Privacy Policy

1Overview.

CMS Nexus LLC ("CMS Nexus," "we," "us," and "our") respects your privacy and is committed to protecting it through compliance with this Privacy Policy ("Privacy Policy"). This Privacy Policy describes how we collect and use your Personal Information when you visit our website at https://www.cmsnexus.com, you communicate with us, or we otherwise process your Personal Information (collectively, the "Platform"), except as specified below with respect to our role as a processor.

This Privacy Policy does not apply to data subjects of our customers whose Personal Information we may receive pursuant to CMS Nexus services we provide to our customers. Our customers use our platform to store and process their own customers' Personal Information, such as to: (i) create their own websites and applications; (ii) offer or provide their own products and services; (iii) send electronic communications; and (iv) otherwise collect, use, share or process Personal Information. In these cases, we act as a processor and service provider when providing these services to our customers (the "Processor Services"). When you give your data to one of our customers or when we collect your Personal Information on their behalf in connection with our Processor Services, our customer's privacy notice, rather than this Privacy Policy, will apply to our processing of your Personal Information.

Please read this Privacy Policy to understand our policies and practices regarding your Personal Information and how we will handle it. If you do not agree with our policies and practices, do not use the Platform. By accessing or using the Platform, you agree and consent to this Privacy Policy.

2Information That CMS Nexus Collects About You.

We collect information about you ("Personal Information") in the following ways:

Directly from you when you provide it to us. When you subscribe to a newsletter, create an account, make a purchase or request information from CMS Nexus, we will ask for things like your name, contact (including email address and phone number), billing, shipping and communication information, and account ID or credentials in order to fulfill your request. If you set up an appointment with us through the Platform, attend a trade show or event, or otherwise contact us, you may also provide similar information. If you submit any Personal Information about other people to us or to our service providers, you are responsible for making sure that you have the authority to do so and to allow us to use their Personal Information in accordance with this Privacy Policy (for example, by you obtaining their consent).

From third parties. We obtain information through marketing partners (such as advertising and marketing companies, marketing affiliates, and social media platforms), vendors (such as data set and information vendors), and suppliers and other third parties (such as hosts or vendors at events or trade shows, public database providers, or research partners). This information can include, for example, your name, contact information, professional information, and content that is publicly available. We might also obtain information through a partner, or co-create datasets with a partner, as part of our business operations.

Automatically when you use our Platform. We collect information about how you interact with the Platform including information about your device (such as IP address and other technical information about your device), the actions you take on our Platform, and through the use of cookies, pixel tags, and similar technologies (collectively, "cookies"). Please view our separate Cookies Policy for more information on our use of cookies.

3How CMS Nexus Uses Information It Collects About You.

We use Personal Information that we collect about you or that you provide to us for the following purposes:

For Functionality and Development of the Platform. We use information to provide, offer, personalize, and improve the Platform. Some information, like your IP address, is used to communicate with your device to provide network connectivity, measure usage levels of the Platform, diagnose server problems and provide security features. Other business purposes that depend on use of your information include data analysis related to testing, modifying, improving or developing new products, services and technologies, and to identify trends. We also use information from the Platform to generate updates and reports, and to check that the Platform is working properly. Update functions may automatically check your system to see whether files need to be refreshed, updated, or modernized, in order to provide you with the up-to-date security, versions, features, options and controls associated with your systems or devices. We use cookies to make our websites and the Platform operate, work more efficiently, and provide analytic information, as explained further in our Cookies Policy.

To Provide AI Features. Some Platform features may leverage artificial intelligence ("AI") tools to enhance performance capabilities. Our use of AI is designed to provide direct services to you. We do not use your Personal Information to train generalized, public AI models. We work with specialized AI subprocessors and our instructions limit their use of your data to the provision of the specific service you are using.

For Customer Support. We use your Personal Information to provide you with customer support for the Platform.

For Business Operations. We use information to operate our business; for example, to perform accounting, auditing, billing, reconciliation, and collection activities, or comply with contractual obligations.

To Communicate. We use contact information to send messages; to communicate with you about the Platform and your account; to provide the Platform; to respond to customer service requests; to provide alerts such as security updates or changes in our policies or about subscriptions that are ending; and to send marketing or informational materials like newsletters or white papers, in accordance with your communication preferences. We occasionally conduct surveys or do focused research or studies through which you may choose to share information.

To Protect and Secure the Platform. We may use information to keep our Platform safe, such as crime or fraud monitoring and prevention or cybersecurity efforts.

For Advertising and Marketing. We may use Personal Information about you, including what advertisements you viewed and other information we collect, to enable us to provide personalized content, verify eligibility for and extend promotional offers, engage in targeted advertising, and study the effectiveness of advertising and marketing campaigns. This includes using data we collect from marketing partners through our affiliate referral program to support our targeted advertising.

For Statistical Purposes to Improve the Platform. We may compile Platform statistics into traffic reports, which help CMS Nexus understand, anticipate, and respond to user needs. This information helps us create a better overall experience for Platform users.

For Legal, Regulatory, and Compliance Purposes. We may use Personal Information to comply with legal, regulatory, or related obligations, including to protect our legal rights.

Legal Basis for Our Use. Certain data protection laws (such as those in the EEA, the UK, and Brazil) require us to identify a valid legal reason ("legal basis") before we collect, use, share or otherwise process your Personal Information. We will collect Personal Information from you only where we have your consent to do so, where we need the Personal Information to perform a contract with you, where we have a legal obligation to do so, or where the processing is in our legitimate interests (such as processing for administrative purposes, direct marketing, product development or improvement, preventing fraud or criminal acts and in support of information security) and not overridden by your data protection interests or fundamental rights and freedoms.

CMS Nexus is the Data Controller of all Personal Information collected through the Platform in the EEA and the United Kingdom, except with respect to the Processor Services (where CMS Nexus is the Data Processor) or where a supplemental Privacy Policy says otherwise. If you have questions about the legal basis on which we collect and use your Personal Information, please contact us using the "How To Contact Us" section below.

4How CMS Nexus Protects Your Information.

We design our Platform to provide reasonable and appropriate administrative, technical and organizational security measures to protect your Personal Information against risks such as temporary or permanent loss, destruction, and unauthorized or unlawful access, alteration, use or disclosure. We require our suppliers and vendors to apply similar protections when they access or use Personal Information that we share with them. Users of the Platform must also do their part in protecting the data, systems, networks, and service they are utilizing.

No technology, data transmission or system can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that your password to any CMS Nexus account has been compromised), please immediately notify us by contacting us using the instructions in the "How To Contact Us" section below.

5When CMS Nexus Shares Your Information.

We may disclose Personal Information with the following categories of third parties:

With Affiliates and Subsidiaries. We may share information with our corporate affiliates and subsidiaries for purposes limited to and consistent with this Privacy Policy.

With Service Providers. We may share information with our authorized vendors and suppliers to provide services we have contracted for, such as product delivery, website hosting, data analysis, IT services, auditing, or customer service. We also share anonymized or aggregated information with suppliers for purposes such as analysis, identifying trends in the areas of our products and to help research and develop new CMS Nexus services. Our contracts with suppliers and vendors include provisions to protect your Personal Information and limit its use.

With Partners. We work with third parties for purposes such as marketing and similar promotions, to enable joint products or identify opportunities for product integration, or to facilitate services on the Platform. For example, we use an affiliate referral system in which third parties promote CMS Nexus services; if you visit or use our Platform through an affiliate referral link, we will share information about you back to the referral partner, including your name, email address, and account plan.

For Advertising and Marketing. We share your information with our third-party company partners to prepare and deliver advertising and marketing content, to provide content services and to enable them to provide you with more personalized ads and to study the effectiveness of our campaigns. Content may be based on information obtained through prior purchases or transactions, through your device's physical location, through information about what advertisements and content you have viewed, or through cookies (as described in our Cookies Policy).

For Connections to Social Networks and Third-Party Services. If you connect third-party services to the Platform, you are agreeing to provide information about you to those third-party services under their respective terms and privacy policies. For example, if you choose to connect your YouTube account to the CMS Nexus Services, this connection uses YouTube's API services and the Google Privacy Policy will apply to you.

Sales, Mergers & Acquisitions. We may disclose Personal Information as part of a contemplated or actual corporate transaction such as a reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings).

For Legal, Regulatory, or Related Purposes. We may disclose your information to the extent required by law or if we have a good-faith belief that such disclosure is necessary in order to comply with official investigations or legal proceedings initiated by governmental and/or law enforcement officials, or private parties, including but not limited to: in response to subpoenas, search warrants, or court orders.

At Your Direction or With Your Consent. CMS Nexus may disclose your Personal Information to any other person or entity where you consent to the disclosure or otherwise direct us to disclose the information.

We do not share your phone number, text messaging originator opt-in data, or consent with any third parties, excluding aggregators and providers of the text messaging services.

6Data Retention.

We will only retain your Personal Information for as long as reasonably necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements and for other purposes described in this Privacy Policy. We may retain your Personal Information for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

To determine the appropriate retention period for Personal Information, we consider the amount, nature and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of your Personal Information, the purposes for which we process your Personal Information and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements. In some circumstances you can ask us to delete your data: see "Your Legal Rights" below for further information. And in some circumstances we will anonymize your Personal Information (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

7Information From Children.

We do not knowingly collect, use, disclose, sell, or share Personal Information from children under 16. If we learn that we have collected the Personal Information of a child under 16 we will take steps to delete the information as soon as possible. If you are under 16, do not provide any information about yourself to CMS Nexus, including your name, address, telephone number or email address. If you become aware that Personal Information of a child under 16 years of age has been provided, please let us know using one of the methods provided under the "How To Contact Us" section below.

8Links to Other Websites and Services.

We are not responsible for the practices employed by websites or services linked to or from the Platform, including the information or content contained therein. This Privacy Policy does not address, and we are not responsible for, the policies and practices of third parties or other organizations that are not operating on CMS Nexus's behalf, including policies and practices related to privacy and security, data collection, processing, use, storage, and disclosure. This includes: (a) any third party operating any site or service to which the Platform links — the inclusion of a link on the Platform does not imply endorsement of the linked site or service by us or by our affiliates; or (b) any app developer, app provider, social media platform provider, operating system provider, wireless service provider or device manufacturer (such as Facebook, Apple, Google, Microsoft, LinkedIn, etc.) — including any Personal Information you disclose to other organizations through or in connection with the Platform or other CMS Nexus Services.

9Do Not Track.

Some browsers incorporate a "Do Not Track" ("DNT") feature that, when turned on, signals to websites and online services that you do not want to be tracked. At this time, the Platform does not respond to DNT signals.

10Your Legal Rights.

CMS Nexus respects your rights related to your Personal Information. Depending on where you live, you may have rights to request access to, corrections of, or deletion of your personal data, and to make additional choices such as the kinds of marketing materials you receive (or choose not to receive marketing from CMS Nexus at all). See the sections below for more information depending on your location. If your jurisdiction does not appear on the list below, you may still have privacy rights — you can contact us using the "How To Contact Us" section below to learn more.

11European Privacy Rights.

If you are in Europe, you may have the following rights under the GDPR, the UK GDPR, or Swiss nFADP:

Rights to Access, Portability, Correction, or Deletion. If you would like to correct or update your Personal Information, or to request access to or deletion of your Personal Information, you may contact us using the "How To Contact Us" section below. Please note that we may still need to retain certain information for recordkeeping purposes, and/or to complete any transactions that you began prior to requesting such change or deletion. Some of your information may also remain within our systems and other records where necessary for compliance with applicable law. At your request and where the law requires us to do so, we will confirm what Personal Information we hold about you and provide a copy. We may charge a processing fee for this service where permitted by law, and we will require evidence of your identity before fulfilling your request.

Right to Object. You can object to processing of your Personal Information or ask us to restrict processing of your Personal Information by making a written request using the "How To Contact Us" section below.

Right to Withdraw Consent. If we have collected your Personal Information with your consent, you can withdraw your consent at any time. Withdrawing your consent will not affect (1) the lawfulness of any processing we conducted prior to your withdrawal, or (2) processing your Personal Information under other legal bases.

Right to Complain. If you believe we are using your Personal Information inconsistently with this Privacy Policy, you can contact your local data protection supervisory authority. The UK supervisory authority is the Information Commissioner's Office (ICO) at www.ico.org.uk. Additionally, under the EU-U.S. DPF and related frameworks, you may contact JAMS Mediation, Arbitration, and ADR Services (https://www.jamsadr.com/eu-us-data-privacy-framework) to address complaints free of charge. We will respond to any complaint directly to us within 45 days.

Advertising and Marketing Choices. To exercise your choices regarding our use and disclosure of your Personal Information for advertising and marketing purposes, you may update your communication preferences using the "How To Contact Us" section below. Please note that if you choose not to receive marketing communications from us, we may still send you communications related to your account or the Platform, such as security updates or service changes.

12U.S. Privacy Rights.

Residents of certain US states, such as California, Colorado, Connecticut, Delaware, Iowa, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, Virginia, and other states to the extent they enact similar privacy laws, may have additional rights under applicable state laws ("US State Privacy Laws"). This section provides further information pursuant to those laws.

Right to Opt Out of Sale/Share/Targeted Advertising. CMS Nexus does not sell your Personal Information for money. However, certain US State Privacy Laws may consider the disclosure of information for advertising purposes to be a "sale," "share," or "targeted advertising." If you wish to opt out of CMS Nexus using your Personal Information for these purposes, you may do so via the "Do Not Sell or Share My Information" option on our website or via the "How To Contact Us" section below.

Rights to Access, Correction, and Deletion. You can request access to, correction of, or deletion of your Personal Information using the "How To Contact Us" section. Please note that CMS Nexus may still need to retain certain information for recordkeeping purposes, to complete transactions begun prior to your request, to comply with applicable law, or for other purposes permitted by law. We may require additional information to verify your identity before processing your request.

Right to Non-Discrimination. We will not discriminate against you for exercising any of your US State Privacy Law rights.

Right to Appeal. If we have not responded to your request or you are unsatisfied with our response, you have the right to appeal by contacting us using the "How To Contact Us" section.

Authorized Agent. You can designate an authorized agent to make a privacy request on your behalf in certain circumstances. CMS Nexus may ask the agent and you for additional information to verify their authorization.

Automated Profiling. We do not profile in furtherance of solely automated decisions that produce legal or similarly significant effects concerning you.

Categories of Personal Information Collected. In the past 12 months, we have collected the following categories of Personal Information: Identifiers (such as name, address, IP address, email, etc.); Personal information listed in the California Consumer Records Statute (Civil Code Section 1798.80(e)), such as name and phone number; Commercial information (such as products or services purchased, obtained, or considered); Internet or other similar network activity (such as information on a consumer's interaction with a website, application, or advertisement); and Inferences (such as analytics and preferences). All the above categories exclude text messaging originator opt-in data and consent, which will not be shared with any third parties, excluding aggregators and providers of the text messaging services.

13Australian Privacy Rights.

This section is addressed to Australian residents only and provides more information about your rights under the Australian Privacy Act.

Data Subject Rights. You can request correction of your Personal Information by using the "How To Contact Us" section. You may also have a legal right to obtain a copy of your Personal Information by making a written request using the "How To Contact Us" section below. We will respond by no later than 30 days of your request. We may charge a processing fee for this service where permitted by law. CMS Nexus will provide reasons to you if we are unable to provide access or only provide limited access to your Personal Information.

Complaints. If you have any complaints regarding our handling of your Personal Information or our compliance with the Privacy Act, please contact us using the "How To Contact Us" section. If you are dissatisfied with our response, you may raise a complaint with the Office of the Australian Information Commissioner at: https://www.oaic.gov.au/about-us/contact-us.

14Canadian Privacy Rights.

This section is addressed to Canadian residents only and provides more information about your rights under the Personal Information Protection and Electronic Documents Act 2000 (PIPEDA).

Data Subject Rights. You can request correction of your Personal Information, and you may also have a legal right to access and obtain a copy of your Personal Information, by making a written request using the "How To Contact Us" section below. We will respond by no later than 30 days of your request. CMS Nexus will ask you to provide certain information to verify your identity. We may charge a processing fee where permitted by law. If CMS Nexus denies your request, we will explain why.

Withdrawal of Consent. If we have collected your Personal Information with your consent, you can withdraw your consent at any time. Withdrawing your consent will not affect (1) the lawfulness of any processing we conducted prior to your withdrawal, or (2) processing your Personal Information under other legal bases.

Residents of Quebec Province may have additional rights; please refer to the European Privacy Rights section above for a description of rights that may be applicable, and contact us if you have any questions.

15International Data Transfers.

CMS Nexus is a global company with its headquarters in the United States. As such, we may transfer your Personal Information between the United States and our affiliates and business partners in other countries. We may also transfer your Personal Information to our affiliates or third-party service providers, who may be located in a different country to you (including India).

CMS Nexus transfers information internationally in order to operate efficiently, to improve performance, and to create redundancies to protect information in the event of an outage or other problem. In so doing, we will process your Personal Information in a way that meets the commitments of this Privacy Policy and complies with the law wherever we transfer it.

Whenever CMS Nexus transfers Personal Information beyond the country of origin, we will do so in accordance with applicable laws. For Personal Information originating in the EEA, the UK, or Switzerland that is transferred outside those regions, CMS Nexus participates in the EU-U.S. Data Privacy Framework (EU-U.S. DPF) and, as applicable, the UK extension to the EU-U.S. DPF, and/or the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF). The Federal Trade Commission has jurisdiction over CMS Nexus's compliance with these frameworks. CMS Nexus may be required to disclose Personal Information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements. CMS Nexus is liable in cases of onward transfers to third parties.

16Data Privacy Framework.

CMS Nexus LLC complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. CMS Nexus has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. DPF Principles with regard to the processing of personal data received from the European Union and from the United Kingdom (and Gibraltar), and to the Swiss-U.S. DPF Principles with regard to the processing of personal data received from Switzerland.

If there is any conflict between the terms in this Privacy Policy and the DPF Principles, the Principles shall govern. To learn more about the Data Privacy Framework program and to view our certification, please visit https://www.dataprivacyframework.gov/. CMS Nexus further agrees to notify you without undue delay if its self-certification under any of the Data Privacy Frameworks is withdrawn, terminated, revoked or otherwise invalidated, and to take appropriate steps to stop and remediate any unauthorized processing of such personal data.

17Privacy Policy Updates.

CMS Nexus may change this Privacy Policy at any time, at its discretion. We will notify you of changes if required by law. Your continued use of the Platform after we make changes is deemed to be acceptance of and consent to those changes, so please check the Privacy Policy periodically for updates.

18How To Contact Us.

To ask questions about this Privacy Policy and our privacy practices, contact us at contact@cmsnexus.com or by mail at:

CMS Nexus LLC
ATTN: Legal Department
13010 Murris Road Building 1 Suite 600