterview Drive, Rochester Hills, Michigan 48309, USA

Privacy contact [email protected] | +1 248.436.2300

This Global Website Privacy Policy (this “Policy”) explains how Pangea Made, Inc. and the affiliated entities within the Pangea group (“Pangea,” “we,” “us,” or “our”) collect, use, disclose, transfer, retain, and otherwise process personal information in connection with the Site, the legal bases on which we rely, and the rights and choices available to you. This Policy is intended to satisfy the transparency requirements of the data-protection and privacy laws of the jurisdictions in which our visitors are located. Please read it carefully. By accessing or using the Site, you acknowledge that you have read and understood this Policy.

1. Introduction and Scope

This Policy is issued by Pangea Made, Inc., a corporation organized under the laws of the State of Michigan, United States, with its principal place of business at 2920 Waterview Drive, Rochester Hills, Michigan 48309, USA. Pangea Made, Inc. owns and operates the Site and is the entity that determines the purposes and means of processing the personal information collected through it. For visitors located in the European Economic Area (the “EEA”), the United Kingdom (the “UK”), or Switzerland, Pangea Made, Inc. is the “controller” of that personal information within the meaning of applicable data-protection law, except where a Pangea affiliate is separately identified to you as the controller.

The Site is a single, English-language website that serves all regions in which Pangea operates. Pangea does not maintain separate country-specific consumer websites; visitors in every country are served the same Site. This Policy applies only to personal information that Pangea collects and processes through the Site and through related online forms and communications that link to or reference this Policy. It does not apply to: (a) personal information Pangea processes in other contexts, such as information about employees, job applicants, customers, suppliers, and business partners handled through separate channels, which is governed by separate notices; (b) information collected by third parties through their own websites, platforms, or services, even where the Site links to or embeds that content; or (c) information that is not personal information under applicable law.

2. About Pangea; Intended Audience

Pangea designs, manufactures, and supplies finished automotive leather and related interior solutions to vehicle original-equipment manufacturers (“OEMs”) and their tier-one suppliers. Pangea does not sell products to individual consumers. The Site exists to provide information about Pangea, its capabilities, its products, and the leather industry, and to enable businesses and professionals to contact us. General information published on the Site is intended to raise awareness about leather and about Pangea; it is not an offer or solicitation directed to individual consumers, and it does not facilitate consumer transactions.

The Site is intended for, and directed to, a business and professional audience. It is not intended for, or directed to, children, and we do not knowingly collect personal information from any individual under the age of eighteen (18).

3. Definitions

The following defined terms are used throughout this Policy. Other capitalized terms are defined where they first appear.

Term Meaning

Personal Information Any information that, alone or in combination with other information, identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. “Personal information” includes “personal data” and similar terms used in applicable law, and includes online identifiers such as IP addresses and cookie identifiers.

Sensitive Personal Information A subset of personal information that applicable law affords heightened protection, such as government-issued identifiers, financial-account information, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, health or biometric data, and information about sex life or sexual orientation.

Processing Any operation performed on personal information, whether or not by automated means, including collection, recording, organization, storage, use, analysis, disclosure, transfer, combination, restriction, erasure, or destruction.

Controller / Business The entity that determines the purposes and means of the processing of personal information.

Processor / Service Provider An entity that processes personal information on behalf of, and under the documented instructions of, a controller.

Cookies and Similar Technologies Cookies, pixels, tags, web beacons, software-development kits, local storage, server logs, and similar technologies used to collect information about your device and your interactions with the Site.

Sale / Share / Targeted Advertising Terms used in certain U.S. state privacy laws to describe disclosures of personal information to third parties for monetary or other valuable consideration, for cross-context behavioral advertising, or to deliver advertising based on personal information obtained across distinct services. These terms are addressed in Sections 8 and 22.

4. Personal Information We Collect

We collect personal information (a) directly from you, (b) automatically through Cookies and Similar Technologies when you use the Site, and (c) from third parties and other sources. The categories and elements we collect are described below. The amount and type of personal information we collect depends on how you interact with the Site; many areas of the Site can be used without providing any information that identifies you.

4.1 Information you provide to us

When you complete a contact or inquiry form on the Site (including our “Let’s Connect,” main contact, simple contact, and trade-show contact forms), subscribe to receive information, or otherwise communicate with us through the Site or by email generated from the Site, we collect the personal information you choose to submit. This typically includes:

– Identification and contact details — your name and business email address;

– Professional and routing details — your job title and the “area of interest” you select (for example, sales and marketing, quality, purchasing, operations, or careers), which we use to route your inquiry to the appropriate Pangea team; and

– Correspondence content — the contents of any message, attachment, or other information you choose to provide in a free-text field or in correspondence with us, together with metadata such as the date and time of your submission.

Please provide only the information reasonably necessary for your inquiry, and please do not submit Sensitive Personal Information through the Site. We may decline to process, and may delete, information that we did not request.

4.2 Information we collect automatically

When you access or use the Site, we and our service providers automatically collect certain information about your device, browser, and interaction with the Site using Cookies and Similar Technologies and server logs. This information may include:

– Device and connection information — your Internet Protocol (IP) address; device type, model, and settings; operating system; browser type, version, and configuration; language preferences; screen and window characteristics; and unique device, advertising, or cookie identifiers;

– Usage and interaction information — the pages, content, and resources you view; the website or source from which you arrived and the page to which you exit; links, buttons, and features you click; scrolling, search, navigation, and download activity; video-engagement events (such as plays, pauses, and completion); and the dates, times, frequency, and duration of your visits; and

– Approximate location information — a general geographic location (such as country, region, or city) inferred from your IP address. We do not collect precise geolocation through the Site.

Section 7 and our separate Cookie Notice and Cookie Policy describe these technologies, the providers involved (which currently include Google Analytics and the LinkedIn Insight Tag), and your choices in greater detail.

4.3 Information from third parties and other sources

We may receive personal information about you from third parties and other sources, including: (a) analytics, advertising, and measurement providers (such as Google and LinkedIn), which provide us with reporting and audience-measurement information about how visitors engage with our content; (b) providers of embedded content on the Site, such as Vimeo and YouTube, when you interact with their players; (c) our affiliates; (d) service providers that support the Site; and (e) publicly available sources and professional or business-information providers. We may combine information we receive from these sources with information we collect through the Site for the purposes described in this Policy. We do not purchase personal information for the purpose of building individual marketing profiles, and we do not enrich the information you submit through the Site with third-party data in order to profile you individually.

4.4 Sensitive Personal Information

The Site is not designed or intended to collect Sensitive Personal Information, and we ask that you not provide it through the Site. To the extent we receive Sensitive Personal Information through the Site (for example, because you include it in a free-text message), we use and disclose it only for the purposes for which it was provided or as otherwise permitted by applicable law, and we do not use or disclose Sensitive Personal Information for the purpose of inferring characteristics about you.

5. How and Why We Use Personal Information

We use personal information for the business and commercial purposes described below, and for any additional purpose disclosed to you at or before the time of collection or otherwise permitted or required by applicable law. Except where applicable law requires a narrower approach, we may use any category of personal information described in Section 4 for any of the following purposes:

– To respond to you — to receive, authenticate, route, evaluate, and respond to your inquiries, requests, applications, and correspondence; to provide the information, materials, or follow-up you request; and to maintain records of our communications with you;

– To operate, maintain, and improve the Site — to provide, host, personalize, and administer the Site and its content and features; to remember your preferences and settings; to monitor, troubleshoot, and optimize the performance, reliability, and usability of the Site; and to develop new content, features, products, and services;

– To secure the Site and prevent harm — to protect the security, availability, and integrity of the Site and our systems; to authenticate users and manage access; to detect, investigate, prevent, and respond to fraud, abuse, spam, security incidents, and other unlawful, harmful, or unauthorized activity; and to back up and recover data;

– To analyze and understand usage — to measure and analyze traffic, trends, and how visitors find and use the Site; to conduct analytics, research, and statistical analysis; and to evaluate and improve our content, marketing, products, services, and operations;

– For marketing, advertising, and business development — to promote Pangea and our products and capabilities; to plan, deliver, measure, and improve our marketing, communications, advertising, and presence on professional and social-media platforms (such as LinkedIn); to invite you to, and administer, events and trade shows; and, where you have requested communications from us or where otherwise permitted by applicable law, to send you Pangea news, updates, and other communications;

– To manage and develop our business — to manage our relationships, records, and operations; to perform accounting, auditing, reporting, and other internal functions; and to plan for, evaluate, negotiate, conduct, and complete corporate transactions, including any merger, acquisition, financing, joint venture, reorganization, restructuring, or sale or transfer of assets or business (including in connection with diligence, integration, or insolvency);

– For legal, regulatory, and compliance purposes — to comply with applicable laws, regulations, codes, court orders, and legal process; to respond to lawful requests from public and governmental authorities; to establish, exercise, enforce, and defend legal claims and our agreements and policies; and to protect the rights, property, safety, and interests of Pangea, our personnel, our visitors, and others; and

– For any other purpose with notice or consent — for any other purpose described to you when you provide your personal information, or to which you consent, or that is compatible with the purposes above and permitted by applicable law.

We may use Cookies and Similar Technologies, analytics, and advertising tools for the purposes described above and in our Cookie Notice and Cookie Policy, subject to the choices described in Sections 7 and 8 and the rights described herein.

6. Legal Bases for Processing (EEA, UK, and Switzerland)

If you are located in the EEA, the UK, or Switzerland, we process your personal information only where we have a valid legal basis for doing so. The legal bases we rely on, depending on the purpose, are set out below. Where we rely on legitimate interests, we have assessed that those interests are not overridden by your interests or fundamental rights and freedoms, and you may contact us at [email protected] for further information about that assessment.

—————————————————————————————————————————————————————————————————————————————–
Purpose (see Section 5) Legal basis Where we rely on legitimate interests, those interests are:
———————————————————- —————————————————————————————————– ————————————————————————
Responding to your inquiries and communications Performance of a contract or steps taken at your request prior to contracting; legitimate interests Engaging with business contacts and responding effectively to requests

Operating, maintaining, and improving the Site Legitimate interests Providing and improving a functional, reliable, and effective website

Securing the Site and preventing fraud and abuse Legitimate interests; legal obligation Protecting our Site, systems, visitors, and business from harm

Analytics and measurement Consent (where required for non-essential Cookies); legitimate interests Understanding and improving our Site, content, and operations

Marketing, advertising, events, and business development Consent (where required); legitimate interests Promoting our business to a professional audience

Business management and corporate transactions Legitimate interests; legal obligation Managing, evaluating, and carrying out our business and transactions

Legal compliance and protection of rights Legal obligation; legitimate interests; establishment, exercise, or defense of legal claims Complying with law and protecting our legal interests
—————————————————————————————————————————————————————————————————————————————–

Where we rely on your consent (for example, for certain Cookies or communications), you may withdraw it at any time as described in Sections 7, 8, and 23, without affecting the lawfulness of processing carried out before withdrawal. Where we process your personal information to comply with a legal obligation or to perform a contract, providing the information may be necessary for us to respond to you, and a failure to provide it may mean we cannot do so.

7. Cookies, Analytics, and Similar Technologies

We and our service providers use Cookies and Similar Technologies to operate and secure the Site, to remember your settings and preferences, to measure and analyze traffic and performance, and to support our marketing and advertising. These technologies fall into the general categories of: (a) strictly necessary technologies, which are required for the Site to function and cannot be switched off in our systems; (b) functional technologies, which enhance functionality and personalization; (c) analytics technologies, which help us understand how the Site is used (for example, Google Analytics); and (d) advertising and measurement technologies, which help us measure and deliver our content and advertising (for example, the LinkedIn Insight Tag and Google and LinkedIn tags). Embedded video players from Vimeo and YouTube may also set cookies when you interact with that content.

We use a consent-management platform to present a cookie banner that describes the categories of Cookies used on the Site and, where applicable, to record your preferences. Our separate Cookie Notice and Cookie Policy provides a detailed and current inventory of the specific Cookies and Similar Technologies in use on the Site, including their names, providers, classification as first- or third-party, duration, and purpose, and explains how to manage your preferences. You may also control Cookies through your browser settings, including by deleting or rejecting Cookies; disabling some Cookies may affect the availability or functionality of parts of the Site. Appendix B summarizes the categories of Cookies we use.

Where applicable law requires opt-in consent for non-essential Cookies (for example, in the EEA and the UK), we will obtain that consent through our cookie banner before placing those Cookies on your device, and you may change or withdraw your consent at any time through the consent-management tool. Where applicable law permits a different approach, we may rely on the choices made available to you through the banner and your browser, consistent with that law.

8. Online Advertising, “Sale”/“Sharing,” and Your Choices

We use analytics tools, including Google Analytics, to understand how visitors use the Site. You can learn about Google’s practices and opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on and by adjusting your Google ad settings.

We also use professional-network and search measurement and advertising tools, including the LinkedIn Insight Tag and Google and LinkedIn advertising tags, to measure the performance of our content and communications and to reach business audiences on those platforms. Depending on how these tools are configured, some of these activities may be considered “targeted advertising,” a “sale,” or a “share” of personal information under certain U.S. state privacy laws, even though we do not exchange personal information for money. Where that is the case, we provide the opt-out described below and in Section 22, and we treat opt-out requests in accordance with applicable law.

– Cookie controls — use our cookie banner, consent-management tool, and Cookie Notice and Cookie Policy to accept or reject analytics and advertising Cookies;

– Opt-out preference signals — where required by applicable law, we honor recognized browser-based opt-out preference signals, including the Global Privacy Control (GPC), as a valid request to opt out of “sale”/“sharing”/“targeted advertising” for the browser or device from which the signal is sent.

– Platform and industry controls — adjust your advertising preferences directly with providers such as Google and LinkedIn, and use available industry opt-out tools, such as those offered by the Digital Advertising Alliance and the Network Advertising Initiative; and

– Direct request — submit a request to opt out of any “sale,” “sharing,” or “targeted advertising” by emailing [email protected] or using the mechanisms described in Section 22.

Because opt-out preference signals and Cookie-based opt-outs are specific to the browser or device on which they are set, you may need to renew your choices if you use a different browser or device or clear your Cookies.

9. How We Disclose Personal Information

We do not sell your personal information for money. We disclose personal information only as described in this Policy and as permitted by applicable law, to the following categories of recipients and for the purposes described in Section 5:

– Service providers and processors — third parties that perform services for us and process personal information on our behalf and under our instructions, such as website hosting and content-delivery providers, form-handling and email-transmission tools, analytics providers, security and information-technology providers, communications providers, and professional advisors. We authorize these providers to use personal information only as necessary to perform services for us, and we require them by contract to protect personal information and to process it consistent with applicable law;

– Affiliates — other entities within the Pangea group, which may process personal information to host and support the Site, to respond to and route your inquiry, to manage our business, and for the other purposes described in this Policy, consistent with applicable law;

– Analytics and advertising partners — providers such as Google and LinkedIn that help us measure, analyze, and deliver our content and advertising, as described in Sections 7 and 8;

– Providers of embedded content — providers such as Vimeo and YouTube, which may collect information when you interact with their players embedded on the Site, under their own privacy policies;

– Legal, regulatory, and safety recipients — courts, regulators, law-enforcement and other governmental authorities, and other parties, where we believe in good faith that disclosure is necessary or appropriate to comply with applicable law or legal process, to respond to lawful requests, to enforce our terms, policies, and agreements, or to protect the rights, property, safety, or interests of Pangea, our personnel, our visitors, or others; and

– Parties to a corporate transaction — actual or prospective counterparties, their advisors, and successors, in connection with any merger, acquisition, financing, joint venture, reorganization, restructuring, or sale or transfer of assets or business, including in diligence and integration and in the context of insolvency.

We may also disclose personal information at your direction or with your consent, and we may disclose de-identified or aggregated information without restriction as described in Section 10. A summary of our personal-information handling practices for purposes of U.S. state law, including categories of recipients to which we disclose each category of personal information for a business purpose, appears in Section 22 and Appendix A.

10. De-Identified and Aggregated Information

We may de-identify, aggregate, or anonymize personal information so that it no longer identifies, and cannot reasonably be used to identify, a particular individual or household, and we may create statistical, analytical, modeled, and aggregated data derived from personal information. We may use, retain, license, and disclose such de-identified and aggregated information for any lawful business purpose, without restriction and without further notice to you, except as limited by applicable law. Where required by applicable law, we will maintain and use information in de-identified form, will not attempt to re-identify it except as permitted by law, and will contractually obligate recipients to comply with the same restrictions.

11. Marketing and Business Communications

Where permitted by applicable law, we may use the contact information you provide to send you communications about Pangea, our products and capabilities, and events such as trade shows. Where applicable law requires your prior consent before we send marketing communications (for example, in the EEA and the UK), we will obtain that consent, and we will keep records of it. You may opt out of, or withdraw your consent to, marketing communications at any time, at no cost, by following the unsubscribe or preference instructions included in the relevant communication or by contacting us at [email protected]. Even if you opt out of marketing communications, we may still send you non-promotional communications, such as responses to your inquiries and communications about our legal or business relationship with you.

12. International Data Transfers

Pangea is headquartered in the United States, and the Site and its supporting systems and databases are hosted in the United States. When you use the Site or contact us, the personal information you provide, and the information collected automatically, will be transferred to, stored in, and processed in the United States, and may be accessed by Pangea and our service providers and affiliates in other countries in which we operate. These countries may have data-protection laws that differ from, and may provide a lower level of protection than, the laws of your country, and their governmental authorities may in some circumstances be entitled to access personal information.

Where we transfer personal information from the EEA, the UK, or Switzerland to a country that the relevant authorities have not recognized as providing an adequate level of protection, we implement an appropriate transfer mechanism and safeguards required by applicable law. These may include the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Agreement or Addendum, the Swiss-approved clauses, and, where adopted, intra-group data-transfer agreements or binding corporate rules, together with any supplementary technical, organizational, and contractual measures necessary to protect the transferred information. You may contact us at [email protected] to request further information about the safeguards we use and, where available, to obtain a copy. Transfers of personal information out of jurisdictions such as China, South Korea, and South Africa are made in accordance with the requirements of those jurisdictions’ laws, as further described in the applicable addenda in Section 24.

Where the laws of your country permit, by using the Site and submitting personal information to us, you understand and agree that your personal information may be transferred to and processed in the United States and other countries as described in this Policy. If you do not want your personal information transferred as described, please do not submit it through the Site.

13. How Long We Keep Personal Information

We retain personal information for as long as necessary to fulfill the purposes for which it was collected and processed, as described in this Policy, and for additional periods where necessary to comply with our legal, regulatory, tax, accounting, and reporting obligations, to establish, exercise, or defend legal claims, to resolve disputes, and to enforce our agreements and policies. To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal information; the potential risk of harm from unauthorized use or disclosure; the purposes for which we process it and whether we can achieve those purposes through other means; and applicable legal requirements. For example, information you submit through a contact form is generally retained for the period necessary to handle and document your inquiry and our relationship, after which it is deleted, de-identified, or archived consistent with our retention practices. When personal information is no longer needed, we will delete, de-identify, or anonymize it, or, where that is not feasible (for example, because it is stored in backup archives), we will securely store and isolate it from further processing until deletion is possible. This data is routinely reviewed for deletion and is typically retained for a period not exceeding seven (7) years after our last interaction, unless a longer retention period is mandated by applicable law.

14. Information Security

We maintain administrative, technical, organizational, and physical safeguards designed to protect personal information against accidental or unlawful destruction, loss, alteration, and unauthorized disclosure of, or access to, personal information, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of processing, as well as the risks involved. These measures may include encryption of data in transit, access controls and authentication, network and application security, logging and monitoring, and personnel and vendor management. We also maintain procedures to address suspected security incidents, and we will notify you and the relevant authorities of a personal-data breach where we are required to do so by applicable law. No method of transmission over the Internet or method of electronic storage is, however, completely secure, and we cannot guarantee absolute security. You are responsible for maintaining the security of any credentials and information you transmit to us, and you transmit information to us at your own risk.

15. Third-Party Websites, Links, and Embedded Content

The Site may contain links to, and may display content from, third-party websites, platforms, and services that Pangea does not own or control, including embedded videos hosted by Vimeo and YouTube and features provided through Google and LinkedIn. This Policy does not apply to those third parties, and Pangea is not responsible for their content or privacy practices. When you click a link to a third-party website or interact with embedded content, the relevant third party may collect information about you, including through its own Cookies and Similar Technologies, and will use that information in accordance with its own privacy policy. We encourage you to review the privacy policies of any third-party websites and services you use. The inclusion of a link or embedded feature does not imply Pangea’s endorsement of the third party or its content, products, or services.

16. Social Media

Pangea maintains a presence on third-party social-media and professional-network platforms, which currently include LinkedIn and YouTube, and may include other platforms (such as WeChat or other regional services) from time to time. When you interact with Pangea on or through these platforms, the platform operator may collect information about you and may make information available to us in aggregated or, in some cases, identifiable form, in each case under the platform’s own terms and privacy policy. We use the information we receive to understand and improve our communications and engagement. We do not control, and are not responsible for, the data-processing practices of social-media platforms, and we encourage you to review their privacy policies and adjust your settings on those platforms.

17. Children’s Privacy

The Site is directed to a business and professional audience and is not directed to children. We do not knowingly collect, use, or disclose personal information from children under the age of eighteen (18), or under the higher age of majority or consent specified by applicable law in your jurisdiction. We do not knowingly sell or share the personal information of, or use for targeted advertising the personal information of, individuals under the age of sixteen (16). If you are under the applicable age, please do not use the Site or submit any personal information to us. If you believe that a child has provided personal information to us through the Site, please contact us at [email protected], and we will take appropriate steps to delete the information consistent with applicable law.

18. Automated Decision-Making and Profiling

Pangea does not use the personal information collected through the Site to make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you. We may use analytics and measurement tools that analyze Site usage in the aggregate, as described in Sections 7 and 8, but we do not use these tools to evaluate or make significant decisions about you as an individual. If we introduce any such automated decision-making in the future, we will update this Policy and provide any notice, and obtain any consent, required by applicable law, and we will honor any right you have to opt out of profiling as described in Section 22.

19. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices, technologies, or legal requirements, or for other operational, legal, or regulatory reasons. When we do, we will revise the “Last Updated” date at the top of this Policy and post the revised Policy on the Site. Where the changes are material, we will, where practicable, provide additional and more prominent notice on the Site — for example, through a banner, pop-up, or other notice on or linked from the Site’s home page or this page — and, where required by applicable law, we will provide any further notice, and obtain any consent, that the law requires before the changes take effect. A revised Policy applies to personal information collected on and after its effective date and, to the extent permitted by applicable law, to personal information already held by us. We encourage you to review this Policy periodically, and to note its effective date, to stay informed of our privacy practices. Your continued use of the Site after a revised Policy becomes effective constitutes your awareness of the revised Policy to the extent permitted by applicable law.

20. How to Contact Us

If you have questions, concerns, or requests regarding this Policy or our privacy practices, or if you wish to exercise a privacy right, please contact us using the details below. We will respond consistent with applicable law.

Controller Pangea Made, Inc., 2920 Waterview Drive, Rochester Hills, Michigan 48309, USA

By email [email protected]

By mail Privacy Office, Pangea Made, Inc., 2920 Waterview Drive, Rochester Hills, Michigan 48309, USA

By phone +1 248.436.2300

EEA / UK representative [If appointed under Article 27 of the EU GDPR and the UK GDPR, the representative’s name and contact details will be inserted here.]

Data Protection Officer [If appointed, the DPO’s contact details will be inserted here.]

21. Your Privacy Rights and How to Exercise Them

Depending on your jurisdiction and subject to the conditions, limitations, and exceptions of applicable law, you may have some or all of the following rights with respect to your personal information: to be informed about our processing; to access and obtain a copy of your personal information; to correct inaccurate or incomplete personal information; to delete your personal information; to obtain a portable copy of your personal information; to opt out of certain processing, including any “sale,” “sharing,” or “targeted advertising” and certain profiling; to limit the use of Sensitive Personal Information; to object to or restrict processing; and, where processing is based on consent, to withdraw your consent. The specific rights available to you, and the conditions that apply, are set out in the addenda below.

21.1 How to submit a request

You may submit a request to exercise your rights by emailing [email protected], by writing to the Privacy Office at the address in Section 20, or by calling +1 248.436.2300. Please tell us which right you wish to exercise and provide sufficient information for us to locate your personal information and respond. You may also use the Cookie controls and opt-out preference signals described in Sections 7 and 8 to exercise certain choices.

21.2 Verification of your identity

To protect your personal information, we will take reasonable steps to verify your identity before responding to a request, which may include asking you to provide information that we can match against information we hold, or, where permitted, requiring a declaration under penalty of perjury. We will use the information you provide for verification only for that purpose. If we cannot verify your identity to the standard required by applicable law, we may be unable to fulfill your request and will notify you accordingly.

21.3 Authorized agents

Where permitted by applicable law, you may use an authorized agent to submit a request on your behalf. We may require the agent to provide proof of your written authorization, may require you to verify your own identity directly with us, and may require you to confirm that you have authorized the agent to act on your behalf.

21.4 Timing, fees, and our response

We will respond to your request within the period required by applicable law (for example, generally within 45 calendar days under many U.S. state laws, with the possibility of an extension where permitted, and within one month under the EU/UK GDPR, with the possibility of extension for complex requests). We will act on requests to opt out of “sale,” “sharing,” or “targeted advertising,” and to limit the use of Sensitive Personal Information, within the time and in the manner required by applicable law. We generally do not charge a fee to process or respond to a verifiable request, unless the request is excessive, repetitive, or manifestly unfounded, in which case we may charge a reasonable fee or decline to act, as permitted by applicable law.

21.5 Appeals

If we decline to take action on your request and applicable law provides a right to appeal, we will inform you of the reason for our decision and of how to appeal. To appeal, follow the instructions in our response or contact us at [email protected]. We will respond to your appeal within the period required by applicable law. If your appeal is denied, you may, depending on your jurisdiction, contact the relevant data-protection authority or attorney general.

21.6 No discrimination or retaliation

We will not discriminate or retaliate against you for exercising any of your privacy rights, including by denying you goods or services, charging you different prices or rates, or providing you a different level or quality of goods or services, except where a difference is permitted by applicable law (for example, where it is reasonably related to the value provided by your data). We do not offer financial incentives in exchange for the collection, sale, sharing, or retention of personal information.

22. United States Addendum (Multistate and California)

This addendum applies to residents of U.S. states that have enacted comprehensive consumer-privacy laws, including California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Minnesota, Maryland, Indiana, Kentucky, Rhode Island, and Tennessee, and other states as their laws take effect, in each case to the extent the relevant law applies to Pangea and to our processing of your personal information. The rights described here are subject to the conditions, limitations, exemptions, and verification requirements of the applicable state law, and some rights are not available in all states.

22.1 Your U.S. state privacy rights

Subject to applicable law, you may have the right to:

– Confirm and access — confirm whether we process your personal information and access that information, including the categories of personal information collected, the categories of sources, the business or commercial purposes for collecting, selling, or sharing it, the categories of third parties to whom we disclose it, and the specific pieces of personal information we have collected about you;

– Correct — request that we correct inaccurate personal information we maintain about you;

– Delete — request that we delete personal information we have collected from or about you;

– Data portability — obtain a copy of personal information you previously provided, in a portable and, to the extent technically feasible, readily usable format;

– Opt out of sale, sharing, and targeted advertising — direct us not to “sell” or “share” your personal information and not to process it for “targeted advertising,” as those terms are defined by applicable law;

– Opt out of certain profiling — opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you (we do not engage in such profiling through the Site);

– Limit use of Sensitive Personal Information — where applicable, direct us to limit the use and disclosure of Sensitive Personal Information to permitted purposes;

– Appeal — appeal our decision on your request, where the applicable state law provides an appeal right; and

– Non-discrimination — not be subjected to unlawful discrimination for exercising your rights.

22.2 How to exercise your U.S. rights; opt-out signals

To exercise these rights, email [email protected], write to the Privacy Office at the address in Section 20, or call +1 248.436.2300, and follow the verification, authorized-agent, timing, and appeal procedures in Section 21.

22.3 “Sale,” “sharing,” and targeted advertising

We do not sell your personal information for monetary consideration. As described in Section 8, however, our use of analytics and advertising technologies (such as the LinkedIn Insight Tag and Google and LinkedIn tags) may, depending on configuration, constitute a “sale,” “share,” or “targeted advertising” of certain identifiers and internet-activity information under some state laws. You may opt out as described in Section 22.2. We do not knowingly sell or share, or use for targeted advertising, the personal information of consumers under sixteen (16) years of age.

22.4 Sensitive Personal Information

As described in Section 4.4, the Site is not designed to collect Sensitive Personal Information, and we do not use or disclose Sensitive Personal Information for the purpose of inferring characteristics about a consumer. Accordingly, the right to limit the use of Sensitive Personal Information has limited or no application to our processing through the Site; we will nonetheless honor valid requests to the extent required by applicable law.

22.5 California “Shine the Light”

California Civil Code Section 1798.83 permits California residents to request information about a business’s disclosure of certain categories of personal information to third parties for those third parties’ own direct-marketing purposes. We do not disclose personal information to third parties for their own direct-marketing purposes. California residents may submit related inquiries to [email protected].

22.6 Retention

We retain personal information as described in Section 13. We do not retain personal information for longer than is reasonably necessary for the disclosed purposes for which it was collected.

22.7 Summary of prior twelve-month practices

During the twelve (12) months preceding the Last Updated date of this Policy, we collected the categories of personal information described in Appendix A from the sources, and for the business and commercial purposes, described in this Policy, and disclosed those categories to the categories of recipients described in Section 9 and Appendix A for business purposes. We did not sell personal information for monetary consideration. Certain analytics and advertising activity described in Sections 8 and 22.3 may have constituted “sharing,” a “sale,” or “targeted advertising” under certain state laws; you may opt out as described above. We have not used or disclosed Sensitive Personal Information other than as described in this Policy.

22.8 State-specific notes

Residents of states other than California have the rights described in Section 22.1 to the extent provided by their state’s law. For example, residents of Colorado, Connecticut, Virginia, Oregon, Texas, Montana, and similar states generally have rights to confirm and access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and certain profiling, together with a right to appeal; Utah provides a more limited set of rights and generally no appeal right. Where a state requires a specific disclosure, contact method, or response time, we comply with that requirement for residents of that state. If you have questions about the rights available to you in your state, contact us at [email protected].

23. EEA, United Kingdom, and Switzerland Addendum

This addendum applies if you are located in the EEA, the UK, or Switzerland, including the legal bases described in Section 6 and the international-transfer disclosures in Section 12.

23.1 Controller and contacts

The controller of your personal information is Pangea Made, Inc., with the contact details in Section 20, except where a Pangea affiliate is separately identified to you as the controller. If we appoint a representative under Article 27 of the EU GDPR or the UK GDPR, or a Data Protection Officer, their contact details will be provided in Section 20 and may be obtained by contacting [email protected].

23.2 Your rights

Subject to the conditions and exceptions of the EU GDPR, the UK GDPR, and the Swiss Federal Act on Data Protection, you have the right to:

– Access — obtain confirmation of whether we process your personal information and, if so, access to it and to certain information about the processing;

– Rectification — obtain correction of inaccurate, and completion of incomplete, personal information;

– Erasure — obtain erasure of your personal information in certain circumstances (the “right to be forgotten”);

– Restriction — obtain restriction of processing in certain circumstances;

– Portability — receive personal information you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible;

– Objection — object, on grounds relating to your particular situation, to processing based on our legitimate interests, and object at any time to processing for direct-marketing purposes; and

– Withdraw consent — withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

To exercise these rights, contact [email protected] or use the procedures in Section 21. You also have the right to lodge a complaint with your local data-protection supervisory authority (in the UK, the Information Commissioner’s Office; in Switzerland, the Federal Data Protection and Information Commissioner). We would, however, appreciate the opportunity to address your concerns before you do so.

23.3 International transfers

As described in Section 12, we transfer personal information to the United States and other countries outside the EEA, the UK, and Switzerland. Where required, we rely on appropriate safeguards, including the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Agreement or Addendum, together with supplementary measures. You may request further information and, where available, a copy of the relevant safeguards by contacting [email protected].

24. Additional Country Addenda

The following addenda provide additional disclosures and rights for residents of the identified jurisdictions, in each case subject to and as required by the applicable law. Where an addendum grants you rights, you may exercise them using the procedures in Section 21.

24.1 Mexico

If you are in Mexico, this Policy, together with any short-form privacy notice (aviso de privacidad) we provide at the point of collection, constitutes our privacy notice under the Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP) and its successor legislation. You have the rights of access, rectification, cancellation, and opposition (the “ARCO” rights), the right to revoke your consent, and the right to limit the use or disclosure of your personal data. To exercise these rights, contact [email protected]. We process personal data for the purposes described in Section 5; where required, we identify primary and secondary purposes and offer a means to opt out of secondary purposes.

24.2 People’s Republic of China

If you are in mainland China, we process your personal information in accordance with the Personal Information Protection Law (PIPL). Subject to the PIPL, you have rights to know and decide about, access and copy, correct, and delete your personal information, to request an explanation of our processing rules, and to withdraw consent where processing is based on consent. Where we rely on your consent (including for any cross-border transfer of your personal information or for processing sensitive personal information), we will obtain the separate consent the PIPL requires. We transfer personal information outside of China only in accordance with the PIPL, including, as applicable, on the basis of a standard contract adopted by the Cyberspace Administration of China, a security assessment, certification, or your separate consent, together with the required protection measures. To exercise your rights, contact [email protected].

24.3 Republic of Korea

If you are in the Republic of Korea, we process your personal information in accordance with the Personal Information Protection Act (PIPA). Subject to PIPA, you have rights to access, correct, delete, and suspend the processing of your personal information, and to withdraw consent. Where PIPA requires consent (including for the collection and use of personal information, the provision of personal information to third parties, and cross-border transfers), we obtain that consent and provide the legally required disclosures. To exercise your rights, contact [email protected].

24.4 Japan

If you are in Japan, we handle your personal information in accordance with the Act on the Protection of Personal Information (APPI). Subject to the APPI, you may request disclosure, correction, addition, deletion, cessation of use, and cessation of provision to third parties of your retained personal data, and may request disclosure of records of third-party provision. We obtain consent where the APPI requires it, including for certain provision of personal data to third parties and for cross-border transfers, and we provide the information about the transfer destination that the APPI requires. To exercise your rights, contact [email protected].

24.5 Republic of South Africa

If you are in South Africa, we process your personal information in accordance with the Protection of Personal Information Act (POPIA). Subject to POPIA, you have the right to be notified of the collection of your personal information, to request access to it, to request correction or deletion, to object to processing, and to lodge a complaint with the Information Regulator. Pangea’s Information Officer may be contacted at [email protected]. We transfer personal information outside South Africa in accordance with POPIA, including on the basis of an adequate level of protection, your consent, or contractual safeguards.

24.6 Canada, Brazil, Australia, and other jurisdictions

If you are in Canada, we process personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws, and you may request access to, and correction of, your personal information and may withdraw consent, subject to legal and contractual restrictions. If you are in Brazil, we process personal data in accordance with the Lei Geral de Proteção de Dados (LGPD), and you have the rights provided by the LGPD, including confirmation, access, correction, anonymization, portability, deletion, and information about sharing. If you are in Australia, we handle personal information in accordance with the Privacy Act and the Australian Privacy Principles. If you are located in another jurisdiction with applicable data-protection law, we will honor the rights afforded to you by that law. To exercise your rights, contact [email protected] and identify the jurisdiction in which you are located.

Appendix A — U.S. Categories of Personal Information

This Appendix summarizes, for purposes of U.S. state privacy laws (including the California Consumer Privacy Act, as amended), the categories of personal information we collect through the Site, the sources of that information, the business and commercial purposes for which we use it, and the categories of recipients to which we disclose it for a business purpose. We collected the following categories during the twelve (12) months preceding the Last Updated date of this Policy. We do not sell personal information for monetary consideration; categories marked with an asterisk (*) may be “shared” for cross-context behavioral advertising or processed for “targeted advertising” through the analytics and advertising technologies described in Sections 8 and 22, and you may opt out as described in this Policy.

Category (state-law label) Examples collected via the Site Sources Disclosed for a business purpose to

Identifiers* Name, business email address, IP address, device and cookie identifiers You; your device/browser; analytics and advertising providers Service providers; affiliates; analytics/advertising partners; legal/transaction recipients

Professional or employment-related information Job title; area of interest You Service providers; affiliates

Commercial information Records of inquiries and communications with us You; our systems Service providers; affiliates

Internet or other electronic network activity* Browsing and usage data; interactions with content, forms, and videos Your device/browser; analytics/advertising and embedded-content providers Service providers; analytics/advertising partners

Geolocation data Approximate (non-precise) location from IP address Your device/browser; service providers Service providers; analytics/advertising partners

Audio/visual/electronic information Information you submit in messages and form attachments You Service providers; affiliates

Inferences Limited inferences from Site usage for analytics Derived by us and our providers Service providers

Business and commercial purposes: as described in Section 5, including responding to you; operating, securing, analyzing, and improving the Site; marketing, advertising, and business development; business management and corporate transactions; and legal compliance and protection of rights. We do not knowingly collect the categories of personal information not listed above (such as government identifiers, financial information, biometric information, health information, or precise geolocation) through the Site, and we do not knowingly collect Sensitive Personal Information through the Site. We retain each category as described in Sections 13 and 22.6.

Appendix B — Categories of Cookies and Similar Technologies

The table below summarizes the categories of Cookies and Similar Technologies used on the Site. A complete and current inventory of specific Cookies — including names, providers, first- or third-party classification, duration, and purpose — is maintained in our separate Cookie Notice and Cookie Policy and through our consent-management tool, which you can use to manage your preferences.

Category Purpose Examples / providers

Strictly necessary Required for the Site to load, function, and remain secure; cannot be switched off in our systems. Site platform; consent-management tool; security/CDN

Functional Remember your choices and preferences and enhance functionality and personalization. Site platform; preference cookies

Analytics Help us understand how visitors find and use the Site so we can measure and improve it. Google Analytics

Advertising / measurement Help us measure and deliver our content and advertising and reach professional audiences; may involve “sharing”/“targeted advertising” under some U.S. state laws. LinkedIn Insight Tag; Google and LinkedIn tags

Embedded media Enable embedded video playback and related functionality; set by the media provider when you interact with the content. Vimeo; YouTube