Website Privacy Policy

Locus Robotics (“Locus,” “we,” “us,” or “our”) created this Privacy Policy to explain how we collect, use, disclose, and otherwise process Personal Data when you visit https://locusrobotics.com and other digital properties that link to this Privacy Policy (collectively, the “Website”), interact with us for business or marketing purposes, or otherwise interact with us in circumstances where Locus determines how and why your Personal Data is processed.

For purposes of this Privacy Policy, “Personal Data” means information that identifies, relates to, describes, or can reasonably be linked to an individual or household, or as otherwise defined under applicable privacy laws.

If you are coming to our Services from the European Union (EU), European Economic Area (EEA), or United Kingdom (UK), or certain U.S. States, you may be entitled to certain individual rights under applicable Data Protection Laws. Please see the Notice to Certain Residents of Data Subject Rights for more information.

I. Scope of This Privacy Policy

This Privacy Policy applies to Personal Data we collect:

• through the Website;
• when you contact us, request information or a demonstration, download materials, or otherwise communicate with us;
• in connection with our sales, marketing, events, webinars, and other business development activities; and
• in connection with our relationships with Customers, prospective customers, vendors, suppliers, business partners, and their representatives.

Customer Data Processed on Behalf of Our Customers

This Privacy Policy does not apply to Personal Data that Locus processes on behalf of its customers through Locus in connection with the use of our autonomous robotics solution (the “Subscription Service”) and related support services, including customer success and other professional services (the “Support Services”) that we provide to our customers (“Services” shall mean, collectively, the Subscription Service and Support Services). For purposes of this Privacy Policy, “Customer” means any entity that purchases a license or subscription to any portion or component of the Services and “Customer Data” means the Personal Data uploaded into or otherwise made accessible to any portion of the Services by or for Customer, as further described below.

Locus processes Customer Data on behalf of a Customer as described in the Master Agreement with the Customer and any required data processing agreement (DPA). When providing such services, Locus acts as data processor or service provider, as applicable. If you are an end-user of Locus’s Subscription or Support Services, you may have certain privacy rights. If you want to exercise those privacy rights, you should direct your request to the Locus Customer you work for or interact with directly (the data controller). Locus will assist Customers in handling privacy rights requests as required by our agreements and applicable law.

Additionally, this Privacy Policy also does not apply to Personal Data collected in the employment or applicant context, which is addressed in our separate Employee and Applicant Privacy Notice.

II. Personal Data We Collect About You

The Personal Data we collect depends on how you interact with us and may include:

Category	Examples
Identifiers and Contact Information	Name, business email address, telephone number, business address, IP address, and similar identifiers
Professional Information	Employer, job title, department, professional role, and other business information
Commercial Information	Products or services of interest, business relationship information, and interactions with Locus
Internet and Electronic Activity	Website activity, pages viewed, links clicked, referring URLs, browser and device information, IP address, and interactions with our digital communications
Approximate Location	General location derived from an IP address or similar information
Communications and Other Information You Provide	Inquiries, messages, feedback, event registrations, form submissions, and other information you choose to provide
Preferences and Inferences	Marketing preferences, interests, and information regarding interactions with our Website and communications

III. How We Collect Personal Data

We may collect Personal Data:

• Directly from you. For example, when you contact us, complete a form, purchase our Services, request a demonstration, download materials, attend an event, or otherwise communicate with us.
• Automatically. We collect certain Personal Data when you interact with our Website and digital communications through cookies and similar technologies.
• From Customers and business partners. We may receive business contact information through our existing and prospective customer relationships, referrals, events, and other business relationships.
• From third parties and publicly available sources. We may obtain business contact and professional information from marketing and lead-generation providers, event organizers, professional networking platforms, publicly available databases, and other sources, as permitted by applicable law.

IV. Cookies and Similar Technologies

We and/or certain service providers operating on our behalf may collect Personal Data about your activity, or activity on devices associated with you over time, on our sites and applications, and across non-affiliated websites or online applications. We may collect this Personal Data by using certain technologies, such as cookies, web beacons, pixels, software developer kits, third party libraries, and other similar technologies. Third party service providers, advertisers, and/or partners may also view, edit, or set their own cookies or place web beacons.

• Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting, you may be unable to access certain parts of our Services. Our system may issue cookies when you direct your browser to our Website. Non-essential cookies and similar technologies will be set only where permitted by applicable law and, where required, after you have provided consent.
• Web Beacons. Website pages may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us, for example, to count users who have visited those pages and for other related statistics (for example, recording the popularity of certain content and verifying system and server integrity). We also use these technical methods to analyze the traffic patterns, such as the frequency with which our users visit various parts of the Services. These technical methods may involve the transmission of Personal Data either directly to us or to a third party authorized by us to collect Personal Data on our behalf. Our Services use retargeting pixels from Google, Facebook, and other ad networks. We also use web beacons in HTML emails that we send to determine whether the recipients have opened those emails and/or clicked on links in those emails.
• Analytics. Analytics are tools we may use, such as Google Analytics, to help provide us with Personal Data about traffic to our Website and use of our Services, which Google may share with other services and websites who use the collected data to contextualize and personalize the ads of its own advertising network. We have enabled measures to restrict the way Google uses certain unique identifiers and other data processed in the provision of the Services. You can view Google’s Privacy Practices here: Privacy Policy – Privacy & Terms – Google.

Our use of online tracking technologies may constitute a “sale” or “sharing” of Personal Data under certain laws. To the extent that disclosing Personal Data to providers of these technologies is deemed a “sale” or “sharing,” you may opt out of that sale or sharing by using our Cookie Settings tool or by broadcasting an opt-out preference signal, such as the Global Privacy Controls (GPC). We recognize and honor GPC signals as a valid opt-out request under applicable law. Please note that some features of our Website may not be available to you as a result of these choices.

V. How We Use Personal Data

We may use Personal Data:

• To operate, maintain, secure, and improve our Website;
• To respond to inquiries and requests;
• To provide requested information, materials, and demonstrations;
• To communicate with Customers, prospective customers, vendors, and business partners;
• To establish and manage our business relationships;
• To administer contracts and transactions;
• To conduct sales, marketing, and business development activities;
• To send marketing and promotional communications, subject to applicable law and your preferences;
• To administer events and webinars;
• To understand how visitors use our Website and interact with our communications;
• To conduct analytics and measure the effectiveness of our Website, advertising, and marketing activities;
• To personalize Website content and advertising;
• To detect, investigate, and prevent fraud, security incidents, and misuse;
• To comply with applicable laws, regulations, and legal processes;
• To establish, exercise, or defend legal claims; and
• To accomplish other purposes disclosed to you at the time Personal Data is collected.

VI. How We Share or Disclose Personal Data

We may share and/or disclose your Personal Data as set forth in the Privacy Policy and in the following circumstances:

• Third Party Service Providers. We may share your Personal Data with third-party service providers that perform certain functions or services on our behalf (such as to host the Website, manage databases, perform analyses, provide customer service, or send marketing communications for us). These third-party service providers are authorized to use your Personal Data only as necessary to provide these services to us. In some instances, we may aggregate Personal Data we collect so third parties do not have access to your identifiable Personal Data to identify you individually.
• Personal Data Shared with our Subsidiaries and Affiliates. We may share your Personal Data with our subsidiaries and affiliates.
• Business Partners. We may disclose Personal Data to business partners in connection with events, referrals, joint marketing activities, and other business relationships.
• Governmental Authorities and Others for Legal Purposes. We may disclose Personal Data where reasonably necessary to comply with law, legal process, regulatory requirements, or governmental requests; enforce our agreements; investigate security or fraud; or protect the rights, property, or safety of Locus or others.
• Business Transfers. Personal Data may be disclosed or transferred in connection with a merger, acquisition, financing, reorganization, sale of assets, or similar corporate transaction.

We may also disclose Personal Data at your direction or with your consent.

VII. Links to Other Websites

The Website may contain links to other websites or services that are not owned or controlled by us, including links to Social Media Platforms such as Facebook, Instagram, or YouTube, or may redirect you off our Website away from our Services.

This Privacy Policy only applies to Personal Data collected by our Services. We are not responsible for the privacy and security practices of those other websites or Social Media Platforms or the Personal Data they may collect (which may include IP address). You should contact such third parties directly to determine their respective privacy policies. Links to any other websites or content do not constitute or imply an endorsement or recommendation by us of the linked website, Social Media Platform, and/or content.

VIII. Information Security

We maintain reasonable administrative, technical, and organizational safeguards designed to protect Personal Data against unauthorized access, use, disclosure, alteration, loss, or destruction. However, no information system or transmission of information over the Internet can be guaranteed to be completely secure.

IX. Data Retention

We retain Personal Data only for as long as reasonably necessary for the purposes for which it was collected or otherwise processed, including to maintain our business relationships, comply with legal and regulatory obligations, resolve disputes, enforce agreements, and establish or defend legal claims. Retention periods vary depending on the category of Personal Data and the purpose for which it is processed. We determine applicable retention periods using the criteria described in this section, including the nature and sensitivity of the Personal Data, the purposes for which it was collected, the potential risks associated with continued retention, applicable legal requirements, and our legitimate business needs. For individuals in the EU, EEA, and UK, additional retention considerations are described in the “Retention” subsection of the EU/EEA/UK section below.

X. Your Marketing Choices

• Marketing Communications. If you do not want to receive marketing and promotional emails from us, you may click on the “unsubscribe” or “Update Subscription Preferences” links in emails we send you to unsubscribe and opt out of marketing email communications or see “Contact Us” below for more information.
• Text Messages. As part of marketing our Services to businesses, contacts may voluntarily sign up to receive text messages from Locus or third-party service providers that send these communications on behalf of Locus (e.g., text message marketing). By signing up for text messaging services or otherwise expressly opting in to receive text messages (opting in via short code or entering your phone number into a collection widget), you agree that you have provided Locus with prior express written consent to be contacted by text message, including recurring automated promotional and personalized marketing text messages. Message and data rates may apply. Please note, we will not disclose text messaging opt–in data with any third parties for their marketing purposes. You may revoke your consent and opt out to discontinue text messages at any time. If you no longer want to receive text messages from us, reply STOP (or as otherwise instructed).
• Cookies & Other Tracking Technologies. You can manage your preferences through our Cookie Settings tool. We also recognize legally required browser-based opt-out preference signals, including Global Privacy Control (“GPC”), where required by applicable law. Please note that if you choose to block cookies and other trackers, certain features of the Website may not work. Blocking or rejecting cookies will not stop all of the tracking described in this Privacy Policy. These features and options are browser and device specific and are not uniform. You can find these settings in the options or preferences menu of your browser.

XI. Notice to Certain Residents of Data Subject Rights

A. Notice of Privacy Rights for Residents of Certain U.S. States

Residents of certain U.S. states may have rights and choices regarding their Personal Data. These rights may apply in the following states: Alabama, California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Utah, Vermont, and Virginia. To the extent any data protection law applies to our collection of your Personal Data on our Website, this supplemental section of our Privacy Policy outlines the individual rights you may be entitled to and how to exercise those rights.

Depending on where you live and subject to certain exceptions, you may have some or all of the following rights:

1. Right to Know and Access. You may have the right to request that we confirm whether we process your Personal Data, and to request information about our collection and use of your Personal Data, including whether we sell or share your Personal Data. You also have the right to request access to Personal Data we may process about you.
2. Right to Data Portability. Where the processing is carried out by automated means, and subject to certain exceptions, you may have the right to request and obtain a copy of your Personal Data that you previously provided to us in a portable format. In addition, to the extent technically feasible, you may have the right to obtain your Personal Data in a readily usable format that allows you to transmit the Personal Data to another data controller without hindrance.
3. Right to Request Correction of Inaccurate Personal Data. To the extent that we may maintain inaccurate Personal Data, you may have the right to request that we correct such inaccurate Personal Data, taking into account the nature of the Personal Data and the purposes of the processing of the Personal Data.
4. Right to Request Deletion. You may have the right to request that we delete certain Personal Data or records provided by or obtained about you, with certain exceptions and limitations as allowed under law.
5. Right to Object. You may have the right to object to the processing of your Personal Data on grounds relating to your particular situation.
6. Right to Opt Out of the Sale and Sharing of Personal Data. You may have the right to opt out of the processing of your Personal Data for the purpose of selling or sharing your Personal Data for cross-context behavioral advertising.
7. Right to Opt-Out of the Use of Personal Data for Targeted Advertising and Profiling. You may have the right to opt out of the processing of your Personal Data for purposes of targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.
8. Right to Non-Discrimination. You may have a right to not be discriminated against in the Services or quality of Services you receive from us for exercising your rights. We will not discriminate against you for exercising any of your rights in this section including denying goods or Services, charging different prices or rates for goods or Services, or providing a different level of quality of goods and Services. However, we may offer a different price, rate, level, quality, or selection of goods or Services, including offering goods or Services for no fee, if you have exercised your right to opt-out.
9. Right to Disclosure of Third-Parties. You may have a right to know the categories and names/addresses of third parties that we have disclosed your Personal Data to under this Policy.
10. Right to Appeal. You may have the right to appeal our denial of any request you make under this section. To exercise your right to appeal, please submit an appeal request via the information in the Contact Us section below or using the Your Privacy Choices form. Within the timeframe prescribed by applicable law, we will inform you in writing of any action taken or not taken in response to your appeal, including a written explanation of the reasons for our decision. If we deny your appeal, you may contact the Attorney General or another authority which we will help you identify.

To learn more about whether you are granted certain rights, or to submit a request to exercise your rights, please contact us using any of the methods in the Contact Us section.

As noted above, if you are an end-user of Locus’s Subscription or Support Services, you may also have certain privacy rights. If you want to exercise those privacy rights, you should direct your request to the Locus Customer you work for or interact with directly (the data controller). Locus will assist our Customers in handling privacy rights requests as required by our agreements and applicable law.

B. Notice to Individuals in the European Union, the European Economic Area, and the UK

This section applies only to individuals coming to our Services from within the European Union (“EU”), the European Economic Area (“EEA”), and the UK, and only if we collect through the Services Personal Data from you that is subject to the General Data Protection Regulation (GDPR) or the UK Data Protection Act 2018.

Personal Data includes any information relating to an identified or identifiable natural person, who could be identified either directly or indirectly by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person (which may include some or all of your Personal Data, as defined in this Privacy Policy).

1. Identity and Contact Details of Privacy Contact

Unless otherwise stated, for purposes of this Website, we are the Data Controller for the Personal Data we process.

Email: privacy@locusrobotics.com
Write us: Locus Robotics Corporation
Attn: Data Privacy
100 Fordham Rd.
Wilmington, MA 01887

2. Your Data Protection Rights

To the extent the GDPR and Data Protection Act 2018 apply, and we hold your Personal Data in our capacity as a Data Controller as defined under those laws, you may request that we:

• Restrict the way that we process and share your Personal Data;
• Transfer your Personal Data to a third party;
• Provide you with access to your Personal Data;
• Remove your Personal Data if no longer necessary for the purposes collected;
• Update your Personal Data so it is correct and not out of date; and/or
• Object to our processing of your Personal Data.

You may also revoke your consent for processing of your Personal Data. If you wish to object to the use and processing of your Personal Data or withdraw consent to this Privacy Policy, you can contact us as outlined in the Contact Us section.

The requests above will be considered and responded to in the time-period stated by applicable law. Note, certain Personal Data may be exempt from such requests. We may require additional Personal Data from you to confirm your identity in responding to such requests.

Locus does not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects concerning individuals.

3. Data Protection Complaints

If you have any queries or concerns about our handling of your Personal Data, please contact us directly via privacy@locusrobotics.com. We will confirm receipt and our next steps within 30 days and all queries will be investigated without undue delay. In all cases we will provide you with an outcome that explains what steps we have taken following your concern.

If you are not satisfied with our response, you may report your concerns to the data protection authority of the country where you live or work, or where you believe your rights have been infringed. If you are in the UK, the Information Commissioner’s Office (ICO) generally requires that you first raise your complaint with us before it will consider the matter. The UK’s ICO can be contacted at https://ico.org.uk/make-a-complaint/. The contact details of each EU national data protection authority can be found at: https://www.edpb.europa.eu/about-edpb/members_en.

4. Lawful Basis for Processing Your Personal Data

The lawful basis for our processing of your Personal Data will depend on the purposes of the processing.

• Legitimate Interests. We may process Personal Data where necessary for our legitimate business interests, including operating and improving our Website and business, communicating with business contacts, developing and managing customer and prospective customer relationships, securing our systems, conducting appropriate B2B marketing, and protecting our legal rights.
• Consent. We rely on consent where required by applicable law, including for certain marketing communications and non-essential cookies and similar technologies. You may withdraw your consent at any time.
• Contract. We may process Personal Data where necessary to enter into or perform a contract with you.
• Legal Obligations. We may process Personal Data where necessary to comply with applicable legal or regulatory obligations.

If the processing of your Personal Data is based on your consent, the GDPR and Data Protection Act 2018 also allow users the right to access, revoke, or modify your consent at any time. Please see the Contact Us section, below, to review or modify your consents.

5. Consent to Transfer

Locus is based in the United States and operates internationally. Accordingly, we may use service providers based in the United States to operate our business and our relationship with you. Please be aware that Personal Data that we collect may be transferred to, stored, and processed in the United States, a jurisdiction in which the privacy laws may not be as comprehensive as those in the country where you reside and/or are a citizen. We maintain measures to address the transfer of your Personal Data between our group companies and between us and our third-party providers in accordance with applicable data protection laws and regulations.

6. Retention

We will retain your Personal Data for as long as needed for the purposes described in this Privacy Policy. More specifically, the time we maintain your Personal Data depends on the following factors:

• Whether we need the Personal Data to provide the Services. We will maintain any data needed to provide you with the Services, such as contact information and payment or transaction information, for as long as needed for us to provide you with the Services, respond to your questions and requests, and/or administer your account (if applicable).
• Whether we need the Personal Data to comply with our legal obligations. We may have legal obligations to maintain your Personal Data where a legal or regulatory body may ask for it in the future, for example in response to a data subject request or complaint. This Personal Data may include contact information and location information.
• Whether we need the Personal Data for a legitimate business interest. We may store Personal Data like contact information, cookies, and location information in order to perform analytics, troubleshoot errors, or improve our Services. In any event, we delete the Personal Data when it is no longer needed for our legitimate interest.

Regardless of our reason for retaining your Personal Data, we delete all Personal Data in accordance with our routine record keeping policies.

XII. Exercising Your Data Subject Rights

To exercise any of the rights described above, please submit a verifiable consumer request to us via the methods described below. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Data, or an authorized representative; and
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

To help protect your privacy and maintain security, if you request access to or deletion of your Personal Data, we will take steps and may require you to provide certain information to verify your identity before granting you access to your Personal Data or complying with your request. In addition, if you ask us to provide you with specific pieces of Personal Data, we may require you to sign a declaration under penalty of perjury that you are the consumer whose Personal Data is the subject of the request. Only you or your authorized agent may make a verifiable consumer request related to your Personal Data. If you designate an authorized agent to make a request on your behalf, we may require you to provide the authorized agent written permission to do so and to verify your own identity directly with us (as described above). You may also make a verifiable consumer request on behalf of your minor child.

XIII. Notice to California Residents – “Shine the Light” Requests

Under California Civil Code Section 1798.83, the “Shine the Light” law, our customers who are residents of California may request certain information about our disclosure of Personal Data during the prior calendar year to third parties for the third parties’ direct marketing purposes. We do not disclose Personal Data to third parties for their own direct marketing purposes.

To make a request or to contact us to learn more information, please visit the Contact Us section below.

XIV. Geographic Location of Data Storage and Processing

Locus is based in the United States and operates internationally. Personal Data may therefore be processed in the United States and other countries where Locus, its affiliates, or its service providers operate. Some of these countries may have different data protection laws than your country of residence. Where applicable law requires safeguards for international transfers of Personal Data, we use appropriate safeguards, which may include adequacy decisions, approved contractual safeguards such as the European Commission’s Standard Contractual Clauses, the UK International Data Transfer Addendum or other legally recognized transfer mechanisms, as applicable.

XV. Children

Our Website and marketing activities are intended for business and professional audiences and are not directed to children under 13, or under 16 where applicable law sets a higher age threshold. We do not knowingly collect Personal Data from children through our Website in circumstances requiring parental consent. If we learn that we have collected Personal Data from a child in violation of applicable law, we will take appropriate steps to delete it.

XVI. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes to our practices, technologies, legal requirements, or other factors. When we make changes, we will update the “Last Updated” date above and provide additional notice where required by applicable law.

XVII. Contact Us

If you have questions about this Privacy Policy, our privacy practices, or would like to exercise an applicable privacy right, please contact us at:

Locus Robotics Corporation
100 Fordham Rd.
Wilmington, MA 01887
Attn: Data Privacy
Email: privacy@locusrobotics.com