WAULD PRIVACY POLICY

Last updated on May 21, 2026

Wauld LLC ("Wauld" or "We" or "Us") is committed to data security and the fair and transparent processing of personal data. We provide a content management and content generation platform. Wauld's platform assists people in making documents and credentials for events, courses, and activities. This Privacy Policy also describes your choices regarding use, access, and correction of your personal information. "You" or "Your" refers to the person or organization using the Service. The "Service" is the digital credentialing and certification functionality, associated insights, and connection to relevant education and training opportunities provided through the platform offered by Wauld. This Privacy Policy is subject to the Data Processing Agreement (https://wauld.com/data-processing-addendum) and the Terms of Use (https://wauld.com/terms-of-use) ("Terms" or "ToS"). Any term not defined herein shall be interpreted as per the definitions provided in the Terms of Use and the Data Processing Agreement ("DPA").

1. SCOPE

This Privacy Policy applies to personal information processed by Wauld in two distinct capacities:

First, Wauld acts as a data controller with respect to personal information that Wauld collects directly from Issuers, Issuer administrators, billing contacts, support contacts, and other users who interact with Wauld directly, including in connection with account registration, billing, support, product analytics, and marketing of Wauld's own services ("Account Data"). This Privacy Policy describes how Wauld processes Account Data as a controller.

Second, Wauld acts as a data processor with respect to personal information that an Issuer or its authorized users upload or that is included in or associated with a Credential issued through the Services, including data relating to Recipients ("Credential Data"). Wauld's processing of Credential Data is performed on the Issuer's behalf and in accordance with the Issuer's documented instructions. The Wauld Data Processing Addendum, available at https://wauld.com/data-processing-addendum, governs Wauld's processing of Credential Data and is incorporated into this Privacy Policy by reference. In the event of a conflict between this Privacy Policy and the Data Processing Addendum on a matter of Credential Data processing, the Data Processing Addendum prevails.

When the Wauld platform is provided to you via a third party (such as a reseller who independently hosts the Services), that third party's privacy policy may apply in addition to or in place of this Privacy Policy, as set forth in the applicable agreement.

If you use the Services for your business that has a separate Service Agreement or other governing agreement with Wauld, the terms of that agreement will supersede the Privacy Policy herein. All capitalized terms not explained herein shall be interpreted as per the ToS.

"Affiliates" means Wauld's attorneys, auditors, consultants, and service providers who are under confidentiality obligations at least as restrictive as those contained herein. This Policy, together with Wauld's Terms of Use and any other documents referred to in them, sets out the basis on which Wauld processes Personal Data.

"Personal Data" means any information relating to an identified or identifiable natural person, as further defined by Applicable Data Protection Laws. References to Personal Data in this Privacy Policy include both Account Data and Credential Data as defined above.

"Website Analytics" includes but is not limited to user analytics, website usage times, sessions, and bounce rates.

Any definitions not mentioned herein shall be interpreted according to the Terms of Use.

PLEASE READ THIS POLICY CAREFULLY AS IT CONTAINS IMPORTANT INFORMATION ON WHO WAULD IS, HOW AND WHY WAULD COLLECTS, STORES, USES, AND SHARES PERSONAL DATA, YOUR RIGHTS IN RELATION TO YOUR PERSONAL DATA, AND HOW TO CONTACT US IN THE EVENT THAT YOU WOULD LIKE TO REPORT A CONCERN ABOUT THE WAY IN WHICH WAULD PROCESSES YOUR DATA.

This Privacy Policy describes Wauld's broadest potential use of your Personal Data, although Wauld may actually make less use. The basis for Wauld's processing of your Personal Data is your informed consent. No law requires you to provide us with your Personal Data. You may withdraw your consent for us to process your Personal Data at any time, but that may preclude you thereafter from using the Website and the Service. Wauld will delete your Personal Data following the withdrawal of your consent; however, such withdrawal will not affect the lawfulness of processing prior to withdrawal. Wauld collects Personal Data when you choose to submit it through email, an online form, or any other mode. Wauld also maintains a log of certain information concerning visitors to Wauld's websites, including but not limited to internet protocol ("IP") address, third-party websites from which visitors access Wauld's website, type of web browsers used, and pages viewed. Such information may include Personal Data and Website Analytics. By using this website, you give Wauld consent to collect and process your Personal Data and website usage data, including Website Analytics.

By your use of the Service, you consent to Wauld's use and disclosure of your Personal Data in accordance with this Privacy Policy.

2. ABOUT US

Wauld is a digital credentialing platform that enables organizations ("Issuers") to create, issue, and manage digital certificates, badges, and other forms of documentation for individuals or organizations ("Recipients"). Recipients can access, store, and share these credentials, including with third parties ("Verifiers") who do not have Wauld accounts. Issuers are Wauld's direct customers, while Recipients are the users who receive credentials created by the Issuers. The Issuer is solely responsible for the verification and accuracy of any content they create. The Recipient acknowledges that Wauld acts merely as a platform and intermediary. In the event of any complaints or issues regarding the content, the Recipient may reach out to Wauld using the contact information provided in Section 16.

Wauld may share your information with trusted affiliates (both within and outside the United States), including sharing engagement metrics related to Credentials with the relevant Issuer. By using Wauld's website and Services, you acknowledge that such transfers and sharing may occur for the purpose of operating the Services and supporting Wauld's affiliates in their delivery of the Services.

For the purposes of the EU General Data Protection Regulation, the UK General Data Protection Regulation, the California Consumer Privacy Act (as amended by the California Privacy Rights Act), and other applicable data protection laws, Wauld's role depends on the type of personal information being processed: (a) Wauld is the data controller (or Business, as applicable under the CCPA/CPRA) of Account Data, as further described in Section 1 of this Privacy Policy; and (b) Wauld is the data processor (or Service Provider, as applicable under the CCPA/CPRA) of Credential Data, with the Issuer acting as the controller (or Business) of such Credential Data.

3. WHAT PERSONAL DATA DO WE COLLECT?

Wauld may collect and process the following personal data:

3.1 Information You Provide to Us

To register for or use the Service, you will be prompted to give us certain required information about yourself, such as your name and email address. When you configure your account settings, you may enter additional, optional information about yourself. You may, at times, also send us an email which may contain not only your email address but other information about you, including home or business addresses, telephone numbers, or account details. The information you give us may also include statements you make on the Service such as testimonials, services reviews, or other statements that may identify you personally.

An Issuer may directly create an account on the Service by providing the requested information, which may include name, email address, phone number, company, and other information. Please note that Wauld will never ask for your (whether you are an Issuer or Recipient) Social Security Number, bank account passwords, credit card numbers, or any other financial information. If you have been requested to provide such information, please refer to the How to Contact Our Privacy Officer section below to get in touch with us.

Wauld may use your Personal Data to contact you regarding your use of the Service, for customer support purposes, and to inform you of updates, modifications, and other matters relating to the Service, and information about other services that Wauld offers in accordance with your subscription preferences. You may decline to receive mail or email from us that does not relate directly to your access to or use of the Service by selecting the opt-out link contained in any such email or by contacting us through the information provided in the How to Contact Our Privacy Officer section.

3.2 Information Wauld Collects About You

Wauld will also maintain a history of your access to the Service, and certain actions taken by you while accessing the Service, a log of users' IP addresses, the third-party website from which users access the Service, the type of web browsers used to access the Service, and the browser's settings that may affect Service performance (collectively, "Usage Log Information"), explicitly when Recipients share credential links.

3.3 Information Wauld Receives from Issuers and Recipients

Issuers, when creating their account and using the Services, provide Personal Information to us, including name, email, organization name, logo, billing details, verification documents (domain verification or similar), and authorized users' contact information. The use of information collected from Issuers shall be limited to the purpose of providing the service for which these organizations have engaged Wauld. Wauld collects information about Recipients directly from the Issuer regarding their name and email. A Recipient who creates an account on Wauld provides their name and email to Wauld directly.

An individual who seeks access, or who seeks to correct or amend inaccurate Credentials, should direct their query to the Issuer. Wauld retains Personal Information that Wauld processes on behalf of the Issuers for as long as needed to provide services to the Issuers and the Users and in compliance with all applicable personal information retention laws. Individual Credentials and a User's entire account may be deleted by the User at any time by contacting us using the information provided under the How to Contact Our Privacy Officer section. There is no default automatic purge policy. Wauld verifies deletion requests, and if deletion may affect system consistency, the data is pseudonymized.

3.4 Non-Personal Information

Wauld may statistically aggregate, in non-person-specific form, information collected to improve Wauld's websites, their quality controls, operations management, security processes, future marketing and promotional efforts, and the overall Service in an attempt to better understand its users' interests and preferences. In some cases, Wauld may transfer this information to its third-party service providers, who will have access to only the required data for delivery of their service. By using the Services, you consent to this non-personally identifiable data aggregation and the use and transmission of this aggregated statistical data as outlined above.

4. HOW DOES WAULD USE YOUR DATA (PERSONAL & OTHERWISE)?

In addition to the uses described above of the information received in connection with your use of the Service, Wauld uses and, where specified, shares your information:

• To display Credentials to users.
• To provide support or other services that you have requested, and to respond to your inquiries.
• To engage in transactions with you, including contacting you about your account or transactions.
• To notify you of relevant opportunities such as new product releases and service developments, related facts, or programming that may be relevant to you.
• To improve quality and facilitate use of the Service.
• To operate the Service through the assistance of third parties. Wauld may use services from third-party service providers, such as hosting services and software developers, in support of its operation of the Service. When doing so, Wauld will take steps to ensure that such service providers implement appropriate privacy and security measures consistent with this Privacy Policy to safeguard against the unauthorized use or disclosure of your information. These companies are authorized to use your personal information only as necessary to provide these services to us.
• To comply with legal requirements. In addition, Wauld may also disclose information about you as required by law, such as to comply with a subpoena or other legal process, when Wauld believes in good faith that disclosure is reasonably necessary to enforce its rights or protect its operations, users, or others; to investigate fraud; or in response to legal processes or governmental investigations in accordance with its internal policy on access by governmental authorities; or under exigent circumstances in response to a perceived significant threat to a person's health or property.
• To assist in verification or other processes ancillary to the Services.
• We engage third-party service providers or Subprocessors (as defined in the DPA) to help us operate and support our services. These Subprocessors may process personal data on our behalf, consistent with the purposes described in this Privacy Policy. A current list of subprocessors is available in our Data Processing Addendum.

The table below outlines the lawful bases for processing your personal data.

This table is provided for transparency and ease of reference only. It does not restrict Wauld's ability to rely on other lawful bases where permitted under applicable law.

If you withdraw your consent, Wauld will stop sending you marketing communications but may continue to send transactional or service-related communications that are necessary to provide the Services.

Data Sharing for Analytics and Advertising (Post Sign-Up)

Wauld uses first-party analytics via PostHog to understand platform usage and improve user experience.

When you create an account or while using the Service, you may provide consent for us to use your data for additional purposes, including:

• Enhanced product analytics
• Engagement tracking across sessions and devices
• Custom audience creation for advertising
• Delivery of targeted advertising via third-party platforms (e.g., Google Ads, Meta Ads)

You can manage your data-sharing preferences at any time via your account settings or by contacting our Privacy Officer.

Credential Engagement Analytics

We may collect and use analytics data such as views, downloads, shares, and engagement metrics associated with credentials issued through Wauld. This information helps credential issuers understand how their credentials are being accessed, used, and distributed.

These engagement metrics are visible only to the issuing organization and are not shared with unrelated third parties.

In jurisdictions where explicit consent is required, Wauld will not use engagement data for behavioral advertising or profiling unless you have provided consent. In other regions, Wauld may use such data for advertising or profiling in accordance with applicable law.

5. HOW WAULD OBTAINS CONSENT

Wauld is dedicated to safeguarding your privacy and ensuring that your personal information is collected, used, and disclosed in accordance with applicable laws and regulations.

Consent Methods: Wauld may obtain your consent through one of the following methods:

• Website Signup: By clicking "Create Account" or otherwise continuing with the registration process on Wauld's website (including at https://wauld.app/user/signup), you acknowledge that you have read, understood, and agree to this Privacy Policy, the Terms of Use (https://wauld.com/terms-of-use), and the Data Processing Agreement (https://wauld.com/data-processing-addendum), where applicable. You acknowledge that the Services may involve the processing of personal information, including, where applicable, limited categories of sensitive personal information, as described in this Privacy Policy.
• Email Confirmation: Wauld may send you an email requesting your consent. You must reply to this email to confirm your consent.
• Print-and-Send: You may receive a consent form that you can print, sign, and return to us via mail or fax.
• Revoking Consent: You may withdraw your consent at any time by updating your account preferences or contacting Wauld using the information provided under the How to Contact Our Privacy Officer section. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal but may limit your ability to use certain features of the Services.

Contact Information

If you have any questions about Wauld's consent mechanism or wish to revoke your consent, please contact us using the information under the How to Contact Our Privacy Officer section.

Child Usage Policy

Our services are intended for a general audience and are not directed to children under the age of 13. We do not knowingly collect, use, or disclose personal information from children under 13 without verifiable parental consent, in compliance with the Children's Online Privacy Protection Act (COPPA).

If you are the parent or guardian of a child under the age of 13, Wauld requires verifiable parental consent before collecting any personal information from your child, in compliance with the Children's Online Privacy Protection Act (COPPA) and other relevant legislation.

6. PRIVACY OF YOUR DATA

Wauld collects name, email, organization name, logo, billing details, verification documents (domain verification or similar), and authorized users' contact information from Issuers. In the instance of Recipients, name and email are supplied by the Issuer. Issuers can create custom fields (e.g., certificate ID, grades). This data is provided to Wauld via CSV uploads, API, or manual entry. The verification and validity of any data provided by the Recipient or Issuer is the responsibility of the Issuer.

Wauld uses select third-party services under appropriate contractual terms to support platform functionality, which includes hosting and infrastructure, email delivery, monitoring, analytics, and customer experience tools. These providers are used solely for their intended technical purpose and do not access data beyond what is required for delivery of their service. A current list of our subprocessors, including their functions and locations, is available at https://wauld.com/data-processing-addendum. We will notify Issuers of any intended changes to this list in accordance with our Data Processing Agreement.

7. SECURITY OF YOUR DATA

Wauld takes appropriate administrative, technical, and organizational measures to protect personal information processed through the Services. Access to personal data is limited to personnel and service providers who require it for legitimate business purposes and who are bound by confidentiality and security obligations.

Wauld applies Zero Trust security principles, including role-based access controls, regular access audits, and monitoring. Data is encrypted in transit and at rest using industry-standard protocols, and pseudonymization techniques are applied where appropriate. Cryptographic protocols are reviewed periodically to ensure continued effectiveness. Administrative actions (such as credential edits or voiding) are logged for auditability and visibility to Issuers where applicable.

In the event of a personal data breach affecting Account Data or Credential Data, Wauld will notify the affected Issuer without undue delay after becoming aware of the breach, and in any event within seventy-two (72) hours. The notification will include, to the extent known at the time of notification: (a) the nature of the breach, including, where possible, the categories and approximate number of data subjects affected and the categories and approximate number of records affected; (b) the likely consequences of the breach; (c) the measures Wauld has taken or proposes to take to address the breach, including any measures to mitigate possible adverse effects; and (d) the name and contact details of Wauld's data protection contact for further information. If complete information is not available within the 72-hour window, Wauld will provide an initial notification with the information then available and will follow up with additional information as it becomes available. Where Wauld acts as a Processor, the Issuer remains responsible for notifying affected data subjects and competent supervisory authorities in accordance with applicable law.

While Wauld employs industry-standard safeguards, no method of transmission or storage is completely secure. Users should take standard precautions such as protecting login credentials and using secure devices. To the fullest extent permitted by law, Wauld disclaims liability for unauthorized access resulting from circumstances beyond its reasonable control.

8. ACCESS, RETENTION, AND DELETION

Wauld's primary data storage is on Google Cloud Platform infrastructure located in the United States, including both structured databases and object storage (such as PDFs). In the course of providing the Services, personal data may also be processed by Wauld's sub-processors, some of which operate in the United States, the European Union, or globally, as further described in Wauld's Data Processing Addendum (Annex II). Wauld implements appropriate safeguards for cross-border data transfers, including Standard Contractual Clauses where required by applicable law, as described in the Data Processing Addendum. If an Issuer's account is terminated, the credentials they have issued remain on the platform (unless revoked) as they are considered independent, persistent digital records. Wauld may retain your Personal Information for as long as your account is active and so long as retention is required or permitted in accordance with this Privacy Policy, or otherwise by law. You may access, correct, or request deletion of your personal information by logging into your account or by referring to the How to Contact Our Privacy Officer section.

Retention Periods by Data Category

Right to Deletion

You may request deletion of your personal information by contacting Wauld or submitting a request through your account. Where Wauld acts as a Controller (e.g., for Account Data), we will verify and process your deletion request in accordance with applicable law. Where Wauld acts as a Processor (e.g., for Credential Data managed by an Issuer), your request will be forwarded to the Issuer, who is responsible for determining how to respond.

Change Requests and Account Creation

For Recipients with an existing account, they may submit change requests through their account. A verification code will be sent to the Recipient by Wauld when a change request is submitted. Upon correctly entering the verification code, the Recipient may submit the change request, which will subsequently update their account.

For Recipients without an existing account, they may submit change requests. An account will be created for the Recipient by Wauld, and subsequently a verification code will be sent to the Recipient. Upon correctly entering the verification code, the Recipient may submit the change request, which will subsequently update their account.

9. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies to operate the Wauld platform, understand how users interact with the Services, and improve user experience. Our approach to cookies varies by jurisdiction in accordance with applicable law.

Categories of Cookies We Use

A. Strictly Necessary Cookies

These cookies are essential for the website and application to function. They support core functionality such as authentication, session management, security, and load balancing. Strictly necessary cookies do not require consent under applicable law and cannot be disabled without affecting service performance.

B. Functional Cookies

These cookies support features that you actively engage with, including support chat, feedback submission, changelog notifications, and user preference settings. We use Featurebase to power support, feedback, and changelog functionality; Featurebase cookies are configured to support only these interactive features and do not track users across other websites or for advertising purposes.

C. Analytics Cookies

We use PostHog, a product analytics platform, to understand how users interact with the Wauld platform, identify areas for improvement, and monitor service reliability. PostHog analytics is used solely for internal product improvement and is never used for advertising, profiling, or sharing with external parties.

How We Use PostHog. For website visitors, PostHog collects information about how the platform is used, including page views, feature interactions, and aggregate usage patterns. For logged-in users, PostHog may collect limited identifiers (such as user ID or email) to link analytics with product functionality and feature adoption, where consent has been obtained or where the user is located in a jurisdiction operating under an opt-out consent model. PostHog may set cookies (such as a project token or session identifier) to enable analytics to operate correctly. PostHog does not use data for advertising, profiling for advertising purposes, or sharing with external parties.

Regional Consent Approach

Wauld applies different consent practices based on user location to comply with regional privacy laws:

For visitors located in the European Economic Area (EEA), the United Kingdom, and Switzerland: Wauld presents a cookie consent banner on first visit that allows you to accept all cookies, reject all non-essential cookies, or customize your preferences by category. Analytics and other non-essential cookies are not set or loaded until you provide consent. You may change your consent decision at any time by clicking the "Cookie Preferences" link in the Wauld website footer. Wauld uses a Consent Management Platform to handle consent collection, storage, and audit logging in accordance with the EU General Data Protection Regulation, the UK General Data Protection Regulation, the ePrivacy Directive, and the Swiss Federal Act on Data Protection.

For visitors located outside the EEA, the United Kingdom, and Switzerland: Wauld operates analytics and other non-essential cookies on an opt-out basis, consistent with applicable law (including the California Consumer Privacy Act as amended by the California Privacy Rights Act, and similar U.S. state privacy laws). You may opt out of analytics cookies at any time by submitting a request through Wauld's privacy request portal at https://wauld.app/privacy-request/, by adjusting your browser cookie settings, or by sending a recognized universal opt-out signal (such as the Global Privacy Control signal) where applicable law requires Wauld to honor such signals.

Browser-Level Controls

Regardless of region, you may also manage cookies through your browser settings. Disabling strictly necessary cookies will affect the operation of the Services. Disabling functional or analytics cookies will not prevent you from using the Services but may reduce our ability to improve the platform based on usage patterns.

Third-Party Websites

The Services may include links to third-party websites or platforms that are not controlled by Wauld. We do not control and are not responsible for the cookie practices of these external sites. We recommend that you review the privacy policies and cookie notices of any third party with whom you interact.

Questions About Cookies

If you have questions about our use of cookies or tracking technologies, please contact us via the How to Contact Our Privacy Officer section below.

10. THIRD-PARTY SITES

Wauld works with authorized resellers and other Affiliates who assist in sales, data processing, internal management, human resources, onboarding, and customer relationships. Depending on the agreement in place with the end customer, a reseller may or may not host the platform independently or access end-user data. Wauld always enters into a formal reseller agreement in such cases, which clearly defines roles, data responsibilities, and access permissions.

11. CONFIDENTIALITY OF DATA

Wauld will use industry-standard physical, technical, and administrative security measures to keep your Personal Data confidential and secure, and will not share it with third parties, except as otherwise provided in this Privacy Policy, or unless such disclosure is necessary in special cases, such as a physical threat to you or others, as permitted by applicable law.

12. YOUR RIGHTS

You have certain rights in relation to your Personal Data. You can access your Personal Data and confirm that it remains correct and up-to-date, choose whether or not you wish to receive material from Wauld or some of Wauld's partners, and request that Wauld delete or provide you with a copy of your Personal Data. You may exercise these rights by submitting a request through Wauld's privacy request portal at https://wauld.app/privacy-request/, by logging into your Wauld account, or by contacting our Privacy Officer at dpo@wauld.com.

Where Wauld acts as a Controller (for example, when you create an account directly with Wauld), you may exercise your data subject rights directly with us.

Where Wauld acts as a Processor (for example, when your credential is issued by an organization using Wauld), your relationship with Wauld is governed by the DPA.

Wauld also believes that all data subjects have the following rights:

• provide access to any Personal Data Wauld holds about you;
• update any Personal Data which is out of date or incorrect;
• delete any Personal Data which Wauld is holding about you;
• restrict the way that Wauld processes your Personal Data; or
• provide you with a copy of any Personal Data which Wauld holds about you.

Wauld will try to answer every request promptly where possible, and provide a response within a reasonable time period. However, when deleting your Personal Data, there may be residual information that will remain within Wauld's databases, access logs, and other records, which may or may not contain your Personal Data. Please also note that certain Personal Data may be exempt from such requests in certain circumstances, which may include if Wauld needs to retain your Personal Data to comply with a legal obligation.

Wauld's Services are designed for the creation, issuance, management, and verification of digital credentials. In the course of providing the Services, Wauld may process personal information that an Issuer uploads or that is included in or associated with a Credential, including, where applicable, limited categories of sensitive personal information (which may include, depending on the Issuer's use case, government identifiers, health-related data, biometric data, precise geo-location, or similar categories).

Wauld processes any personal information that an Issuer uploads or that is included in or associated with a Credential ("Credential Data") solely for the purpose of providing the Services as instructed by the Issuer and for complying with applicable legal obligations. Wauld does not use Credential Data for analytics, advertising, behavioral profiling, marketing, training of artificial intelligence models, or any purpose unrelated to the delivery of the Services. Wauld may use aggregated or de-identified data derived from Credential Data, provided that such data does not identify any individual and cannot reasonably be re-identified, for purposes such as improving the Services, generating internal analytics, and benchmarking, but excluding the training of artificial intelligence models.

Issuers are solely responsible for ensuring they have lawful authority and any required consents to upload personal data of Recipients, including any sensitive personal information. Wauld does not independently verify the lawfulness of an Issuer's collection or upload of personal data. Issuers planning to use the Services in a manner that relies centrally on sensitive personal information (for example, credentialing programs that rely centrally on health data, government identifiers, or financial account data) should contact Wauld in advance at dpo@wauld.com to discuss whether additional safeguards or contractual terms are required.

To exercise these rights, or if you have an unresolved privacy or data use concern that Wauld has not addressed satisfactorily, please refer to the How to Contact Our Privacy Officer section below.

12.1 Rights of California Residents (CCPA/CPRA)

If you are a resident of California, you have specific rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). These rights include the following:

Right to Know

You have the right to request that we disclose the following information about your personal information collected over the past 12 months:

• The categories of personal information we have collected
• The sources from which the personal information was collected
• The purposes for which the personal information was collected
• The categories of third parties with whom we share personal information
• The specific pieces of personal information we have collected about you

Right to Delete

You may request that we delete the personal information we have collected from you, subject to certain legal or operational exceptions (such as complying with our legal obligations or completing a transaction you requested).

Right to Correct

You may request that we correct inaccurate personal information we maintain about you.

Right to Opt Out of Sale or Sharing

Wauld may share limited personal information, such as email addresses or behavioral data, with advertising platforms to help us reach new users through targeted ads. This type of sharing qualifies as "cross-context behavioral advertising" under the California Privacy Rights Act (CPRA). California residents who wish to express their preferences regarding the sale or sharing of their personal information may submit a request through Wauld's privacy request portal at https://wauld.app/privacy-request/ or contact our Privacy Officer at dpo@wauld.com. Wauld will honor recognized universal opt-out signals (such as the Global Privacy Control signal) where applicable law requires.

Right to Limit Use of Sensitive Personal Information

Wauld may process limited categories of sensitive personal information (which may include government identifiers, precise geo location, health-related data, or similar categories) where such information is included in or associated with a Credential or otherwise necessary to deliver the Services that an Issuer has requested. Wauld processes any personal information that is included in or associated with a Credential solely for the purpose of providing the Services and does not use such information for advertising, cross-context behavioral advertising, marketing, behavioral profiling, training of artificial intelligence models, or any purpose unrelated to the delivery of the Services. Wauld may use aggregated or de-identified data derived from such information, provided that such data does not identify any individual and cannot reasonably be re-identified, for purposes such as improving the Services and generating internal analytics, but excluding the training of artificial intelligence models.

Under the California Privacy Rights Act, California residents have the right to direct Wauld to limit its use and disclosure of sensitive personal information to only those purposes that are necessary to perform the Services or for the additional permitted purposes specified in the CCPA (Cal. Civ. Code § 1798.121(a)). To exercise this right, please submit a request through Wauld's privacy request portal at https://wauld.app/privacy-request/ or contact our Privacy Officer at dpo@wauld.com. We will honor your request within fifteen (15) business days of receipt.

Right to Use an Authorized Agent

You may designate an authorized agent to submit requests on your behalf. We may require verification of both your identity and the agent's authority before fulfilling the request.

Non-Discrimination

We will not discriminate against you for exercising any of your rights under the CCPA/CPRA. This includes denying services, charging different prices, or altering service levels.

How to Exercise These Rights

To exercise any of the rights described above, please contact us using the information provided under the How to Contact Our Privacy Officer section.

12.2 Rights of Utah Residents (UCPA)

If you are a resident of Utah, you have rights under the Utah Consumer Privacy Act (UCPA). These rights apply to personal data that we collect through your interaction with Wauld.

As a Utah resident, you may:

Right to Access

Request confirmation of whether we are processing your personal data and obtain access to the categories and specific pieces of personal data collected.

Right to Delete

Request the deletion of personal data you have provided to us, subject to legal and operational exceptions.

Right to Obtain a Copy

Request a copy of your personal data that you have previously provided to us, in a portable and readily usable format.

Right to Opt Out

Wauld may use personal information to deliver targeted advertising, including sharing data with platforms such as Google or Meta to help us reach similar audiences. This may include identifiers like email addresses or device data.

You may opt out of targeted advertising at any time by adjusting your privacy settings or contacting us.

You have the right to opt out of the processing of your personal data for:

• Targeted advertising
• The sale of personal data
• Certain automated decision-making (where applicable)

How to Exercise These Rights

To exercise any of the rights described above, please contact us using the information provided under the How to Contact Our Privacy Officer section.

Other U.S. States: Residents of Virginia, Colorado, Connecticut, and other states with comprehensive privacy laws may have rights similar to those described above, including rights to access, delete, correct, and opt-out of certain processing. To exercise such rights, please contact us as described in the How to Contact Our Privacy Officer section.

12.3 Rights Related to Education Records (FERPA)

Wauld may be used by educational institutions to issue credentials or process student-related information. In such cases, Wauld acts solely as a service provider or "school official" under the Family Educational Rights and Privacy Act (FERPA), and we process education records only on behalf of and under the direction of the educational institution.

We do not independently access, use, disclose, or sell student data. All student information remains under the control of the institution that uploads or issues credentials through Wauld. Our role is limited to providing the infrastructure to store, manage, and deliver credentials in accordance with applicable educational policies and agreements.

Requests to access, correct, or delete education records should be directed to the issuing institution. We will assist the institution in responding to such requests as required by FERPA.

12.4 Children's Data Privacy (COPPA)

Wauld is not intended for use by children under the age of 13, and we do not knowingly collect personal information directly from children under 13 years of age.

We do not allow account creation by minors and do not target our services toward them. However, our platform may be used by authorized institutions or organizations (such as schools, nonprofits, or training programs) to issue credentials that may include information about minors under 13, including but not limited to names, email addresses, or photos.

In such cases, Wauld acts as a data processor or service provider, and the responsibility to obtain any required parental or guardian consent under the Children's Online Privacy Protection Act (COPPA) lies with the issuing organization.

If you believe that Wauld has collected personal information about a child under 13 without appropriate authorization, please contact us using the information under the How to Contact Our Privacy Officer section. Upon confirmation, we will promptly delete the information in question.

12.5 Utah Online Privacy Protection Act (UOPPA)

In accordance with the Utah Online Privacy Protection Act (UOPPA), Wauld provides clear and transparent information regarding the personal data we collect, how we use it, and your rights related to that data.

Utah residents may contact us using the information under the How to Contact Our Privacy Officer section to:

• Request access to the personal data we hold about you
• Request corrections or updates to your information
• Request deletion of your account and associated data

We do not share your personal information with third parties except as described in this Privacy Policy, and we update this policy periodically to reflect any material changes.

13. INTERNATIONAL DATA TRANSFERS

Wauld's parent organization and a significant portion of our development and support team are based in India. As a result, personal data may be accessed, processed, or stored by team members located outside your country of residence, including in India.

If you are located in the European Economic Area (EEA), United Kingdom, or other jurisdictions with data transfer restrictions, we ensure that such transfers are governed by appropriate safeguards, including the Standard Contractual Clauses (SCCs) approved by the European Commission or equivalent contractual protections under applicable law.

For more information, or to request a copy of these safeguards, please contact us using the information under the How to Contact Our Privacy Officer section.

14. POLICY UPDATES

Wauld may update this Privacy Policy from time to time, and the updated version will be effective upon posting as to Wauld's treatment of subsequently acquired Personal Information. If Wauld makes any material changes, Wauld will notify you by email (sent to the email address specified in your account) or by means of a notice on this website prior to the change becoming effective. Please check the revision date at the beginning of this Privacy Policy periodically to check for revisions. By continuing to use the Service, including the Website, after a revised version has been posted, you agree to be bound by the revised Privacy Policy as to subsequently acquired Personal Data.

15. MISCELLANEOUS

• Third Party Websites/Applications. The Services may contain links to other websites/applications, and other websites/applications may reference or link to the Services ("Third-Party Websites"). The Third-Party Websites are not controlled by us. Providing personal information to third-party websites or applications is at your own risk. Wauld encourages users to read the privacy policies of each website and application with which they interact. Wauld does not endorse, screen, or approve, and is not responsible for, the privacy practices or content of such other websites or applications.

• Governing Law. By using the Service or by otherwise providing information to us, you agree that any dispute over the privacy or the terms contained in this Privacy Policy will be governed in accordance with the Terms.

• Supervisory Authority. If you are located in Switzerland, the European Economic Area, or Brazil, you have the right to lodge a complaint with a supervisory authority if you believe the processing of your personal information violates applicable law.

16. HOW TO CONTACT OUR PRIVACY OFFICER

If you have any questions, concerns, or requests regarding your personal data or this Privacy Policy, you may contact our Privacy Officer using the details below:

You may also use this contact to exercise your data protection rights under applicable laws, including the GDPR, CCPA/CPRA, UCPA, UOPPA, COPPA, and FERPA, or to submit a privacy request through Wauld's privacy request portal at https://wauld.app/privacy-request/.

Wauld Privacy Policy | Last updated May 21, 2026