Quadient Suite and Cloud Services Privacy Notice

Last updated: July 29, 2026

Access: Quadient's Privacy Notice for California Residents

Introduction

Quadient and its affiliates (“Quadient”, “we”, “our” or “us”) are committed to respecting your privacy as an authorized user on behalf of our Customer (as defined in the relevant Customer Contract/order form), (“you”). We recognize that when you choose to provide us with Personal Information about yourself, you trust us to act in a responsible manner.

That is why we have published this Quadient Suite and Cloud Services Privacy Notice (also referred to as the ‘Privacy Notice’) to inform you of our practices regarding the collection, use, and disclosure of information gathered from users of our Quadient Suite platform and Digital Solutions (collectively "Services"). This Privacy Notice supplements Quadient’s General Privacy Statement and applies specifically to personal data processed through the Quadient Suite and associated cloud-based services.

This Privacy Notice covers the following Services and explains the privacy rights you have in relation to these processing activities.

• Quadient Suite, see Link;

• Quadient Inspire, see Link;

• Quadient Impress, see Link;

• Quadient Evolve, see Link;

• Quadient Accounts Receivable, see Link;

• Quadient Accounts Payable, see Link.

As used in this Privacy Notice, ‘Personal Information’ or ‘Personal Data’ means information that relates to an identified individual or to an identifiable individual. For example, this could include (among other things) your name, address, email address, business contact details, or information gathered through your interactions with us via our Services.

“Personal Information” also includes any data that can reasonably be linked to an individual and is defined according to the applicable privacy laws in each jurisdiction where Quadient operates.

Who is responsible for processing your personal information?

Quadient processes your personal information only as a Processor on behalf and under the instruction of a Customer under a signed data processing addendum (the “DPA”). In that case, such respective DPA will prevail over this Privacy Notice.

You may request from the Customer, whose authorized User you are, to see that DPA. The DPA also contains a list of the respective Subprocessors which we have contracted for the specific Quadient Service used and the measures that are in place to ensure proper data protections.

Otherwise, you can also find the standard template of the DPA and other additional information under User Terms and the General and Specific Service Conditions for the respective Quadient Service you are using.

What personal information do we collect?

Quadient acts as a service provider on behalf of the Customer, and only receives Personal Information and other data as instructed by the Customer. Therefore, in addition to the necessary personal data provided by the Customer for issuing the necessary user credentials, we may at times request that you voluntarily supply us with Personal Information. Generally, this information is requested when you register for an online service, or in connection with an online transaction.

Personal Information

Personal Information collected by Quadient on the Services platform from customers, suppliers, business partners and their respective users may include, but is not limited to, the following:

• Identity Data including first name, last name, username or similar identifier, business contact information, function and title.

• Contact Data may include billing address, email address and telephone numbers.

• Transaction Data may include your preferred settings, uploaded content in the various Services as well as data on the batches and transactions from you and other users on your Service account.

• Technical Data includes internet protocol (IP) address, your login data and other data created on Quadient’s platform.

• Usage Data includes products or platform navigation, your notification settings, preferences, inputs and saved content.

• We also collect, use and share aggregated data such as statistical or technical data and volume. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific service feature. However, if we combine or connect Aggregated Data with your Personal Data so that it can directly or indirectly identify you, we treat the combined data as Personal Data which will be used in accordance with this User Privacy Notice.

• In rare situations, where it is required to fulfill our contractual obligations, we will also store Customer Content or user data that might contain special categories of data, e.g. for the unambiguous identification of a natural person, or as content of Customer created communications, like health data.

• Cookies and Tracking: We may also store personal information about you in cookies or tokens (files which are sent by us to your computer or other access device), which we can access when you log on or use our Service platform, e.g. for single sign-on, saved drafts or preferences, notices or other. If you want to manage or delete any specific settings, please check our user notification or preference center.

• Cookies (Cookies, pixel tags and other trackers) are pieces of data sent to your browser when you visit a website and stored on your computer’s hard drive. Cookies may store user preferences and other information. Depending on the applicable law, when you first visit our Websites and again if you delete the Cookies or the Cookies expire or change, you will be asked which Cookies you consent to.

We may use the following types of cookies on our websites:

• Strictly Necessary Cookies - Essential for the correct functioning of a website, strictly necessary cookies allow users to navigate and use website features. Typically, these cookies cannot be disabled as they are required for basic website functionality.

• Functional Cookies – websites can set functional cookies to remember user preferences to help build a more personalized experience on return visits. This includes information such as language, font size, and other customizable elements.

• Targeting Cookies – Also known as advertising cookies, cookies of this nature help website operators to deliver advertisements that are more relevant to the user. Targeting cookies set information that allows advertisers to display content based on a user’s browsing history and online behavior. They are also used to limit the number of times a user sees a particular advertisement and targeting cookies are often set by third-party advertising networks.

• Social Media Cookies – These cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They can track your browser across other sites and build up a profile of your interests. This may impact the content and messages you see on other websites you visit. If you do not allow these cookies, you may not be able to use or see these sharing tools.

• Performance Cookies - These cookies collect information about how users interact with a website. Performance cookies track which pages have been visited, whether any errors occur, and loading times. These types of cookies are typically used to improve user experience and website performance.

• Analytics Cookies are a type of Performance Cookies which are used to improve the websites by collecting information on how you interact with the Websites; The cookies collect information in a way that does not directly identify anyone, rather they collect information in an aggregated or generalized statistical form, including the number of visitors to the Websites, where visitors have come to the websites from and the pages they visited. One of the analytic cookies we use is Google Analytics. Google's overview of privacy practices and data safeguards is available at: https://support.google.com/analytics/answer/6004245. To opt out of being tracked by Google Analytics across all websites, visit http://tools.google.com/dlpage/gaoptout.

Sensitive Personal Information

We ask that you do not send us, and do not upload or share any sensitive Personal Information on the Service platform, unless it is expressly agreed in the DPA with the Customer whose user you are. Some examples of sensitive personal information are: government-issued IDs; special categories of data and any information that reveals racial or ethnic origin, religious, political or philosophical beliefs; trade union membership details; information about health, disabilities, or sexual orientation; credit history; and criminal records.

Information from Minors

Quadient does not knowingly collect or solicit personal information from anyone under the age of 18. In the event that we find out that we have collected personal information from a person under 18 (without verification of parental consent), we will delete that information as quickly as possible. If you believe that we might have any information from or about a child under 18 on our Services platform, please contact us using the online form.

As the use of the Quadient Suite is restricted to business use only, individual users must be 18 years of age (or considered as adults under applicable law) or older in order to use the Services.

Purposes for Processing Personal Data and legal basis:

Sharing your personal data

Quadient may share your Personal Data with other group entities in Quadient (“Affiliates”), third-party service providers; and as required by Quadient’s legal and contractual obligations.

Authorized Quadient employees from Quadient Affiliates may access your Personal Information solely for the purpose of performing their job functions, such as servicing a customer agreement or activities related to your user documentation.

Sharing Your Personal Data within Quadient:

Quadient employees from Quadient Affiliates are authorized to access Your Personal Information only to the extent necessary to perform their job functions. This includes activities such as the servicing of a Customer agreement or activities related to Your user documentation.

Sharing Your Personal Data outside Quadient:

At no time do we rent out your Personal Information, content or contacts to third parties, nor use them for any purpose other than those set forth in our agreements or this Privacy Notice. However, we may sell, share or otherwise disclose your Personal Information with the following third parties for legitimate business purposes:

• Third-party service providers: We may engage third-party service providers to process Personal Data on Quadient’s behalf, for example to process and deliver the Services, manage and service your data, distribute emails, carry out research and analysis, manage brand and product promotions as well as providing certain services and features. You can find in the following link a detailed list of third-party service provider used to provide you with the service, within chapter Product Security – Subprocessors.

• Other third parties as required by law: We may share your Personal Information when necessary to: (i) comply with a government request, subpoena, court order or applicable law; (ii) prevent illegal uses of Quadient Services and apps or violations of our websites’ and the apps’ terms of use and our policies; (iii) defend ourselves against third-party claims; and (iv) assist in fraud prevention or investigation (e.g., counterfeiting) (v) carry out the reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings).

Where we utilize third parties for the processing of any Personal Information, we implement reasonable contractual and technical protections to ensure that such information is used only for the purposes of providing the Services as specified by Quadient.

Third-party sites and services

If you use any third-party services or visit any linked platforms or websites (like Facebook pages and Gartner studies etc), we strongly suggest you review their user privacy notice or privacy statement.

Quadient Services may contain links or interfaces to third-party services (e.g. APIs to SMS service providers) or to other websites that operate independently from Quadient. Such Services and websites will have their own privacy statements or notices. If you use any third-party services or visit any linked websites, we strongly suggest that you review their privacy statement or user privacy notice. Any information you provide when you visit a non-Affiliated Quadient Service (meaning outside of our platform) or website, is subject to their respective privacy statements or user privacy notices. Unless expressly agreed otherwise in a written agreement, we are not responsible for the third-party services, or content of any third-party services, that are not affiliated with or owned by Quadient. Quadient is not responsible for any use of those services or websites, nor the privacy practices of such websites or services.

Your rights

Depending on the place where you reside, you may have certain privacy rights (Data Subject Rights) for the Personal Information we process about you. Whether you are a customer user, supplier, consultant or other person that uses the Services, you can choose to access, correct, delete, restrict and ask for a copy of your individual personal information.

If you reside in the EU, Switzerland, UK, Australia, California or any adequate jurisdiction that provides these rights as a matter of law, you have the right to request: (i) access to your Personal Data; (ii) correction of your Personal Data if it is incomplete or inaccurate; (iii) deletion or restriction of Your Personal Data or (IV) ask for portability of your Personal Information that you have provided to us via electronic means. Residents of California also have the right to (i) limit use and disclosure of sensitive personal information, (ii) opt-out of the sale of personal information, and (iii) to not receive discriminatory treatment by us due to your exercise of your rights.

A California resident has the right to request Quadient to stop sharing personal information with third parties for cross context behavioral advertising. A California resident also has the right to opt-out of such targeted advertising by selecting the Do Not Sell or Share my Personal Information button, or by displaying an opt-out preference signal via the Global Privacy Control.

Please see Quadient’s Privacy Notice for California Residents for more information. Where we have obtained your consent for the processing of your Personal Data, you have the right to withdraw your consent at any time for the future. You also have the right to object to the processing of your Personal Data, including opting-out from the use for direct marketing purposes.

You may have additional rights pursuant to your local law applicable to the processing. For example, if the processing of your Personal Information is subject to the EU General Data Protection Regulation ("GDPR"), and your Personal Information is processed based on legitimate interests, you have the right to object to the processing on grounds relating to your specific situation.

Right to Lodge a Complaint:

You have the right to file a complaint with a competent data protection authority. However, if You have any questions, concerns or complaints regarding our compliant processing of your Personal Information, We would like to ask that you please contact the Customer (Controller) on whose behalf you are using the Services or Quadient (as the Processor) first . We will investigate and collaborate with the Customer to resolve your concerns over the use and disclosure of personal information in accordance with our contractual obligations and applicable law.

If after raising Your concerns with the Customer or our Quadient privacy team, you still do not feel your concerns have been adequately addressed, you can always lodge a complaint with your competent data protection authority.

The name and contact details of the data protection authorities in the European Union can be found here.

Your California Consumer Privacy Act (CCPA) rights:

The CCPA provides California residents with certain rights regarding their Personal Information, including the right to access, opt-out and deletion. Click here to see Our CCPA Privacy Notice.

How does Quadient secure your personal information?

Quadient takes appropriate precautions to protect your Personal Information via technical and organizational measures.

When you place orders or access your account information, we offer the use of a secure server. The secure server software (SSL) encrypts all information you input before it is sent to us. Furthermore, Quadient uses a variety of technical and organizational security measures, including encryption and authentication tools, to maintain the safety of your personal data. Your personal data is processed in secured networks and is only accessible by a limited number of persons with special access rights to these systems. Please see here for more information about our Security, Privacy and Compliance program.

When you use our emailing Service, you need to remember that most electronic communication by its nature, is not a reliably private means of communication, and that this may result in the transmission of unencrypted email in plain text over the public internet. As a user, you are responsible for encrypting any Personal Data or content you use in conjunction with the Services. Email sent using the Services may be unsecured, may be intercepted by other users of the public internet, and may be stored and disclosed by third parties (such as a recipient’s email Service provider). Although Services include support for TLS, content may be transmitted even if the recipient does not also support TLS, resulting in an unencrypted transmission.

When Quadient engages third-party Subprocessors to assist in the provision of Services, such Subprocessors shall be subject to the same level of data protection and security as Quadient, as defined in the DPA. Quadient also ensures appropriate contractual safeguards for cross-border transfers via agreeing on data-protection agreements and EU Standard Contractual Clauses or other adequate safeguards.

As appropriate, Quadient regularly verifies that its service providers satisfy these requirements.

Quadient also complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce. Quadient has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF. Quadient has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF. If there is any conflict between the terms in this privacy policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the DPF Principles shall govern. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit Data privacy framework website.

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Quadient commits to cooperate and comply respectively with the advice of the panel established by the EU data protection authorities (DPAs) and the UK Information Commissioner’s Office (ICO) and the Swiss Federal Data Protection and Information Commissioner (FDPIC) with regard to unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF.

For any dispute arising under the EU-U.S. DPF program, the UK Extension to DPF and the Swiss-U.S. Data Privacy Framework program that is not resolved through contacting through the contact methods listed in this Privacy Statement, individuals may, under certain conditions, invoke binding arbitration for some residual claims not resolved by other redress mechanisms. See https://www.dataprivacyframework.gov/framework-article/ANNEX-I-introduction.

Quadient is subject to the investigatory and enforcement powers of the United States Federal Trade Commission (FTC) in compliance with the Data Privacy Framework. Quadient is responsible for the processing of personal information we receive or subsequently transfer to a third party acting as an agent on our behalf. We comply with applicable data protection law, including DPF Principles for all onward transfers of personal information from the EEA and Switzerland, including the onward transfer liability provisions in the DPF Principles.

Retention of your personal data

We retain your Personal Data for as long as necessary to provide the Services and fulfil the purposes for which we collect it, except if required otherwise by contract or applicable law.

Your registration information will be retained for as long as the Customer’s account is active or as needed to provide the Customer with our Services. If you wish to request that we no longer use your registration information to provide the Customer with our Services, contact us using our online form.

To determine the appropriate retention period for Personal Data, we consider the amount, nature, and sensitivity of the Personal Data, the potential risk of harm from unauthorized use or disclosure of your Personal Data, the purposes for which we process your Personal Data and whether we can achieve those purposes through other means, as well as the applicable contractual and legal requirements.

What if there are changes to our privacy notice?

We may update this Privacy Notice from time to time to reflect changes to our Services, security or data governance practices and to comply with our legal requirements. The revised Privacy Notice will be made available with an updated revision date. We encourage you to check back periodically for any changes or updates.

How to contact us?

If you have a question related to this User Privacy Notice, please contact us at the following email address privacyteam@quadient.com. Your message will be forwarded to the appropriate member of Quadient's Data Privacy Team, such as Regional Data Protection Officers or members of their teams.

If you are resident in California: To exercise Your rights described above, please submit a verifiable access request to us by either:

• Using the online form;

• Calling Us at: +1 800- 636-7678; or

• Email Us at: privacyteam@quadient.com.

You need to provide enough information in your request that allows us to reasonably identify and verify that you are the person that we collected information about, and to check which Customer Contract and DPA your Service usage and Personal Data processing may be subject to.

If you have any other concerns related to Personal Data and you want to report it anonymously, please also feel free to report your concern on the Quadient Ethics Line.