Andersen Institute Application Privacy Policy

Effective As Of January 23, 2025

I. INTRODUCTION

This privacy policy (“Privacy Policy”) describes how Andersen Institute will collect, use, and share your personal information and other information, including information related to the use of our mobile and/or web application (the “Application” or “App”).

For purposes of this Privacy Policy, “Personal Information” is data specifically about you, which you typically provide on a voluntary basis. Personal Information may include personal data that is subject to the EU General Data Protection Regulation (“GDPR”) and other applicable European data protection laws and, to the extent applicable, “personally identifiable information” under the Gramm-Leach-Bliley Act (“GLB Act”) and its implementing regulations. Personal Information does not include aggregated or combined information, which includes data that is related to you but studied as a group and is anonymized so that it does not identify you specifically.

II. INFORMATION COLLECTED BY ANDERSEN INSTITUTE

In order to provide you with the benefits of using our Application, Andersen Institute collects certain information from you and your devices. By using the Application or otherwise providing Personal Information to Andersen Institute, you consent to Andersen Institute’s collection, use, and sharing of the data as described in this Privacy Policy.

Under applicable data protection laws that recognize the concept of a controller of Personal Information, Andersen Institute is the controller responsible for the processing of Personal Information that we collect as described in this Section.

1. Information that You Provide to Andersen Institute

You may provide information to Andersen Institute in a number of ways. When you use the Application, you may provide certain Personal Information to us, such as when you register an account, register for an event, communicate with us, subscribe to our mailing lists, or apply for a job.

2. Information Collected from Third Party Sources

In addition to Personal Information that you provide to Andersen Institute, you may also affirmatively authorize or direct third parties to provide us with information. We may also collect publicly available information about you in public and private databases, such as through Lexis-Nexis or other search engines.

3. Information Collected from Your Device

When you visit or interact with the Application, we may automatically gather and store certain information (including Personal Information) about your session from your device, such as your IP address, geographical information, device type, operating system version, referral sources, unique device identifiers, and other information relating to your usage of the Application (“Application Data”). We may collect this information through the use of built-in device logging, analytics SDKs, and other software methods.

4. Information Collected Using Cookies and Tracking Technologies

For further information on our use of cookies, tracking tokens, and device identifiers within the App, please visit our Cookie Notice.

III. USE AND SHARING OF COLLECTED INFORMATION; PURPOSES FOR COLLECTION

1. Use of Collected Information

Andersen Institute may use your Personal Information (including the categories of Personal Information described above) and Application Data (collectively, the “Collected Information”) in a variety of ways as permitted by applicable law, which include those set out below.

For example, where your Collected Information is subject to the GDPR, such Collected Information may only be used by Andersen for a lawful purpose as set out in the GDPR. Where the relevant lawful purpose under the GDPR is that it is necessary for our legitimate interests to use your Collected Information, we have made sure to check that such legitimate interests are not overridden by your interests or fundamental rights and freedoms. You can obtain further information about how we assess these legitimate interests against any potential impact on your interests or fundamental rights and freedoms by contacting us using the information in the “Contact Us” section below.

Where your Collected Information is subject to the GDPR and includes special categories of Personal Information, such as your racial or ethnic origin or your religion, such Personal Information can only be processed under strict conditions. Where Andersen Institute is processing special categories of Personal Information (other than Personal Information relating to criminal convictions and offenses), unless another specified lawful purpose set out in applicable data protection laws applies, your explicit consent must be obtained before any such Personal Information is processed. Personal Information relating to criminal convictions and offenses will only be processed if such processing is authorized under applicable data protection laws. It is possible that a data privacy impact assessment may need to be carried out before special categories of Personal Information can be processed.

2. Application Data

In addition to the uses described above, Andersen Institute may use Application Data to improve the Application and to help Andersen Institute understand how users are interacting with the interface. This information is also collected for statistical analysis, to improve the utility and performance of the Application, and for other purposes described in this Privacy Policy. To the extent the Application Data constitutes Personal Information, we use this Personal Information if you have consented to our use of essential and tracking technologies. We may also use this Personal Information to ensure that content from the Application is presented in the most effective manner for you because it is in our legitimate interests to improve our customers’ mobile and digital experience.

IV. YOUR RIGHTS TO YOUR PERSONAL INFORMATION

1. Right to Review, Correct, Update and Delete Personal Information

You may review, correct, and update certain of your Personal Information that we have about you. For example, where your Personal Information is inaccurate or incomplete, you may ask for your Personal Information to be rectified or completed. In addition, in certain circumstances, you may request deletion of certain of your Personal Information.

You may exercise these rights by contacting us using the information in the “Contact Us” section below. We may ask you to verify your identity and to provide other details before we provide access to, update, or delete any of your information. Your right to delete information is subject to our record retention policy, including any retention requirements under applicable laws, and to exceptions to this right under applicable laws.

2. Right to Disclosure and Access

Depending on your applicable jurisdiction, including if you live in California or if your Personal Information is subject to the GDPR, you may have additional rights with respect to your Personal Information. You may have the right to request that a business that collects Personal Information about you disclose to you:

• The categories of Personal Information it has collected about you.
• The categories of sources from which the Personal Information is collected.
• The business or commercial purpose for collecting or selling the Personal Information.
• The categories of third parties with whom the business shares Personal Information.

In addition, you may have the right to request that a business that discloses your Personal Information for a business purpose disclose to you the categories of Personal Information that the business collected about you and the categories of Personal Information that the business disclosed about you for a business purpose.

You may also have the right to request that a business that collects Personal Information about you disclose to you the specific pieces of Personal Information that it has collected about you. In some jurisdictions, you may request that this information be provided in a structured, commonly used, and machine-readable format so that you may share it with others. If you have these rights, a business may not discriminate against you for exercising these rights, including by denying goods or services to you.

A general list of the categories of Personal Information that we have collected, the categories of sources from which the Personal Information was collected, the business or commercial purposes for collecting the Personal Information, and the categories of third parties with whom we share Personal Information is described in this Privacy Policy. To obtain a list of this information that is specific to you, or to obtain the specific pieces of Personal Information that we have collected about you (which may be limited to certain information that we collected in a specific timeframe, depending on your jurisdiction), please contact us using the information in the “Contact Us” section below. We may ask you to verify your identity and to provide other details before we provide such information to you.

3. Right to Transfer; Right to Object to Processing; Right to Restrict Processing; Right to Withdraw Consent

Depending on your applicable jurisdiction, including if your Personal Information is subject to the GDPR, you may have the right to request the transfer of your Personal Information to another party. You may also have the right to object to us processing your Personal Information by asking for the processing of that Personal Information to be restricted or stopped. You may also have the right to ask us to restrict the processing of your Personal Information, for example, if you want us to establish its accuracy or the reason for processing it. You may also have the right to withdraw your consent to us processing your Personal Information, where you have previously provided consent.

You may exercise these rights by contacting us using the information in the “Contact Us” section below. We may ask you to verify your identity and to provide other details before we fulfill your request.

4. Right to Make a Complaint

Depending on your applicable jurisdiction, you may make a complaint to your applicable data protection authority (or the equivalent regulator in your jurisdiction) about the manner in which Andersen Institute is processing your Personal Information. For more information, or if you believe that Andersen Institute has not complied with this Privacy Policy or the applicable law, please contact us using the information in the “Contact Us” section below. If you are not satisfied with the outcome of Andersen Institute’s assessment of your complaint, you may be able to refer your complaint to the relevant regulator under applicable law.

5. No Sale of Personal Information

Andersen Institute does not sell your Personal Information to non-affiliated third parties (including for their own direct marketing purposes) without your consent. In addition, Andersen Institute has not sold your Personal Information to non-affiliated third parties in the last 12 months. If you are entitled to any disclosure rights in your jurisdiction regarding our sale of your Personal Information to non-affiliated third parties or our disclosure of your Personal Information to third parties for their own direct marketing purposes, this disclosure satisfies those requirements. If you still wish to learn more about our compliance with this requirement, please contact us using the information provided in the “Contact Us” section below.

V. OPTING-OUT

You may receive in-app notifications or email communications from Andersen Institute, including communications regarding the Application or our services, marketing or promotions, and/or other topics. To contact you, Andersen Institute may use the information you provide to us, including email, address, or phone.

You may, at any time, inform us that you do not want Andersen Institute to contact you for marketing purposes by sending your request to us using the contact information in the “Contact Us” section below or by sending an e-mail to info@anderseninstitute.org. You may also opt-out of promotional email communications by clicking on a link provided in the promotional email message, managing your notification settings directly within your device’s operating system settings, or through the use of Section 7216 Consent to Use forms in relation to tax returns information (if such is applicable to you).

After opting out, you will no longer receive marketing or promotional communications but will continue to receive other non-marketing-related messages, such as transactional notifications or emails relating to our provision of professional services to you, your account status, or your critical use of the Application.

VI. TRACKING; THIRD PARTY ANALYTICS PROVIDERS

1. Do Not Track & App Tracking Transparency Disclosure

Certain web browsers and mobile operating systems provide opt-out or tracking restriction options (such as App Tracking Transparency on iOS or Do Not Track signals). The Application honors user choices where technically enforced by the native operating system platform, but otherwise, standard platform analytics operate as described herein to maintain app stability and performance.

2. Third Party Analytics Providers

For further information on our use of Third Party Analytics within the application environment, please visit our Cookie and Tracking Notice.

VII. EXCLUSIONS

The Application may contain links to websites or external services owned by other companies. Because Andersen Institute has no control over the privacy practices or content of these linked sites, we recommend that you carefully review the privacy policy of each external platform or website you visit. Andersen Institute is not responsible for the content or privacy practices of applications or websites owned by other companies.

VIII. CONTACT US

For questions or comments regarding this Privacy Policy, including to exercise your rights pursuant to the “Your Rights to Personal Information” section above, please contact us at:

By Postal Mail:

Andersen Institute

1850 K St. NW Suite 675

Washington, DC 20006

By E-mail:

info@anderseninstitute.org

IX. UPDATES TO PRIVACY POLICY

From time to time, we may update this Privacy Policy. If we do, we will note near the top of this page the date that any changes are made and/or when they become effective, and where appropriate, we may notify you via an in-app alert or push notification. If the changes being made are material, we may alert you to the changes in a more prominent way. Your inaction or continued use of the Application after any such notices will tell us that you agree to these changes.