RAT RACE's Privacy Policy

4.1. Personal Data You Provide To Us, Including Health Data.

We collect data you provide directly to us.

• Account data. When you create an account with us ("Account"), we will collect your Google or Apple accounts to enable third party authentication. We will also collect and maintain your username.
• Payment data. To order products or services through RAT RACE, we will collect your payment information through your payment processor. Please note that your financial information is collected and stored by a third party payment processing company. Use and storage of that data is governed by the third party payment processor's applicable privacy policy.
• Purchase data. If you make a purchase on RAT RACE, we will receive data about the purchase.
• App Restriction Information. To provide app-blocking functionality, we will collect a list of applications you choose to restrict, your configured goals, and device authorization status necessary to enforce restrictions. We do not collect the content of other applications or monitor your activity with those applications.
• Other data you share through RAT RACE. You may provide us with data when you upload a picture of yourself, update or add information to your Account, respond to surveys, post to forums, provide us with feedback, participate in promotions, or use other features of RAT RACE.

With your permission, Rat Race may access health and activity information from your device or authorized third-party health platform ("Health Data"), including:

• Daily step count
• Walking distance
• Activity history
• Activity timestamps
• Goal progress
• Device motion information

We access only the information you authorize. We do not collect medical records, diagnoses, prescriptions, or healthcare provider information.

When we conduct research or carry out surveys and you participate in our research or surveys, we may collect sensitive personal data or sensitive personal information ("SPDI") about you, for example, information about your racial or ethnic origin, political opinions, religious or philosophical beliefs, sex life or sexual orientation. We will get your explicit consent for our collection, use, or sharing of this data as required by law. We do not collect or process SPDI for any other purpose other than those permitted by applicable law.

4.2. Data That We Collect Automatically About Your Browser And Device.

When you access or use RAT RACE, we use cookies and similar technologies that collect information about your browser and device:

• Log Data. We automatically receive and record information from your device or web browser when you interact with RAT RACE. For example, we may collect your device model, app model, device identifier, internet protocol (IP), time zone setting, language preference, operating system, platform, and internet service provider (ISP).
• Account ID. If you create an Account ID, we will use this information to collect data about your activities through RAT RACE.
• Usage and Analytics Information. We automatically collect information regarding your use of RAT RACE including, features used, session duration, goal completion statistics, notification interactions, screens or pages viewed, buttons clicks, app launches and exits, crash and performance information, and other diagnostic and usage information.

4.3. Data That We Collect From Third-Parties.

RAT RACE uses information provided by your mobile device and may request permission to access the following information:

• Motion and fitness activity
• HealthKit
• Health Connect and/or
• device administration permissions.

You may revoke permissions at any time through your device settings. However, revoking your permissions may disable certain functionalities.

10.1. Information For EU Users (Including Legal Bases)

We will use your personal data only for the purposes for which we collect it, unless we reasonably consider that we need to use it for another reason that is compatible with the original purpose. If we need to use your personal data for another purpose, we will explain the legal basis we rely on.

Depending on the purpose, we process your personal data according to the following basis:

• Your consent,
• Performance of a contract,
• Our legitimate interest,
• Compliance with legal obligations

The table below shows what we use your personal data for and the lawful basis for processing it in each case.

10.2. Legal Rights For EEA Users

If you are an EU resident, you have certain rights in respect of the information that we hold about you. Below is a short overview of those rights:

• Access. With some exceptions designed to protect the rights of others, you have the right to a copy of the personal data that we hold about you. Where the data is data that you have given to us, you have the right to receive your copy of it in a common electronic format, and to provide copies of it to other people if you wish.
• Correction. You have the right to have the personal data we hold about you corrected if it is factually inaccurate. This right does not extend to matters of opinion, such as views expressed in editorial content.
• Deletion. In some limited circumstances, you have the right to have personal data that we hold about you erased (the "right to be forgotten"). This right is not generally available where we still have a valid legal reason to keep the data (for example, because we are obliged to do so by law).
• Objection. You have the right to object to our processing of your personal data where we rely on "legitimate interests" as our legal basis for processing, but we may be able to continue processing if our interest outweighs your objection.
• Withdrawing consent. If we are processing your personal data on the basis of your consent, you have the right to withdraw that consent at any time, in which case we will stop that processing unless we have another legal basis on which to continue.

10.3. How To Exercise Your Rights

To exercise your rights, please go to the settings in RAT RACE or contact us at data-privacy@buzzfeed.com. In order to protect your privacy and that of others, we will ask you to prove your identity before we take any steps in response to a request you have made. If a third party is making a request on your behalf, we will ask them to prove that they have your permission to act for you.

We may contact you to ask you for further information to help you exercise your legal rights or to speed up our response. We will try to respond to requests within one month and we will let you know if we need to take longer, for example because your request is complicated. We may have an overriding lawful basis for processing your personal data, or certain exemptions may apply. If we refuse your request, we will explain why. You may also reach us at data-privacy@buzzfeed.com to exercise your data privacy rights described above, including the right to deletion. You may also contact our data protection office (DPO) or our EU Representative.

Our Data Protection Officer (DPO) is DP Dock DPO Services GmbH. Their contact details are:

Our EU Representative is EU-REP.Global GmbH. Their contact details are:

11.1. Privacy Rights

• Right to Deletion. You have the right to request that we delete certain personal data we have about you.
• Right to Access. You have the right to request that we inform you about the categories of personal data we collect or disclose about you; the categories of sources of such data; the business or commercial purpose for collecting your personal data; and the categories of third parties with whom we share/disclose personal data. Such information is also set forth above in this Privacy Policy. You may also request that we provide you access to and/or a copy of the specific pieces of personal data we collected about you (also called a data portability request).
• Right to Correction. If you feel that any of the records of personal data we have about you are incorrect, you have a right to request that we correct those inaccuracies. This right does not extend to matters of opinion, such as views expressed in editorial content.
• No Discrimination. You have the right to not be discriminated against (as provided for in the applicable US Privacy Law) for exercising your rights.
• Right to Opt-Out. You have the right to opt-out of the "sale" of your personal data, or the "sharing" of your personal data for interest-based or other targeted advertising on third party websites. Note that "sale" is defined broadly and may include allowing third parties to receive certain data, such as cookies, IP address, and/or browsing behavior, to deliver targeted advertising on our Services or other sites and apps. We do not engage in the sale/sharing of your personal data for targeted advertising.

11.2. Notice for California Users

This section provides you with our practices regarding the collection, use, and disclosure of your personal data in the 12 months prior to our last update to this Policy (see the date at the top). It also explains your rights regarding your personal data that we collect pursuant to applicable U.S. state privacy laws.

Categories of Information We Collect:

• Your contact details (e.g. your user name; your Apple or Google sign-in information).
• Purchase history & preferences (e.g. records of services purchased or obtained).
• Internet activity information (e.g., browsing history, search history, information on a consumer's interaction with a website, application, or questions and other messages you address to us directly through online forms or by email).
• Online identifiers (e.g. IP address, ADID/IDFA, internal identification numbers).

Categories of Sources:

• You
• Automatically from our device
• From Apple, Google, or other third-party services that you authorize

Purpose of Collection

• To provide and maintain RAT RACE, including the ability to track your health data and provide restriction functionality on your selected apps.
• To register and authenticate your Account.
• To communicate with you, including to process your requests for products/services and/or information.
• To improve RAT RACE, including to better understand our customer base.
• To enforce our User Agreement, and for the administration and protection of our business.
• To comply with applicable law, regulations, and legal and regulatory processes.

Disclosures. We do not sell or share your personal data for targeted advertising. We may disclose your personal data, including health data, with our service providers and business partners only as needed to provide RAT RACE. We provide details of our disclosure below:

We may share your personal data with government entities when required to do so by law.

Your privacy rights. As a California resident, the following rights are available to you. You may exercise these rights by going to your settings or emailing us at data-privacy@buzzfeed.com.

• Right to Know the categories of specific personal data we maintain about you.
• Right to Correct inaccurate personal data we maintain about you.
• Right to Delete your personal data;
• Right to Obtain a Portable Copy of the personal data we hold about you;
• Right to Limit the Use and Disclosure of sensitive information.
• Right to Appeal the Denial of Your Request.
• Right to be Free from Discrimination for exercising your privacy rights.

11.3. California Shine the Light Disclosure

Under California Civil Code sections 1798.83-1798.84, California residents are entitled to ask for a notice identifying the categories of personal customer data which we share with our affiliates and/or third parties for their own direct marketing purposes, and providing contact information for such affiliates and/or third parties. RAT RACE does not share any personal data for direct marketing purposes.