Privacy Policy

Vespera Life, LLC (“Vespera,” “we,” “us,” or “our”) collects and uses personal data to provide world-class services for our employees, clients, and partners. This Policy sets forth how Vespera handles personal data collected in the normal course of business and when you use our website and services.

---

Purpose

Vespera strives to be global and consistent in how it handles personal data. This privacy policy applies to:

• All individuals who provide personal information — consumers, customers, research subjects, business partners, shareholders, job applicants, employees, retirees, and others.
• All locations where we operate, even where local regulations do not exist.
• All methods of contact, including in person, written, via the Internet, direct mail, telephone, or facsimile.

This Policy describes Vespera’s standard global procedure governing access to and use of Vespera’s Personal Data across borders. Notwithstanding any limited application to Vespera’s industry, Vespera complies with such legislation as the Health Insurance Portability and Accountability Act of 1996 (as amended), Subtitle A of Title V of the Gramm-Leach-Bliley Act, the Sarbanes-Oxley Act of 2002, and other privacy laws, rules, and regulations that may apply to Vespera, its employees, or its clients.

This Policy does not necessarily describe how local management may handle personal data in order to comply with local privacy laws. Local management, in conjunction with the responsible human resources personnel, will be responsible for accessing and complying with local or unique laws regarding the processing of personal information in that particular locale.

This Policy is also designed to inform all employees about their obligation to protect the privacy of all individuals (including co-employees, independent contractors, or sub-contractors) and the security of their personal information. Violation of this Policy, whether negligent or intentional, will be subject to disciplinary action by Vespera.

---

Scope

This is a global policy.

---

Definitions

• Controller — Vespera and its authorized personnel, which determine the purposes and means of processing of Personal Data.
• Data Subject — Any employee or third person (e.g., consultant or independent contractor) who can be identified, directly or indirectly, in particular by reference to an identification number or to one or more factors specific to his or her physical, physiological, mental, economic, cultural, or social identity.
• General Business Purpose — The processing of Personal Data for any activity related to the commercial operations of Vespera’s worldwide organization. This includes, but is not limited to, sales, marketing, research and development, protecting intellectual property, provision of services, internal operations, and general employment matters (including recruitment). Data processing for General Business Purposes also includes publishing global directories, maintaining files, payroll processing, managing benefit and medical plans, conducting performance reviews, and intra-company communications.
• Personal Data — Any information related to an identified or identifiable person. For example, a Data Subject’s home address, email address, phone number, personnel file, or benefits information.
• Processor — A natural or legal person, or any other entity, that processes Personal Data on behalf of the Controller and under its control (e.g., a payroll preparation firm). Vespera requires Processors to protect the privacy, confidentiality, and security of Vespera Personal Data.
• Processing — Any operation or set of operations performed upon Personal Data, whether or not by automatic means — including collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure, or destruction.
• Sensitive Data — A subset of Personal Data referring to any Personal Data pertaining to racial or ethnic origins, trade union membership, medical or health conditions, political or religious beliefs, sex life, criminal history, or other similar metrics.
• Third Party — Any natural or legal person, public authority, agency, or other entity other than the Data Subject, the Controller, the Processor, and the persons who, under the direct authority of the Controller or Processor, are authorized to process the Personal Data.
• Vespera — Vespera Life, LLC.

---

How We Use and Safeguard Personal Data

A Data Subject’s Personal Data is initially maintained in his or her personnel file and/or entered into one of several appropriate databases managed by Vespera’s local management staff. In the course of day-to-day business operations, authorized individuals within Vespera may utilize and transfer the Data Subject’s Personal Data among various Vespera personnel. These transfers are necessary to carry out Vespera’s General Business Purposes.

To safeguard this Personal Data and comply with current legal requirements, Vespera has formalized and implemented a standard global procedure governing access to and use of Personal Data.

---

Quality of Personal Data

Vespera takes reasonable steps to ensure that Personal Data and Sensitive Data are:

• Obtained, where possible, directly from the Data Subject to whom the Personal Data relates.
• Obtained and processed fairly and lawfully by Vespera for General Business Purposes.
• Relevant to, and no more revealing than, is necessary for General Business Purposes.
• Kept up to date to maintain accuracy while under Vespera’s control, and retained only for so long as is reasonably necessary.

---

Notice and Use of Personal Data

Vespera may inform Data Subjects what information we collect, how it is used, whether it may be temporarily transferred to others to provide the products or services requested, and how to contact Vespera with privacy inquiries. Vespera’s use of Personal Data and Sensitive Data is limited to General Business Purposes and will not be kept longer than is necessary.

---

Individual Rights of Access to Personal Data

Vespera takes steps to ensure that the personal information it uses is correct. Data Subjects may have reasonable access to their Personal Data and Sensitive Data during normal working hours and upon reasonable request, and may be allowed to update or correct any inaccurate information.

---

Information We Collect

We may collect personal information such as your name, email address, phone number, and any other information you provide when using our services or website.

---

How We Use Your Information

We may use the information we collect to:

• Provide, operate, and maintain our services.
• Improve, personalize, and expand our services.
• Communicate with you, including customer service and support.
• Send you updates, marketing, and promotional materials.

---

Sharing of Your Information

We do not sell, trade, or rent your personal information to third parties. We may share your information with trusted third-party service providers who assist us in operating our website and services, provided they agree to keep this information confidential.

---

Security of Personal Data

Vespera takes reasonable precautions to protect Personal Data and Sensitive Data from loss, misuse, unauthorized access, disclosure, alteration, and destruction. For these purposes, Vespera classifies such data into three levels of security:

Level 1 — Vespera Public Data

Personal Data such as job title, workplace location, office telephone number, and office email address. Vespera Public Data is available for unrestricted use within Vespera and to Processors, and may be disclosed outside of Vespera for General Business Purposes.

Level 2 — Vespera Private Data

Personal Data such as a Data Subject’s home contact information (home address, home email, home telephone), as well as information about compensation, benefits, performance evaluations, and identification numbers. Vespera Private Data may only be disclosed for General Business Purposes to authorized personnel within Vespera and to Processors authorized to access or use such data on behalf of a Vespera business unit. It is disclosed to third parties only with the prior written permission of the Data Subject, except as allowed by applicable law.

Level 3 — Vespera Sensitive Data

Sensitive Data is treated as highly restricted data by Vespera and is stored locally. Transfers of Vespera Sensitive Data — either outside the country of origin or outside of Vespera — occur only as required for General Business Purposes. Recipients may include authorized Vespera users or Processors who are authorized to access or use such Sensitive Data by a Controller with appropriate authorization. Vespera Sensitive Data is disclosed to third parties only with the prior written permission of the Data Subject, except as allowed by applicable law.

---

Accountability

Vespera expects its employees, independent contractors, subcontractors, and partners to maintain the trust placed in Vespera by those Data Subjects who provide personal information. Vespera provides privacy training to its employees to highlight the importance of privacy in its global business. Those who manage personal information complete periodic privacy self-assessments to ensure that personal information is secure and protected. Vespera periodically audits privacy compliance and, where necessary, extends by contract its privacy policies and data protection practices to supplier and partner relationships.

---

Procedure for Accessing Personal Data

Vespera personnel must receive specific authorization to access Personal Data and Sensitive Data classified as Level 2 and above, except when a Data Subject requests access to his or her own data. Questions about Personal Data or authorization to access such Personal Data should be directed to the Data Subject’s Vespera management personnel. Unauthorized access may be grounds for disciplinary action, including termination.

---

Transfer of Data

Subject to this Policy, Vespera may transfer Personal Data and Sensitive Data within and between its various locations for General Business Purposes, in compliance with country-of-origin regulations and this Policy.

Vespera personnel, outside firms and consultants, and clients who receive Personal Data may be located in the Data Subject’s home country, the United States, or any other country in which Vespera or its affiliates do business. Personal Data may therefore be transferred to any country in the world, including the United States, where privacy laws may be more or less protective than those where the Data Subject lives or works.

Concerned individuals may withhold their consent to such international transfers and will be informed of the impact such opt-out will have on their employment within Vespera (e.g., inability to process benefits or payroll data in a timely or appropriate fashion).

---

Status of This Policy

This Policy is subject to change, although Vespera will provide updates from time to time about changes. In the case of a sale of the company, acquisition or merger, bankruptcy, or other change in corporate status, this Policy could change. This Policy may also be supplemented by other company policies and statements.

---

Contact Us

Questions or concerns about how Vespera manages Personal Data should be directed to the Data Subject’s supervisor or appropriate Vespera management personnel. If you have questions about this privacy statement, or wish to opt out of any provisions hereof, please contact us: