Privacy Notice

1. Introduction

Welcome to Touchstone Learning and Consulting ("Touchstone," "we," "our," or "us"). Touchstone provides the DOCHEK platform and associated services to businesses and their authorized users.

At Touchstone, we take your privacy seriously. We provide this Privacy Notice ("Notice") to tell you what Personal Information we collect, how we obtain it, how we share it, and how you may limit the ways in which we use it. If you have questions after reviewing this Notice, please contact us at info@touchstonelc.com.

Importantly, Touchstone acts primarily as a service provider or data processor — we collect and process Personal Information on behalf of our business customers ("Customers") in order to provide them with our services. Our Customers determine the purposes and means of processing the Personal Information we handle on their behalf. If you interact with a Customer's product or service, you should also review that Customer's privacy notice.

2. Scope

This Notice governs our websites, https://www.touchstonelc.com/ and https://dochek.com, as well as any associated subdomains, the DOCHEK platform, and all instances in which you provide Personal Information or otherwise interact with us online or in person (collectively, our "Service").

For the purpose of this Notice, "Personal Information" (sometimes referred to as "Personal Data") means any information relating to an identified or identifiable individual that is protected by applicable privacy laws. The definition of Personal Information does not include publicly available information from government records.

Our Services are used by our Website Visitors (individuals who visit our website), Customers (companies or organizations that sign up to use the DOCHEK platform to manage relationships with their users) and End Users (individuals who interact with our Customers' implementations of our Service). By accessing or using our Service, you acknowledge this Notice and agree to our Terms and Conditions.

3. What Information We Collect

We limit the Personal Information we collect to that which is adequate, relevant, and reasonably necessary for us to provide our Services.

Information You Provide to Us

We collect the following Personal Information when you register, use our Service, or contact us as follows:

Website Visitors

• Name
• Company
• Email address

Customers

• Name / Username: to identify your account and personalize your experience.
• Company
• Email address: to manage your account, communicate with you, and provide support.
• Your payment, service and purchase history. Payments made with a credit or debit card, bank account information or other financial information is processed separately through our payment processor.

End Users

• Name / Username: to identify your account and personalize your experience.
• Email address: to manage your account, communicate with you, and provide support.

Information Automatically Collected

Like many online services, we and our service providers automatically collect certain technical information when you visit or use our Service, including:

• IP address and device identifiers;
• Browser type, language, and operating system;
• Pages and features accessed, and time spent;
• Referring URLs and session data; and
• General geographic location inferred from IP address.

We collect this information to operate, secure, and improve our Service. Where this information can be linked to an identified individual, we treat it as Personal Information.

Information from Third Parties

We may receive limited information about you from third parties, such as automated fraud detection services when you submit your email to us.

Information We Process on Behalf of Our Customers

When Touchstone provides its Service to Customers, those Customers may direct us to process Personal Information belonging to their own End Users. In those cases, Touchstone acts solely as a data processor or service provider, and the Customer is the data controller. We process such data only as directed by the Customer and under our contractual agreement with the Customer. If you have questions about how a Customer uses your Personal Information, please contact that Customer directly.

4. Cookies and Other Tracking Technologies

We only use cookies to manage login sessions, but do not use any cookies or other tracking technologies on our website.

Do Not Track

Do Not Track ("DNT") is a web browser setting that requests that a web application disable its tracking of an individual user. Currently, we do not monitor or take any action with respect to DNT signals or other such mechanisms. You can learn more about Do Not Track at www.allaboutdnt.com.

5. Why We Collect Information

We use the Personal Information we collect for the following purposes:

To Provide Our Services

• Operate, maintain, and improve the DOCHEK platform and website;
• Enable you to access and use the Service, including processing account registration;
• Process transactions and fulfill orders for products or services;
• Provide and deliver the features and services you request; and

To Communicate with You

• Respond to customer service inquiries and support requests;
• Send periodic emails and account-related notices;
• Send personalized promotions and updates where you have opted in; and
• Implement your communications preferences, including unsubscribe requests.

To Improve Our Services

• Analyze usage and feedback to improve our platform offerings;
• Administer contests, surveys, or other features; and
• Detect, prevent, and investigate fraud, unauthorized access, and security issues.

To Comply with Applicable Laws

• Maintain records for internal administrative purposes; and
• Comply with applicable legal and regulatory obligations and respond to lawful governmental requests.

To Enforce Our Terms and Agreements

To maintain a safe and trusted environment, we use Personal Information to ensure compliance with our Terms, policies, and agreements with you and any third parties.

With Your Consent

We process certain Personal Information to fulfill other business or commercial purposes at your direction or with your consent.

Service Provider Role

Where Touchstone acts as a service provider or data processor for our Customers, we process Personal Information only for the purpose of providing services to those Customers as directed by our contractual agreements. We do not use Customer-directed data for our own independent purposes, including advertising or sale.

6. When We Disclose Information

To the extent permitted by law, we may disclose Personal Information in the following circumstances:

• Service providers. We share information with trusted third-party vendors who perform services on our behalf, such as cloud hosting, database management, email management, payment processing, and customer service. These parties are contractually prohibited from using your information for any purpose other than performing services for us.
• Customers. Where we process Personal Information on behalf of a Customer, we may disclose that information to the Customer as directed by our agreement and as necessary to provide our Service.
• Affiliates. We may disclose information to our corporate affiliates, who are required to treat it in accordance with this Notice.
• Legal process. To comply with a validly issued subpoena, court order, or other legal obligation; or as part of actual or threatened legal proceedings, disclosing only what is necessary.
• Business transactions. In connection with a prospective or completed sale, merger, or transfer of all or substantially all of our assets, subject to appropriate confidentiality protections.
• Protection of rights and safety. To protect the rights, property, or safety of Touchstone, our Customers, End Users, or the public, or to prevent illegal or unethical activity.

We may aggregate, de-identify, and/or anonymize Personal Information such that it is no longer linked to you, and may use and share such anonymized data for any lawful purpose, including research and analytics.

We do not sell the Personal Information of Website Visitors, Customers or End Users.

7. How We Use Your Email Address

We do not send unsolicited commercial emails. By submitting your email address to us, you agree to receive emails from us. You will continue to receive transactional and account-related messages.

8. Retention of Personal Information

We retain your Personal Information only for as long as necessary to provide our Service and fulfill the purposes described in this Notice, or as required to comply with our legal obligations, resolve disputes, and enforce our agreements.

We store Personal Information of End Users for 1 year following the termination of a contract with Customers. We will store course completion, scoring, feedback from End Users in our platform for 5 years.

When we no longer need your information and have no legal or regulatory obligation to retain it, we will remove it from our systems or de-identify it so that you can no longer be identified from it.

9. Cross-Border Transfers

Touchstone is incorporated in the USA. Information we collect may be transferred to, and hosted or processed in, the United States or other countries, which may have different data protection laws than your country of residence. By using our Service, you consent to the transfer and processing of your information in the United States and other countries as described in this Notice.

Where we transfer Personal Information from the European Economic Area, United Kingdom, or other jurisdictions with applicable transfer restrictions, we take steps to ensure appropriate safeguards are in place, such as Standard Contractual Clauses approved by the European Commission.

10. Children's Privacy

Our websites are not directed to children under the age of 13, and we do not knowingly collect Personal Information from children under 13. In limited cases, Customers might use our Service to collect and process Personal Information of children between the ages of 13 and 16, but only with the consent of a parent or guardian. If you are a parent or guardian and believe we may have inadvertently collected the Personal Information of your child, please contact us using the information in the Contact Us section below. If we become aware that we have collected Personal Information from a child under 13 without verified parental consent, we will take steps to remove that information from our systems.

11. Links to Other Websites

Our Service may contain links to third-party websites or services that are not operated or controlled by Touchstone. We are not responsible for the privacy practices, content, or accuracy of those websites. When you follow a link to another website, this Notice no longer applies. We encourage you to review the privacy policies of any third-party sites you visit.

12. Security

We implement a variety of administrative, technical, and physical security measures to protect your Personal Information. Sensitive information (such as payment data) is transmitted via SSL technology and encrypted in our systems.

However, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee the absolute security of your information, and you provide it to us at your own risk. In the event of a data breach that affects your Personal Information, we will notify you as required by applicable law.

13. Your Choices About the Information We Collect

Communications Preferences

You may opt out of receiving marketing emails or other promotional communications at any time by clicking the unsubscribe link in any email or contacting us using the information in the Contact Us section below. You will still receive transactional and account-related messages.

Updating or Correcting Your Information

You may contact us to update or correct your Personal Information, change your communications preferences, or request deletion of your account and associated data. We will make good-faith efforts to fulfill your request as soon as reasonably practicable, subject to our legal obligations and legitimate business reasons to retain certain information.

Please note that it may not be technologically possible to remove every record of your information from backup systems. Promptly after receiving your request, we will update, correct, or delete your information from all actively used databases to the extent reasonably and technically practicable.

End Users

If you are an End User of a Customer's implementation of our Service and wish to update, delete, or obtain information we hold about you, please contact the Customer (organization) through which you use our Service.

14. Your California Privacy Rights

Although we do not technically meet the threshold to comply with the California Consumer Privacy Act of 2018 ("CCPA") as amended by the California Privacy Rights Act ("CPRA"), we have created this section to provide information to California residents.

Personal Information Collected

We have collected the following categories of Personal Information from California residents in the preceding 12 months:

We do not sell Personal Information. We do not share Personal Information for cross-context behavioral advertising. We do not have actual knowledge that we sell or share the Personal Information of consumers under 16 years of age.

California Resident Rights

California residents have the following rights:

• To know the categories of Personal Information collected, the purposes for collection, and whether it is sold or shared;
• To access the specific pieces of Personal Information we have collected about you;
• To delete your Personal Information, subject to certain exceptions;
• To correct inaccurate Personal Information;
• To opt out of the sale or sharing of your Personal Information (we do not sell or share);
• To limit the use of Sensitive Personal Information (we do not collect Sensitive Personal Information beyond CCPA-permitted purposes); and
• Not to be discriminated against for exercising your privacy rights.

Exercising Your California Privacy Rights

You or your authorized agent may submit a request by:

• Email: info@touchstonelc.com (subject line: "California Privacy Rights")

California "Shine the Light" Law

If you are a California resident with an established business relationship with us, you may request information about disclosures of your Personal Information to third parties for their direct marketing purposes in the preceding calendar year. We do not currently disclose Personal Information to third parties for their own direct marketing purposes.

15. Opt-Out Preference Signals

In certain regions, when we detect a Global Privacy Control ("GPC") or other recognized opt-out preference signal from your browser, we will treat it as a valid request to opt out of the sale or sharing of your Personal Information, without requiring additional steps from you.

16. Your Rights Under the General Data Protection Regulation

This section applies to data subjects residing in the European Economic Area ("EEA"). We adopt this section to comply with the General Data Protection Regulation ("GDPR").

Where Touchstone collects Personal Information from EEA residents directly (e.g., when a user registers for our Service), Touchstone acts as a data controller for that data. Where we process data on behalf of a Customer, we act as a data processor and the Customer is the controller.

Legal Bases for Processing

• Contract: To perform our agreement with you — for example, creating and managing your account, providing access to our Service, and handling support requests.
• Legitimate interests: To operate, secure, and improve our Service where our interests are not overridden by your rights — for example, fraud prevention and analytics.
• Legal compliance: To comply with applicable legal obligations, such as tax and record-keeping requirements.
• Consent: For marketing communications, where we rely on your consent, which you may withdraw at any time.

Your GDPR Rights

If you are located in the EEA, you have the right to:

• Access your Personal Information;
• Rectify inaccurate or incomplete Personal Information;
• Request erasure of your Personal Information ("right to be forgotten");
• Restrict or object to certain processing;
• Receive your Personal Information in a portable format; and
• Withdraw consent at any time where processing is based on consent.

You also have the right to lodge a complaint with your local supervisory authority.

How to Exercise Your GDPR Rights

Please submit a request to info@touchstonelc.com. Include your full name, email address, and your country of EEA citizenship or residence. We will respond within 30 days and may ask you to verify your identity.

If you are unsatisfied with our response, you have the right to contact your local data protection supervisory authority.

Contact:info@touchstonelc.com

17. Your Rights Under the UK GDPR

If you are based in the United Kingdom, the provisions in Section 16 above apply, with references to the GDPR read as references to the UK GDPR. Complaints should be directed to the UK Information Commissioner's Office (ICO).

For cross-border transfers of personal data out of the UK, we rely on the UK International Data Transfer Agreement or the International Data Transfer Addendum to the European Commission's SCCs, as applicable.

18. Changes to This Privacy Notice

We may update this Privacy Notice at any time. We will post all changes to this page and update the effective date at the top. Where required by applicable law, we will provide advance notice of material changes, for example through our Service. By continuing to use our Service after a revised Notice is posted, you agree to be bound by the updated Notice. If you do not agree to this or any updated Privacy Notice, you may delete your account.

19. Contact Us

If you have any questions, concerns, or requests regarding this Notice or our privacy practices, please contact us: