PRIZM Privacy Policy

This Privacy Policy explains how NEXTWAVE collects, uses, discloses, protects, retains, and transfers personal information through the PRIZM website, dashboard, customer accounts, and related industrial connectivity services (the "Services"). It applies globally, subject to additional rights and requirements under laws that apply in particular locations. It does not replace a customer's own employee or end-user privacy notice.

Information we control. NEXTWAVE generally determines the purposes and methods of processing personal information used to manage its website, accounts, billing, customer relationships, security, support, and marketing. For this information, NEXTWAVE generally acts as a data controller (or the equivalent role under applicable law).

Customer-controlled data. PRIZM is designed primarily to connect industrial equipment, sensors, and operational systems. Machine telemetry such as temperature, voltage, battery status, fault codes, and equipment operating hours ordinarily does not identify an individual. However, information such as operator IDs, access logs, screen captures, precise location histories, or machine records linked to a person may qualify as personal information. When a customer decides what such information to collect through PRIZM, NEXTWAVE generally acts as a processor or service provider on that customer's behalf, under the customer's instructions and any applicable Data Processing Agreement ("DPA"). The customer is responsible for providing required notices, obtaining necessary legal grounds, and responding to data subject requests concerning its own data, with our assistance where applicable.

The distinction above depends on the actual data and processing activity. NEXTWAVE may act as an independent controller for its own security and account records even when it processes customer telemetry as a processor.

Depending on how you interact with PRIZM, we may collect:

• Account and business contact information: name, work email, organization, job role where provided, account identifier, access permissions, and marketing preferences.
• Transaction information: subscription, invoice, transaction status, billing contact and limited payment references. Payment cards are entered with our payment processor, Stripe; NEXTWAVE does not intentionally receive or store full card numbers.
• Service and support communications: messages, technical-support requests, attachments you choose to send, and records of responses.
• Technical and security information: IP addresses, login activity, time stamps, browser or device information, requests to the Services, authentication records, and security events as needed to operate and protect the Services.
• Connected-device information: device identifiers, connectivity status, network information, and cellular tower identifiers. Where a cellular-location feature is used, tower information may be used to estimate a device's approximate geographic location. Device location may be personal information if it can reasonably be linked to an individual.
• Website analytics: we currently use a self-hosted instance of Umami to understand aggregate website and service usage without analytics cookies. Essential account, security, or content-delivery technologies may nevertheless use cookies or similar mechanisms where necessary.
• Customer Data: machine readings, configuration values, uploaded files, screen captures, or other content transmitted or selected by a customer. This is generally processed on the customer's behalf as described in Section 1.

We do not intentionally collect sensitive personal information through ordinary account registration. Customers should not send sensitive personal information in machine telemetry or support attachments unless necessary, authorized, and covered by appropriate safeguards and agreements.

We process the information described above to:

• Provide and administer the Services: create accounts, authenticate users, process billing, deliver requested features, and provide technical support. Where applicable, the legal basis is performance of a contract or steps requested before entering one.
• Keep the Services secure and reliable: detect abuse, investigate faults, maintain access records, prevent fraud, and protect connected systems. Where applicable, the legal basis is legitimate interests or compliance with law, balanced against individual rights.
• Communicate important service information: respond to requests and provide account, transaction, security, and operational notices. The legal basis may be contract, legal obligation, or legitimate interests as applicable.
• Meet legal requirements: maintain legally required accounting records, handle lawful requests, and comply with applicable privacy, cybersecurity, and other laws.
• Improve product reliability and usability: analyze technical performance and aggregate or de-identified usage information, applying safeguards to avoid identifying individuals unnecessarily. Where applicable, we rely on legitimate interests or another lawful basis.
• Send optional marketing: provide product updates and promotional messages only where you have opted in or where another lawful basis and required notice permit them. You may unsubscribe at any time.

Where consent is required for a particular activity or cross-border transfer, we seek it separately and allow withdrawal subject to applicable law. If you do not provide information needed to operate an account or requested function, the relevant function may be unavailable.

NEXTWAVE processes Customer Data to provide the functions the customer has selected: collecting and transmitting machine data, storing it within applicable plan limits, displaying dashboards, issuing configured alerts, supporting integrations, and performing contracted analytics or automation tasks. Access by NEXTWAVE personnel or authorized vendors is limited to what is reasonably necessary for support, maintenance, security, legal compliance, or another purpose authorized by the customer, subject to appropriate access controls and confidentiality obligations.

We do not sell Customer Data or use identifiable Customer Data to train general-purpose AI models without the customer's affirmative authorization or separate written agreement. If an optional AI feature sends data to a third-party model or processing provider, we will identify the material provider arrangements and applicable processing terms before or when that feature is enabled, as required by law. Customers are responsible for deciding what information to submit to optional AI features.

Customers may configure webhooks, exports, and integrations. Transfers to customer-selected destinations occur under the customer's instructions and responsibilities; NEXTWAVE remains responsible for transfers and processing that it determines or conducts independently under applicable law.

We do not sell personal information. We may share it with staff, affiliates, professional advisers, or contracted providers only where needed for the purposes in this Policy, under appropriate duties of confidentiality and security. The main current categories and providers are:

Provider identity, legal entity, processing location, and transfer details may vary by country, contracted service, or deployment. When law requires more specific information, an up-to-date subprocessor or overseas-transfer disclosure, DPA, or applicable account notice will provide it. Each provider processes information only as required for its assigned purposes, subject to applicable agreements and law.

We may also disclose information where legally required; to prevent or investigate fraud, security incidents, or abuse; to protect rights or safety; or in connection with a merger, acquisition, financing, or business transfer, with applicable notices and protections. We do not disclose customers' names, logos, or confidential use cases for marketing without permission.

PRIZM's standard hosted platform uses AWS infrastructure in the Republic of Korea. Certain supporting services process personal information outside Korea, including the cross-border services listed in Section 5. International transfers may occur when you create an account, access the Services, pay, use cellular connectivity, or request a device-location lookup, depending on the feature. Data is sent through relevant electronic networks for those specific purposes.

We take measures required by applicable cross-border data laws, which may include contractual safeguards, recognized adequacy arrangements, standard contractual clauses, notice, consent where required, a transfer assessment, or other legal mechanisms. For individuals in the European Economic Area, the United Kingdom, or Switzerland, applicable transfer mechanisms and safeguards will be provided where required. For personal information governed by Korean law, we will provide the overseas-recipient, purpose, transfer-method, retention, and other notices or choices required by the Personal Information Protection Act.

Customer-configured export features may transmit Customer Data to destinations selected by the customer. Customers remain responsible for their instructions and required legal grounds. Alternative hosting or local storage is available only where expressly agreed in an applicable Order; it should not be inferred from this Policy.

We retain personal information only for as long as reasonably necessary for the purposes stated in this Policy, taking account of legal obligations and the categories below:

• Account contact and profile information: generally while the account remains active. We may close and delete information associated with accounts that have been inactive for two (2) years, following advance notice where reasonably possible, unless continued retention is required by law or justified for a legitimate purpose.
• Customer machine telemetry and other Customer Data: in accordance with the subscription plan, selected retention settings, applicable Order, and DPA. An active account does not imply indefinite historical-data retention. See https://prizm.io/software/cloud/pricing and the Terms of Service.
• Ordinary server request logs: currently retained for up to three (3) days, except where a particular record must be preserved longer for incident investigation, security, abuse prevention, or legal reasons. Other account-level security or transaction records may follow different justified schedules.
• Billing, invoices, and transaction records: for the period required by tax, accounting, or other applicable laws.
• Support requests and communications: for the period reasonably needed to resolve the request, maintain service records, and meet any legal requirements.
• Backups: personal information may remain temporarily in protected backup copies and will be deleted or overwritten under applicable backup rotation schedules, unless a legal hold applies.

When information is no longer needed, we delete or irreversibly de-identify it using methods appropriate to the data and systems. No claim of immediate deletion from all backups is intended where lawful backup rotation or legal preservation applies.

Depending on your location and applicable law, you may have the right to request access to personal information, correction of inaccurate data, deletion, restriction or suspension of processing, objection to certain processing, portability, withdrawal of consent, or information about international transfers. You may also have the right to complain to a competent privacy regulator.

To exercise your rights, contact the Privacy Officer as described in Section 13. We may request information necessary to verify your identity and will respond within the time required by applicable law. Where your request concerns personal information controlled by a PRIZM customer rather than NEXTWAVE, we may direct you to that customer or assist the customer in addressing your request, as appropriate.

Marketing: marketing communications are off unless you opt in, except where a separate lawful basis permits communication. You can unsubscribe using your account settings, the link in a message, or by contacting us. You may still receive essential service and security notices.

Cookies: you may control nonessential cookies through available preferences and browser settings where applicable. Disabling essential authentication or security functions may prevent parts of PRIZM from working.

We use technical and organizational measures appropriate to the information and risks involved, which may include access restrictions, authentication, encryption in transit where supported, logging, vendor controls, and incident-response procedures. No internet-connected system is completely secure. Customers are responsible for securing their own credentials, local networks, machines, gateways, integrations, and account permissions.

If a security incident affects personal information, we will investigate, take reasonable protective steps, and notify affected persons, customers, or regulators when and within the time required by applicable law or the relevant DPA.

Some supported connectivity configurations use cellular tower identifiers to estimate a connected device's approximate location. This indicates the estimated location of the device, not necessarily the location of a person. However, a device's location may be personal information if it is linked to an employee, driver, operator, or another identifiable individual. Customers must provide necessary notices and satisfy applicable consent or other legal requirements before using PRIZM to monitor people through their assigned devices.

The Services are designed for business and industrial use, not for children. We do not knowingly seek personal information from children through direct account registration. If you believe a child has provided information to NEXTWAVE without appropriate authorization, contact us so that we can assess and take action as required. Customers must not transmit sensitive personal information through their deployments without a lawful basis and appropriate controls.

We may update this Policy to reflect changes in law, service providers, features, or processing practices. The current version and its effective date will be posted at https://prizm.io/resources/privacy. We will provide additional notice and obtain consent when required for a material change in how we use personal information. Historical versions may be made available on request where practicable.