Privacy Policy For Sites and Services Provided by ARC Document Solutions, Inc.

ARC Document Solutions, Inc. (“ARC”) collects information through the use of applications, platforms, and web sites created and operated by ARC and its subsidiaries and other related companies (“ARC Sites”). This Privacy Policy describes ARC’s collection of information from end users of an ARC Site. This privacy policy does not govern any collection or disclosure of information by third parties, including those that may offer products and/or services on or through ARC Sites. If you believe an ARC Site uses ARC software or services but does not have a privacy policy, contact us at privacy@e-arc.com.

What information does ARC collect?

ARC collects information through use of ARC Sites, including:

• Device Information – We may collect information about devices running ARC Sites, including platform, a unique ARC-generated ID, OS version, IP address, carrier information, and a country code.
• Application Usage Information – We collect information about how ARC Sites are used, such as the frequency and duration of usage.
• Website Information – We may collect information provided on the ARC Sites such as contact information or feedback. Additionally, we may use cookies and web beacons to monitor traffic patterns and collect information about previous visits to the sites.
• Personally Identifiable Information – We may collect personally identifiable information shared with ARC Sites. Personally identifiable information collected may include information like name, email address, location, gender, interests, device, app usage, user ID, and contact information.

Does ARC collect real time location information?

ARC may collect device location information if location services are enabled for any ARC Sites on the device. We could use location information to provide users of the ARC Sites with information relevant to them based on their location.

How does ARC use information collected from you?

• ARC Internal Use – We use information we collect to help us provide and optimize the services offered on the ARC Sites, and to monitor and improve the ARC Sites and our services.
• Third Parties – We will share information we collect with third parties only in ways described in this privacy policy.
• Specifically, we may disclose information we collect:
  1. to third parties as required by law, such as to comply with a subpoena or similar legal process.
  2. to third parties as we deem necessary, based on our good faith belief.
  3. to protect our rights, user safety, or the safety of others.
  4. to investigate fraud.
  5. to respond to a government request.
  6. to trusted services providers who work on our behalf, who do not have an independent use of the information we disclose to them, and who have agreed to adhere to the rules set forth in the privacy statement; and iv. to our affiliated companies, and to third parties in conjunction with a merger, acquisition or sale of ARC.
  7. If ARC is involved in a merger, acquisition, or sale of all or a portion of its assets, affected users will be notified via email and/or a prominent notice on the ARC Sites of any change in ownership or uses of this information, as well as any choices users may have regarding this information.

Automatic data collection

We automatically collect information about how ARC Sites are used, such as the frequency and duration of usage. This includes details about mobile devices, such as a unique ARC-generated ID for the mobile device. We share anonymous information about use of their respective ARC Sites with third parties, including the way ARC Sites are used, which facilitates improvements to the ARC Sites.

OPT-Out

You may opt out of the collection of location information by turning off location services for ARC Sites on your device. You may opt out of the collection of personally identifiable information by not providing that information to ARC Sites. If you have any questions or need assistance, feel free to email privacy@e-arc.com.

Data retention policy, managing your information

ARC will retain information collected throughout the life of each user's use of ARC Sites except where prohibited by law. If you would like us to delete User Information and Automatically Collected information associated with your record, please contact us at privacy@e-arc.com. We will keep anonymous information and may need to retain some identifying information to ensure that your request continues to be honored. Your information will be deleted from our active database but may remain in our archives. If we are required to maintain certain information about you, we will comply with your deletion request after fulfilling any legal requirements.

Children

The ARC Sites are not designed for use by children, and ARC does not knowingly market to or collect or solicit data from or market to children under the age of 13. If a parent or guardian becomes aware that his or her child has provided us with information without their consent, he or she should contact us at privacy@e-arc.com. We will delete such information from our files within a reasonable period of time.

Security

We are concerned about safeguarding the confidentiality of user information. We provide physical, electronic, and procedural safeguards to protect information we process and maintain. For example, we limit access to this information to authorized employees who need to know that information in order to operate, develop or improve our Services.

International transfer

We may, in the process of providing services to you, transfer information that we collect about you or your end users, including personal information, to affiliated entities, or to other third parties across border and from your country or jurisdiction to other countries or jurisdictions around the world. If you or your end users are located in the European Union or other regions with laws governing data collection and use that may differ from U.S. law, please note that you are transferring information and permitting the transfer of information, including personal information, to a country and jurisdiction that does not have the same data protection laws as your jurisdiction, and you consent to the transfer of information to the U.S. and the use and disclosure of information about you and your end users, including personal information, as described in this privacy policy.

Changes

This Privacy Policy may be updated from time to time for any reason. We will notify you of any changes to our Privacy Policy by posting the new Privacy Policy here: https://www.riotcolor.com/privacy/ You are advised to consult this Privacy Policy regularly for any changes.

Your Consent

By using an ARC Site, you are consenting to our collection and processing of information as set forth in this Privacy Policy now and as amended by us. “Processing” means using cookies on a computer/hand held device or using or touching information in any way, including, but not limited to, collecting, storing, deleting, using, combining and disclosing information, all of which activities will take place in the United States. If you reside outside the U.S. your information will be transferred to the U.S., and processed and stored there under U.S. privacy standards.

By using the ARC Sites and providing information to us, you consent to such transfer to, and processing in, the U.S.

For questions about this Privacy Policy, please contact:

Attn: Legal Department ARC Document Solutions 12657 Alcosta Blvd, Suite 200 San Ramon, CA 94583 privacy@e-arc.com

Additional California Privacy Disclosures

Effective as of January 1, 2020 If you are a California resident, the processing of certain personal data about you may be subject to the California Consumer Privacy Act (“CCPA”) and other applicable California state privacy laws. Beginning January 1, 2020, the CCPA gives you certain rights with respect to the processing of your personal data (known as “personal information”, as described in under the CCPA). This supplement provides additional privacy disclosures and informs you of your additional rights as a California resident, and should be read in conjunction with our Privacy Policy.

Personal Information Collected and Processed

Our Privacy Policy sets forth the categories of personal information that ARC collects and processes about you, a description of each category, and the sources from which we obtain each category.

Requests to Exercise Your Rights

RIGHT TO KNOW REQUEST - Under the CCPA, you have a right to request information about our collection, use, and disclosure of your personal information over the prior 12 months, and ask that we provide you with the following information:

• 1. Categories of and specific pieces of personal information we have collected about you.
  2. Categories of sources from which we collect personal information.
  3. Purposes for collecting, using, or selling personal information.
  4. Categories of third parties with which we share personal information.
  5. Categories of personal information disclosed about you for a business purpose.
  6. If applicable, categories of personal information sold about you and the categories of third parties to which the personal information was sold, by category or categories of personal information for each third party to which the personal information was sold.

To make a verifiable request for information about the personal information we have collected about you, please email us at privacy@e-arc.com. RIGHT TO DELETE REQUEST - You also have a right to request that we delete personal information, subject to certain exceptions. You may exercise your right to delete by emailing us at privacy@e-arc.com. HOUSEHOLD REQUESTS - We currently do not collect household data. If all the members of a household makes a Right to Know or Right to Delete request, we will respond as if the requests are individual requests. REQUESTS, GENERALLY - You may make a verifiable consumer request related to your personal information twice per 12-month period. We will not discriminate against you for exercising any of your rights under the CCPA. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. REQUESTS MADE THROUGH AGENTS - You may designate, in writing or through a power of attorney, an authorized agent to make requests on your behalf to exercise your rights. Before accepting such a request from an agent, we will require the agent to provide proof you have authorized it to act on your behalf, and we may need you to verify your identity directly with us.

Contact Us

You may contact us by emailing us at privacy@e-arc.com.