Privacy Policy

Effective Date: [date of publication]  |  Last Updated: 19 October 2026

This document is a draft prepared for legal review and has not yet been reviewed by counsel. Highlighted items in square brackets are still to be confirmed by Colony.

This policy explains what personal information Colony collects, why, who sees it, how long we keep it, where it goes, and what rights you have. It is written in plain English. Colony is business software, so please read section 2 first: it explains when we decide how your data is used and when the business you deal with decides.

1. Who we are

Colony is run by eOTP LLC, trading as Colony ("Colony", "we", "us"), a Delaware limited liability company, registration number [number], 800 North King Street, Suite 304 #4144, Wilmington, DE 19801, US, at colonys.io. Colony is business management software with a built-in CRM for service businesses.

• Privacy requests and questions: support@colonys.io
• Postal address: 800 North King Street, Suite 304 #4144, Wilmington, DE 19801, US
• Data protection officer: [name or "we have not appointed one; contact the address above"]
• EU and UK representative (GDPR article 27): [name and address, or "not appointed"]
• South Africa Information Officer (POPIA): [name, email]; Deputy: [name, email]
• General enquiries: info@colonys.io

2. Two roles: please read this first

Colony does two different things with personal information, and who is responsible differs.

If you are a customer, lead or contact of a business that uses Colony, that business decides what is collected and why. Its privacy notice, not this policy, describes that. Public pages built with Colony (storefronts, booking pages, forms, landing pages) belong to the business that publishes them.

3. What we collect and why: notice at collection (our own data)

This table is our notice at collection for the data we control. We have collected these categories in the past 12 months.

We do not ask for or intend to collect sensitive personal information about our own users (for example health, race, religion, biometrics, precise location or government ID numbers). We derive no profiles or inferences about individuals from account data beyond the usage statistics described above.

Is providing data compulsory? Account, company and billing details are needed to give you an account; without them we cannot provide Colony. Everything else is optional or happens automatically.

4. What businesses put into Colony (we process, they control)

Depending on how a business uses Colony, it may store: contact details, addresses, company and tax details, job and visit notes, appointments, quotes, invoices and payments, consent and opt-out records, documents, scans, forms and uploads, signatures and signing evidence (time, IP address, browser, document fingerprint), messages and attachments on email, WhatsApp and SMS, loyalty cards, points and vouchers, support tickets, custom fields, files and photos, and the results of AI features.

A business may put sensitive information into Colony, for example health or financial details. Colony does not ask for this, does not use it for its own purposes, and does not treat it differently from other customer data. Colony is not designed for regulated records such as protected health information, payment card numbers or children's data unless the business and Colony agree safeguards in writing. The business must make sure it has the right to hold the data and that the features it uses are suitable.

5. Where we get information

• From you, when you sign up, use Colony, contact us or fill in a form.
• From your device, automatically (logs and visit counts).
• From Google or Microsoft, if you sign in with them or connect mail and calendar.
• From the business that invited you, when it adds you as a user.
• From businesses and their customers, for data we process on a business's behalf (section 4).

We do not buy personal information about people from data brokers.

6. How we use information

• Run, secure, support and bill for Colony, and create and manage accounts.
• Send service messages: sign-in codes, security alerts, receipts, changes to the service.
• Detect and prevent fraud, abuse and security incidents; enforce our terms.
• Meet legal obligations and respond to lawful requests.
• Understand how Colony is used and improve it, using usage records and aggregated or de-identified statistics. We do not use Customer Data (section 2) for this beyond what is needed to operate the service.
• Send marketing only with your opt-in.

We do not sell personal information. The only sharing for cross-context behavioural advertising is through Google Ads cookies on Colony's own marketing, sign-up and login pages, and only if you choose "Accept all" (section 10). We never use customer data for advertising. We do not use customer data to train AI models, ours or anyone else's.

7. Artificial intelligence

Some Colony features send content you choose to an AI provider: Anthropic (the Claude models) for drafting, the in-app assistant, document and form drafting, reports, page generation and similar, and OpenAI for voice transcription, and, where a business uses them, AI page-writing and AI image features.

• Purpose limits. Content is sent only to produce the result you asked for. We do not use it to train models and we contract with providers that commit not to train on it: Anthropic's commercial terms and OpenAI's API terms provide that API data is not used to train their models unless the customer opts in. Colony has not opted in.
• What the providers keep. Providers may keep inputs and outputs for a limited time for abuse monitoring, safety and legal reasons under their own terms, and may keep them longer if a request is flagged or the law requires it. "Zero data retention" is not automatic and exists only where the provider has approved it for the account. Colony does not promise zero retention. OpenAI's published API documentation states that its audio transcription endpoint is not used for training and is not kept for abuse monitoring.
• Voice input. When you use voice input in the assistant, the short recording is sent to OpenAI to be turned into text. Colony does not store the audio. The text is placed in your message box for you to check before sending, and then follows the assistant-chat rules below.
• Assistant chats. Chats and unconfirmed assistant actions are deleted after 30 days. The assistant only reads records the signed-in user is allowed to see, and any change it proposes is a draft that a person must confirm.
• Human review. Colony staff do not routinely read AI content. We may look at it with the business's permission to give support, or where needed to investigate abuse or a security incident. Provider staff may review flagged content under their own safety rules.
• Accuracy. AI output can be wrong or out of date. Review it before relying on it or sending it to anyone. Features that read documents (for example a review of drawings or contracts) present findings that a person must approve.
• No significant automated decisions. AI features suggest and draft. They do not make decisions that have legal or similarly significant effects on individuals. See section 22.
• Controls. Account owners can switch AI features off, Colony can cap AI spend per company, and a business should not send personal data to an AI feature unless it has the right to.

8. Who we share information with

We share information only as described here.

• Sub-processors that process data for us under written contracts: hosting, email delivery, bot checks, AI providers, WhatsApp, SMS, Google and Microsoft sign-in, and wallet services. The full list, with purposes and regions, is in sub-processors. We tell account owners before adding one that handles customer data, and they may object (see the Data Processing Agreement).
• Services a business connects itself, for example Stripe, PayFast, Ozow, Stitch, Gmail, Outlook or its own email provider. The business chooses these and has its own contract with the provider.
• Professional advisers and insurers under confidentiality.
• Authorities and others when the law requires, to enforce our terms, or to protect people's rights, safety or property. Where we can, we tell the business whose data is asked for.
• A buyer or successor in a merger, acquisition or sale of our business, with notice to you and the same protections for your data.
• Aggregated or de-identified statistics that do not identify you.

9. Messaging, payments and signatures through Colony

• WhatsApp. Messages a business sends from its own WhatsApp Business account go through Meta's WhatsApp Business Platform under Meta's terms; the business is Meta's customer. Colony also sends its own service messages, for example reminders to people who opted in, from a Colony number using approved templates. We do not use message content for advertising.
• SMS and voice. Through LogicSMS, or an SMS service a business supplies. STOP and opt-out requests are honoured.
• Email. Colony sends through Cloudflare unless a business connects its own email provider. Marketing email includes an unsubscribe link and respects suppression lists. Incoming email to a company's Colony address is received through Cloudflare and attached to that company's records.
• Payments. Card and bank details are entered on the payment provider's page. Colony stores the payment status and references, not card numbers. Colony does not hold your funds.
• Signatures and forms. Signed documents are stored with their evidence (time, IP address, browser, document fingerprint). Signers see who asked for the signature.
• Wallet passes and loyalty. If a business offers a loyalty card or voucher in Apple Wallet or Google Wallet, the pass content and, for Apple, the device's update token are shared with Apple or Google so the pass can be kept up to date.

10. Cookies, similar technologies and Global Privacy Control

Colony's other own pages (password reset, two-factor, Terms and Privacy) use only strictly-necessary cookies: sign-in (kept for up to 30 days), security (anti-forgery), a pending two-factor step, and a small cookie that remembers your cookie choice where a notice is shown. We use no advertising or tracking cookies on these pages.

Colony's marketing, sign-up and login pages (the home page, features, use cases, compare, sign-up and sign-in) use Google Analytics 4 to understand how people find and use Colony. It sets first-party cookies (for example _ga and _ga_<ID>) and sends your visit, device and approximate location data to Google as our service provider (Google says Analytics does not log or store IP addresses). This starts when you open the page; you do not need to click anything. Google's advertising features are switched off, and we do not use the data for advertising, sell it or share it for targeted advertising. Google may also use the data as described in its own privacy policy. To switch it off, use the "Cookie settings" button on the page and choose "Essential only", or send a Global Privacy Control signal from your browser, and it stops loading and the Google cookies are removed. Colony's Google Ads cookies (for example _gcl_au) and sign-up conversion measurement, if we turn them on, load only after you choose "Accept all". The sign-up conversion we record is only that an account was created; it does not include your name, email or company. We do not sell personal information and we never use customer data for advertising.

Pages built with Colony (storefronts, booking pages, forms, landing pages) belong to the business that publishes them. On marketing pages Colony shows a cookie notice with two equal choices, "Essential only" and "Accept all", and a "Cookie settings" button to change your mind.

• Essential cookies and browser storage (for example a basket or customer sign-in) are always used.
• Anonymous visit counts use a shortened IP address and no cookie. They stop if you choose "Essential only" or your browser sends a Global Privacy Control signal. [Before you choose, counting continues for visitors outside the EU and UK; for EU and UK visitors it starts only after "Accept all".]
• If the business added its own Google Analytics, it loads only after "Accept all", with advertising features switched off.
• Your choice is stored in your browser and in one first-party cookie that records only that choice.
• Transactional pages (invoice, booking, signing, unsubscribe) are not tracked.

Global Privacy Control and Do Not Track. We treat a browser's Global Privacy Control signal as a valid request to opt out of analytics and non-essential tracking, on every browser and device where it is sent, without asking you again. Advertising and analytics cookies on Colony's own pages load only after "Accept all", so a browser that sends the signal, or a visitor who chooses "Essential only", never loads them. You can withdraw at any time with the "Cookie settings" button. We do not respond to the older Do Not Track header.

Colony loads some fonts and code libraries from content delivery networks (Google Fonts, jsDelivr, cdnjs), which can see your IP address when your browser fetches them. The business is responsible for anything else it adds to its own page, and for its own privacy notice.

11. How long we keep data

We may keep de-identified or aggregated data without limit.

12. Where data is stored and international transfers

Colony is hosted by [hosting provider] in [country or region]. Colony is a US company serving customers in the United States, Israel, the United Kingdom, Australia, South Africa and elsewhere, and our sub-processors operate in other countries, so personal information is transferred to and processed in the United States and other countries.

When personal information leaves a country that restricts transfers we use one of these safeguards, named in our contracts:

• EU and EEA to a country without an adequacy decision: the European Commission's Standard Contractual Clauses (Decision 2021/914), modules 2 and 3 where we act as processor and module 1 where we act as controller, incorporated by reference in our Data Processing Agreement. Where a recipient is certified under the EU-US Data Privacy Framework we may rely on that framework for transfers to it.
• UK: the ICO's International Data Transfer Addendum to those clauses, or the UK International Data Transfer Agreement, and the UK Extension to the Data Privacy Framework for certified recipients.
• Switzerland: the same clauses, adapted as the Swiss Federal Data Protection and Information Commissioner requires.
• South Africa: a binding agreement giving substantially similar protection to POPIA, or another ground in POPIA section 72 (for example your consent or performance of a contract).
• Israel: the undertakings the Privacy Protection Regulations on data transfers abroad require, or another lawful basis in those Regulations.
• Australia: reasonable steps under Australian Privacy Principle 8 to make sure the recipient handles information consistently with the Australian Privacy Principles.

Colony itself relies on the Standard Contractual Clauses and the UK Addendum for personal information it receives from the EU, EEA, UK and Switzerland. You can ask for a copy of the safeguards at support@colonys.io.

13. Security

We protect personal information with measures appropriate to the risk, including: separation of each company's data and role-based access; least-privilege staff access; passwords stored as hashes; optional two-factor sign-in; encryption of connections (TLS); encryption of stored secrets and signing keys; audit logs of sensitive actions; backups; rate limits and bot checks on public pages; expiring and token-protected public links; input validation; automated tests including checks that one company cannot see another's data; staff confidentiality duties; and an incident response process. The detailed measures are in Annex 2 of our Data Processing Agreement. No system is perfectly secure, so please use a strong, unique password and switch on two-factor sign-in.

14. If something goes wrong (breach notice)

• Data we process for a business: we notify the business without undue delay and within [72] hours of becoming aware, with the facts it needs, so it can notify you and the regulator.
• Our own data: we notify affected people and regulators as the law requires. This includes the supervisory authority within 72 hours where GDPR or UK GDPR applies and risk is likely; the Information Regulator and affected people as soon as reasonably possible under POPIA section 22; US state attorneys general and residents under state breach laws; and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

15. Your rights

Your rights depend on where you live. Colony recognises all of them for people anywhere, as far as the law and practicality allow.

If your data is in a business's Colony account, ask that business. We cannot decide on its behalf. We will refer you to it and help it answer, using our export and erase tools.

16. How to make a request

• Email support@colonys.io or use [web form link]. Please say which right you are using and which country or state you live in.
• Verification. We confirm your identity by matching details you give us to what we hold, or by replying to the email address on the account. We may ask for more if needed. We will not ask for more than is necessary and will not use it for anything else.
• Authorised agents. In California and other states you may use an authorised agent. We ask for your written permission to the agent, or a power of attorney, and may confirm directly with you.
• Fees. None for ordinary requests. We may charge or decline for requests that are manifestly unfounded or excessive, as the law allows.
• Refusals and appeals. If we refuse, we say why. You may appeal by replying to our answer with the word "appeal"; we respond within the period your law sets and tell you how to contact your regulator.
• No retaliation. We do not treat you worse for using your rights.

17. California notices

• Sale and sharing. In the past 12 months Colony has not sold personal information. Colony's own marketing, sign-up and login pages use Google Ads and Google Analytics cookies, only after a visitor chooses "Accept all"; California treats that as "sharing" for cross-context behavioural advertising. A visitor can opt out at any time with the "Cookie settings" button, and we honour the Global Privacy Control signal automatically. Colony has no actual knowledge of selling or sharing personal information of anyone under 16 and does not direct ads to them. There is no "Limit the Use of My Sensitive Personal Information" link because we do not use sensitive personal information for purposes beyond those the law allows. [Counsel: confirm that the "Cookie settings" control satisfies the California opt-out link rule, or add a footer link "Do Not Sell or Share My Personal Information" that opens it.]
• Disclosures for a business purpose. In the past 12 months we disclosed identifiers, contact information, commercial information, internet or network activity, and professional information (for example a job title or company) to our sub-processors (section 8) for the purposes in section 3. We did not disclose sensitive personal information for any other purpose.
• Your rights and how to use them are in sections 15 and 16, including preference signals (section 10).
• Shine the Light (Civil Code section 1798.83). We do not disclose personal information to third parties for their own direct marketing. You may ask us at support@colonys.io to confirm this.
• Financial incentives. We offer none.
• Service-provider role. For customer data a business puts in Colony we act as its service provider (section 2); consumers should send requests to that business.
• Metrics. [Delete this line unless Colony receives requests for 10 million or more California consumers in a year.]

18. EU and UK

Our legal bases are listed in section 3. Where we rely on legitimate interests, they are keeping Colony secure and working, preventing abuse, and understanding use so we can improve it; we balance them against your rights and you may object. You may complain to your supervisory authority (for example the Information Commissioner's Office in the UK, or the authority in the EU country where you live or work). Representative and data protection officer details are in section 1.

19. South Africa

For our own data Colony is the responsible party under POPIA. We process information lawfully and for the purposes stated, collect only what we need, keep it only as long as section 11 says, keep it accurate, tell you what we collect and why, and secure it as POPIA sections 19 to 22 require. Where we process for a business we act as operator and the business is the responsible party. Complaints: first to us, then to the Information Regulator (South Africa), JD House, 27 Stiemens Street, Braamfontein, Johannesburg, 2001; enquiries@inforegulator.org.za; complaints.IR@inforegulator.org.za. Our PAIA manual is available on request.

20. Israel

Colony holds personal information about Israeli users as a database holder or processor. You may inspect and correct your information (Privacy Protection Law sections 13 and 14), and ask to be removed from direct-marketing lists (section 17F). If you have a complaint you may contact the Privacy Protection Authority.

21. Australia

Colony handles personal information of Australian users in line with the Australian Privacy Principles. You may ask for access and correction (APPs 12 and 13). If you are unhappy with our response, you may complain to the Office of the Australian Information Commissioner (oaic.gov.au). Marketing messages follow the Spam Act 2003: consent, sender identification and a working unsubscribe.

22. Automated decision-making

Colony does not make decisions about individuals based solely on automated processing that have legal or similarly significant effects. Its rule-based features (for example flagging a customer who has gone quiet, or a lead score) assist a person at the business, who decides. Businesses that configure automations are responsible for their own use.

23. Children

Colony is a business service. It is not for anyone under 18 and we do not knowingly collect personal information from children. If you believe a child has given us personal information, tell us and we will delete it. Businesses that keep children's information in Colony (for example a clinic, school or club) are responsible for the extra legal duties, such as parental consent, and must tell us in writing so we can agree safeguards first.

24. Marketing

We send marketing only if you opted in, with an unsubscribe link in every message. Service, security and billing notices are not marketing. Marketing text and WhatsApp messages need your consent. Reply STOP to opt out of texts and WhatsApp messages.

25. Changes

We will change the "last updated" date and, for material changes, tell account owners by email or in the app before they apply. Earlier versions are available on request.

26. Contact

eOTP LLC trading as Colony, 800 North King Street, Suite 304 #4144, Wilmington, DE 19801, US. Privacy: support@colonys.io. General: info@colonys.io. Security reports: support@colonys.io.

Sub-processors and connected services

This page lists the companies that process personal information for Colony, what they do, what data they see and where. It is Annex 3 of the Data Processing Agreement. Colony tells account owners at least [30] days before it adds or replaces a sub-processor that handles customer data, and account owners may object (see the DPA). To receive change alerts, [email subscription address or page to watch].

1. Colony's own sub-processors

These are used for every customer that uses the feature shown. Colony has a written data processing agreement or equivalent terms with each.

2. Services a business connects itself

The business is the customer of these providers and has its own contract with them. Colony sends data to them only on the business's instruction, and they are not Colony sub-processors. Colony does not control their privacy practices.

Data imported from other tools (for example HubSpot, Pipedrive, Apollo or Lusha) comes from a file the business uploads. Colony does not connect to those companies.

3. Software loaded in the browser

Public pages built with Colony load fonts and code libraries from content delivery networks, which can see a visitor's IP address and browser details when the page loads.

4. Colony's own systems

These are run by Colony, are not third parties, and sit inside the hosting arrangement in section 1: the database, the message queue (RabbitMQ), and Colony's background worker application.

5. Why a transfer mechanism is listed

Where a provider is outside the customer's country, Colony relies on the EU Standard Contractual Clauses (with the UK Addendum for UK data), a Data Privacy Framework certification where the provider holds one, or the other mechanisms in Annex 4 of the DPA. Ask support@colonys.io for a copy of the safeguards for any provider.

6. Change log

Your region

These sections add to the policy above for people and businesses in these places. If a section here is stricter than the rest of this policy, the stricter rule applies to you.

South Africa (POPIA)

It applies when a business or person in South Africa uses Colony, when personal information of people in South Africa is processed in Colony, or when Colony processes personal information using automated or non-automated means in South Africa (POPIA section 3).

1. Who is the responsible party and who is the operator

POPIA has two roles, and they map to the two roles in the core Privacy Policy.

Colony as operator (POPIA sections 20 and 21). Colony processes a business's information only with that business's knowledge and authorisation, treats it as confidential, and does not disclose it unless the law requires it or the business instructs it. Colony and the business have a written contract that obliges Colony to keep the information secure: the Data Processing Agreement, which forms part of the Terms of Service. It covers the points POPIA expects in an operator contract: processing only on instruction, confidentiality, the security measures in Annex 2, notice to the business of a security compromise, help with data subject requests, sub-processor controls, return or deletion at the end, and audit information. Colony will notify the responsible party immediately where there are reasonable grounds to believe that personal information has been accessed or acquired by an unauthorised person (section 21(2)).

Colony as responsible party. For its own account, billing, security, website and marketing data, Colony decides why and how personal information is processed. Colony's contact for these matters is in section 12.

2. Information Officer

Every private body must have an Information Officer (POPIA sections 55 and 56; for a company this is the head of the company unless another person is designated). The Information Officer must register with the Information Regulator through the Regulator's online eServices portal before taking up the duties.

• Colony's Information Officer: [name], [email], [telephone], 800 North King Street, Suite 304 #4144, Wilmington, DE 19801, US.
• Deputy Information Officer: [name], [email].
• Registration with the Information Regulator: [Colony's Information Officer is registered with the Information Regulator (registration number [number], date [date])].

The Information Officer's duties (POPIA section 55 and Regulation 4) include encouraging compliance with the eight conditions, dealing with requests made to Colony, working with the Regulator, developing, implementing, monitoring and continually improving a compliance framework, carrying out personal information impact assessments, and making sure there are internal measures and systems to process requests for information or access. Colony's Information Officer also runs the breach procedure in section 9.

A business using Colony must appoint and register its own Information Officer for its own data. Colony's Information Officer is not the business's Information Officer.

3. The eight conditions for lawful processing and how Colony meets them

This table covers the information for which Colony is the responsible party. For information a business puts into Colony, the business must meet the conditions, and Colony supports it as operator.

The notice required when collecting personal information (POPIA section 18) is given by the core Privacy Policy and this section: it says what is collected, why, whether giving it is voluntary, who receives it, that data can go outside South Africa (section 7), your rights to access, correct, object and complain, and who to contact.

4. Special personal information and children

Special personal information is information about religious or philosophical beliefs, race or ethnic origin, trade union membership, political persuasion, health or sex life, biometric information, and criminal behaviour or alleged offences (POPIA sections 26 to 33). Information of a child (a person under 18 who is not legally competent to act alone) needs a lawful ground and generally the consent of a competent person (sections 34 and 35). Both are prohibited unless a specific ground applies, such as consent, establishing or defending a legal right, or an authorisation from the Information Regulator.

• Colony does not ask for or use special personal information or children's information for its own purposes. The account holders Colony deals with are businesses and their staff.
• A business that puts this information into Colony (for example a clinic, therapist, school or sports club) is the responsible party. It must have a ground under POPIA for it, and it must make sure the features it uses are suitable. Where the transfer of special or children's information to a country without adequate protection is planned, POPIA section 57 requires the Regulator's prior authorisation unless a ground applies; the business must consider this before using Colony for that information.
• Colony's AI features are not designed for clinical or legal decisions.

5. Direct marketing and messaging (POPIA section 69, ECTA section 45, CPA section 11)

The rules.

• Electronic direct marketing (email, SMS, WhatsApp, automated calls and calls by telephone) is prohibited unless the person has consented, or is an existing customer of the sender: the sender obtained the contact details in the context of a sale of a product or service, markets only its own similar products or services, and gave the person a reasonable opportunity to object, free of charge, when the details were collected and on each occasion a message is sent.
• Consent can be asked for only once. A responsible party may approach a person only once to ask for consent, and only if that person has not previously refused. The first message to someone who is not a customer must therefore be the request for consent, stating the goods or services to be marketed.
• An opt-out is not consent. The Regulations state that for unsolicited electronic marketing an opt-out does not amount to consent. Silence or a pre-ticked box is not consent. The sender must be able to prove the consent.
• How consent can be requested. Since 17 April 2025 consent may be requested on a form substantially similar to the Information Regulator's Form 4 or in any other expedient way that is free of charge and reasonably accessible, for example by email, telephone, SMS, WhatsApp, fax or automated calling machine. A request made by telephone or automated call must be electronically recorded, and the recording or a transcript must be given free of charge on request.
• Every message must state the identity of the sender (or the person for whom it is sent) and give an address or contact details where the person can ask that the messages stop (section 69(4)). Compile and keep a list of people who refused or objected.
• Opt-out registers. A person may register a pre-emptive block against direct marketing under CPA section 11. The National Consumer Commission launched its National Opt-Out Registry on 7 October 2026: direct marketers must register on it and clean their lists against it monthly before a campaign, and consumers can register blocks from May 2027. WASPA members must not market to numbers on the National Consumer Commission's or WASPA's registers, must honour STOP, END, CANCEL, UNSUBSCRIBE and QUIT in any capitalisation, and must send a confirmation of the opt-out.
• Hours. The WASPA Code of Conduct prohibits direct marketing on Sundays and public holidays, on Saturdays before 09:00 and after 13:00, and on other days between 20:00 and 08:00, unless the person has agreed otherwise.
• Unsolicited commercial messages under ECTA section 45 must offer a free way to opt out and, on request, identify where the contact details came from.

What Colony does.

• A business is the sender of its own marketing and is responsible for obtaining, recording and proving consent. Colony's consent record (the consent ledger) stores each consent, its source, time and withdrawal.
• For messages to South African recipients Colony requires a recorded, granted marketing consent before it sends marketing by SMS or WhatsApp. It does not rely on the existing-customer exception. A refusal or STOP is honoured immediately, a final confirmation reply is sent after STOP, and the person is placed on a suppression list. Marketing email carries an unsubscribe link and respects the suppression list.
• Colony holds automated messages between 20:00 and 08:00 in South Africa. SMS and voice marketing hours, the WASPA Code and the national opt-out lists for those channels are handled by LogicSMS, the SMS provider; a business that sends marketing by another route (for example its own SMS provider) must follow the WASPA hours itself.
• SMS and voice go through LogicSMS, [a member of WASPA], and WhatsApp through Meta's WhatsApp Business Platform with approved templates and Meta's opt-in rules.
• Consent checkboxes on forms Colony provides are not pre-ticked. Service messages (for example appointment reminders, document links and invoices) are not marketing, but a business must not use them to promote products.
• Colony sends its own marketing email only to people who have opted in, with an unsubscribe link in every message.

6. Your rights and how to use them (POPIA sections 5, 11, 18, 23 to 25, 69, 71)

You may ask a responsible party to:

• Confirm whether it holds personal information about you (free of charge), and give you the record and the identity of third parties who have had access to it (a prescribed fee may apply for the record);
• Correct or delete information that is inaccurate, irrelevant, excessive, out of date, incomplete, misleading or obtained unlawfully;
• Destroy or delete the record of your information if the responsible party is no longer allowed to keep it;
• Object to the processing on reasonable grounds, or at any time to processing for direct marketing;
• Withdraw consent, without affecting processing already done;
• Not be subject to a decision that has legal or substantial effects on you and is based solely on automated processing of your information, with the exceptions in section 71. Colony makes no such decisions;
• Complain to the Information Regulator (section 10), or go to court.

How to ask Colony (where Colony is the responsible party). Email support@colonys.io or write to the Information Officer. You do not need a particular form: the Regulations accept a request on a form substantially similar to the Regulator's forms, or in any manner that suits you, by hand, post, email, SMS or WhatsApp, and a request made by telephone is recorded and the recording or a transcript is available to you free of charge. The Regulator's forms are:

• Form 1: Objection to the processing of personal information (section 11(3));
• Form 2: Request for correction or deletion of personal information, or for destruction or deletion of a record of personal information (section 24);
• Form 4: Application for the consent of a data subject for direct marketing (section 69(2)).

Objection and correction or deletion requests are free. We will confirm what we did in writing within 30 days (Regulation 3.6); we may ask you to prove who you are before we release or change information.

If a business that uses Colony holds your information, send your request to that business, because it decides what is held and why. Colony will help the business find, correct, export or erase your information with Colony's tools, and will not itself respond to the request except to pass it on.

Access to records under PAIA. A request for access to a record held by Colony is made under PAIA; see the PAIA manual.

7. Cross-border transfers (POPIA section 72)

Colony is a United States company and its providers operate in several countries (see the sub-processor list). Colony's data is hosted at [hosting provider, country]. POPIA allows a responsible party to transfer personal information to a third party in another country only if:

• the recipient is subject to a law, binding corporate rules or a binding agreement that gives an adequate level of protection, substantially similar to the POPIA conditions, including on onward transfers; or
• the data subject consents; or
• the transfer is necessary to perform a contract between the data subject and the responsible party, or to take steps at the data subject's request before a contract; or
• the transfer is necessary for a contract in the data subject's interest between the responsible party and a third party; or
• the transfer is for the benefit of the data subject, it is not reasonably practicable to get consent, and the data subject would be likely to give it.

POPIA has no list of approved countries. Colony relies on a binding written agreement with each sub-processor that requires protection substantially similar to POPIA, restricts onward transfers and requires security, and, for transfers between a business and Colony, on the Data Processing Agreement. Each business, as responsible party, authorises these transfers by accepting the Terms. A business that transfers special personal information or children's information abroad must also consider the Regulator's authorisation under section 57.

8. Retention (POPIA section 14)

Records of personal information must not be kept longer than needed for the purpose, unless the law requires or allows it, the responsible party reasonably needs it, a contract requires it, or the data subject consented. When no longer needed they must be deleted, destroyed or de-identified as soon as reasonably practicable.

Colony's own data: account data while the account is active; up to 30 days after cancellation or deletion for recovery, then deletion from production, and backups age out within 35 days; the Recycle Bin for 30 days; assistant chats 30 days; audit and event logs 12 months; billing and tax records for the period the law requires. A business sets the retention of its own customers' data.

Examples of statutory minimum periods a South African business may need to observe (the periods depend on the record and the business, so check the law that applies to you):

9. Security compromise (POPIA section 22)

If Colony suffers a security compromise it will contain it, assess what happened and which information is affected, and notify each affected responsible party without delay (target: within [72] hours of becoming aware), giving what it knows: what happened, which information and which people, the likely consequences, what Colony has done and what the business should do. A responsible party must then notify the Information Regulator and the affected data subjects as soon as reasonably possible after discovering the compromise, unless a public body responsible for detecting or investigating offences, or the Regulator, determines that notice would impede a criminal investigation. POPIA sets no fixed number of hours. Notice to the Regulator is on the Regulator's form SCN1 (Security Compromises Notification), which the Regulator acknowledges with a reference number; notice to data subjects must give enough information, including what you can do to protect yourself and, if known, who accessed the information, to let you take protective steps. For a compromise of Colony's own data Colony, as responsible party, makes both notifications.

10. Complaints

Start with Colony's Information Officer ([email]). You may complain to the Information Regulator (South Africa) about any interference with your personal information, on Form 5, which can be sent by email, post, courier or hand, or completed online. Anyone with a sufficient personal interest, or acting in the public interest, may complain, and the Regulator will help you put the complaint in writing.

• Physical address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191
• Telephone: 010 023 5200; toll free 0800 017 160
• POPIA complaints: POPIAComplaints@inforegulator.org.za; PAIA complaints: PAIAComplaints@inforegulator.org.za; general enquiries: enquiries@inforegulator.org.za
• Website: inforegulator.org.za

11. What a business in South Africa must do when it uses Colony

This is a summary, not legal advice.

1. Appoint and register an Information Officer (and deputies if needed) with the Information Regulator on its eServices portal.
2. Tell people what you collect and why (POPIA section 18): a short notice on each form, page and booking link, including their right to object and to complain, and that their information may be stored outside South Africa.
3. Have a lawful ground for each type of information you put into Colony, and extra grounds for special personal information and children's information.
4. Accept the Data Processing Agreement (it is part of the Terms), which is your written operator contract with Colony (sections 20 and 21).
5. Market by electronic means only with consent or under the existing-customer exception; ask for consent only once; keep proof; add your identity and an opt-out to every message; honour opt-outs; schedule marketing outside the restricted hours; register on the National Opt-Out Registry and clean your lists as the regulations require.
6. Do not keep information longer than you need; delete or de-identify it, or use Colony's erase tools and Recycle Bin settings.
7. Respond to requests to access, correct, delete or object within 30 days, and keep records of what you did.
8. Keep information secure: strong passwords, two-factor sign-in, role-based access, and removal of former staff.
9. If there is a compromise, notify the Information Regulator (form SCN1) and the affected people as soon as reasonably possible; Colony will tell you without delay if it happens on Colony's side.
10. Keep a PAIA manual (every private body must, including small ones, available at your principal place of business or on your website).
11. Check cross-border rules if you send special personal information or children's information abroad.

Colony's tools to help: consent ledger, suppression and STOP handling, quiet hours, export and erase tools, the Recycle Bin retention setting, per-company roles, audit log, and data export.

12. Contact

Colony's Information Officer: [name], [email], [telephone], 800 North King Street, Suite 304 #4144, Wilmington, DE 19801, US. Privacy requests: support@colonys.io. eOTP LLC trading as Colony, 800 North King Street, Suite 304 #4144, Wilmington, DE 19801, US.

United States

1. Roles

• Where a business puts personal information into Colony (its leads, customers, bookings, invoices, messages and so on), the business is the "business" or "controller" and Colony is its "service provider" or "processor" (California Consumer Privacy Act as amended by the CPRA, "CCPA", and the other state laws below). The Data Processing Agreement contains the contract terms these laws require (section 6).
• Where Colony collects information for its own purposes (account holders and users, billing, security, our website and marketing), Colony is the business or controller, to the extent a law applies to Colony.

2. Which laws

There is no single US privacy law. Twenty states have comprehensive consumer privacy laws: California; Virginia, Colorado and Connecticut (2023); Utah (December 2023); Texas, Oregon, Montana and Florida (2024, Florida's is narrower); Iowa, Delaware, Nebraska, New Hampshire and New Jersey (January 2025); Tennessee and Minnesota (July 2025); Maryland (October 2025); and Indiana, Kentucky and Rhode Island (January 2026). Connecticut, Oregon, Colorado, Kentucky and others have amendments taking effect in 2026. Most of these apply to a business only above thresholds (for example a number of consumers or a share of revenue from selling data), so each business using Colony decides which laws bind it. Colony applies the highest common standard to all US users:

• no sale of personal information and no sharing for cross-context behavioural advertising;
• use of Customer Data only to provide Colony;
• a way to exercise the rights below.

California's regulations on risk assessments, cybersecurity audits and automated decisionmaking technology are being phased in from 2026 and 2027. Colony does not use Customer Data for automated decisions that have legal or similarly significant effects on people.

3. What we collect (for the California notice at collection)

In the last 12 months Colony collected the following categories from you, your business and your devices. Purposes are those in the core Privacy Policy (provide, secure, support, bill and improve Colony; comply with law). Colony does not sell or share any of them, and discloses them only to the service providers listed in the sub-processor list and as the law requires.

Customer Data (information a business puts in Colony) may include any of these categories and others, including sensitive information, at the business's choice; Colony processes it only for the business and does not use or disclose sensitive personal information to infer characteristics.

Sources: you, your business and your devices. No sale, no sharing, no targeted advertising. Colony does not knowingly sell or share the personal information of anyone under 16.

4. Your rights and how to use them

Depending on your state you may know and access what information is held and have a copy (portability); delete; correct; opt out of sale, sharing, targeted advertising and profiling; limit use of sensitive personal information; withdraw consent; and not be discriminated against for using your rights. Colony does not sell information. Sharing for advertising happens only through the Google Ads cookies a visitor accepts on Colony's own pages, which a visitor can switch off at any time with the "Cookie settings" button; we will also record and honour an opt-out request sent to us.

• How: email support@colonys.io. Colony is an online-only business, so an email address is the way to contact us (California Civil Code 1798.130 allows this); we also accept requests through your Colony account.
• If a business holds your information in Colony, ask that business; we refer such requests to it.
• Time: we confirm receipt within 10 business days and respond within 45 days, extended once by up to 45 more days if we tell you why (the period in California and most other states). Opt-out requests are handled within 15 business days.
• Verification: we may ask for information to confirm it is you. You may use an authorised agent; we may ask for proof of authority.
• Appeal: if we refuse a request, you may appeal by replying to our response with the word "appeal"; we answer within 45 to 60 days, as your state requires, and tell you how to contact your state attorney general if you are still not satisfied.
• No charge for up to two requests a year, unless a request is manifestly unfounded or excessive.

5. Global Privacy Control

On pages built with Colony, a browser that sends the Global Privacy Control signal is treated as an opt-out of analytics and non-essential tracking ("Essential only"), without asking again, and visit counting stops for that browser.

6. Service provider and processor terms

The Data Processing Agreement binds Colony, as service provider or processor, to: process Customer Data only for the limited purposes of providing Colony and on the business's instructions; not sell or share it; not retain, use or disclose it outside the direct business relationship or for any other purpose; not combine it with other information; comply with the applicable law and give the business the same level of protection the law requires; tell the business if it can no longer meet its obligations; let the business take reasonable steps to stop unauthorised use; keep it confidential and secure; help the business answer consumer requests; delete or return it at the end of the service; flow the same terms down to sub-processors; and give the information needed to show compliance and allow reasonable assessments.

7. Marketing, texts and calls

• Email (CAN-SPAM Act). Commercial emails must not use false or misleading headers or subject lines, must identify themselves as advertisements, include the sender's valid physical postal address, and give a clear way to opt out that works for at least 30 days after sending. An opt-out must be honoured within 10 business days. Colony honours it immediately and keeps a suppression list. A business using Colony is responsible for its own email content and address.
• Texts and calls (Telephone Consumer Protection Act, state laws).
• Marketing texts or calls made with an autodialler or an artificial or prerecorded voice need the recipient's prior express written consent, which names the seller and the channel and does not make a purchase a condition. Colony records granted consent, source, wording and time, and will not send marketing by text or WhatsApp without a granted consent record.
• Consent may be revoked by any reasonable means, in words such as stop, quit, end, cancel, unsubscribe, opt out or revoke. Colony honours STOP immediately and sends one final confirmation. The FCC's rule that a revocation applies to all future messages from the same sender has been postponed to 31 January 2027 and is under further review by the FCC.
• Hours. Federal rules prohibit telemarketing calls before 8 a.m. and after 9 p.m. at the recipient's location; some states are stricter, and some (for example Florida and Oklahoma) restrict texts to 8 a.m. to 8 p.m. Colony holds marketing messages between 20:00 and 08:00 in the company's time zone as a safeguard; a business that has recipients in several time zones must schedule accordingly.
• State laws such as the Florida Telephone Solicitation Act, and the Oklahoma, Maryland, Washington and other state laws, add consent, frequency and time rules and allow private lawsuits.
• National and state Do Not Call lists apply to telemarketing calls and texts to consumers; businesses must scrub their lists.
• A2P 10DLC. Business texting from US local numbers requires the sender's brand and campaign to be registered with the carriers' registry; the business (or Colony, where it provides the number) must complete registration, and carriers may block unregistered traffic.
• Treatment in Colony: marketing email to US recipients is allowed unless the recipient has opted out (opt-out), unless the business has recorded otherwise; marketing texts and WhatsApp require granted consent.

8. E-signatures and electronic records

The federal ESIGN Act and the state Uniform Electronic Transactions Act (UETA) give electronic signatures and records the same legal effect as paper for most commercial documents if the signer intends to sign, consents to do business electronically, can access and keep the record, and the record is retained and reproducible. For a consumer, ESIGN also requires specific disclosures and consent before required legal notices are delivered electronically. Exceptions include wills, codicils and testamentary trusts; adoption, divorce and other family-law documents; court orders and official court documents; notices of cancellation or termination of utility services; notices of default, acceleration, repossession, foreclosure or eviction on a primary residence; cancellation of health or life insurance; product recall notices; and documents that must accompany hazardous materials; and parts of the Uniform Commercial Code. Colony records the signer's consent, time, IP address and a fingerprint (hash) of the document. Colony is a tool, not legal advice: the business that sends a document decides whether it can be signed electronically.

9. Health, children, financial and biometric information

• Health. Colony is not a HIPAA business associate unless a separate written business associate agreement says so. Do not store protected health information in Colony without one. Some states regulate consumer health data separately (for example Washington's My Health My Data Act, Nevada and Connecticut); a business that keeps such data is responsible for that law.
• Children. Colony is a business service and is not directed to children under 13 (COPPA) or to minors. Businesses that keep children's information in Colony are responsible for the laws that apply to them, including parental-consent rules.
• Financial information. Colony does not hold card numbers: payment providers do. A business covered by the Gramm-Leach-Bliley Act is responsible for its own safeguards and notices.
• Biometrics. Colony does not collect biometric identifiers. A business that does, for example with Illinois's Biometric Information Privacy Act or similar laws, is responsible for notice, consent and retention.

10. Security and data breach

All fifty states have breach-notice laws. If Colony learns of a breach affecting Customer Data it will tell the affected business without unreasonable delay and within [72] hours, with the facts it has, and help the business notify individuals, state attorneys general, credit bureaus and others as the law requires. A service provider that maintains data it does not own must notify the owner immediately after discovery (for example California Civil Code 1798.82). California requires notice to individuals within 30 calendar days of discovery, and to the Attorney General where more than 500 California residents are affected. Security measures are in the Data Processing Agreement (Annex 2).

11. Retention and deletion

As the core Privacy Policy. A business can run its own customers' deletion requests with Colony's erase tool, and when an account ends Customer Data is deleted after 30 days, with backups ageing out in 35 days.

12. Regulators and complaints

Contact us first at support@colonys.io. You may also contact:

• the California Privacy Protection Agency (cppa.ca.gov) or the California Attorney General (oag.ca.gov/privacy);
• your state attorney general (find yours at naag.org);
• the Federal Trade Commission (reportfraud.ftc.gov) for unfair or deceptive practices and email marketing;
• the Federal Communications Commission (fcc.gov/consumers) for unwanted calls and texts.

13. Contact

eOTP LLC trading as Colony, 800 North King Street, Suite 304 #4144, Wilmington, DE 19801, US. Privacy: support@colonys.io. General: info@colonys.io. [Toll-free number, if required by a state law that applies.]

United Kingdom and European Union (GDPR)

1. Who is the controller and who is the processor

• Colony as controller: eOTP LLC trading as Colony decides why and how personal data is processed for its own account, billing, security, website and marketing data.
• Colony as processor: for personal data a business puts in Colony (its customers, leads, staff, bookings, messages and so on), the business is the controller and Colony is its processor. The Data Processing Agreement is the contract required by article 28 GDPR and UK GDPR, and covers the subject matter, duration, nature and purpose of processing, the types of data and data subjects, processing on documented instructions only, confidentiality, security, sub-processors, help with rights requests and breaches, deletion or return, and audits.
• EU and UK representative (article 27): [name and address of the representative in the EU and in the UK, or: Colony has not appointed one because it does not offer services to people in those regions on a regular basis].
• Data protection officer: [name and contact, or: Colony has not appointed one because it is not required to].

2. Law and when it applies

The EU General Data Protection Regulation 2016/679 ("GDPR"), the UK GDPR and the Data Protection Act 2018 (as amended by the Data (Use and Access) Act 2025), the Privacy and Electronic Communications Regulations 2003 (UK "PECR"), and the ePrivacy rules of EU member states. They apply when a business or Colony is established in the EU or UK, offers goods or services to people there, or monitors their behaviour there (article 3).

3. Legal bases (article 6) for data we control

Special-category data (article 9) (health, religion, ethnicity, political opinions, biometric, genetic data, sex life, trade union membership) and criminal-offence data (article 10) are not processed by Colony for its own purposes. A business that keeps such data in Colony needs its own article 9 condition and is responsible for it. Where we rely on legitimate interests we have weighed them against your rights; ask us if you want to see the balancing.

4. Your rights (articles 12 to 22)

You may ask for access to your personal data and a copy; rectification; erasure; restriction; portability (a machine-readable copy, where processing is by consent or contract); objection to processing based on legitimate interests and, absolutely, to direct marketing; withdrawal of consent; and not to be subject to a decision based solely on automated processing with legal or similarly significant effect. Colony makes no such decisions.

• How: email support@colonys.io. We may ask you to prove who you are. Requests are free unless manifestly unfounded or excessive.
• Time: one month from receipt; we may extend it by up to two further months for complex or numerous requests and will tell you within the first month. In the UK the period can be paused while we wait for information we need to identify you or to clarify the request, and we search to a reasonable and proportionate extent.
• If a business holds your data in Colony, ask that business; Colony helps it respond and does not answer requests about data it only processes.
• Complaints procedure: if you are unhappy with how we handled a request or your data, tell us, and we will acknowledge your complaint within 30 days and respond without undue delay. You may also complain to your supervisory authority at any time (section 9).

5. Marketing and cookies (ePrivacy and PECR)

• Email and SMS marketing to individuals needs prior consent. The UK "soft opt-in" for existing customers is not used by Colony. Every marketing message includes who it is from and an easy way to unsubscribe, and unsubscribing is honoured immediately and applied to a suppression list. In the UK, marketing email to a corporate subscriber (a company) does not need consent, but sole traders and some partnerships count as individuals. Breaches of PECR can be fined at the same level as under the UK GDPR.
• Cookies and similar technologies (article 5(3) ePrivacy Directive; PECR regulation 6) need consent unless strictly necessary. Colony's own pages set only strictly necessary cookies. On public pages built with Colony the cookie notice offers equal choices ("Essential only" and "Accept all"); analytics and any business-added Google Analytics load only after "Accept all", with advertising signals off, and Global Privacy Control is honoured. Anonymous visit counts (shortened IP address, no cookie) before a choice has been made are [not counted for visitors in the EU and UK until they accept] [counted without a cookie]. The business that publishes a page is responsible for the rest of that page.

6. International transfers (chapter V)

Colony is based in the United States, hosts data at [hosting provider, country] and uses providers in the United States and other countries (sub-processor list). Personal data from the EEA and UK is transferred only with one of these safeguards:

• an adequacy decision, such as the EU-US Data Privacy Framework or the UK-US data bridge, for a recipient that is certified to it [list Colony's own certification, if any];
• the EU Standard Contractual Clauses (Commission Decision 2021/914; module 2, controller to processor, and module 3, processor to processor) incorporated into the Data Processing Agreement and Colony's agreements with its sub-processors; and for UK data the UK International Data Transfer Addendum to those clauses (or the UK International Data Transfer Agreement); and
• a transfer risk assessment where we rely on the clauses, supplemented where needed by security measures (encryption in transit, access control, limiting access to the data).

You can obtain a copy of the safeguards by writing to support@colonys.io. The Data Privacy Framework decision was upheld by the EU General Court in September 2025; an appeal to the Court of Justice is pending, so we keep the clauses as a fall-back basis.

7. Security and personal data breaches (articles 32 to 34)

Colony applies the measures described in Annex 2 of the Data Processing Agreement. Where Colony is the processor it notifies the controller without undue delay after becoming aware of a breach and in any case within [72] hours, with the information in article 33(3). Where Colony is the controller it notifies the supervisory authority (in the UK, the ICO) within 72 hours of becoming aware, unless the breach is unlikely to result in a risk to people, and tells affected individuals without undue delay when the risk is high. A business that is the controller notifies its own authority and individuals.

8. Sub-processors, records and assessments

The list of sub-processors is in the sub-processor list; Colony gives notice of changes and a chance to object under clause 7 of the Data Processing Agreement and flows the same obligations to each sub-processor (article 28(2) and (4)). Colony keeps records of processing (article 30) and carries out data protection impact assessments for new high-risk processing, including new AI features.

9. Retention

As the core Privacy Policy. Personal data is not kept longer than needed; data a business controls is kept as it instructs and is returned or deleted when the service ends (30 days after deletion, then backups age out in 35 days).

10. Complaints and regulators

Contact Colony first at support@colonys.io. You may complain to your supervisory authority:

• United Kingdom: the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF; telephone 0303 123 1113; ico.org.uk/make-a-complaint.
• European Union and EEA: the data protection authority of the country where you live, work or where the issue arose. A list is at edpb.europa.eu (under "About the EDPB", "Members").

You may also go to court. Because Colony has no establishment in the EU, no single lead authority applies.

11. Contact

eOTP LLC trading as Colony, 800 North King Street, Suite 304 #4144, Wilmington, DE 19801, US. Privacy: support@colonys.io. EU representative: [details]. UK representative: [details].

Israel

1. Roles

• Database owner (בעל מאגר). A business that keeps its customers' or staff's personal data in Colony is the database owner: it decides the purposes and is responsible for the database under the Privacy Protection Law.
• Holder (מחזיק). Colony is a holder: it keeps and processes that data for the database owner under a written agreement, the Data Processing Agreement. Colony is subject to the holder's duties under the law, including security and not using the data for its own purposes, wherever it is based.
• For its own data (account, billing, security, website and marketing data) Colony is the database owner.

2. Law

The Privacy Protection Law, 5741-1981, as amended by Amendment 13 (in force from 14 August 2025); the Privacy Protection (Data Security) Regulations, 5777-2017; the Privacy Protection (Transfer of Data to Databases Abroad) Regulations, 5761-2001; the Privacy Protection Authority's guidelines; and, for marketing, section 30A of the Communications (Telecommunications and Broadcasting) Law, 5742-1982 (the "Spam Law"). Amendment 13 widened the definition of personal data (it now includes data of "special sensitivity"), reduced the registration duty, added duties to appoint a privacy protection officer in some cases, introduced administrative fines imposed by the Authority and strengthened rights.

3. Notice when we collect data (section 11)

When we ask you for personal data, we tell you: whether you must provide it by law or it is voluntary; why we collect it (the core Privacy Policy sets out the purposes); who receives it and for what purpose (the sub-processors in the sub-processor list, and others only as the law requires); the consequence of not providing it (for example, we cannot open an account); and your rights to inspect and correct it. We are [name of database owner], eOTP LLC trading as Colony, 800 North King Street, Suite 304 #4144, Wilmington, DE 19801, US.

4. Database registration and the privacy protection officer

Under the amended law registration is required for certain databases only, such as those used to commercialise personal data (for example data brokers), and a registration must disclose transfers abroad. A privacy protection officer must be appointed by public bodies and their service providers, data brokers, direct-mailing service providers that process data on more than 10,000 people, and organisations that systematically monitor people or process data of special sensitivity on a large scale. Colony's status: [Colony is not required to register a database / Colony is registered under number ___]; [Colony has / has not appointed a privacy protection officer: name and contact]. A business in Israel that uses Colony must decide for itself whether it must register its database or appoint an officer.

5. Security and security incidents

The Data Security Regulations require measures matched to the database's level of security: basic, medium or high. Databases that hold data of special sensitivity or that are used for direct marketing are at least at the medium level; those with data on 100,000 people or more, or with more than 100 authorised users, are at the high level. Colony provides access control by role, logging, encryption of connections, backups, separation of each customer's data, and a security-incident procedure, and gives the database owner what it needs for its security documentation. A severe security incident must be reported to the Privacy Protection Authority immediately after discovery, by the database owner (and the Authority may require the owner to tell the people affected). Colony, as holder, notifies the database owner without delay after it becomes aware of an incident affecting its data, in any case within [72] hours, with the facts it has.

6. Your rights

• Inspection (section 13): to see the personal data held about you, free of charge and in a clear form, including data held by a holder.
• Correction or deletion (section 14): to ask that inaccurate, incomplete, unclear or outdated data be corrected or deleted.
• Objection to direct marketing and to use of your data in a database used for it (section 17F): to ask that your data be removed from the database or list.
• Complaint to the Privacy Protection Authority.

How: write to support@colonys.io; if a business holds your data in Colony, ask that business, and Colony will help it respond. Requests are answered within the legal deadline, which we apply as 30 days.

7. Transfers abroad

The Transfer Regulations prohibit sending personal data out of Israel unless a ground applies: the recipient country protects data at the level required in Israel (including the EEA and countries recognised by the EU as adequate); or you consented; or the transfer is to a recipient that undertakes by contract with the database owner to meet the conditions that apply in Israel to holding and using the data, with the necessary changes; or another ground in the Regulations applies. Colony is a United States company and hosts data at [hosting provider, country]. In the Data Processing Agreement Colony undertakes, as a holder receiving data from an Israeli database owner, to: use the data only for the agreed purposes; give effect to rights of inspection, correction and deletion; keep it confidential; apply security measures that meet the material requirements of the Data Security Regulations [and, where it holds data originating in the EEA, the Israeli rules on EEA data]; apply the same terms to onward transfers and to its sub-processors, and not transfer the data onward without the owner's approval. No approval from the Authority is needed for such a transfer, but the database owner's registration (where it has one) must disclose it. The European Union has recognised Israel as providing an adequate level of protection.

8. Marketing (Spam Law, section 30A)

• Advertising by email, SMS, automated calls or fax needs prior express consent in writing or in electronic form, which must be separate from agreement to terms or a privacy policy.
• A narrow exception allows an advertiser to send advertising about its own similar products to a customer whose details it obtained in a sale, if the customer was offered a clear chance to refuse and a way to refuse in every message.
• Every advertisement must say it is an advertisement, say who sent it and give contact details, and give a simple way to unsubscribe, honoured promptly. Breaches can lead to claims for compensation per message without proof of harm, criminal liability, and administrative fines.
• In Colony: Israel is treated as consent-required: marketing by text, WhatsApp or email requires a granted consent record, STOP and unsubscribe are honoured immediately, a final confirmation is sent after STOP, and marketing is held between 20:00 and 08:00 (Israel time). A business may also avoid Shabbat and holidays; Colony does not block them automatically. Consent to marketing is requested separately from the Terms.

9. Retention

As the core Privacy Policy. A database owner keeps data no longer than needed for its purpose; Colony deletes or returns a business's data when the service ends (30 days after deletion, then backups age out in 35 days).

10. Language and accessibility

The Terms, this notice and the Privacy Policy [are available in Hebrew; where there is a difference, the Hebrew / English version governs]. Colony's pages support right-to-left text. Israeli Standard 5568 (based on WCAG 2.0 level AA) applies to services to the public in Israel; see the Accessibility Statement.

11. Complaints and regulator

Contact support@colonys.io first. You may complain to the Privacy Protection Authority, Ministry of Justice: gov.il/en/departments/the_privacy_protection_authority (in Hebrew: gov.il/he/departments/the_privacy_protection_authority).

12. Contact

eOTP LLC trading as Colony, 800 North King Street, Suite 304 #4144, Wilmington, DE 19801, US. Privacy: support@colonys.io.

Australia

1. Roles

• A business in Australia that keeps its customers' or staff's personal information in Colony is the APP entity responsible for it under the Privacy Act. Colony processes that information on the business's behalf under the Data Processing Agreement and does not use it for its own purposes.
• Colony is responsible for its own account, billing, security, website and marketing information.

2. Law and who is covered

The Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles (APPs); the Notifiable Data Breaches scheme (Part IIIC); the Spam Act 2003; the Do Not Call Register Act 2006; and the Privacy and Other Legislation Amendment Act 2024. The Act applies to Australian government agencies and to private organisations with annual turnover above AUD 3 million, and to smaller ones in certain cases (for example health service providers, businesses that trade in personal information, and contracted service providers to government). Colony applies the APPs to all its Australian users as a standard. Changes from the 2024 amendments include a statutory tort for serious invasions of privacy (in force from 10 June 2025), new enforcement powers for the Information Commissioner, a children's online privacy code, and transparency duties for decisions made by automated systems that significantly affect rights, due from 10 December 2026. Colony does not make such decisions about people.

3. Collection notice (APP 1 and APP 5)

• Who collects: eOTP LLC trading as Colony, 800 North King Street, Suite 304 #4144, Wilmington, DE 19801, US, support@colonys.io.
• What and how: the information in the core Privacy Policy, collected from you, your business and your devices, or from a business that uses Colony.
• Why: to provide, secure, support and bill Colony, and to meet legal obligations; marketing only with your consent.
• Whether the law requires it: no Australian law requires you to give it, but we cannot give you an account without it.
• To whom we disclose it: sub-processors in the sub-processor list, professional advisers, and authorities as the law requires.
• Overseas disclosure (APP 8): Colony stores and processes information in [hosting country] and the United States, and uses providers in other countries (for example South Africa for SMS). Colony takes reasonable steps through contracts to make sure overseas recipients handle information consistently with the APPs. A business that uses Colony remains accountable under APP 8 for its customers' information that it discloses overseas through Colony, and accepts these transfers in the Terms.
• Your rights and complaints: section 4 and section 9.
• Anonymity (APP 2): you can browse our public pages anonymously; an account needs a name and email address.

4. Your rights

• Access (APP 12) and correction (APP 13): ask for the information we hold about you, or to correct it. We respond within 30 days. We may refuse in the cases the Act lists and will tell you why and how to complain. There is no charge to make a request.
• If a business holds your information in Colony, ask that business; Colony will help it.
• Complain first to Colony (support@colonys.io); we respond within 30 days. If you are not satisfied, complain to the Office of the Australian Information Commissioner (OAIC) (section 9). The OAIC generally expects you to complain to us first.

5. Data breaches (Notifiable Data Breaches scheme)

An eligible data breach is unauthorised access to, unauthorised disclosure of, or loss of personal information that is likely to result in serious harm to a person. If we suspect one we assess it within 30 days. If it is eligible, the entity that holds the information must notify the OAIC and the affected individuals as soon as practicable, with what happened, the information involved and recommended steps. Where Colony holds a business's information, Colony notifies the business without delay (within [72] hours) so that the business, as APP entity, can notify; where Colony is the entity responsible for the information, Colony notifies the OAIC and the people affected. Notification is made through the OAIC's online form.

6. Marketing (Spam Act, Do Not Call Register)

• Spam Act 2003: commercial electronic messages (email, SMS, instant messages) may be sent only with the recipient's consent (express, or inferred from an existing relationship in limited cases, for example a recent purchase); the message must identify the sender and give accurate contact details; and it must have a functional unsubscribe that is free and honoured within 5 business days. Penalties are heavy and the ACMA enforces them. Address lists must not be harvested.
• In Colony: marketing by SMS or WhatsApp to Australian recipients requires a granted consent record; unsubscribe and STOP are honoured immediately, a final confirmation is sent after STOP, and the suppression list is applied. Marketing is held between 20:00 and 08:00 in the business's time zone. A business with recipients in several time zones is responsible for scheduling.
• Do Not Call Register Act 2006: a business must not make telemarketing calls to numbers on the Register unless the person has consented, must check its lists against the Register, and must observe calling hours (weekdays 9 a.m. to 8 p.m.; Saturdays 9 a.m. to 5 p.m.; none on Sundays or public holidays). Calls must identify the caller and be stopped on request.
• Research and charity messages have their own rules; a business must check them if they apply.

7. Sensitive information

Health, racial or ethnic origin, political or religious views, sexual orientation, criminal record, biometric and genetic information are sensitive information and generally need the person's consent (APP 3.3). Colony does not collect or use sensitive information for its own purposes. A business that keeps it in Colony is responsible for consent and for choosing suitable features. If health information is kept, state privacy and health records laws (for example in Victoria, New South Wales and the Australian Capital Territory) may also apply.

8. Retention and security

Information is kept only as long as needed (APP 11): as in the core Privacy Policy. Colony takes reasonable steps to protect information from misuse, interference, loss and unauthorised access, as described in the Data Processing Agreement (Annex 2), and destroys or de-identifies information it no longer needs, subject to legal retention.

9. Regulator and complaints

Contact Colony first at support@colonys.io. You may complain to the Office of the Australian Information Commissioner: oaic.gov.au; telephone 1300 363 992 (from overseas +61 2 9942 4099); post GPO Box 5288, Sydney NSW 2001; online complaint form at oaic.gov.au. Spam complaints go to the Australian Communications and Media Authority (ACMA), acma.gov.au.

10. Contact

eOTP LLC trading as Colony, 800 North King Street, Suite 304 #4144, Wilmington, DE 19801, US. Privacy: support@colonys.io. [Australian representative, if appointed.]