This Privacy Policy is meant to help you understand how we collect, use and disclose personal data across the websites we operate and the services we provide and how you can exercise your privacy rights.

Last updated: NOVEMBER26, 2022

WHO WE ARE

When we refer to “we” (or “our” or “us”), that means Consonant Technologies Ltd. Our headquarters are in Abuja, Nigeria. At Consonant, we build and provide solutions that drive participation and generosity between organizations and their members. For more information, visit the About Us section of our Website. When you use our Services, you’re trusting us with your information. We understand this is a big responsibility and work hard to protect your information and put you in control. This notice applies to consonant.africa and any other websites we own or operate (collectively, our “Websites”) and all products and services we provide, including our online and mobile giving, payments, engagement services, products, and applications, and any other apps or services we offer (“Services”). This Privacy Policy applies to Pushpay and our Websites and Services, as well as the information we collect when you interact with us through other online services. It also applies anywhere it is linked. It does not apply to non-consonant Websites and Services that may link to the Services or be linked to or from the Services; please review the privacy policies on those websites and applications to understand their privacy practices. When we refer to your information, personal data or personal information: we mean identifiable information about you as defined under applicable law. If you can’t be identified (for example, when Personal Data has been aggregated and anonymized) then this notice doesn’t apply.

HOW WE COLLECT YOUR DATA When you visit our Websites or use our Services, we collect information about you. Information you provide to us: When you visit or use some parts of our Websites or Services, we receive information from you, including when you register for an account, make a payment, or provide information to us through your use of the Services. We collect the following information from you: • Your name and email address when you sign up for an account or take part in training and events; • Your name, age, sex, marital status, religious affiliation or denomination, photographs, and any other information you upload when you create a profile. • Your postings when you participate in community forums or join us on social media; • Your contact information and a record of any correspondence when you contact us. Failing to provide your information may mean you can’t use some parts of our Websites or Services. Payment information: Our payment gateway partners will collect and process your payment details when you set up an account for purposes of making or receiving payments. The payment gateway partners’ privacy policy will apply to your payment information. Information we collect automatically: We collect information about you automatically when you visit our Websites or use our Services. This information is collected through cookies, web beacons, and other tracking technologies, as well as through your web browser or device. We collect: • Details of your visits to our Websites and information generated in the course of the use of our Websites and Services (including the timing, frequency and pattern of service use) such as traffic data, location data, time zone, weblogs and other communication data, the resources that you access, and how you reached our site. • Details regarding the device you use to access our Websites and Services, including, but not limited to, your web browser, IP address, operating system and browser type. • Information about how you interact with our ads and newsletters, including whether you open or click links in any correspondence. • Information about your precise geolocation, provided that you have enabled collection through your device settings. This location information is used to identify organizations in your proximity and to pinpoint the location of your transactions for security purposes. If you choose to disable any location-based services on your device and/or opt out of any location-based services through the mobile application’s Settings menu, you will not be able to utilize certain features of our services. • Information that you make available to us on a social media platform (such as by clicking on a social media icon linked from our Websites or Services), including your account ID or username and other information included in your posts. This information is useful for us as it helps us get a better understanding of how you’re using our Websites and Services so that we can continue to provide the best experience possible (e.g., by personalizing the content you see). Some of this information is collected using cookies and similar tracking technologies. If you want to find out more about the types of cookies we use, why, and how you can control them, take a look at our Cookie Notice.

Your browser or device may include “Do Not Track” functionality. At this time, we do not alter our sites’ data collection and use practices in response to Do Not Track signals. We may also collect information about you from the organizations, institutions and businesses you elect to associate with in your Consonant account.

HOW WE USE YOUR INFORMATION

We use your information to operate our Websites and Services and to manage our relationship with you. We use your information for the following purposes: To provide you with access to our Websites and Services. To communicate with you by:

• Providing you with information you’ve requested (like training or education materials) from us, processing your payments, or sending information we are required to send to you; • Sending you operational communications related to changes to our Websites or Services, security updates, or assistance with using our Websites or Services; • Sending you marketing communications (for example, about a product or service we think you might be interested in, based on your marketing preferences); and • Asking you for feedback or to take part in any research we are conducting (which we may engage a vendor to assist with).

To support you: By assisting with the resolution of technical support issues or other issues relating to the Websites or Services. To administer contests and sweepstakes. We or our advertisers and other business partners may conduct or sponsor special contests, sweepstakes, and other promotions that users may enter or otherwise participate in on our Websites or Services. To enhance our Services and develop new ones: By tracking and monitoring your use of Websites and Services so we can keep improving, or by carrying out technical analysis of our Websites and Services so that we can optimize your user experience and provide you with more efficient tools. To protect: By detecting and preventing any fraudulent or malicious activity, and making sure that everyone is using our Websites and Services fairly and in accordance with our terms of use. To market to you: By using your information to display targeted advertising to you online through our own Websites and Services or through outside websites and their platforms. To analyze, aggregate and report: By using the information we or our partners collect about you and other users of our Websites and Services to produce aggregated and anonymized analytics and reports, which we may share publicly or with outside parties.

HOW WE SHARE YOUR DATA

We share your information in the following circumstances: • With the faith-based organization, educational institution, not for profit organization, or business with which you choose to interact with using Consonant’s Services; • With partners and service providers who assist and enable us to use the information to, for example, support delivery of, or provide functionality on, our Websites or Services, or to market or promote our Services to you. • With social media companies where you choose to interact with us through social media, which typically allows the social media company to collect some information about you through cookies they place on your device and other tracking mechanisms. In some cases, the social media company may recognize you through its digital cookies even when you do not interact with the social media company. Please visit the social media companies’ respective privacy policies to better understand their data collection practices and controls they make available to you. • With advertisers or other business partners as part of special contests, sweepstakes, and other promotions that users may enter or otherwise participate in on our Websites or Services. In these instances, the collection of your information may occur directly by our partner on its website or other online service and may be shared with us. The promotion will state the privacy policy or policies governing the collection of such information. • With regulators, law enforcement bodies, government agencies, courts or other entities where necessary to comply with applicable laws or regulations, or to exercise, establish or defend our legal rights. Where possible and appropriate, we will notify you of this type of disclosure; • With an actual or potential buyer (and its agents and advisers) in connection with an actual or proposed purchase, merger or acquisition of any part of our business. • With others where we have your consent.

INTERNATIONAL DATA TRANSFERS

When we share your data, it may be transferred to, and processed in, countries other than the country you live in – such as the United States, where our data hosting provider’s servers are located. The laws in the United States regarding personal data may be different from the laws of your jurisdiction. Any cross-border transfers of your information by us will comply with the safeguards required by us under applicable law. For individuals in the European Economic Area (EEA), your personal data will be transferred outside of the EEA. Where your personal data is transferred outside the EEA, it will only be transferred to jurisdictions that have been identified as providing adequate protection for EEA personal data (like New Zealand), or under an approved transfer mechanism such as Standard Contractual Clauses, or under the EU-U.S. or Swiss-U.S. Privacy Shield frameworks .