Privacy Policy

Last updated: [DATE]

1. Introduction

This Privacy Policy describes how [MUSTER LEGAL ENTITY NAME] ("Muster," "we," "us," or "our") collects, uses, stores, shares, and protects personal data when you visit our website, use the Muster platform and related services (together, the "Services"), or otherwise interact with us.

Privacy is a core commitment at Muster, and we treat the protection of personal data as an organizational priority rather than a compliance afterthought. We have written this policy with the EU General Data Protection Regulation ("GDPR") as our baseline standard, and we also take into account other legislation that may apply to you depending on where you live, including the California Consumer Privacy Act ("CCPA," as amended by the CPRA), the UK Data Protection Act 2018 and UK GDPR, and other applicable state, national, and international privacy laws.

Where this policy refers to "personal data," it means any information relating to an identified or identifiable individual, as defined under applicable law.

2. Data Controller and Privacy Contact

For personal data processed in connection with our website, marketing, and the operation of our business, the data controller is:

[MUSTER LEGAL ENTITY NAME] [REGISTERED ADDRESS]

Questions, concerns, or requests relating to this policy or your personal data should be directed to our privacy team:

• Email: [privacy@CONTACT-DOMAIN]
• Post: [MAILING ADDRESS]

3. Personal Data We Collect and Why

When you interact with us as a prospect, customer, or user of the Services, we may collect and process the following categories of personal data:

• your name and job title;
• the name of your employer or organization;
• business contact details, such as your work address, work email address, and work phone number; and
• connection and location data generated when you interact with the Services.

We use this information to provide, operate, and improve the Services, to communicate with prospects and customers, to administer accounts and billing, and to provide support.

We do not sell your personal information. We share personal data only with third parties that help us deliver the Services, as described in Section 6 below.

In some cases we supplement the information you give us with information obtained from third-party sources, such as publicly available details about your employer or industry, or information from professional social networks such as LinkedIn.

4. Information Collected Automatically

When you visit our website or use the platform, we automatically collect certain technical information, including your IP address, approximate location derived from it, browser type, operating system, referring pages, and usage history within the Services.

We use this information to improve the design and performance of our website and platform, to analyze visitor and usage trends, and to keep the Services secure and reliable. We process this data on the basis of our legitimate interest in understanding how people use our Services so that we can offer relevant products, provide effective support, and operate our business.

5. Cookies and Similar Technologies

We use cookies and similar tracking technologies on our website and in the Services. For details on which cookies we use, why we use them, and how you can accept or reject them, please see our separate Cookie Notice, available at [COOKIE NOTICE URL].

6. How We Share Personal Data

Hosting and storage. The databases in which personal data is stored are hosted by third-party providers in the United States and the European Union. These providers access your data only as needed to perform storage and retrieval functions on our behalf.

Subprocessors. A current list of the subprocessors we use to deliver the Services is available at [SUBPROCESSOR LIST URL / TRUST CENTER URL].

Other disclosures. We may disclose personal data in the following circumstances:

1. when you ask us to, or otherwise at your direction;
2. in connection with events, conferences, or programs that we host or co-sponsor;
3. when required to comply with applicable law, regulation, legal process, or an enforceable governmental request;
4. to service providers who perform functions on our behalf, under contractual confidentiality and data-protection obligations;
5. where we believe disclosure is necessary in an emergency to protect the safety of any person; and
6. as reasonably necessary to resolve disputes or enforce our agreements.

We may also share aggregated or otherwise de-identified data that cannot reasonably be used to identify you, including for marketing and analytical purposes.

Our website and Services may contain links or connections to third-party platforms such as LinkedIn, Facebook, and X (Twitter). If you interact with those platforms, their own privacy policies apply, and we encourage you to review them.

7. International Data Transfers

Where personal data originating in the European Economic Area, the United Kingdom, or Switzerland is transferred to a country that has not been deemed to provide an adequate level of data protection, we implement appropriate safeguards, including binding standard contractual clauses adopted under Article 46 GDPR (and the UK equivalent, where applicable).

Where we rely on another legal basis for a transfer, it will be one recognized under applicable law, such as your consent, the necessity of the transfer for the performance of a contract with you, or compelling legitimate interests that are not overridden by your rights and freedoms. We put data processing agreements and model clauses in place with our vendors wherever feasible.

8. Your Rights

Depending on where you live, you may have some or all of the following rights with respect to your personal data:

1. the right to be informed about how your data is processed;
2. the right of access to the data we hold about you;
3. the right to rectification of inaccurate or incomplete data;
4. the right to erasure ("right to be forgotten"), subject to legal exceptions;
5. the right to restrict processing;
6. the right to data portability;
7. the right to object to processing, including for direct marketing; and
8. rights relating to automated decision-making and profiling.

We provide individuals with reasonable access to their personal data free of charge and within a reasonable timeframe following a verified request. If we cannot grant access or honor a request, we will explain why. You may ask us to confirm whether we process your data, and to tell you the purposes of processing, the categories of data involved, the recipients or categories of recipients to whom it has been disclosed, the source of the data, and how long we expect to store it.

You may correct inaccurate records, request deletion of your data (subject to exceptions permitted by law), and opt out of direct marketing at any time. You also have the right to lodge a complaint with your local data protection supervisory authority.

To exercise any of these rights, contact us using the details in Section 2. We may need to verify your identity before acting on a request.

9. Data Retention and Storage

We retain personal data associated with active customers for the duration of the customer relationship, and thereafter for analysis, historical, and archiving purposes consistent with applicable law. Personal data relating to prospects is retained only for as long as it has business value and is purged thereafter. Any personal data under our control can be deleted upon a verified request from the data subject, subject to legal retention obligations.

Personal data is stored on servers located in Europe and the United States.

10. Security

We maintain administrative, technical, and organizational measures designed to protect personal data against unauthorized access, loss, misuse, or alteration, appropriate to the nature of the data we process.

11. Children's Privacy

Our Services are intended for business use and are not directed at children. We do not knowingly solicit or collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time at our discretion. When we do, we will provide reasonable notice by posting the updated policy on our website and revising the "Last updated" date above. Your continued use of the Services after an update constitutes acceptance of the revised policy. If we make significant changes, such as a change in the lawful basis on which we process your data, we will seek your renewed consent where required by law.

13. Contact and Complaints

If you have a question, concern, or complaint about this policy or our handling of your personal data, please contact us:

• Email: [privacy@CONTACT-DOMAIN]
• Post: [MUSTER LEGAL ENTITY NAME], [MAILING ADDRESS]

We will investigate and attempt to resolve any complaint promptly. If you are not satisfied with our response, you may escalate your complaint to the data protection authority in your jurisdiction.