ZENTARIAS TECHNOLOGIES LLC

POLICY SUMMARY AT A GLANCE

The following table provides a high-level summary of Zentarias's key commitments under this Policy. Full details are set forth in the sections that follow.

1. WHAT IS BIOMETRIC DATA?

Zentarias Technologies LLC ("Zentarias," "we," "our," or "us") may, from time to time and in connection with certain platform features activated by Customers, come into possession of data that constitutes "Biometric Data" — that is, data generated by the automatic measurement of an individual's biological or physiological characteristics, used to identify a specific individual.

Biometric Data may include, without limitation:

• Scans or measurements of facial geometry or structure
• Scans or measurements of hand geometry
• Retina or iris scans
• Fingerprints or fingerprint imagery
• Voiceprints or voice-based identifiers

Biometric Data does not include photographs, written descriptions of physical appearance, or other data that does not involve the automated measurement or mapping of biological characteristics for the purpose of individual identification.

2. SECURITY AND PROTECTION OF BIOMETRIC DATA

To the extent that Zentarias comes into possession of Biometric Data in connection with the delivery of its Services, Zentarias will apply security safeguards that are at least equivalent to — and, where applicable, more protective than — those applied to other categories of confidential and sensitive personal information within our systems.

Specifically, Biometric Data held by Zentarias will be protected in accordance with the following security frameworks and standards:

• SOC 2 (Service Organization Control 2) — a widely recognized security and privacy framework developed by the AICPA, which establishes rigorous criteria for managing customer data based on trust service principles including security, availability, processing integrity, confidentiality, and privacy.
• ISO 27001 — the internationally recognized standard for information security management systems (ISMS), which defines best practices for systematically managing sensitive data to minimize risk of unauthorized access, disclosure, or loss.

3. RETENTION PERIOD AND PERMANENT DELETION

Zentarias does not retain Biometric Data beyond what is strictly necessary for the purpose for which it was collected or obtained. All Biometric Data in Zentarias's possession will be permanently and irreversibly deleted by the earlier of the following two events:

Permanent deletion means the irreversible destruction of Biometric Data such that it cannot be recovered, reconstructed, or accessed by any party. Zentarias does not archive, anonymize, or otherwise retain Biometric Data in any form beyond the retention limits described above, except as provided in Section 4 below.

4. SUSPENSION OF DELETION FOR LEGAL COMPLIANCE

Zentarias's standard deletion schedule described in Section 3 may be suspended — in whole or in part, and solely to the extent strictly necessary — when Zentarias is subject to a binding legal obligation that requires the retention of Biometric Data beyond the standard retention period. Such legal obligations may include, without limitation:

• A valid warrant issued by a court of competent jurisdiction
• A lawfully served subpoena requiring the preservation or production of specific records
• A court order or judicial directive requiring retention of data pending resolution of litigation or an investigation
• Any other binding legal process or regulatory requirement that mandates the preservation of specific data

In such circumstances, Zentarias will retain the relevant Biometric Data only for the duration and to the extent required by the applicable legal obligation. Upon satisfaction or expiration of the legal hold, Zentarias will promptly resume its standard deletion practices with respect to the affected data.

5. CONSENT REQUIREMENTS

Where required by applicable federal, state, or local law — including but not limited to the Illinois Biometric Information Privacy Act (BIPA), 740 ILCS 14/1 et seq., and similar laws in other jurisdictions — Zentarias will obtain written informed consent from each individual before collecting or obtaining their Biometric Data.

Any consent obtained by Zentarias for the collection of Biometric Data will, at a minimum, specify the following:

• The specific type or category of Biometric Data being collected (e.g., facial geometry scan, voiceprint)
• The purpose or purposes for which the Biometric Data is being collected and will be used
• The length of time for which the Biometric Data will be retained and used, consistent with this Policy

6. SCOPE AND APPLICABILITY OF THIS POLICY

This Policy applies to Biometric Data that comes into Zentarias's possession in connection with the delivery of the Zentarias fleet management platform and related services. It governs Zentarias's own handling of Biometric Data and does not substitute for or limit Customer's independent legal obligations under applicable Biometric Laws.

This Policy should be read together with the following Zentarias legal documents, all available at www.zentarias.com/legal:

• Zentarias Privacy Policy — governing the collection, use, and disclosure of personal data generally
• Biometric Services Addendum — governing Customer's specific obligations when activating biometric features
• Zentarias Terms of Service — the master agreement governing the use of all Zentarias Services

Zentarias reserves the right to update or amend this Policy at any time to reflect changes in applicable law, industry standards, or our internal data management practices. Continued use of the Zentarias platform after an updated Policy is posted constitutes acceptance of the revised terms.

CONTACT INFORMATION