Global Privacy Notice

1. Scope and Roles

This Notice describes personal data processing by PrediSmart Global, LLC in connection with the institutional website, accounts, Platform, support, security, business administration, and related services. Depending on the processing activity and contractual relationship, PrediSmart may act as a controller/business for its own purposes or as a processor/service provider on behalf of a Customer. Customer-controlled operational data is also subject to the Customer’s own privacy responsibilities.

2. Categories of Data

PrediSmart may process account and identity data; organizational and role data; contact information; authentication and security records; device, browser, network and technical data; operational records; work orders and audit events; images and attachments; OCR-derived information; voice or text reports when enabled; asset, meter, route, inventory, structure, TAG, IoT and sensor-related information; support communications; billing and transaction metadata; and other information submitted through authorized Platform functions.

3. Purposes

Data is processed to provide and administer the Platform; authenticate and authorize access; maintain tenant isolation and security; execute Customer-configured workflows; synchronize offline and online operations; maintain records and auditability; support users; operate integrations and notifications; prevent abuse and fraud; meet legal and contractual obligations; administer billing; and improve reliability, usability, and security.

4. Legal Bases

Where GDPR or similar law applies and PrediSmart acts as controller, processing may rely on performance of a contract, steps requested before a contract, legitimate interests, compliance with legal obligations, protection of vital interests where applicable, or consent where consent is the appropriate legal basis. Where PrediSmart acts as processor, processing is performed on documented Customer instructions and the applicable DPA, subject to legal requirements.

5. Sharing and Recipients

Personal data may be disclosed to authorized Customer personnel; service providers and subprocessors supporting cloud infrastructure, authentication, communications, security, payments, analytics or other contracted functions; professional advisers; authorities where legally required; and transaction counterparties in a lawful corporate transaction subject to appropriate protections. PrediSmart does not authorize recipients to use processor data for unrelated independent purposes.

6. International Transfers

PrediSmart operates internationally and may process data in countries other than the individual’s location. Where transfer restrictions apply, PrediSmart and the relevant Customer shall use an applicable legal transfer mechanism and supplementary safeguards as required. Current subprocessor and transfer information is maintained under PS-LEGAL-008.

7. Retention

Data is retained for periods reasonably necessary for the purposes described, Customer instructions, security, auditability, contractual obligations, dispute handling, legal requirements, and legitimate business records. Retention may vary by data category and Customer configuration. Data subject to a legal hold or mandatory retention requirement may be retained longer.

8. Security

PrediSmart uses technical and organizational safeguards designed for the nature and risk of the processing, including access controls, authentication, authorization, tenant separation, auditability, secure development practices, integrity controls, monitoring, and other measures appropriate to the service. No system can guarantee absolute security.

9. Individual Rights

Rights depend on the applicable jurisdiction and PrediSmart’s role. They may include access, confirmation, correction, deletion, restriction, portability, objection, information about sharing, withdrawal of consent where consent is the basis, non-discrimination for exercising applicable privacy rights, and review of certain automated decisions where legally required. Requests may require identity verification and may be directed to the Customer where the Customer controls the relevant data.

10. Brazil Notice

Where Brazil’s LGPD applies, individuals may exercise rights provided by applicable law, and PrediSmart will provide clear information regarding relevant processing for which it acts as controller. Where PrediSmart acts as operator, requests concerning Customer-controlled data may be referred to the applicable controller. International transfers are handled according to applicable LGPD requirements and ANPD rules.

11. EEA/Portugal/Spain Notice

Where GDPR applies, required controller information, purposes, legal bases, recipients, transfers, retention criteria and rights are provided through this Notice and applicable supplemental notices. Individuals may lodge a complaint with the competent supervisory authority. Processing on behalf of Customers is governed by the applicable data processing terms.

12. United States and California Notice

Applicable U.S. privacy rights vary by state. Where the California Consumer Privacy Act, as amended, applies to PrediSmart as a business, eligible California consumers may exercise applicable rights to know, delete, correct, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive non-discriminatory treatment. PrediSmart does not state that a statutory right applies where the relevant law does not apply to the relationship or data.

13. Sale and Targeted Sharing

PrediSmart does not sell Customer operational data as a business model. If a future processing activity constitutes a statutory sale, sharing, or targeted advertising activity under an applicable law, PrediSmart will provide the required notice and choice before relying on that activity.

14. Cookies and Similar Technologies

The institutional website and Platform may use necessary storage and similar technologies for security, preferences, session continuity and functionality. Any non-essential analytics, advertising, or comparable technology is governed by PS-LEGAL-006 and applicable consent or opt-out requirements.

15. Automated Processing, OCR and AI-Assisted Functions

PrediSmart may use automated processing to extract, classify, organize, correlate, summarize, detect patterns, or support contextual operational functions. Such processing does not by itself transfer professional, legal, safety, or operational responsibility from the Customer. Where applicable law grants rights concerning solely automated decisions with legal or similarly significant effects, those rights will be honored.

16. Children

The Platform is intended for authorized organizational and professional use and is not directed to children. Customers must not provision users who are not legally eligible for the intended service unless expressly authorized under an applicable agreement and lawful process.

17. Changes

This Notice is versioned. Material changes will be communicated as required. Where a change affects processing based on consent, applicable consent requirements will be respected.