SMG Services

Global Privacy Policy

Effective Date: July 2019

This Privacy Policy applies to SMG’s processing of Personal Data collected through this
website and other websites, services, and applications, including mobile applications, on
which this Privacy Policy is posted, linked or referenced (collectively, the “SMG Services”).
“Personal Data” is information relating to an identified or identifiable natural person. The SMG
Services are owned and/or operated by Service Management Group, LLC, Service
Management Group Limited, Service Management Group GK, and their respective affiliates
(collectively, “SMG,” “we” or “us”). This Privacy Policy addresses how we collect and process
your Personal Data.

REVIEW THIS PRIVACY NOTICE CAREFULLY. Your Personal Data will be collected and
processed as described in this Privacy Policy.

If you have not done so, review SMG Terms of Service, which sets forth the terms governing
your use of our websites, applications, services and mobile applications (“SMG Services”).

IF YOU DO NOT AGREE WITH ANY PART OF THIS PRIVACY POLICY OR TERMS OF
SERVICE, DO NOT USE ANY OF THE SMG SERVICES.

1. CHANGES TO PRIVACY POLICY

2. CATEGORIES OF PERSONAL DATA PROCESSED BY SMG
3. HOW WE COLLECT INFORMATION AND PURPOSES OF PROCESSING
4. LEGAL GROUNDS FOR PROCESSING
5. HOW WE USE AND SHARE PERSONAL DATA
6. RETENTION AND DISPOSAL OF PERSONAL DATA
7. YOUR RIGHTS AND CHOICES CONCERNING PERSONAL DATA PROCESSING
8. CONSEQUENCES OF NOT PROVIDING PERSONAL DATA
9. COOKIES POLICY
10. MANAGING YOUR ACCOUNT INFORMATION
11. CHILDREN’S PRIVACY
12. LINKS TO THIRD PARTY SERVICES
13. INFORMATION SECURITY
14. GEOGRAPHIC CONSIDERATIONS AND CROSS-BORDER TRANSFERS OF
PERSONAL DATA
15. HOW TO CONTACT US
16. DATA CONTROLLER AND DATA PROTECTION OFFICER

1. CHANGES TO THIS PRIVACY POLICY

We will update this Privacy Policy from time to time when we make changes impacting the
Privacy Policy, such as adding new services and applications, improving our services, and
addressing changes in technologies and laws. The Effective Date of this Privacy Policy, which
is set forth at the top of this webpage, reflects the date the Privacy Policy was last updated.
SMG will provide notice to you if these changes are material, and where required by applicable
law, we will obtain your consent. This notice will be provided by posting notice of the changes
on our website or through our applications.

2. CATEGORIES OF PERSONAL DATA PROCESSED BY SMG

SMG conducts market research on behalf of companies who wish to better understand
consumer preferences about their goods and services. These companies are our “Clients.”

1
We conduct surveys on behalf of our Clients (collectively, “Surveys”) and use that information
to derive consumer insights, such as where, when and how often consumers visit retail
locations and their experiences during the visits. When you take a Survey or use SMG
Services, we collect Personal Data that you voluntarily provide to us.

The Personal Data we collect includes: (1) contact data (such as e-mail address, telephone
number, and employer); (2) demographic data (such as gender, date of birth, and zip code);
(3) your responses on surveys to the extent the information identifies you or is linked to you
as an individually identifiable person; and (4) information relating to your use of SMG Services
(“Usage Data”).

Usage Data we collect includes: (1) IP address; (2) domain server; (3) type of device(s) used
to access the Services; (4) statistics and information associated with the interaction between
your browser or device, such as device model, carrier/network, battery life information to
optimize location sampling based upon remaining battery life, and basic usage statistics about
your device; (5) real-time GPS or other geolocation data when you allow us to receive
information through the location (or similar) settings on your device; (6) referring webpage or
other source through which you accessed the Services. When you take Surveys online, we
collect multiple unique attributes about your device for purposes of detecting and preventing
fraud.

3. HOW WE COLLECT INFORMATION AND PURPOSES OF PROCESSING

We collect and process information you provide to us and from your use of SMG Services.
The information we collect and how we process it depends on how you access and use SMG
Services.

From You. We collect information from you when you:

▪ Complete a Survey: We collect the information you submit in Survey responses about
your consumer experiences and preferences. We may combine information received
in your Survey responses with information we receive from our Clients, such as
information about your involvement in our Clients’ loyalty programs, to better
understand your consumer experiences. We also may combine information received
in your Survey responses with information received in Survey responses from other
users to better understand overall consumer experiences. When you complete a
Survey, the information you choose to provide us will be used in reports and other
analyses of consumer experiences and preferences for our Clients or for any other
uses we disclose to you at the time the information is collected. If you do not wish to
have your information used in reports, analyses or as otherwise disclosed to you, you
may choose not to complete a Survey.

▪ Use SMG Services. We automatically collect Usage Data when you interact with the
SMG Services through the use of cookies and other data collection tools. We use this
Usage Data to facilitate communications between your device and our systems, deliver
Surveys, ensure Survey integrity, detect and prevent fraud, conduct market research,
administer and improve our website and applications, and analyze usage of and
improve and enhance SMG Services. To learn more about how and why we use
cookies and similar data collection tools, see the “Cookie Policy” section of this Privacy
Policy.

▪ Submit Your Personal Data While Using SMG Services: When you submit your
Personal Data in connection with using SMG Services, such as contacting us for
assistance or information or providing comments about your experiences with one of
our Clients, we collect and analyze the information you submit. When you provide

2
 comments to SMG, the information you provide contributes to the services we provide
to our Clients and to our overall market research. With your permission, your
comments may be posted on TrumpetRatings.com and/or on our Clients’ websites.
When such information is posted in a public forum, such as TrumpetRatings.com or
other websites accessible to the general public, such information becomes public
information. What you have written may be seen and/or collected by third parties and
be used by others in ways we are unable to control or predict.

▪ Access SMG Services through Social Media Credentials: SMG may offer you the
opportunity to use social networking services (collectively, “Social Media”) to access
certain SMG Services. When you choose to access SMG Services through Social
Media login credentials, SMG may, depending on your privacy settings, have access
to information that you have provided to the Social Media platform, such as your name,
email address, profile photo, posts, comments and other information associated with
your Social Media account. We may use this information for any purposes described
in this Privacy Policy and for any additional purposes of which you were advised at the
time the information was collected. If you do not want your Social Media information
to be shared with SMG by a Social Media provider, you should not use your Social
Media accounts to access SMG Services.

From our Clients. For some of our products and services, our Clients may send us
information about your interactions with their brands, products, and services, which may
include information relating to any loyalty programs in which you are enrolled and information
about your transactions with our Clients. We may combine this information with other
information we collect to enhance the market research we conduct and services we provide
for our Clients.

4. LEGAL GROUNDS FOR PROCESSING

4.1. We process your contact data, demographic data, and responses on Surveys when
you complete a Survey or use SMG Services. We process such Personal Data based
on our Clients’ legitimate interests in obtaining feedback from their customers to help
them improve their products and services for the benefit of their customers and their
businesses, and based on SMG’s legitimate interests in enhancing SMG’s products,
services and market research and in responding to users’ requests for assistance or
information.

4.2. We process your Usage Data when you complete a Survey or use SMG Services.
We process this Usage Data based on your election to continue into the Survey,
confirming your consent to SMG’s use of cookies and other data collection
technologies. You may withdraw your consent by contacting our Data Protection
Officer by email at privacyofficer@smg.com or by writing to Data Protection Officer,
Service Management Group, LLC, 1737 McGee Street, Kansas City, MO 64108.

4.3. We may also process information you have provided to Social Media platforms,
depending on your privacy settings, when you use social networking services in
conjunction with SMG services. We process such information based on your consent,
which you provide in your privacy settings to the social networking service. You may
withdraw your consent by changing your privacy settings to no longer allow us access
to your Social Media data.

4.4. We process information received from our Clients concerning your interactions with
their brands, products and services. We process such information based on SMG’s
and SMG’s Clients’ legitimate interests, including improving and enhancing SMG’s
and our Clients’ products and services and enhancing SMG’s market research.

3
5. HOW WE USE AND SHARE PERSONAL DATA

How we use and share information that we collect or that you provide to us depends on how
you use or access the SMG Services. Where required by law, SMG will comply with your
request that we cease providing personal data to third parties.

▪ Communicating with You. Your Personal Data will be used, as needed, to manage
our relationship and communicate with you by mail, telephone, e-mail, mobile alerts,
and SMS text messaging. Unless a survey respondent expressly requests
communication, SMG will not contact a survey respondent other than necessary
contact to verify the integrity of a survey, to deliver Surveys, to provide rewards or
benefits earned as a result of taking a survey, or to provide customer service. Although
SMG does not use your Personal Data for direct marketing purposes, you should
review the Privacy Policy of the client for which we are collecting your Personal Data
to determine if such client does so. We may share your Personal Data with service
providers that assist us in managing our relationship with you.

▪ Performing Services You Request. We may use and share your Personal Data in
order to perform services you request or functions you initiate, such as when you post
information and materials on message boards, forums, or on our Social Media pages.
In addition, when you give us permission, we may disclose your Personal Data in order
to identify you to anyone to whom you send communications through the SMG
Services. Further, we may use and share your Personal Data with third parties in order
to provide rewards and fulfill benefits you have requested and earned by taking
Surveys. If you elect to participate in a sweepstakes or other promotion, we send your
information to third party administrators of those promotions, so they can answer your
questions or contact you about a prize you won or other issues related to the
promotion.

▪ Analyzing Use of and Improving SMG Services. We use Personal Data collected
from cookies and other data collection tools for usage analytics, fraud detection, and
performance improvement for the SMG Services. We may use third party website
analytics services to analyze how individuals use SMG Services, including, to record
mouse clicks, mouse movements, scrolling activity, and text that you type into free-
form text boxes. We use information collected from these third-party services to help
us better understand how our users find and use SMG Services, to enhance our
services, and to improve your user experience.

▪ Sharing Data with Other Service Providers. We may share your information,
including your Personal Data, with other service providers we use to perform the
functions for which we engage them, such as hosting, data storage, and security. We
may also share your Personal Data as needed to operate other related SMG services,
such as ratings and reviews websites that we operate.

▪ Sharing Data with Clients. If you access SMG Services to take a Survey regarding
your consumer experience with one of our Clients, we share the Personal Data we
collect from you about and relating to your Survey responses with that Client. We also
may use this Personal Data to derive market research insights and provide consumer
behavior analytics and business intelligence to our Clients. For information concerning
how the Client for which we are collecting your Personal Data uses, protects and
otherwise processes Personal Data, read such Client’s privacy policy. We and our
Clients also may combine different types of information, including Personal Data
collected from or about you by us, our Client or third-party sources. SMG may use the
combined information for any of the purposes described in this Privacy Policy, and our

4
 Clients may use the combined information for any purposes described in their privacy
policies.

▪ Complying with Legal Obligations and Enforcing Legal Rights. We may also
share the information we collect from you, as needed, to enforce our rights, protect our
property or protect the rights, property or safety of others, or as needed to support
external auditing, compliance, and corporate governance functions. We will disclose
Personal Data as we deem necessary to respond to a subpoena, binding order of a
data protection authority or judge, legal process, governmental request or any other
legal or regulatory obligation, in each case this may be an entity outside your country
of residence. We may also share Personal Data as required to pursue available
remedies or limit damages we may sustain.

▪ Transferring Data in Connection with Corporate Changes. We may transfer

information about you, including Personal Data, in connection with any actual or
impending reorganization, merger, sale, joint venture, assignment, transfer, acquisition
or other change of ownership or control by or of SMG or any affiliated company (in
each case whether in whole or in part), including, without limitation, in connection with
any bankruptcy or similar proceeding. Any such entity to which we transfer Personal
Data will be required to provide you with notice of any purposes of processing not
compatible with the purposes set forth in this Privacy Policy, as well as any privacy
practices that are materially different than the practices set forth in this Privacy Policy.
Where required by law, such entity also will be required to obtain your consent.

▪ Using Personal Data for Other Business Purposes. We also use your Personal
Data for other legitimate business purposes, such as product and service development
and administration of SMG Services.

6. RETENTION AND DISPOSAL OF PERSONAL DATA

We will retain your Personal Data in our records for no longer than is necessary for the
purposes for which it was originally collected. When such information is no longer needed
for the purposes for which it was originally collected, we will securely delete all of your
electronic Personal Data, and securely shred any hard copy Personal Data, except for
what is needed to comply with our legal obligations.

7. YOUR RIGHTS AND CHOICES CONCERNING PERSONAL DATA PROCESSING

You may discontinue participating in Surveys at any time by no longer accessing the SMG
Services.

If you reside in a location with laws or regulations granting you rights to request specific
actions relating to your Personal Data, you will have the specific rights granted to you by
such law[s] or regulation[s], which may include the right to request access to and rectification
(e.g., amendment or supplementation) or erasure of your Personal Data, the right to transfer
your data (i.e., data portability), restriction of processing of your Personal Data, as well as
the right to object to processing of your Personal Data, the right to withdraw your consent,
the right to cancel your account, and the right to lodge a complaint with a supervisory
authority. All such requests will be handled in accordance with the parameters set forth in
applicable laws and regulations.

If you reside in the European Union, you have the right under the General Data Protection
Regulation to request from SMG access to and rectification or erasure of your personal data,
data portability, restriction of processing of your personal data, the right to object to
processing of your personal data, the right to withdraw your consent, and the right to lodge a

5
complaint with a supervisory authority. If you reside outside of the European Union, you also
may have certain data subject rights under your local laws.

To make such a request, contact our Data Protection Officer by email at

privacyofficer@smg.com or by writing to Data Protection Officer, Service Management
Group, LLC, 1737 McGee Street, Kansas City, MO 64108.
8. CONSEQUENCES OF NOT PROVIDING PERSONAL DATA

Although participation in our Surveys is voluntary, you may not qualify for certain incentives,
rewards, or benefits if you do not provide all information requested by a Survey.

9. COOKIES POLICY

9.1. What Are Cookies

SMG and our service providers use small text files called cookies. “Cookies” are small
computer files sent to or accessed from your web browser or your computer's, mobile device’s
or tablet’s hard drive that contain information about your computer, such as a user ID, user
settings, browsing history, and activities conducted while using the Services. A Cookie
typically contains the domain name (internet location) from which the Cookie originated, the
“lifetime” of the Cookie (i.e., when it expires), and a randomly generated unique number or
identifier. Cookies may be linked to Personal Data.

9.2. How We Use Cookies and Data Collection Tools

Cookies help us improve SMG Services by tracking your navigation habits, and customizing
your experience with SMG Services. This enables us to analyze technical and navigational
information about SMG Services and helps us to detect and prevent fraud.

We also use Cookies and other Data Collection Tools (such as web beacons and server logs),
which we collectively refer to as “Data Collection Tools,” to help improve your experience
with SMG Services – for example, by remembering you when you come back to visit us, and
making the content you see more relevant to you.

SMG Services also may use Data Collection Tools to collect information from the device you
use to access SMG Services, such as your operating system type, browser type, domain, and
other system settings, as well as the language your system uses and the country and time
zone in which your device is located.

9.3. Your Control of Cookies

Web browsers allow some control of most Cookies through browser settings. Some web
browsers (including mobile web browsers) provide settings that allow you to reject Cookies or
to alert you when a Cookie is placed on your computer, tablet or mobile device. You may be
able to reject mobile device identifiers by activating the appropriate setting on your mobile
device. Although you are not required to accept SMG’s Cookies or mobile device identifiers,
if you block or reject them, you may not have access to all features available through SMG
Services. In addition, if you reside in a jurisdiction that requires us to obtain your consent to
use cookies on our websites and/or applications, you will have an opportunity to manage your
cookie preferences on those websites and/or applications; except that certain cookies are
required to enable the core functionality of such websites and applications and you cannot
choose to disable those cookies.

10. MANAGING YOUR ACCOUNT INFORMATION

6
You can visit the account section of the applicable SMG Service to manage and correct
factual inaccuracies in the information we have about you. If you have questions about how
to access or correct your Personal Data, contact our Data Protection Officer by email at
privacyofficer@smg.com or by writing to Data Protection Officer, Service Management
Group, LLC, 1737 McGee Street, Kansas City, MO 64108.

11. CHILDREN’S PRIVACY

SMG Services are intended for general audiences and are not directed to children who are
under the age at which they may provide consent for the processing of their Personal Data in
any jurisdiction where we operate. We do not knowingly collect Personal Data from such
persons. If you become aware that a child under the age at which [s]he may legally provide
consent to the processing of his/her Personal Data has provided us with Personal Data
without parental consent, contact our Data Protection Officer by email at
privacyofficer@smg.com or by writing to Data Protection Officer, Service Management
Group, LLC, 1737 McGee Street, Kansas City, MO 64108. If we become aware that a child
under the age at which [s]he may provide consent to Personal Data processing in his or her
jurisdiction has provided us with Personal Data without parental consent, we take steps to
remove such information and terminate the child's account as soon as possible.

12. LINKS TO THIRD PARTY SERVICES

SMG Services may contain links to third party websites and services (“Third Party Services”)
with which SMG has no affiliation. A link to any Third Party Service does not mean we endorse
it or the quality or accuracy of information presented on it. If you decide to visit a Third Party
Service, you are subject to its privacy practices and not the privacy practices set forth in this
Privacy Policy.

13. INFORMATION SECURITY

SMG has an information security program that implements technical, physical, and
organizational measures designed to assist in maintaining the security and confidentiality of
Personal Data; safeguarding against anticipated threats to the confidentiality, integrity and
availability of Personal Data; and protecting your Personal Data against loss, misuse,
unauthorized alteration or destruction, and unauthorized access or disclosure.

However, whenever Personal Data is processed, there is a risk that such data could be lost,
misused, modified, hacked, breached, and/or otherwise accessed by an unauthorized third
party. No system or online transmission of data is completely secure. In addition to the
technical, physical, and organizational measures that SMG has in place to protect your
Personal Data, you should use appropriate security measures to protect your Personal Data.
If you believe that your SMG account or any information you provided to us is no longer secure,
notify our Data Protection Officer immediately by email at privacyofficer@smg.com or by
calling 1-800-764-0439 and asking to speak with SMG’s Data Protection Officer.

14. GEOGRAPHIC CONSIDERATIONS AND CROSS-BORDER TRANSFERS OF

PERSONAL DATA

SMG controls and operates SMG Services from the United States of America. SMG may
transfer, store and process your Personal Data in the United States, the United Kingdom,
Japan, or another location in Asia or in the European Union. Note that data protection and
privacy laws of the country to which your Personal Data is transferred may not be as
comprehensive as the laws in your country. For example, Personal Data transferred to the

7
United States may be subject to lawful access requests by federal and state authorities in the
United States.

Any transfers of Personal Data from the European Economic Area (“EEA”) to the United States
are done pursuant to the EU-US Privacy Shield. SMG participates in and complies with the
EU-U.S. Privacy Shield principles regarding the collection, use, sharing, and retention of
Personal Data from the EEA, as described in our EU-US Privacy Shield certification. View the
Privacy Shield list here. Learn more about the Privacy Shield here. SMG is subject to the
oversight of the US Federal Trade Commission, and will remain responsible for processing of
Personal Data in a manner inconsistent with the Privacy Shield Principles by third parties to
which SMG has transferred personal data unless SMG proves it is not in any way responsible
for the event giving rise to the damage. Any and all such transfers of Personal Data outside
the EEA shall be in accordance with this Privacy Policy and all applicable laws. If you have a
complaint about our Privacy Shield compliance, contact our Data Protection Officer by email
at privacyofficer@smg.com or by writing to Data Protection Officer, Service Management
Group, LLC, 1737 McGee Street, Kansas City, MO 64108. You can also refer a complaint,
free of charge, to our chosen independent dispute resolution body, American Arbitration
Association, and in certain circumstances, invoke the Privacy Shield binding arbitration
process.

This English-language Privacy Policy is SMG’s official statement of its privacy practices
relating to SMG Services. In case of any inconsistency between this English-language Privacy
Policy and any translation into another language, this English-language document prevails.

You can also refer a complaint, free of charge, to our chosen independent dispute resolution
body, American Arbitration Association (http://go.adr.org/privacyshield.html), and in certain
circumstances, invoke the Privacy Shield binding arbitration process.

15. HOW TO CONTACT US

If you have questions about privacy, need assistance with accessing or updating your
Personal Data or have complaints relating to the processing of your Personal Data, contact
our Data Protection Officer by email at privacyofficer@smg.com.

You can also write to us at:

Service Management Group, LLC

Attn: Data Protection Officer
1737 McGee Street
Kansas City, MO 64108

Service Management Group, Ltd.

Attn: Data Protection Officer
38-40 The Maltings
St Albans
Hertfordshire AL1 3HL
UNITED KINGDOM

Service Management Group G.K.

Attn: Data Protection Officer
2-7-16 No. 3 Komoriya Building 9F
Hamamatsu-cho, Minato-ku
Tokyo 1050013, Japan

8
16. DATA CONTROLLER AND DATA PROTECTION OFFICER
Personal Data collected by SMG is controlled by Service Management Group, LLC, 1737
McGee Street, Kansas City, MO 64108. You may contact our Data Protection Officer by email
at privacyofficer@smg.com or by writing to Data Protection Officer, Service Management
Group, LLC, 1737 McGee Street, Kansas City, MO 64108.