We at PandaTree know you care about how your personal information is used and shared, and we take your privacy seriously. Please read the following to learn more about our Privacy Policy. By using or accessing the Services in any manner, you acknowledge that you accept the practices and policies outlined in this Privacy Policy, and you hereby consent that we will collect, use, and share your information in the following ways.

Remember that your use of PandaTree's Services is at all times subject to the Terms of Use which incorporates this Privacy Policy. Any terms we use in this Policy without defining them have the definitions given to them in the Terms of Use https://www.pandatree.com/terms_conditions.

For the purposes of this Privacy Policy, "you" means a parent or guardian of a child who accesses or uses the Services, referred to in this Privacy Policy as a "student". This Privacy Policy sets forth PandaTree's policy and practices with respect to information collected from visitors to and users of the Services when accessing or using our Services, including personally identifiable data about you or your child who is a student ("Personal Data"). This Privacy Policy does not cover the practices of companies we don't own or control, or people that we don't manage. We gather various types of Personal Data from our users, as explained in more detail below, and we use this Personal Data internally in connection with our Services, including to personalize, provide, and improve our services, to contact you, to fulfill your requests for certain products and services, and to analyze how you use the Services. In certain cases, we may also share some Personal Information with third parties, but only as described below.

The Services and our business may change from time to time. As a result, at times it may be necessary for PandaTree to make changes to this Privacy Policy. PandaTree reserves the right to update or modify this Privacy Policy at any time and from time to time. We will alert you to changes by placing a notice on https://www.pandatree.com/notifications, by sending you an email, and/or by some other means. If you use the Services after any changes to the Privacy Policy have been posted, that means you agree to all of the changes. If we make changes to the Privacy Policy related to types of Personal Data we collect from students under 13 (or 16 if you are located in the EU), or how we use and share Personal Data collected from these students, we will send you a notice of such changes and obtain your consent before implementing those changes in a manner that affects information collected from your child.

When users interact with us through the Services, we may collect Personal Data and other information from such user, as further described below:

Information Collected Directly From Parents, Guardians, Teachers and School Administrators: We collect Personal Data from parents, guardians, teachers and school administrators about parents, guardians, teachers, school administrators or students when a parent, guardian, teacher or school administrators voluntarily provides such information to us, such as when a parent, guardian, school administrator or teacher contacts us with inquiries, responds to one of our surveys, uses certain Services or submits information through a web form to create an account and register for access to the Services for itself and the student. We collect Personal Data from parents, guardians, teachers and school administrators, including but not limited to:

1. First and Last Name
2. Phone Number
3. Email Address
4. Zip code
5. School (if applicable)
6. Grade Taught (if applicable)
7. Subjects Taught (if applicable)
8. Information about students:
   • Student First name
   • Student Age
   • Student's Interests
   • School
9. Payment Information (including credit card and zip code)Notes about a student's progress

Information Collected Directly From Students: Through our Session Recordings (as defined in our Terms of Service), we may collect certain Personal Data directly from students participating in the Services, including children who are under the age of 13 (or 16 if you are located in the EU). "Children's Personal Data" means personal information that we and our service providers collect from children under the age of 13 (or 16 if you are located in the EU) who participate in foreign language tutoring and related activities through the Services.

This Privacy Policy explains our policies and practices with respect to Children's Personal Data collected from children under the age of 13 (or 16 if you are located in the EU).The Children's Online Privacy Protection Act ("COPPA") requires that online service providers obtain parental consent before they knowingly collect personally identifiable information online from children who are under 13.

We do not knowingly collect or solicit Children's Personal Data without obtaining verifiable consent from that child's parent or guardian ("Parental Consent"), except for the limited amount of Personal Data we need to collect in order to obtain Parental Consent ("Required Information"). When you register a student for the Services, you will be asked to provide Parental Consent before the student's first lesson. Until we have received Parental Consent, we will only use Required Information for the purpose of obtaining Parental Consent. If you are a child under 13 (or 16 if you are located in the EU), please do not attempt to send any personal

information about yourself to us before we obtain Parental Consent, except for the Required Information in the context of the Parental Consent process. If you believe that a child under 13 (or 16 if you are located in the EU) has provided us with personal information (beyond the Required Information) without our obtaining Parental Consent, please contact us at customercare@pandatree.com. We do not condition participation in our Services on disclosure of more Children's Personal Data than is reasonably necessary for that participation, and we do not retain Children's Personal Data longer than is reasonably necessary in order to fulfill the purpose for which it was disclosed.

We require Parental Consent via one of the following methods:

1. Online video at the start of student's first lesson.
2. Over the phone prior to student's first lesson.
3. Credit card purchase prior to student's first lesson.

By voluntarily providing us with Personal Data and consenting to a student's use of the Services and our collection of Personal Data from the student, you are consenting to our use of your Personal Data and the student's Personal Data in accordance with this Privacy Policy. You acknowledge and agree that if you are providing Personal Data about a student using the Services, you have all rights necessary to do so. If you provide (or permit a student to provide) Personal Data to the Services, you acknowledge and agree that such Personal Data may be transferred from your current location to the offices and servers of PandaTree and the authorized third parties referred to herein located in the United States.

Once a parent or legal guardian has registered for parent and student accounts on the Services, a child will be able to log into the Services to participate in live, online foreign language tutoring sessions and engage in related games, activities and other content through the Services. We may audio and video record all or any part of any tutoring sessions with a child, which may contain Children's Personal Data including the child's name, image, voice and any other information about the child or the child's family that is provided by the child in the course of the session.

Information Directly Collected From Tutors: We may collect Personal Data from prospective tutors through the tutor application process, including, but not limited to:

1. First and Last Name
2. Email Address
3. Physical Address
4. Social Security Number
5. Work Experience and Educational Background
6. Video recordings of interviews and test lessonsFeedback about a student's session

Information Directly Collected From Site Visitors: We may also collect Personal Data from visitors of the Services, including but not limited to when visitors provide their email addresses when accessing the Services.

Information About Use of the Services: We collect information on how our registered users—parents, guardians, teachers, tutors and students—interact with the Services. For example, we track which pages of the Services users visit to help us understand which content is of interest to users, and how users use certain features of the Services. We also track student activity and progress on the Services to understand when a student has mastered proficiency of certain language skills or subjects, and which types of games and activities appeal to and assist a student in the context of language learning. We collect information about children's performance and activities on the Services, including completion of tutoring sessions and use and progress of our online activities such as games. We collect this information for internal use and to provide parents and guardians with reports on their children's use of the Services, and do not share this information with other entities other than as described in this Privacy Policy.

IP Addresses; Device IDs: When users visit the Services, we or our service providers may collect a user's IP address (the Internet address of your computer). If a user accesses the Services on a mobile device, we or our service providers may also collect the device type and identification number and request access to settings information for similar purposes. By visiting or using the Services or permitting a student to visit or use the Services, you are consenting to the collection of IP addresses and device identifiers.

Children's Data: We and our service providers may automatically collect the following information about a child's use of the Services and other online sites and services through cookies and other technologies: domain name; browser type and operating system; web pages viewed; links clicked; the length of time spent on the Services; the length of time the child spent interacting with certain portions of the Services; analytics statistics; referring URL information, or other information about the webpage that led the child to the Services; language information; device name and model; country/city/state, and operating system type, name and version. We and our service providers may also collect IP addresses, device identifiers or similar unique identifiers from users of the Services, including children. In connection with operating the Services, we work with third party service providers who use cookies and related technologies that may collect Children's Personal Data through the Services.

Aggregated Personal Data; De-Identified Information: When a user interacts with PandaTree through the Services, we use various technologies to passively collect information from the user that, on its own, does not identify the user personally. PandaTree may collect and store such information itself, or such information may be collected by and included in databases owned and maintained by PandaTree affiliates, agents or service providers. In an ongoing effort to better understand and serve the visitors to and users of the Services, PandaTree often conducts research on its customer and student demographics, interests and behavior based on the Personal Data and other information provided to us. This research may be compiled and analyzed on an aggregate basis, and PandaTree may share this aggregate data with its affiliates, agents and business partners. This aggregate information does not identify users personally. PandaTree may also disclose aggregated user statistics in order to describe the Services to current and prospective business partners, and to other third parties for other lawful purposes.

Cookies and Other Tracking Technologies: In operating the Services, we may use "cookies" and similar technologies. A cookie is a piece of information that the computer that hosts the Services gives to the browser that a user is using when a user accesses the Services.

We may allow third-party service providers to use cookies or similar technologies to collect information about a user's browsing activities over time and across different websites following a user's use of the Services. These services track number of visits, links users click on and sections of the Services users interact with, browser and help us analyze how users use the Services so that we are able to enhance user experiences.

Do Not Track Signals:The Services currently do not respond to "Do Not Track" (DNT) signals and operate as described in this Privacy Policy whether or not a DNT signal is received. If we do respond to DNT signals in the future, we will update this Privacy Policy to describe how we do so.

We will use the Personal Data that a user gives us in connection with the reason for which it was provided. For instance, if you contact us by email to ask us a question or inform us about an issue with your or a student's account, we will use the Personal Data you provide to answer the question or resolve the problem. We send you reminders or alerts about upcoming sessions or to notify and thank an individual or school that referred you to the Services. We also use email addresses collected from parents, guardians, teachers, school administrators and other visitors to the Services to send marketing messages about our Services.

We also process Personal Data to operate, improve, understand and personalize our Services. For example, we use Personal Data to:

1. Create and manage accounts
2. Monitor your and the student's use of the Services
3. Communicate with you about the Services
4. Contact you about service announcements
5. Send you reminders or alerts about upcoming sessions or to notify and thank an individual or school that referred you to the Services. These may be voice call or text message reminders (automated or live person calling/sending)
6. Contact you in the future to tell you about features of the Services we believe will be of interest to you and the student(s) in your household. If we do so, each marketing communication we send you will contain instructions permitting you to "opt-out" of receiving future marketing communications. In addition, if at any time you wish not to receive any future marketing communications or you wish to have your name deleted from our mailing lists, please contact us as indicated below.
7. Provide support and assistance for the Services
8. Book and pay for tutoring sessions
9. Catalog information about the student's progress
10. Simplify booking future lessons
11. Personalize content and communications based on your preferences
12. Meet contract or legal obligations
13. Meet contract or legal obligations
14. Fulfil user requests
15. Resolve disputes
16. Protect against or deter fraudulent, illegal, or harmful actions
17. Enforce our Terms of Service
18. Analyze how visitors and users use the Services, measure traffic to the Services and related browsing behavior and improve visitors' and users' experiences when using the Services
19. Help us understand which content is of interest to you, and how you use certain features of the Services.
20. Help us improve the content and functionality of the Services and to better understand our users
21. Track student activity and progress on the Services to understand when a student has mastered proficiency of certain language skills or subjects, and which types of games and activities appeal to and assist a student in the context of language learning
22. Pool it with other information to track, for example, the total number of visitors to the Services, the number of visitors to each page of the Services and the domain names of our visitors' Internet service providers.
23. Training: We may use excerpts of Session Recordings and other information submitted by students in connection with tutoring sessions for internal training purposes. Managers and tutors may also have access to the Session Recordings.
24. We may use IP addresses or other unique identifiers for various purposes as necessary to operate the Services, including to identify user accounts from a single household and repeat visitors to the Services; to otherwise analyze and report upon visits to and usage of the Services; to diagnose and prevent service or technology problems affecting the Services and to monitor and prevent fraud and abuse. We and our service providers may also use unique identifiers to track users across third-party apps or websites.

Our cookies help us provide additional functionality through the Services and help us analyze how visitors and users use the Services, measure traffic to the Services and related browsing behavior and improve visitors' and users' experiences when using the Services. For instance, we may set a cookie on your browser that allows you to access the Services without needing to remember and then enter a password more than once during a visit to the Services, or to help us understand how you have been directed to the Services and which content on the Services is of the greatest interest to you and other visitors to and users of the Services. On most web browsers, you will find a "help" section on the toolbar. Please refer to this section for information on how to receive a notification when you are receiving a new cookie and how to turn cookies off. We recommend that you leave cookies turned on because they allow you to take advantage of some of the Services' features.

We may de-identify your Personal Data so that you are not identified as an individual, and provide that information to our partners. We may also provide aggregate usage information to our partners (or allow partners to collect that information from you), who may use such information to understand how often and in what ways people use our Services, so that they, too, can provide you with an optimal online experience.

We use Children's Personal Data collected from a particular child for the following purposes:

1. To provide the Services to the child and the child's parent or guardian;
2. To market features of the Services to the child and the child's parent or guardian;
3. To respond to customer service and technical support issues and requests; and
4. To train tutors who may work with the child or children of a similar age.

We may use aggregate or de-identified information about children or collected from children for research, analysis and similar purposes. When we do so, we strip out names, contact information and other personal identifiers. We may use aggregate or de-identified information for the following purposes:

1. To better understand how users access and use the Services;
2. To improve the Services and respond to user desires and preferences; and
3. To conduct research or analysis, including research and analysis conducted with the help of third parties.

To the extent required by applicable law, we will only process your Personal Data if we have a lawful basis for doing so. Lawful bases for processing include consent, contractual necessity and our "legitimate interests" or the legitimate interest of others, as further described below.

1. Contractual Necessity: We process the data that you provide to us as a matter of "contractual necessity", meaning that we need to process that data to perform under our Terms of Use with you, which enables us to provide you with the Services. When we process data due to contractual necessity, failure to provide such Personal Data will result in your inability to use some or all portions of the Services that require such data.
2. Legitimate Interest: We process all categories of your Personal Data when we believe it furthers the legitimate interest of us or third parties. Examples of these legitimate interests include:
   • Operation and improvement of our business, products and services
   • Troubleshooting technical problems
   • Tailoring and customizing the Services for users
   • Marketing of our products and services
   • Provision of customer support
   • Protection from fraud or security threats
   • Quality control
   • Compliance with legal obligations (including COPPA)
   • Completion of corporate transactions
3. Consent: In some cases, we process Personal Data based on the consent you expressly grant to us at the time we collect such data. When we process Personal Data based on your consent, it will be expressly indicated to you at the point and time of collection.
4. Other Processing Grounds: From time to time we may also need to process Personal Data to comply with a legal obligation, if it is necessary to protect the vital interests of you or other data subjects, or if it is necessary for a task carried out in the public interest.

We share Personal Data with vendors, third party service providers and agents who work on our behalf and provide us with services related to the purposes described in this Privacy Policy or our Terms of Service. We also share Personal Data when necessary to complete a transaction initiated or authorized by you or provide you with a product or service requested. We may share Personal Data with the following parties:

1. Tutors: PandaTree will share certain information with our tutors and tutor managers as necessary to provide you and students with access to the Services and improve upon your experiences. This information includes, but may not be limited to, your first name, the student's name (but only the last name initial), the student's age, the student's school and grade (if applicable), the student's language level and the student's interests, content discussed in tutoring sessions (including Session Recordings, as defined in our Terms of Service), the student's word list and account activity as well as any comments or notes from previous tutors. All of our tutors are bound by confidentiality obligations and are prohibited from using such information outside of providing the Services to you.
2. Schools: If you request that we share a student's Session Recordings or other Personal Data with a school or other educational institution and provide written consent for us to do so, we will make Session Recordings and other Personal Data available through the Services as requested until you tell us that you would like for us to stop sharing this information or request the deletion of the Session Recordings or applicable Personal Data from the Services.
3. Parents and Guardians: A parent or guardian may view certain information collected from their child(ren) through the Services, and may request information about the information we have collected from their child(ren) by contacting us at the address set forth below.
4. Business Transfers: As we develop our business, we might sell or buy businesses or assets. In the event of a corporate sale, merger, reorganization, dissolution or similar event, Personal Data, including Children's Personal Data, may be part of the transferred assets.
5. Related Companies: We may also share Personal Data with our Related Companies for purposes consistent with this Privacy Policy. "Related Companies" refers to PandaTree and its affiliates and subsidiaries.
6. Agents, Vendors, Service Providers and Related Third Parties: PandaTree, like many businesses, sometimes hires other companies to perform certain business-related functions on our behalf, such as mailing information, maintaining databases, processing payments and identifying individuals who may be interested in the Services. When we employ another entity to perform a function of this nature, we provide the entity with the information that it needs to perform its specific function(s) on our behalf. We may disclose the information we collect from all users, including children, to third- party vendors, service providers, contractors or agents who perform business-related functions on our behalf and are capable of protecting the Personal Data, including Children's Personal Data, we share with them. Please refer to this link https://www.pandatree.com/3rdpartypolicies for a list of all third party service providers that collect or maintain Personal Data, including Children's Personal Data, through the Services.
7. Legal Requirements: PandaTree may disclose Personal Data if required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, (ii) protect and defend the rights or property of PandaTree, (iii) act in urgent circumstances to protect the personal safety of visitors to or users of the Services or the public or (iv) protect against legal liability. We also may disclose information we collect in order to comply with the law, a judicial proceeding, court order, subpoena or other legal process.

We do not sell Children's Personal Data, and a child may not make his or her Children's Personal Data publicly available through the Services. In general, we may disclose Children's Personal Data and other information that we collect from children to provide the Services, to comply with the law and to protect PandaTree and other users of the Services. We may share Children's Personal Data and other information that we collect from children as set forth in this Privacy Policy.

We also may disclose information we collect when we believe it is necessary to investigate, prevent or take action regarding illegal activities, suspected fraud, situations involving potential threats to the safety of any person, violations of our Terms of Service or Privacy Policy, or as evidence in litigation in which PandaTree is involved.

We also share information with third parties when you give us consent to do so.

We may also use and share aggregate or de- identified information about users with third parties for marketing, research or similar purposes.

This Privacy Policy applies only to the Services. The Services may contain links to other websites or services not operated or controlled by PandaTree (the "Third Party Sites"). The policies and procedures described here do not apply to the Third Party Sites. The links from the Services do not imply that PandaTree endorses or has reviewed the Third Party Sites. We suggest contacting those sites directly for information on their privacy policies.

We will retain Personal Data collected from you and the student as long as is reasonably necessary to provide the Services to you and the student and to improve the content and functionality of the Services. You may direct us to delete Personal Data by contacting us at customercare@pandatree.com. In some cases we retain Personal Data for longer, if doing so is necessary to comply with our legal obligations, resolve disputes or collect fees owed, or is otherwise permitted or required by applicable law, rule or regulation. Afterwards, we retain some information in a depersonalized or aggregated form but not in a way that would identify you personally.

PandaTree takes reasonable steps to protect the Personal Data provided via the Services from loss, misuse, and unauthorized access, disclosure, alteration or destruction using appropriate technical and organizational measures based on the type of Personal Data and applicable processing activity. For example, all data with PandaTree.com is encrypted during transfer, customer data is encrypted when stored, and we try to minimize the amount of data we collect from our users. However, no Internet or email transmission is ever fully secure or error free. Please keep this in mind when disclosing any Personal Data to PandaTree via the Internet.

Through your account settings, you may access, and, in some cases, edit or delete the following information you’ve provided to us:

1. name and password
2. email address
3. phone number
4. user profile information (parent and child information), including images and videos you have uploaded to the site

The information you can view, update, and delete may change as the Services change. If you have any questions about viewing or updating information we have on file about you, please contact us at CustomerCare@PandaTree.com

You can always opt not to disclose information to us, but keep in mind some information may be needed to register with us or to take advantage of some of our features. You may be able to add, update, or delete information as explained above. When you update information, however, we may maintain a copy of the unrevised information in our records. Some information may remain in our records after your deletion of such information from your account. We may use any aggregated data derived from or incorporating your Personal Information after you update or delete it, but not in a manner that would identify you personally.

If you are a parent or guardian of a user of our Services who is under 13 (or 16 if you're located in the EU), you may contact us at any time to ask that (a) we stop collecting Personal Data from such user, (b) we delete any Personal Data already collected from such user, and (c) we stop disclosing Personal Data collected from such user to third parties, but continue to allow for collection and use of Personal Data collected from such user in connection with the Services.

If you have questions or concerns about Children's Personal Data you can contact PandaTree at customercare@pandatree.com or write to us at the following address:

COPPA Compliance
PandaTree Inc
855 El Camino Real Ste 13A-234
Palo Alto, CA 94301

You may also contact us at 1-844-267-2632. Please note that if you are not 18 years of age or older, then you must have your parent or legal guardian's permission to call this number.

Under California Civil Code Sections 1798.83-1798.84, California residents are entitled to contact us to prevent disclosure of Personal Data to third parties for such third parties' direct marketing purposes; in order to submit such a request, please contact us at customercare@pandatree.com. California residents are entitled to ask us for a notice identifying the categories of Personal Data which we share with our affiliates and/or third parties for marketing purposes, and providing contact information for such affiliates and/or third parties. If you are a California resident and would like a copy of this notice, please submit a written request to: customercare@pandatree.com

If you are a resident of the European Union ("EU"), United Kingdom, Lichtenstein, Norway, or Iceland, you may have additional rights under the EU General Data Protection Regulation (the "GDPR") with respect to your Personal Data, as outlined below. For more information about these rights, or to submit a request, please email customercare@pandatree.com. Please note that in some circumstances, we may not be able to fully comply with your request, such as if it is frivolous or extremely impractical, if it jeopardizes the rights of others, or if it is not required by law, but in those circumstances, we will still respond to notify you of such a decision. In some cases, we may also need to you to provide us with additional information, which may include Personal Data, if necessary to verify your identity and the nature of your request.

Access: You can request more information about the Personal Data we hold about you and request a copy of such Personal Data. You can also access certain of your Personal Data by logging into your parent hub at https://www.pandatree.com/login/?user=parent, clicking your name and the top, then click the "edit" link.

Rectification: If you believe that any Personal Data we are holding about you is incorrect or incomplete, you can request that we correct or supplement such data. You can also correct some of this information directly by logging into your parent hub at https://www.pandatree.com/login/?user=parent, clicking your name and the top, then click the "edit" link.

Erasure:You can request that we erase some or all of your Personal Data from our systems.

Withdrawal of Consent: If we are processing your Personal Data based on your consent (as indicated at the time of collection of such data), you have the right to withdraw your consent at any time. Please note, however, that if you exercise this right, you may have to then provide express consent on a case-by-case basis for the use or disclosure of certain of your Personal Data, if such use or disclosure is necessary to enable you to utilize some or all of our Services.

Portability: You can ask for a copy of your Personal Data in a machine-readable format. You can also request that we transmit the data to another controller where technically feasible.

Objection: You can contact us to let us know that you object to the further use or disclosure of your Personal Data for certain purposes, such as for direct marketing purposes.

Restriction of Processing: You can ask us to restrict further processing of your Personal Data.

Right to File Complaint: You have the right to lodge a complaint about PandaTree's practices with respect to your Personal Data with the supervisory authority of your country or EU Member State.

The Services are hosted and operated in the United States ("U.S.") through PandaTree and its service providers, and if you do not reside in the U.S., laws in the U.S. may differ from the laws where you reside. By using the Services, you acknowledge that any Personal Data about you, regardless of whether provided by you or obtained from a third party, is being provided to PandaTree in the U.S. and will be hosted on U.S. servers, and you authorize PandaTree to transfer, store and process your information to and in the U.S., and possibly other countries. You hereby consent to the transfer of your data to the U.S.

Please feel free to contact us if you have any questions about PandaTree's Privacy Policy or the information practices of the Services.

You may contact us as follows:
PandaTree Inc
855 El Camino Real Ste 13A-234
Palo Alto, CA 94301
1-844-267-2632
CustomerCare@PandaTree.com