GDPR Privacy Notice

Last updated: October 1, 2026

This GDPR Privacy Notice (“GDPR Notice”) applies if you are located in the European Economic Area (“EEA”) or the United Kingdom (“UK”). It supplements Argyle’s Privacy Notice and describes your additional rights under the EU General Data Protection Regulation (Regulation (EU) 2016/679) (“EU GDPR”) and the EU GDPR as it forms part of the law of England and Wales, Scotland, and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 (“UK GDPR,” and together with the EU GDPR, the “GDPR”).

This GDPR Notice applies to your personal data (as the GDPR defines it) within Your Records, your Direction Records, your Credentials, and Your Data. Capitalized terms not defined here have the meanings given in the Privacy Notice or the Consumer Terms.

Argyle Systems Inc. is the controller of your personal data for the purposes of the GDPR.

1. Lawful Bases for Processing.

We process your personal data only where we have a lawful basis for doing so. The bases we rely on are as follows.

1.1 Your consent. In some cases we process personal data on the basis of consent you expressly give us. Where we do, we say so at the point and time of collection. You can withdraw your consent at any time by emailing privacy@argyle.com with “GDPR Request” in the subject line. Withdrawing consent does not affect processing we carried out before you withdrew it.

1.2 Performance of a contract. We process personal data where doing so is necessary to provide the Services under the Consumer Terms. Where processing is necessary for that purpose, not providing the personal data means we cannot provide some or all of the Services that depend on it.

1.3 Our legitimate interests. We process personal data where doing so furthers our legitimate interests or those of a third party, and those interests are not overridden by your interests or fundamental rights and freedoms. Those interests are: information security; operating, maintaining, and improving the Services; audience measurement and analytics; direct marketing, where we are not required to obtain consent; general business development and management; and the protection and enforcement of legal rights. Before relying on this basis we assess whether our interest is outweighed by the effect on you, and you can ask us about that assessment.

1.4 Compliance with a legal obligation. We may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements, and to other third parties where compelled by law or regulation — including in response to court orders and subpoenas.

2. Your Rights.

You have the rights below. To exercise any of them, email privacy@argyle.com with “GDPR Request” in the subject line. You do not have to pay a charge. These rights are subject to the exemptions and restrictions applicable law provides, and they are not absolute; where we cannot fully comply with a request, we tell you and explain why. We may need additional information from you, which may itself be personal data, to verify your identity and understand what you are asking for.

2.1 Access. You can ask what personal data we hold about you and ask for a copy of it.

2.2 Rectification. If personal data we hold about you is inaccurate or incomplete, you can ask us to correct or complete it.

2.3 Erasure. You can ask us to erase some or all of your personal data.

2.4 Restriction of processing. You can ask us to restrict how we process your personal data.

2.5 Objection. You can object to our processing of your personal data in certain circumstances, including where we rely on our legitimate interests. Where you do, we stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless we need the personal data to establish, exercise, or defend legal claims.

2.6 Portability. You can ask for a copy of your personal data in a structured, commonly used, machine-readable format, and ask us to transmit it to another controller where that is technically feasible.

2.7 Withdrawal of consent. Where we process personal data on the basis of your consent, you can withdraw it at any time.

2.8 Direct marketing. You can object at any time to processing of your personal data for direct marketing purposes, by selecting “Unsubscribe” in any marketing email or by emailing privacy@argyle.com with “GDPR Request” in the subject line. We then stop using your personal data for that purpose.

3. Automated Decision-Making and Profiling.

We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. The Platform is designed to deliver Your Records as they appear at the Data Location: it does not select which records are delivered, evaluate them, or make any determination about you. Decisions about a product, service, or benefit you are seeking are made by the Partner you deliver records to, under that Partner’s own obligations to you. We do not profile you for marketing purposes.

4. How Long We Keep Personal Data.

We keep personal data for no longer than necessary to fulfill the purposes described in the Privacy Notice, unless a longer retention period is required by law. Sections 1.8 and 2.5 of the Privacy Notice describe how we decide how long that is, and how personal data goes away. Section 1.8 also explains how long we keep your Direction Records and why, and Section 1.1(b) explains how long we keep your Credentials.

5. International Transfers.

We are based in the United States, so when you provide personal data to us you transfer it to the United States. We may also transfer it to other countries where our service providers operate. The United States and other recipient countries may not provide the same protections as the data protection laws where you are located.

Where we transfer personal data out of the EEA or the UK, we rely on an adequacy decision of the European Commission or the UK Secretary of State where one covers the transfer, and otherwise on the standard contractual clauses approved by the European Commission or, for the UK, the International Data Transfer Agreement or Addendum. Before we rely on those clauses we assess the law and practice of the destination country and put in place any supplementary measures that assessment shows are needed. To ask about how we transfer personal data internationally, email privacy@argyle.com.

6. How to Complain.

If you have concerns about how we use your personal data, tell us first at privacy@argyle.com with “GDPR Request” in the subject line, and we will try to resolve them.

You also have the right to lodge a complaint with a supervisory authority — in the EEA, the authority of the member state where you live or work or where you believe an infringement occurred, and in the UK, the Information Commissioner’s Office at ico.org.uk/make-a-complaint. A list of EEA supervisory authorities is available from the European Data Protection Board at edpb.europa.eu.

7. Our Representatives in the EU and UK.

We have appointed VeraSafe Ireland Ltd., Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork T23 AT2P, Ireland, as our EU representative under Article 27 of the EU GDPR, and VeraSafe United Kingdom Ltd., 37 Albert Embankment, London SE1 7TL, United Kingdom, as our UK representative under Article 27 of the UK GDPR. You can contact them at verasafe.com/public-resources/contact-data-protection-representative.

8. How to Contact Us.

If you have questions about this GDPR Notice or our privacy practices, contact us at privacy@argyle.com.