Privacy Policy Callisto Technology, LLC Effective Date: 7/15/2026 ________________________________________ 1. Introduction Callisto Technology, LLC ("Callisto," "we," "us," or "our") is a New Jersey–based software integration firm specializing in human capital management (HCM) integrations. We respect your privacy and are committed to protecting the personal information we handle. This Privacy Policy explains how we collect, use, disclose, and safeguard information when you: •visit our website at www.callisto-technology.com •contact us or engage with us as a prospective or current client, partner, or vendor; or •otherwise interact with Callisto in the course of our business. It also explains, in Section 5, our role and responsibilities with respect to the employee and workforce data we process on behalf of our clients through the integrations we build and operate. Please read this policy carefully. By using our website or engaging our services, you acknowledge the practices described here. ________________________________________ 2. Scope of This Policy This policy applies to personal information that Callisto controls, including information about website visitors, prospective clients, business contacts, and vendors. This policy does not govern: •Client workforce data we process as a service provider. When we build, host, or operate integrations for a client, we typically process employee, payroll, time, and benefits data on that client's behalf and under that client's direction. Our handling of that data is governed by our written agreement with the client (including any Data Processing Agreement) rather than by this Privacy Policy. See Section 5. •Third-party websites, platforms, or services (including ADP, Inc. and other software vendors) that maintain their own privacy policies. See Section 11. ________________________________________ 3. Information We Collect We collect the following categories of information in connection with our own business relationships and website: 3.1 Information you provide directly •Contact and business information: name, job title, company name, business email address, business phone number, and mailing address. •Communications: the contents of messages, inquiries, support requests, and other correspondence you send to us. •Engagement information: details you share when scoping, negotiating, or managing a project, including technical requirements and points of contact. 3.2 Information collected automatically When you visit our website, we (and our service providers) may automatically collect: •Device and usage data: IP address, browser type, operating system, referring URLs, pages viewed, and timestamps. •Cookies and similar technologies: as described in Section 10. [Confirm which analytics/tracking tools your site actually uses — e.g., Google Analytics, a hosting provider's logs, a contact-form service — and list them here or in Section 10. Remove this subsection if your site collects nothing beyond standard server logs.] 3.3 Information from other sources We may receive business contact information from clients, partners, referral sources, or publicly available professional sources (for example, a client providing the name and email of a project stakeholder). ________________________________________ 4. How We Use Information We use the information described in Section 3 to: •respond to inquiries and communicate with you; •provide, scope, deliver, and support our integration services; •manage our contracts and business relationships; •operate, maintain, secure, and improve our website; •send administrative or project-related communications; •comply with legal obligations and enforce our agreements; and •protect the rights, property, and safety of Callisto, our clients, and others. We do not sell your personal information, and we do not use it for cross-context behavioral advertising. ________________________________________ 5. Information We Process on Behalf of Our Clients A core part of Callisto's business is building and operating integrations that move workforce data between ADP Workforce Now and other systems on behalf of our clients. In performing this work, we may process personal information about our clients' employees and other individuals — which can include names, employee identifiers, compensation and payroll data, time and attendance records, and benefits-related information. With respect to this data: •We act as a service provider / processor. Our client is the party that determines the purposes and means of processing (the "controller" or "business"). We process the data solely to provide the contracted integration services and in accordance with our client's documented instructions. •Our obligations are set by contract. This processing is governed by the agreement between Callisto and the relevant client, including any Data Processing Agreement, security addendum, or similar terms. Those terms — not this Privacy Policy — control how that data is handled. •Individual requests. If you are an employee (or other individual) whose data we process through a client integration and you wish to exercise privacy rights, please contact your employer or the organization that engaged us. We will support that organization in responding to verified requests as required by our agreement and applicable law. ________________________________________ 6. How We Disclose Information We may disclose information in the following circumstances: •Service providers and subprocessors. We share information with third parties that perform services on our behalf — such as cloud hosting and infrastructure providers, security tools, and communication platforms — subject to appropriate confidentiality and data-protection obligations. [Maintain a current list of subprocessors, e.g., your cloud/hosting providers, and reference it here or make it available to clients on request.] •Integration counterparties. In the course of delivering an integration, data flows between the systems a client has directed us to connect (for example, ADP Workforce Now and a client-designated destination system). These flows are defined by the client. •Business transfers. In connection with a merger, acquisition, financing, or sale of assets, information may be transferred as part of the transaction, subject to standard confidentiality protections. •Legal and safety. We may disclose information where required by law, regulation, legal process, or governmental request, or where necessary to protect rights, property, or safety. We do not sell personal information or share it for cross-context behavioral advertising. ________________________________________ 7. Data Security We maintain administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These measures may include encryption in transit and at rest, access controls, secrets management, network segmentation, and monitoring, as appropriate to the sensitivity of the data. No method of transmission or storage is completely secure. While we work to protect your information, we cannot guarantee absolute security. Specific security commitments applicable to client integrations are set out in our agreements with those clients. ________________________________________ 8. Data Retention We retain personal information for as long as necessary to fulfill the purposes described in this policy, including to provide our services, maintain business records, comply with legal obligations, resolve disputes, and enforce our agreements. Data we process on behalf of clients is retained and deleted in accordance with our agreement with the relevant client. ________________________________________ 9. Your Privacy Rights Depending on where you live and the nature of our relationship, you may have rights regarding your personal information under laws such as the New Jersey Data Privacy Act, the California Consumer Privacy Act (as amended by the CPRA), and, where applicable, the EU/UK General Data Protection Regulation. Subject to those laws and applicable exceptions, these rights may include: •the right to access or obtain a copy of your personal information; •the right to correct inaccurate information; •the right to delete your information; •the right to opt out of the sale of personal information or targeted advertising (note: Callisto does not sell personal information or use it for targeted advertising); •the right to data portability; and •the right to be free from discrimination for exercising these rights. To exercise a right regarding information Callisto controls, contact us using the details in Section 13. We will verify your request before responding, as required by law. You may also designate an authorized agent to act on your behalf where permitted. If your request concerns data we process on behalf of a client (see Section 5), please direct it to that organization; we will assist them as our agreement and the law require. [If you serve EU/UK data subjects, confirm your GDPR posture and legal bases with counsel, and add EU/UK-specific mechanisms — e.g., a supervisory-authority complaint right and any required representative — as needed.] ________________________________________ 10. Cookies and Tracking Technologies Our website may use cookies and similar technologies to operate the site, remember preferences, and understand how the site is used. •Strictly necessary cookies enable core site functionality. •Analytics cookies [if used] help us understand site traffic and usage. You can usually control cookies through your browser settings. Disabling certain cookies may affect site functionality. [Tailor this section to what your site actually deploys. If you use a consent banner or any non-essential/analytics cookies, describe them and how users can opt out. If your site sets no cookies beyond what is strictly necessary, simplify accordingly.] ________________________________________ 11. Third-Party Services and Links Our website and services may reference or link to third-party platforms, including ADP, Inc. and other software vendors involved in an integration. We do not control and are not responsible for the privacy practices of these third parties. We encourage you to review their privacy policies. References to ADP Workforce Now® and ADP® are to products and marks of ADP, Inc., used for identification purposes only. ________________________________________ 12. International Data Transfers Callisto is based in the United States, and we process information in the United States. If you access our website or engage with us from outside the United States, be aware that your information may be transferred to, stored in, and processed in the United States, where data-protection laws may differ from those in your jurisdiction. [If you knowingly process EU/UK personal data, address transfer mechanisms — e.g., Standard Contractual Clauses — with counsel.] ________________________________________ 13. Children's Privacy Our website and services are directed to businesses and are not intended for children. We do not knowingly collect personal information from children. If you believe a child has provided us personal information, please contact us so we can take appropriate action. ________________________________________ 14. Changes to This Policy We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date above. Material changes will be communicated as required by law or as otherwise appropriate. We encourage you to review this policy periodically. ________________________________________ 15. Contact Us If you have questions about this Privacy Policy or wish to exercise a privacy right, contact us at: Callisto Technology, LLC Email: [privacy@callisto-technology.com Phone: (551) 316-6988