Country addenda to privacy notice

This Addendum, which supplements and forms part of Carrot’s Privacy Notice, applies to you if you are a resident or citizen of the European Union (EU), United Kingdom (U.K.), or Switzerland, and describes how we collect, use, disclose, and store your Personal Information in accordance with the General Data Protection Regulation (GDPR), the United Kingdom General Data Protection Regulation (U.K. GDPR), and the Swiss Federal Act on Data Protection (revFADP), respectively.

Please click on the below links, respectively, to find out how and why we collect, use, and disclose your information:

• Privacy Notice | Collection
• Privacy Notice | Use
• Privacy Notice | Disclosure

Please note that, If you choose not to provide your Personal Information to us, we may not be able to provide you with access to our Service.

In order to provide services, Carrot will store and process your Personal information in the United States.

To the extent that applicable law considers this an “international data transfer,” we will comply with applicable requirements for transferring Personal Information outside of the EU, the U.K., or Switzerland.

For more information on how we store, protect, and retain your information, please see here.

In addition to the rights outlined here, you have the following data subject rights:

• The right to access the Personal Information that we maintain about you;
• The right to require us to correct your Personal Information;
• The right to the erasure of your Personal Information;
• The right to request that we stop processing your Personal Information;
• The right to not provide or to withdraw your consent at any time;
• The right to suspend the processing of your Personal Information;
• The right to transfer your Personal Information to yourself or to a third-party; and
• The right to not be subject to decisions based solely on automated decision making.

Please contact us at the following email if you would like to exercise your rights: data-requests@get-carrot.com. PLEASE NOTE: ALL REQUESTS ARE SUBJECT TO VERIFICATION OF YOUR IDENTITY. WE WILL RESPOND TO REQUESTS WITHIN THE TIME PERIOD REQUIRED BY APPLICABLE LAW.

Carrot collects and processes Personal Information from job applicants (“Candidates”) for the purposes of managing our recruitment process, including assessing your qualifications with respect to your application and to decide whether to enter into an employment relationship with you. This may include your name, contact details, CV, employment history, educational background, references, and any other information that you provide to us during the recruitment process, or that we receive from a recruitment agency, background check provider (to the extent permitted by applicable law) or other third party. We may also collect sensitive Personal Information if voluntarily provided by you, such as information relating to ethnic origin or disabilities for equal opportunities monitoring.

The legal basis for this processing is our legitimate interest in hiring qualified individuals and, where applicable, compliance with legal obligations. All Candidate Personal Information will be stored securely and will only be accessible by authorized personnel involved in the recruitment process. We may share your Personal Information with third-party service providers who assist us in the recruitment process, subject to appropriate data processing agreements or analogous contractual provisions.

Carrot will retain Personal Information of Candidates for as long as necessary to comply with our legitimate interests, which may include (among other purposes), reviewing applications that have previously been denied, and for the length of time necessary to comply with applicable law.

You can also file a complaint with the applicable local authority. When you consent to our processing your Personal Information for a specified purpose, you may withdraw your consent at any time, and we will stop any further processing of your data for that purpose.

Please contact us at the following email if you would like to exercise your rights: data-requests@get-carrot.com. PLEASE NOTE: ALL REQUESTS ARE SUBJECT TO VERIFICATION OF YOUR IDENTITY. WE WILL RESPOND TO REQUESTS WITHIN THE TIME PERIOD REQUIRED BY APPLICABLE LAW.

Please see here for pertinent details regarding updates to our Privacy Notice (including, as applicable, updates to this Addendum). If you have questions about our Privacy Notice, or this Addendum, please contact us at legal@get-carrot.com.

This country Addendum, which supplements and forms part of Carrot’s Privacy Notice, applies to you if you are a resident or citizen of Serbia and describes how we collect, use, disclose, and store your Personal Information in accordance with the Law on Protection of Personal Data 2018.

Please click on the below links, respectively, to find out how and why we collect, use, and disclose your information:

• Privacy Notice | Collection
• Privacy Notice | Use
• Privacy Notice | Disclosure

Please note that, If you choose not to provide your Personal Information to us, we may not be able to provide you with access to our Service.

Data Storage

In order to provide services, Carrot will store and process your Personal Information in the United States. For more information on how we store, protect, and retain your data, please see here.

International Data Transfers

Carrot operates globally and your Personal Information will be transferred to countries outside of Serbia that are subject to different standards of data protection. We will take reasonable and appropriate steps to ensure that transfers of your Personal Information comply with applicable law and are managed to protect your privacy rights and interests.

In addition to the rights outlined here, you have the following data subject rights:

• Access. You have the right to access the Personal Information that we maintain about you.
• Rectification. You have the right to have your data corrected if it is inaccurate or incomplete. Upon request, we will correct inaccurate Personal Information about you and, taking into account the purposes of the processing, complete incomplete Personal Information.
• Erasure. You have the right to have your Personal Information erased.
• Restrict processing. You may request that we restrict the processing of your Personal Information. This means that we will suspend the processing of your data. This right does not prevent us from continuing to store your Personal Information.
• Right to object. You have the right to ask us to no longer process your Personal Information if your data is processed due to legitimate interests. You can object to direct marketing at any time and at no cost to you if your Personal Information is processed for this purpose.
• Portability. You may ask us to provide you with your Personal Information in a structured, commonly used and machine-readable format, and have such data transmitted directly to another Data Controller, where technically feasible.

Please contact us at the following email if you would like to exercise your rights: data-requests@get-carrot.com. PLEASE NOTE: ALL REQUESTS ARE SUBJECT TO VERIFICATION OF YOUR IDENTITY. WE WILL RESPOND TO REQUESTS WITHIN THE TIME PERIOD REQUIRED BY APPLICABLE LAW.

You may file a complaint with the Commissioner for Information of Public Importance and Protection of Personal Data.

Please see here for pertinent details regarding updates to our Privacy Notice (including, as applicable, updates to this Addendum). If you have questions about our Privacy Notice, or this Addendum, please contact us at legal@get-carrot.com.

This country Addendum, which supplements and forms part of Carrot’s Privacy Notice, applies to you if you are a resident or citizen of Turkey and describes how we collect, use, disclose, and store your Personal Information in accordance with the Law on the Protection of Personal Data (“LPPD”).

Please click on the below links, respectively, to find out how and why we collect, use, and disclose your information:

• Privacy Notice | Collection
• Privacy Notice | Use
• Privacy Notice | Disclosure

Please note that, If you choose not to provide your Personal Information to us, we may not be able to provide you with access to our Service.

In order to provide services, Carrot will store and process your Personal information in the United States.

To the extent that the LPPD considers this an “international data transfer,” we will comply with applicable requirements for transferring Personal Information outside of Turkey.

For more information on how we store, protect, and retain your information, please see here.

In addition to the rights outlined here, you have the following data subject rights:

• Right of Access and Right to Knowledge. You have the right to know whether your information has been processed. If your information has been processed, you have the right to know which data has been processed and how it has been processed.
• Right to Information about Entities with whom Personal Information has been Shared. You have the right to know the the identities of natural or legal persons with whom your information has been shared.
• Correction, Erasure, or Removal of Personal Information. You have the right to request that your information be corrected, erased, or removed, in accordance wit the LPPD. If your information has been transferred, then such requests will be shared with third party recipients in accordance with the LPPD.
• You may object to any negative consequence of your information being analyzed exclusively through automated systems.
• You may request compensation if you have suffered any damage due to the illegal processing of your information.

Please contact us at the following email if you would like to exercise your rights: data-requests@get-carrot.com. PLEASE NOTE: ALL REQUESTS ARE SUBJECT TO VERIFICATION OF YOUR IDENTITY. WE WILL RESPOND TO REQUESTS WITHIN THE TIME PERIOD REQUIRED BY APPLICABLE LAW.

Please see here for pertinent details regarding updates to our Privacy Notice (including, as applicable, updates to this Addendum). If you have questions about our Privacy Notice, or this Addendum, please contact us at legal@get-carrot.com.

This country Addendum, which supplements and forms part of Carrot’s Privacy Notice, applies to you if you are a resident or citizen of South Africa and describes how we collect, use, disclose, and store your Personal Information in accordance with the Protection of Personal Information Act (POPIA) and the Promotion of Access to Information Act (PAIA).

Please click on the below links, respectively, to find out how and why we collect, use, and disclose your information:

• Privacy Notice | Collection
• Privacy Notice | Use
• Privacy Notice | Disclosure

Please note that, If you choose not to provide your Personal Information to us, we may not be able to provide you with access to our Service.

In order to provide services, Carrot will store and process your Personal information in the United States.

To the extent that the POPIA and/or PAIA consider this an “international data transfer,” we will comply with applicable requirements for transferring Personal Information outside of South Africa.

For more information on how we store, protect, and retain your information, please see here.

In addition to the rights outlined here, you have the following data subject rights:

• Access. After providing adequate proof of your identity, you may request that we confirm, free of charge, whether or not we hold Personal Information about you. You may then request a description of this information, including information about third parties who have had access to this information, within a reasonable time and at a prescribed fee (if any). In addition, we will provide information in a reasonable manner and in a form that is generally understandable.
• Rectification. You may request the rectification of inaccurate, incomplete, misleading, or outdated Personal Information.  
• Erasure. You have the right to request that we delete Personal Information that is inaccurate, irrelevant, or excessive, or that we are no longer authorized to retain.
• Object/Opt-out. You have the right to object to the processing of your Personal Information. You also have the right to “opt out” of having your information processed for purposes of direct marketing by means of unsolicited electronic communications.
• Not be Subject to Automated Decision-Making. You have the right to not be subject to a decision which is based solely on the basis of the automated processing of your Personal Information.

Please contact us at the following email if you would like to exercise your rights: data-requests@get-carrot.com. PLEASE NOTE: ALL REQUESTS ARE SUBJECT TO VERIFICATION OF YOUR IDENTITY. WE WILL RESPOND TO REQUESTS WITHIN THE TIME PERIOD REQUIRED BY APPLICABLE LAW.

You may submit a complaint to the Information Regulator regarding alleged interference with the protection of your information or with respect to a determination of an adjudicator.

You may also institute civil proceedings regarding an alleged interference with the protection of your Personal Information.

Please see here for pertinent details regarding updates to our Privacy Notice (including, as applicable, updates to this Addendum). If you have questions about our Privacy Notice, or this Addendum, please contact us at legal@get-carrot.com.

This country Addendum, which supplements and forms part of Carrot’s Privacy Notice, applies to you if you are a resident or citizen of Chile and describes how we collect, use, disclose, and store your Personal Information in accordance with Law 19.628.

Please click on the below links, respectively, to find out how and why we collect, use, and disclose your information:

• Privacy Notice | Collection
• Privacy Notice | Use
• Privacy Notice | Disclosure

Please note that, If you choose not to provide your Personal Information to us, we may not be able to provide you with access to our Service.

In order to provide services, Carrot will store and process your Personal Information in the United States. For more information on how we store, protect, and retain your data, please see here.

Carrot operates globally and your Personal Information will be transferred to countries outside of Chile that are subject to different standards of data protection. We will take reasonable and appropriate steps to ensure that transfers of your Personal Information comply with applicable law and are managed to protect your privacy rights and interests.

In addition to the rights outlined here, you have the following data subject rights:

• Access. You have the right to access to any information that pertains to you.
• Deny.  You may choose not to provide us with permission to process your Personal Information. If you do provide such permission, you may withdraw your consent at any time.
• Correction. You may request the modification of inaccurate, incomplete, misleading, or outdated data.  
• Erase. You may request that we delete your Personal Information.
• Block You have the right to request that we  block Personal Information that is not necessary, is excessive, or is not in accordance with applicable laws.
• Object. You may object to processing of your Personal Information when there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your Personal Information for direct marketing purposes.
• Review Automated Decision-Making. You have the right to have reviewed a decision based solely on automated processing that may affect your interests.

Please contact us at the following email if you would like to exercise your rights: data-requests@get-carrot.com. PLEASE NOTE: ALL REQUESTS ARE SUBJECT TO VERIFICATION OF YOUR IDENTITY. WE WILL RESPOND TO REQUESTS WITHIN THE TIME PERIOD REQUIRED BY APPLICABLE LAW.

Please see here for pertinent details regarding updates to our Privacy Notice (including, as applicable, updates to this Addendum). If you have questions about our Privacy Notice, or this Addendum, please contact us at legal@get-carrot.com.

This country Addendum, which supplements and forms part of Carrot’s Privacy Notice, applies to you if you are a resident or citizen of Colombia and describes how we collect, use, disclose, and store your Personal Information in accordance with Law 1266 of 2008 and Law 1581 of 2012.

Please click on the below links, respectively, to find out how and why we collect, use, and disclose your information:

• Privacy Notice | Collection
• Privacy Notice | Use
• Privacy Notice | Disclosure

Please note that, If you choose not to provide your Personal Information to us, we may not be able to provide you with access to our Service.

In addition to the rights outlined here, you have the following data subject rights:

• Access. You have the right to access the Personal Information that we maintain about you.
• Proof of authorization. You may request that we provide proof of authorization provided to Carrot to process your Personal Information.
• Erase. You may request that we delete your Personal Information.
• Withdraw consent. You may withdraw your consent and/or request suppression of the data if you believe the processing of your Personal Information does not respect constitutional principles or legal provisions.
• Rectification. You have the right to have your data rectified if it is inaccurate or incomplete. Upon request, we will correct any partial, inaccurate, incomplete, fractional, or misleading Personal Information about you.

Please contact us at the following email if you would like to exercise your rights: data-requests@get-carrot.com. PLEASE NOTE: ALL REQUESTS ARE SUBJECT TO VERIFICATION OF YOUR IDENTITY. WE WILL RESPOND TO REQUESTS WITHIN THE TIME PERIOD REQUIRED BY APPLICABLE LAW.

You have the right to submit a complaint to the Superintendency of Industry and Commerce if you believe there has been an infringement and/or violation of data protection.

Please see here for pertinent details regarding updates to our Privacy Notice (including, as applicable, updates to this Addendum). If you have questions about our Privacy Notice, or this Addendum, please contact us at legal@get-carrot.com.

This country Addendum, which supplements and forms part of Carrot’s Privacy Notice, applies to you if you are a resident or citizen of Guatemala and describes how we collect, use, disclose, and store your Personal Information in accordance with the Constitutional Court of Guatemala.

In addition to the rights outlined here, you have the following data subject rights:

• Access. You may ask for a copy of your Personal Information.
• Rectification. You may ask us to modify, update or correct your data if it is not accurate.
• Deletion. You may request us to stop using all or part of your Personal Information and delete Personal Information.
• Transfer. You may request that we transfer your data to another Data Controller where it is technically possible.
• Review Automated Decision Making: You may request to review decision-making made by automated means.

Please contact us at the following email if you would like to exercise your rights: data-requests@get-carrot.com. PLEASE NOTE: ALL REQUESTS ARE SUBJECT TO VERIFICATION OF YOUR IDENTITY. WE WILL RESPOND TO REQUESTS WITHIN THE TIME PERIOD REQUIRED BY APPLICABLE LAW.

Please see here for pertinent details regarding updates to our Privacy Notice (including, as applicable, updates to this Addendum). If you have questions about our Privacy Notice, or this Addendum, please contact us at legal@get-carrot.com.

This country Addendum, which supplements and forms part of Carrot’s Privacy Notice, applies to you if you are a resident or citizen of  Brazil and describes how we collect, use, disclose, and store your Personal Information in accordance with the Brazilian General Data Protection Law (“LGPD”).

Please click on the below links, respectively, to find out how and why we collect, use, and disclose your information:

• Privacy Notice | Collection
• Privacy Notice | Use
• Privacy Notice | Disclosure

Please note that, If you choose not to provide your Personal Information to us, we may not be able to provide you with access to our Service.

Data Storage

In order to provide services, Carrot will store and process your Personal Information in the United States. For more information on how we store, protect, and retain your data, please see here.

International Data Transfers

Carrot operates globally and your Personal Information will be transferred to countries outside of Brazil that are subject to different standards of data protection. We will take reasonable and appropriate steps to ensure that transfers of your Personal Information comply with applicable law and are managed to protect your privacy rights and interests.

When a Brazilian Data Controller (e.g., your employer) sends us an “Employee Eligibility File,” we will implement appropriate safeguards (e.g., executing Standard Contractual Clauses with the Data Controller/Exporter) that contractually obligate each party to ensure that Personal Information receives an adequate level of protection consistent with the requirements and standards of the LGPD.

In addition to the rights outlined here, you have the following data subject rights:

• Information. You have a right to know how we process your Personal Information.
• Access. You may request a copy of your Personal Information.
• Rectification. You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete and to update information you think is out-of-date.
• Erasure. You have a right to request that we delete your Personal Information.
• Object.  You have the right to ask us to block any unnecessary or excessive data collection or processing of your Personal Information.
• Portability. You have the right to request that your Personal Information be sent to another service or product provider, upon express request.
• Information About Recipients. You have the right to request information about the public and private entities with whom we share your Personal Information.
• Decline Consent. You have the right to decline consent to processing your Personal Information where we seek your consent. Please be advised that declining consent may affect our ability to render services to you.
• Review Automated Decision-Making Information. You have the right to review decisions made solely based on the automated processing of your Personal Information affecting your interests.

Please contact us at the following email if you would like to exercise your rights: data-requests@get-carrot.com. PLEASE NOTE: ALL REQUESTS ARE SUBJECT TO VERIFICATION OF YOUR IDENTITY. WE WILL RESPOND TO REQUESTS WITHIN THE TIME PERIOD REQUIRED BY APPLICABLE LAW.

Please see here for pertinent details regarding updates to our Privacy Notice (including, as applicable, updates to this Addendum). If you have questions about our Privacy Notice, or this Addendum, please contact us at legal@get-carrot.com.

This country Addendum, which supplements and forms part of Carrot’s Privacy Notice, applies to you if you are a resident or citizen of the People’s Republic of China and describes how we collect, use, disclose, and store your Personal Information in accordance with the Personal Information Protection Law (“PIPL”).

We will abide by the following principles with respect to your Personal Information: legality, legitimacy, necessity, good faith, transparency, responsibility, and reasonableness.

Personal Information refers to various information related to identified or identifiable natural persons recorded electronically or otherwise, excluding anonymized information. Sensitive Personal Information refers to Personal Information that, once leaked or illegally used, may easily lead to the infringement of the personal dignity of natural persons or the harm of personal and property safety, including biometrics, religious beliefs, specific identities, medical health, financial accounts, whereabouts and Personal Information of minors under the age of fourteen.

Legal Bases: Please see the following for more details related to how and why we process your information:

The Personal Information we generate, collect and obtain during our operations within the territory of the People’s Republic of China will be stored overseas. Unless otherwise stipulated by applicable law, we will only store your Personal Information for the shortest time necessary to achieve the purpose of processing.

We transfer Personal Information overseas in accordance with the requirements set forth in applicable law and as needed to fulfill our legal obligations with your Employer. We use commercially reasonable measures to protect the confidentiality and safety of your information.

In addition to the rights outlined here, you have the following data subject rights:

• You have the right to review and copy your Personal Information, unless otherwise stipulated by laws and administrative regulations;
• You have the right to correct inaccuracies associated with your Personal Information;
• You have the right to change the scope of your consent and/or withdraw consent;
• You have the right to portability with respect to your Personal Information;
• You have the right to request an interpretation of this Privacy Notice from us;
• You have the right to object to the use of automated decision-making; and
• You have the right to ask us to delete your Personal Information under the following circumstances:
• The purpose of processing has been achieved, cannot be achieved, or is no longer necessary to achieve the purpose of processing;
• We stop providing relevant Services;
• You withdraw your consent;
• We process your Personal Information in violation of laws, administrative regulations, or agreements; and
• Other circumstances stipulated by laws and administrative regulations.

We do not charge a separate fee for you to exercise your rights. However, for repeated requests that exceed reasonable limits, we reserve the right to charge a separate fee. We have the right to refuse requests that are unreasonably repetitive, require excessive technical means, pose risks to the legitimate rights and interests of others, or are impractical.

Please contact us at the following email if you have questions or would like to exercise your rights: data-requests@get-carrot.com.  

PLEASE NOTE: ALL REQUESTS ARE SUBJECT TO VERIFICATION OF YOUR IDENTITY. WE WILL RESPOND TO REQUESTS WITHIN THE TIME PERIOD REQUIRED BY APPLICABLE LAW. UNLESS THERE ARE SPECIAL CIRCUMSTANCES, WE WILL ACCEPT AND PROCESS YOUR COMPLAINTS AND REPORTS WITHIN 30 DAYS.

Please see here for pertinent details regarding updates to our Privacy Notice (including, as applicable, updates to this Addendum). If you have questions about our Privacy Notice, or this Addendum, please contact us at legal@get-carrot.com.

This country Addendum, which supplements and forms part of Carrot’s Privacy Notice, applies to you if you are a resident or citizen of the Philippines and describes how we collect, use, disclose, and store your Personal Information in accordance with the Republic Act No. 10173, otherwise known as the Data Privacy Act of 2012 (“DPA”).

Please click on the below links, respectively, to find out how and why we collect, use, and disclose your information:

• Privacy Notice | Collection
• Privacy Notice | Use
• Privacy Notice | Disclosure

Please note that, If you choose not to provide your Personal Information to us, we may not be able to provide you with access to our Service.

In order to provide services, Carrot will store and process your Personal information in the United States.

To the extent that the DPA considers this an “international data transfer,” we will comply with applicable requirements for transferring Personal Information outside of the Philippines.

For more information on how we store, protect, and retain your information, please see here.

In addition to the rights outlined here, you have the following data subject rights:

• Access to Personal Information we process about you. It is your right to obtain confirmation on whether or not data relating to you are being processed.
• Rectification of your Personal Information. You may have your information corrected if it is inaccurate or incomplete.
• Erasure or order blocking of your Personal Information whenever warranted.
• The Right to Object if the Personal Information processing involved is based on consent or on legitimate interest.
• The right to Data Portability through which you may obtain and electronically move, copy, or transfer your data securely for further use.

Please contact us at the following email if you would like to exercise your rights: data-requests@get-carrot.com. PLEASE NOTE: ALL REQUESTS ARE SUBJECT TO VERIFICATION OF YOUR IDENTITY. WE WILL RESPOND TO REQUESTS WITHIN THE TIME PERIOD REQUIRED BY APPLICABLE LAW.

Please see here for pertinent details regarding updates to our Privacy Notice (including, as applicable, updates to this Addendum). If you have questions about our Privacy Notice, or this Addendum, please contact us at legal@get-carrot.com.

This country Addendum, which supplements and forms part of Carrot’s Privacy Notice, applies to you if you are a resident or citizen of Thailand and describes how we collect, use, disclose, and store your Personal Information in accordance with the Personal Data Protection Act 2019 (PDPA).

In order to provide services, Carrot will store and process your Personal Information in the United States. For more information on how we store, protect, and retain your data, please see here.

Carrot operates globally and your Personal Information will be transferred to countries outside of Thailand that are subject to different standards of data protection. We will take reasonable and appropriate steps to ensure that transfers of your data comply with applicable law and are managed to protect your privacy rights and interests.

In addition to the rights outlined here, you have the following data subject rights:

• Access. You may request a copy of your Personal Information.
• Withdraw Consent. You have the right to withdraw consent to processing your information where we seek your consent. Please be advised that declining consent may affect our ability to render services to you.
• Rectification. You may request that we correct incomplete, inaccurate, misleading, or not up-to-date Personal Information.
• Erasure. You have a right to request that we delete or anonymize your Personal Information.
• Opt Out/Object.  You may object to the collection, use, or disclosure of your Personal Information in certain circumstances, such as for direct marketing purposes.
• Portability. You may request a copy of the Personal Information we retain about you in a readable format that can be used or disclosed by automated means. You may also request that we transfer your Personal Information in such formats to other Data Controllers if it can be done by automatic means. In the event we cannot transfer your data to other Data Controllers due to technical circumstances you may request to obtain a copy of your Personal Information directly.

Please contact us at the following email if you would like to exercise your rights: data-requests@get-carrot.com. PLEASE NOTE: ALL REQUESTS ARE SUBJECT TO VERIFICATION OF YOUR IDENTITY. WE WILL RESPOND TO REQUESTS WITHIN THE TIME PERIOD REQUIRED BY APPLICABLE LAW.

You may file a complaint with the Personal Data Protection Committee.

Please see here for pertinent details regarding updates to our Privacy Notice (including, as applicable, updates to this Addendum). If you have questions about our Privacy Notice, or this Addendum, please contact us at legal@get-carrot.com.

This country Addendum, which supplements and forms part of Carrot’s Privacy Notice, applies to you if you are a resident or citizen of India and describes how we collect, use, disclose, and store your Personal Information in accordance with the Digital Personal Data Protection Act, 2023 (DPDPA).

Please click on the below links, respectively, to find out how and why we collect, use, and disclose your information:

• Privacy Notice | Collection
• Privacy Notice | Use
• Privacy Notice | Disclosure

In order to provide services, Carrot will store and process your Personal information in the United States.

To the extent that the DPDPA considers this an “international data transfer,” we will comply with applicable requirements for transferring Personal Information outside of India.

For more information on how we store, protect, and retain your information, please see here.

In addition to the rights outlined here, you have the following data subject rights:

• The right to Access your Personal Information that is being processed;
• The right to Correct incomplete, inaccurate data; and
• The right to request that we Erase your Personal Information.

Please contact us at the following email if you would like to exercise your rights: data-requests@get-carrot.com. PLEASE NOTE: ALL REQUESTS ARE SUBJECT TO VERIFICATION OF YOUR IDENTITY. WE WILL RESPOND TO REQUESTS WITHIN THE TIME PERIOD REQUIRED BY APPLICABLE LAW.

Please see here for pertinent details regarding updates to our Privacy Notice (including, as applicable, updates to this Addendum). If you have questions about our Privacy Notice, or this Addendum, please contact us at legal@get-carrot.com.

This country Addendum, which supplements and forms part of Carrot’s Privacy Notice, applies to you if you are a resident or citizen of Canada and describes how we collect, use, disclose, and store your Personal Information in accordance with the Personal Information Protection and Electronic Documents Act (“PIPEDA”).

Please click on the below links, respectively, to find out how and why we collect, use, and disclose your information:

• Privacy Notice | Collection
• Privacy Notice | Use
• Privacy Notice | Disclosure

Please note that, If you choose not to provide your Personal Information to us, we may not be able to provide you with access to our Service.

In order to provide services, Carrot will store and process your Personal information in the United States.

To the extent that PIPEDA or applicable Provincial data privacy laws consider this an “international data transfer,” we will comply with applicable requirements for transferring Personal Information outside of Canada.

For more information on how we store, protect, and retain your information, please see here.

In addition to the rights outlined here, you have the following data subject rights:

• The right to correct your Personal Information;
• The right to delete your Personal Information that is no longer needed to provide you with Services;
• The right to obtain a copy of the Personal Information we have processed; and
• The right to confirm which Personal Information we have about you.

Please contact us at the following email if you would like to exercise your rights: data-requests@get-carrot.com. PLEASE NOTE: ALL REQUESTS ARE SUBJECT TO VERIFICATION OF YOUR IDENTITY. WE WILL RESPOND TO REQUESTS WITHIN THE TIME PERIOD REQUIRED BY APPLICABLE LAW.

You may be able to take advantage of the tool developed by the Digital Advertising Alliance of Canada to opt out of third-party advertising. Where available, this tool provides a list of parties that may target advertisements based on your online web-browsing activities and the ability to opt-out of their use of your information for that purpose. Please click the following link to access the tool: AdChoices in Canada - Learn about the blue icon & your choices .

Please see here for pertinent details regarding updates to our Privacy Notice (including, as applicable, updates to this Addendum). If you have questions about our Privacy Notice, or this Addendum, please contact us at legal@get-carrot.com.

Carrot, domiciled in the United States, is the Data Controller, which means we are responsible for and determine how your Personal Information is handled.

This country Addendum, which supplements and forms part of Carrot’s Privacy Notice, applies to you if you are a resident or citizen of Mexico and describes how we collect, use, disclose, and store your Personal Information in accordance with the Federal Law for Personal Data Protection in Possession of Individuals (the "Data Protection Law").

Please click on the below links, respectively, to find out how and why we collect, use, and disclose your information:

• Privacy Notice | Collection
• Privacy Notice | Use
• Privacy Notice | Disclosure

Please note that, If you choose not to provide your Personal Information to us, we may not be able to provide you with access to our Service.

In order to provide services, Carrot will store and process your Personal information in the United States.

To the extent that the Data Protection Law considers this an “international data transfer,” we will comply with applicable requirements for transferring Personal Information outside of Mexico.

For more information on how we store, protect, and retain your information, please see here.

In addition to the rights outlined here, you have the following data subject rights:

• The right to Access your Personal Information that is being processed.
• The right to Rectification of incomplete, inaccurate data.
• The right to Cancellation of Personal Information, which results in a period of blocking after which the data may be deleted.
• The right to Oppose the processing of Personal Information for legitimate reasons.
• You also have the right to limit the use or disclosure of Personal Information, and, if we have obtained your consent to process Personal Information, you may revoke this consent at any time.

Please contact us at the following email if you would like to exercise your rights: data-requests@get-carrot.com. PLEASE NOTE: ALL REQUESTS ARE SUBJECT TO VERIFICATION OF YOUR IDENTITY. WE WILL RESPOND TO REQUESTS WITHIN THE TIME PERIOD REQUIRED BY APPLICABLE LAW.

Please see here for pertinent details regarding updates to our Privacy Notice (including, as applicable, updates to this Addendum). If you have questions about our Privacy Notice, or this Addendum, please contact us at legal@get-carrot.com.

This Country Addendum, which supplements and forms part of Carrot’s Privacy Notice, applies to you if you are a resident or citizen of Australia and describes how we collect, use, disclose, and store your Personal Information in accordance with the Australia Privacy Act of 1988 (“Privacy Act”) and its 13 Australian Privacy Principles (APPs).

In most circumstances, it is impractical for people to communicate with us anonymously. We need to identify you to assist you effectively. However, in circumstances where it is lawful and practicable to do so, we will provide you with the option of not identifying yourself, or using a pseudonym, when entering into communications with us.

We collect Personal Information about you when you voluntarily submit information to us when you use our Service. This can include information you provide to us when you register for an account, send us messages, subscribe to our mailing lists, newsletters or other forms of marketing communications related to the Service, participate in a survey, or use some other feature of our Service.

Please see here for more.

We also collect information about you through automated means, as detailed here.

Where we receive Personal Information about you which we have not requested (whether directly from you or from a third party), we will consider, within a reasonable period, whether we could have collected that Personal Information from you had we requested it.

Where we determine that we could have collected the Personal Information had it been requested, we will use, disclose, and store that Personal Information in the manner set out in our Privacy Notice.

Where we determine that we could not have collected the Personal Information had it been requested, we will destroy or de-identify that Personal Information as soon as practicable, provided it is lawful and reasonable to do so.

For a detailed description of how and why we use and disclose Personal Information (including information classified as “sensitive”), please see:

• Privacy Notice | Use
• Privacy Notice | Disclosure

In order to provide Services, Carrot will store and process your Personal Information in the United States.

To the extent that this is considered an “international data transfer” under the Privacy Act:

• We will take reasonable steps to ensure that data security and appropriate privacy practices are maintained.
• We will only transfer Personal Information outside Australia if (1) you have given us your consent to do so; (2) we reasonably believe that (a) the overseas recipient is subject to a law or binding scheme that is, overall, substantially similar to the Privacy Act and (b) the law or binding scheme can be enforced; or (3) the disclosure is required or authorized by an Australian law or court / tribunal order.

For more information on how we store, protect, and retain your information, please see here.

Where we collect your Personal Information, it will usually be identified by a common identifier such as your name, address or contact details. Subject to certain exceptions under the Privacy Act, we will not disclose identifiers assigned by Government agencies or its agents, such as tax file numbers, or use those identifiers to identify your Personal Information.

In addition to the rights outlined here, you have the following data subject rights:

Access

Subject to any exceptions in the Privacy Act, if you have provided us with Personal Information, you have a right to request access to it. In the event that a request for access is made, we will review our records to determine what Personal Information relating to you we hold and endeavor to respond to your request within a reasonable period after the request is made, but in any event, within 30 days. Once we have notified you of the nature of the Personal Information relating to you which we hold, we will give you access to your Personal Information in the manner requested by you, if it is reasonable and practicable to do so. We do not levy a charge in respect of the making of a request for access to Personal Information held by us. However, we may charge you for the reasonable costs incurred by us in providing you with access to the Personal Information held by us. The Privacy Act provides instances where a holder of Personal Information may refuse to provide an individual with access to their Personal Information. If we refuse to give you access to your Personal Information, we will give you a written notice that sets out our reasons for the refusal and the mechanisms available to complain about our refusal.

Correction

Carrot takes reasonable steps to keep your Personal Information as accurate, complete, and up-to-date as possible. We make an effort to ensure this data is of high quality, but this relies on the accuracy and frequency of data provided by you. You can assist us by notifying us if your circumstances change, such as if your name changes. If we hold Personal Information about you and you request that we correct the information, we will take reasonable steps to rectify the situation free of charge if we are satisfied that the information we currently hold is inaccurate, out-of-date, incomplete, irrelevant, or misleading. If we refuse to correct your Personal Information, we will give you a written notice setting out our reasons for the refusal and the mechanisms available to complain about the refusal.

You may exercise these rights by contacting data-requests@get-carrot.com. PLEASE NOTE: ALL REQUESTS ARE SUBJECT TO VERIFICATION OF YOUR IDENTITY. WE WILL RESPOND TO REQUESTS WITHIN THE TIME PERIOD REQUIRED BY APPLICABLE LAW.

If you wish to make a complaint about a breach of your privacy by Carrot, you may contact us at legal@get-carrot.com. All complaints will be investigated by an appropriately qualified representative of Carrot. We will endeavor to resolve your complaint as quickly as possible and, in any event, within 30 days. We will notify you of the outcome of the investigation, including how we propose to resolve your complaint and what, if any, corrective measures we will implement.

Please see here for pertinent details regarding updates to our Privacy Notice (including, as applicable, updates to this Addendum). If you have questions about our Privacy Notice, or this Addendum, please contact us at legal@get-carrot.com.

This Country Addendum, which supplements and forms part of Carrot’s Privacy Notice, applies to you if you are a resident or citizen of New Zealand and describes how we collect, use, disclose, and store your Personal Information in accordance with the Privacy Act 2020 (“Privacy Act”).

Please click on the below links, respectively, to find out how and why we collect, use, and disclose your information:

• Privacy Notice | Collection
• Privacy Notice | Use
• Privacy Notice | Disclosure

Please note that, If you choose not to provide your Personal Information to us, we may not be able to provide you with access to our Service.

In order to provide services, Carrot will store and process your Personal Information in the United States.

To the extent that the Privacy Act considers this an “international data transfer,” we will comply with applicable requirements for transferring Personal Information outside of New Zealand.

For more information on how we store, protect, and retain your information, please see here.

In addition to the rights outlined here, you have the following data subject rights:

Access

Under the Privacy Act, individuals have the right to access information that an organization holds about them.

Correction

Where a person establishes that the Personal Information we hold about them is not accurate, complete, or up-to-date, or is misleading, we will correct our records as necessary. Depending on the nature and complexity of any such request, we may charge an administration fee for providing access to Personal Information.

You may exercise these rights by contacting us at data-requests@get-carrot.com. PLEASE NOTE: ALL REQUESTS ARE SUBJECT TO VERIFICATION OF YOUR IDENTITY. WE WILL RESPOND TO REQUESTS WITHIN THE TIME PERIOD REQUIRED BY APPLICABLE LAW.

Breach Notification

If we become aware of a data breach that we consider constitutes a notifiable privacy breach under the Privacy Act, we will notify the Office of the Privacy Commissioner and any affected individuals.

Complaints

If you wish to make a complaint about a breach of your privacy by Carrot, you may contact us at legal@get-carrot.com. All complaints will be investigated by an appropriately qualified representative of Carrot. We will endeavor to resolve your complaint as quickly as possible and, in any event, within 30 days. We will notify you of the outcome of the investigation, including how we propose to resolve your complaint and what, if any, corrective measures we will implement.

Please see here for pertinent details regarding updates to our Privacy Notice (including, as applicable, updates to this Addendum). If you have questions about our Privacy Notice, or this Addendum, please contact us at legal@get-carrot.com.