Effective date: May 1, 2024

This Privacy Statement describes how Sling, Inc. (a Toast company) and its subsidiaries and affiliates (collectively “Sling”, “we”, “us” and/or “our”) collects and manages your personal information (i.e., any information that relates to an identified or identifiable individual) as part of providing our Services (defined below).

We may amend this Privacy Statement from time to time in line with the Changes to this Privacy Statement section below. 

To see our California Privacy Statement, please click the link or scroll down. 

1. Scope 

Sling’s Privacy Statement describes how we manage the collection, usage, storage, and disclosure of personal information.  We use your personal information differently depending on how you interact with the Services or with Sling. This Privacy Statement primarily covers the following relationships: 

• Account Holder: You sign up to use, or manage the Sling Services on behalf of an organization or a company. 
• Application User: You use the Sling Services. Your organization or company signs up for the Services and invites you to become a user, and/ or you access the Sling application via our Website (www.getsling.com), through our mobile application, via Devices, or via other means (during and after which you are known as an “Application User”). 
• Website User: You visit Sling’s website (www.getsling.com) (the “Website”) while browsing the internet (during and after which you are known as a “Website User”), although you may not have necessarily procured or plan to procure an account of any kind with Sling. Sling collects a limited amount of data from our Website Users. For more information, please see our Cookie Policy.  

Please note certain locations where we operate have laws that require us to share specific privacy information and practices with individuals in those locations. As a result, this Privacy Statement consists of two sections – a generally applicable statement and a location-specific addendum. Where there are variations for a specific location or additional information is required to be provided under the applicable country or state law, individuals in that location can refer to the applicable addendum.  Links to the pertinent sections, can be found below:

• United States (California)
• United States (Colorado)
• United States (Connecticut)
• United States (Virginia)
• United States (Utah)
• Canada
• European Union/European Economic Area
• United Kingdom

Please note our Account Holders are independent third parties who maintain their own business practices and policies outside of their relationship with Sling and their use of the Services.  As a result, unless provided otherwise in this Statement, we are not responsible for the privacy policies or data practices of our Account Holders.  If you are an Application User, your employer is responsible for providing any additional required notices or information to you regarding its privacy practices outside of this Statement.

By using the Services and/or providing us with your personal information, you acknowledge that your personal information will be processed and used in the manner set out in this Privacy Statement. 

2. Definitions

Here are a few terms used throughout this Privacy Statement that you should be aware of:

• “Device” means electronic devices used to access the Services, including but not limited to mobile phones, desktop computers, laptop computers, and tablets.
• “Services” means the Sling Application, our Website, mobile applications (web, iOS and Android), application programming interfaces (APIs), our content, and various third-party services that make up Sling, including technical support. 
• “You” and/or “your” is an Account Holder, an Application User, a Website User (all defined above) or other covered data subject.

3. Personal information we collect

What personal information we collect and how we collect that information will depend on the nature of your interaction with the Services and our Website.  While some information is collected automatically or through sources outside of Sling, most is collected when you use our Services or visit our Website. A breakdown of the collection has been provided below.

* Data collected will vary depending on your role, implementation, and what you choose to upload to the Services as well as how you choose to interact with Sling.

4. How Sling uses your personal informati

5. How Sling discloses and shares your personal information

In certain instances, Sling will share the personal information it collects from you or otherwise processes from you in order to provide the Services or fulfill the other purposes within this Statement. A summary of how Sling may share your information is below.

Sling may also share your information with third parties in the following circumstances:

• In connection with, or during the negotiation of, any merger, sale of company stock or assets, financing, acquisition, divestiture or dissolution of all or a portion of our business.
• If we believe it is authorized or necessary to:
  • Protect our rights or property, or the security or integrity of our Services or our Website.
  • Enforce our terms of service or other applicable agreements or policies.
  • Protect us, users of our Services or the public from harm or potentially prohibited or illegal activities.
  • Investigate, detect and prevent fraud and security breaches.
  • Comply with any applicable law, regulation, legal process, governmental or judicial request (including, for example, a court order, subpoena, or search warrant).

We may also share aggregated and/or anonymized information derived from the Services that does not directly identify you, including device information and information derived from cookies and log files with third parties for the purposes described in this Statement.

6. How Sling communicates with you

As part of providing the Services, Sling (whether directly or through a third-party service provider), may send You various communications related to the Services. 

The specific nature of the communications may vary depending on Your role as well as what specific services or requests you have made. These communications include:

• Marketing communications: If you are an Account Holder or an Application User with a manager account, we may send you marketing and other promotional communications for new or existing Services that we think you might be interested in.
  • These marketing communications may be sent via email or may include marketing text messages if you have opted in to receive them. 
  • You can opt out of or unsubscribe from any marketing communications by following the instructions in those messages, by changing your communications preferences within your account or through your device. You can also opt out by contacting help@getsling.com. Opting out of one communication will not necessarily opt you out of all marketing communications.  
  • Please note that you may still receive certain non-marketing communications after opting out. If you are located outside the United States, we will not send you direct marketing communications without your opt-in consent or as otherwise permitted under the applicable law. 
• Service-related communications: As part of your interaction with our Services, you may receive various non-marketing communications from Sling that may be sent via email or text message.
  • For Account Holders these include:
    • Emails to support the onboarding process. 
    • Emails for account validation. 
  • For Application Users these include:
    • Email or SMS messages initiated by your employer inviting you to join Sling. 
    • Emails advising that you are missing messages from others in your organization if you have been invited to but have not yet joined Sling.  

For additional information about how we communicate with you, please contact us at privacy@getsling.com. 

7. How long does Sling keep your personal information?

Sling retains personal information as long as reasonably necessary to provide the Services, carry out the purposes described in this Statement, or as otherwise required in order to comply with our records retention periods (which reflect the applicable law). For example, we may retain information about users of our Services in order to comply with our legal and regulatory obligations or to protect our interests as part of providing the Services.

In the majority of cases, Sling processes the personal information of Application Users as a processor on behalf of the Account Holder. As a result, Sling’s retention of the Account Holder’s employment-related information will be governed by the terms of the agreement between Sling and the Account Holder. Such information may also be managed independently by the Account Holder as part of its own obligations as part of managing its business. Sling maintains a retention schedule for the removal of this information following the termination of any such agreement with the Account Holder. 

8. Securing your information

Sling will take appropriate steps to protect any personal information that we collect and store from unauthorized access, misuse, loss, and destruction by employing administrative, technical, and physical security measures. However, even though we have taken such measures to protect your personal information, we cannot guarantee that the collection, transmission and storage of personal information will always be completely secure.

9. Your rights with regard to your personal information

Overview 

Depending on your location, you may have specific individual rights under the applicable law in relation to how we process your personal information. These individual rights may include a right of deletion, access, correction, portability as well as rights in relation to various processing restrictions (e.g., sale, sharing and targeted advertising). Additional information on these rights and how to invoke them can be found below, as well as in our location-specific addendums linked in this Statement. 

Applicability

If you are an Application User and would like to make a request relating to our use of your personal information in the context of the Services we provide to your company or organization and for which we are a data processor, please contact your company or organization initially. If you contact us initially, we will refer you to your company or organization.

If you are an Application User and would like to make a request relating to our use of your personal information in a context outside of the Services we provide to your company or organization, or if you are a Website User, please contact us directly with your request.

How to invoke your rights

Sling has established an individual rights portal as well as other channels for the purposes of submitting the individual rights requests above, including the right of access and deletion. 

Individual rights requests can be submitted to Sling through the below channels:

• Web portal: Individual Rights Portal
  • In response to “Please select from the options below in order for us to better understand your relationship with Toast” select “User of Sling Services” or “Other Interaction with Sling”
• By email:  privacy@getsling.com
• By post:  Attn: Toast Privacy Office 

                             Toast, Inc.
                            333 Summer Street Boston, MA 02210

• By phone (toll-free): (866) 226-4484

If you submit an individual rights request, we may ask you for additional information in order to verify your identity or to provide additional details to help us respond to your request. This may include your name, email address, phone number or other details related to your use of Sling’s Services. Where applicable, these requests can be submitted by an authorized agent through the channels described above in accordance with the applicable law.  In these instances, we will take steps to verify the authorized agent’s authority to act on your behalf. In order to verify the authorized agent’s authority, we generally require evidence of either (i) a valid power of attorney or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a statement of authorization for the request. Depending on the evidence provided, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to verify your identity in connection with the request. Please note that in certain circumstances, we may refuse to act or impose limitations on your rights, as permitted by the applicable law in relation to individual rights submissions.

To the extent you are a resident of a location where we have developed a location-specific addendum to this Privacy Statement, there is additional information in those addendums around individual rights and your rights in this area.

10. Cookies and other tracking technologies

Sling uses “cookies,” or small data files stored on your computer and related tracking technologies as part of our business operations. We do so to gather information and improve our Services. Sling may use “persistent cookies” to allow users to save their user IDs and passwords for ease of future logins. Sling may use “session ID cookies” to enable features of the Services, gain an understanding of how users interact with the Services, and to monitor usage and web traffic on the Services. We may track usage patterns on our Website via internal and external analytic platforms (“online tracking”). We do so in order to improve the design and functionality of our Services and Website. 

You may program your browser to stop accepting cookies or to prompt you to opt in to cookies from websites you frequent. When you do not accept cookies, you may limit the usability of the Service. You can manage your cookie settings by visiting the cookie preference center by clicking here. There are also other ways to control and/or reject the setting of cookies and similar technologies within your browser settings. As each browser is different, please consult the “help” menu within your browser.  For additional information about cookies and how to control their use on various browsers and devices, you can visit http://www.allaboutcookies.org. Please be aware that depending on the Services being used, restricting cookies may prevent you from accessing and using all or part of the Services.

For more information, please visit the Sling Cookie Policy.

There are other tracking technologies, such as web beacons/GIFs, pixels, page tags, embedded scripts, that consist of small transparent image files or other web programming code that record how you interact with websites, mobile applications and services.  They are often used in conjunction with web browser cookies or other identifiers associated with your device. We also use pixels and related technologies as part of session replay services on certain Websites that are used to understand and improve functionality and an individual’s experience on those sites.

Targeted advertising and your choices

In certain cases, we allow third-party advertising partners to use cookies, web beacons and other tracking technologies on our Websites, mobile applications and within our Services to collect information about you and your activities for interest-based advertising or other targeted content.  The information they collect may be associated with your personal information or they may collect information, including personal information, about your online activities over time and across different websites and other online services. This information may be shared with ad networks and other content providers.

If you want to opt out of receiving online interest-based advertisements on your internet browser, please visit  and follow the instructions at www.aboutads.info/choices, or http://www.networkadvertising.org/choices/ to place an opt-out cookie on your device indicating that you do not want to receive interest-based advertisements.  Opt-out cookies only work on the specific internet browser and device that they are downloaded onto. If you want to opt out of interest-based advertisements across all your browsers and devices, you will need to opt out on each browser on each device you actively use. If you delete cookies on your device generally, you will need to set the opt-out cookie again on that device. If you want to opt out of receiving online interest-based advertisements on mobile applications, please follow the instructions at http://www.aboutads.info/appchoices or by visiting the settings in your mobile device.

Please note that when you opt out of receiving interest-based advertisements, this does not mean you will no longer see advertisements from us or on our online services.  It means that the online ads that you do see should not be tailored to your interests.  We are not responsible for the effectiveness of, or compliance with, any third-parties’ opt-out options or programs or the accuracy of their statements regarding their programs. In addition, third parties may still use cookies to collect information about your use of our online services, including for analytics and fraud prevention purposes.

Do not track

We may use, and we may allow third-party service providers and other third parties to use, cookies or other technologies on our Services that collect information about your browsing activities over time and across different websites following your use of the Services. Do Not Track (“DNT”) is an optional browser setting that allows you to express your preferences regarding tracking across websites. Outside of certain opt-out preference settings within the browser used to access our Websites such as the Global Privacy Control noted in the state-specific addendums, we currently do not respond to DNT signals and we may continue to collect information in the manner described in this Privacy Statement from web browsers that have enabled DNT signals or similar mechanisms.

11. Links to other websites

This Privacy Statement only applies to information collected when visiting our Website or otherwise using our Services. While visiting our Website or using the Services, you and/ or your personal information may be directed to third-party websites or services that are not operated or controlled by us, for example, the websites of our Account Holders or their business partners that provide other services. We are not responsible for the privacy practices and policies of these third parties. As a result, we encourage you to review the privacy policies of these third-party websites as their practices may differ from ours. 

12. Children 

Our Services are not targeted or directed at children under the age of 13, and we do not intend to, or knowingly, collect or solicit personal information from children under the age of 13.  If you have reason to believe that a child under the age of 13 has provided personal information to us, we encourage the child’s parent or guardian to contact us as described in the “How to Contact Us” section of this Statement to request that we remove the information from our systems. If we learn that any personal information we collected has been provided by a child under the age of 13, we will promptly delete that personal information.

13. How to contact us

If you have questions or concerns about our Privacy Statement, our practices or our compliance with applicable privacy laws, you can reach us at:

• Web portal: Individual Rights Portal
• By email: privacy@getsling.com 
• By post: Attn: Toast Privacy Office 

                            Toast, Inc.
                            333 Summer Street, Boston, MA 02210

• By phone (toll-free): (866) 226-4484

Additional contact points can be found in the addendums.

A downloadable version of this Statement can be found here.

14. Changes to this Privacy Statement 

From time to time, we may update, change, modify or amend this Privacy Statement in order to comply with the applicable law or our changing business practices. Unless we are required by the applicable law to provide a prescribed form of notice and/or obtain consent, updated versions of this Statement may be posted on this website with additional communication. An archived version of our previous Privacy Statement can be found here. Please check this website and this Privacy Statement regularly for updates.

Addendum A – United States (California)

Last updated: May 1, 2024

1. Privacy Statement for California Residents as required by the California Consumer Privacy Act of 2018 (including as amended by the California Privacy Rights Act of 2020)(“CCPA”). 

The provisions below supplement the information provided in the generally applicable portion of our Privacy Statement and apply solely to individuals that are residents of California and qualify as a “Consumer” under the CCPA. This California-specific Statement provides additional information about how we collect, use, disclose and otherwise process the personal information of these individuals, either online or offline, within the scope of the CCPA. Any terms defined in the CCPA or as otherwise defined in our Privacy Statement have the same meaning as used in this addendum. 

When we use the term “personal information” in this Addendum, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. 

A. CCPA personal information table

     The below table summarizes:

• The categories of personal information collected by Sling in the past 12 months;
• The sources of collection of the personal information; 
• How we use your personal information; and
• The categories of personal information disclosed for business purposes by Sling (including to third parties) in the past 12 months.

Please see the generally applicable section of this Privacy Statement for additional information on Sling’s information practices, including more detail on how we use and disclose your personal information.

*Note that the actual personal information collected will depend on the nature of the individual relationship and the specific Services provided.

B. Categories of personal information sold or shared

While Sling does not “sell” personal information in the traditional sense, we do, however, sell or share personal information for the purpose of displaying advertisements that are selected based on personal information obtained or inferred over time from an individual’s activities across businesses or distinctly-branded websites, applications or other services (otherwise known as “targeted advertising” or “cross-context behavioral advertising”), for personalization features and for tracking and analytics purposes.   

The categories of personal information impacted in the preceding 12 months may include:

• Identifiers;
• Internet/Network Information; and
• Inferences.

Each of the above categories of information may be disclosed to third-parties, which may include our business partners depending on the nature of a user’s interactions.

Consumers can exercise their right to opt out of these sales or sharing through our cookie management tool that can be accessed by clicking on our “Do not sell or share my personal information” link at the bottom of https://getsling.com. You can also opt out of the “sale” of personal information or “sharing” for targeted advertising purposes by enabling the Global Privacy Control or a similar opt-out preference setting within the browser you use to access our Websites. Please note that your opt out will be specific to the device and browser you use when you opt out, and our Websites will recognize opt-out preference settings only on domains of our Websites where any “selling” or “sharing” occurs. You may also review our Privacy Statement section titled “Cookies and other tracking technologies” for more information on how Sling uses cookies, analytics and personalized advertising. Sling has no actual knowledge that the “sales” or “sharing” described above include the personal information of individuals under 16 years of age.

C. Description of rights available to Consumers 

If you are a resident of the state of California and subject to certain legal limitations and exceptions, you may be able to exercise some or all of the following rights: 

• The right to know/access: you have the right to request that an in-scope business that collects personal information from you, disclose the following in relation to the preceding 12 month period, upon verification of your identity: (i) the categories of personal information collected about you, (ii) the categories of sources where the personal information was collected, (iii) the business or commercial purposes for collecting (or where applicable, selling or sharing) the personal information, (iv) the categories of personal information that we have disclosed to third parties for a business purpose along with the corresponding recipients, (v) the categories of personal information we have sold or shared along with the corresponding recipients, and (vi) the specific pieces of personal information collected about you. 
• The right of deletion: you have the right to request that an in-scope business delete personal information that it has collected from you, subject to certain exceptions.
• The right of correction: you have the right to request that an in-scope business correct inaccurate personal information, subject to certain conditions. 
• The right to opt out of the sale or sharing of personal information: you have the right to request that an in-scope business refrain from selling or sharing personal information it has collected about you to third parties now or in the future. If you are under the age of 16, you have the right to opt in, or to have a parent or guardian opt in on your behalf, to such sales or sharing. 
• The right to limit the use and disclosure of sensitive personal information: to the extent that we use sensitive personal information for purposes beyond those set forth in subdivision (a) of Section 1798.121, you have the right to limit the use or disclosure of that sensitive personal information subject to the exceptions within the CCPA.
• The right of access to and to the ability to opt-out of automated decision-making technology: subject to further regulations being issued, you have the right to access information pertaining to automated decision-making technologies and the ability to opt out.
• The right against discrimination and retaliation: you have the right to not be discriminated or retaliated against as a result of exercising any of the above rights. 

However, please note that if the exercise of these rights limits our ability to process personal information (such as in the case of a deletion request), we may no longer be able to provide you with our Services or engage with you in the same manner. In addition, the exercise of the rights described above may result in a different price, rate, or quality level of product or service where that difference is reasonably related to the impact the right has on our relationship or is otherwise permitted by law.

Please note that your ability to invoke the rights above are limited pursuant to the scope and limitations of the CCPA, including any available exceptions. For example, an access request can only be made twice by a Consumer within a 12-month period. 

D. How to invoke your rights

Sling has established an individual rights portal as well as other channels for the purposes of submitting the individual rights requests above, including the right of access and deletion. Individual rights requests can be submitted to Sling through the below channels:

• Web portal: Individual Rights Portal
• By email:     privacy@getsling.com 
• By post:        
  Attn: Toast Privacy Office
  Toast, Inc.
  333 Summer Street Boston, MA 02210
• By phone (toll-free): (866) 226-4484

Once an individual rights request has been submitted, Sling may ask you for additional information in order to verify your identity or to provide additional details to help us respond to your request. This may include your name, email address, phone number or other details related to your use of Sling’s Services. Where applicable, these requests can be submitted by an authorized agent through the channels described above in accordance with the applicable law.  In these instances, we will take steps to verify the authorized agent’s authority to act on your behalf. In order to verify the authorized agent’s authority, we generally require evidence of either (i) a valid power of attorney or (ii) a signed letter containing your name and contact information, the name and contact information of the authorized agent, and a statement of authorization for the request. Depending on the evidence provided, we may still need to separately reach out to you to confirm the authorized agent has permission to act on your behalf and to verify your identity in connection with the request. Please note that in certain circumstances, we may refuse to act or impose limitations on your rights, as permitted by the applicable law in relation to individual rights submissions.

E. To Exercise the Right to Opt Out of the Selling or Sharing of Personal Information 

Unless you have exercised your right to opt out of the sale or sharing of personal information, we may “sell” or “share” your personal data to third parties for targeted or cross-context behavioral advertising purposes, for personalization features and for tracking and analytics purposes. The third parties to whom we sell or share personal information may use such information for their own purposes in accordance with their own privacy statements. In these instances, the right to opt out of the sale of personal information can be invoked through our cookie management tool that can be accessed by clicking on our “Do not sell or share my personal information” link at the bottom of https://getsling.com. You can also opt out of the “sale” of personal information or “sharing” for targeted advertising purposes by enabling the Global Privacy Control or a similar opt-out preference setting within the browser you use to access our Websites. Please note that your opt out will be specific to the device and browser you use when you opt out, and our Websites will recognize opt-out preference settings only on domains of our Websites where any “selling” or “sharing” occurs.  Although Sling does not currently engage in other practices at this time that may constitute a “sale” or “sharing” beyond these instances and the methods above are the most effective methods to manage your preferences, you may also submit your right to opt out of any sales or sharing by clicking here or in instances where you would like additional support. You do not need to create an account with us to exercise your right to opt out of personal information sales or sharing. However, if applicable, we may ask you to provide additional personal information so that we can properly identify you in our dataset and to track compliance with your opt out request. We will only use personal information provided in an opt out request to review and comply with the request. If you choose not to provide this information, we may only be able to process your request to the extent we are able to identify you in our systems. Once you make an opt-out request, you may change your mind and opt back in to future personal information sales at any time by contacting us at privacy@getsling.com or by managing your preferences within the cookie management tool.

F. Accessibility

In the event you are a user with a disability, or are supporting an individual with a disability, and are having difficulty navigating this Statement or the information linked within this Statement, please contact us at privacy@getsling.com for support. 

G. Sensitive Personal Information

As part of our services, Sling collects “sensitive personal information” as defined by the CCPA as part of our operations and the Services offered to our Account Holders. The categories of sensitive personal information are described below along with the use case and whether the information is sold or shared.

Presently, Sling does not use or disclose an individual’s sensitive personal information for purposes other than those specified in subdivision (a) of section 1798.121 of the CCPA and as a result, has not included a Notice of Right to Limit.

H.  Retention

We retain personal information as long as reasonably necessary to provide the Services and carry out the purposes described in this Statement. However, if necessary, we may retain personal information for longer periods of time, until set retention periods and deadlines expire, or for instances where we are required to do so in accordance with legal, tax and accounting requirements set by a legislature, regulator or other government authority.  

To determine the appropriate duration of the retention of personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of personal information and if we can attain our objectives by other means, as well as our legal, regulatory, tax, accounting and other applicable obligations. 

The retention period will vary depending on our relationship. For example,

• For Account Holders, we will generally retain their personal information for the duration of our agreement with the Account Holder plus a period following termination as provided for in our retention schedules. 
• For Application Users, Sling will generally maintain Application User accounts that are required to access an Application Holder’s account page for the duration of the individual’s use of Services plus a period of inactivity.  Application Users are also permitted to remove these user accounts on an ad hoc basis when relevant (e.g., the individual is no longer part of an Account Holder’s organization). 

In all cases, the retention will be subject to any additional legal, regulatory, tax, accounting or other applicable obligations.

Once retention of the personal information is no longer necessary for the purposes outlined above, we will either delete or de-identify the personal information or, if this is not possible (for example, because personal information has been stored in backup archives), then we will securely store the personal information and isolate it from further processing until deletion or deidentification is possible.

I. Notice of Financial Incentives 

Neither Sling nor the Services contemplate any program or service involving financial incentives or requiring notification of a financial incentive. This Statement does not take into account any obligations imposed on the independent businesses of our Account Holders based on their operations.  

J.   Deidentified information

We may at times receive, or process personal information to create, deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual or household. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by law.

K.  Updates to this Statement

We will update this Statement from time to time. When we make changes to this Statement, we will change the “Last updated” date at the beginning of this Statement. All changes shall be effective from the date of publication unless otherwise provided in the notification.

2. California “Shine the Light” disclosure
As applicable to Sling and our Services, California residents that have an established business relationship with us have a right to know how their information is disclosed to third parties for their direct marketing purposes under California’s “Shine the Light” law (Civ. Code § 1798.83). Please contact us through any of the communication channels within the “How to contact us” section in the main body of this Statement to invoke these rights.

Addendum B – United States (Colorado)

Last updated: May 1, 2024

A. Privacy Statement for Colorado residents as required by the Colorado Privacy Act (“CPA”).

The provisions below supplement the information provided in the generally applicable portion of our Privacy Statement and apply solely to individuals that are residents of Colorado and qualify as a “Consumer” under the CPA. This Colorado-specific Statement provides additional information about how we collect, use, disclose and otherwise process the personal information of these individuals, either online or offline, within the scope of the CPA. Any terms defined in the CPA or as otherwise defined in our Privacy Statement have the same meaning as used in this Addendum. 

When we use the term “personal information” in this Addendum, we mean “personal data” pursuant to the CPA, including information that is linked or reasonably linkable to an identified or identifiable natural person.

B. Categories of personal information processed 

Please refer to the “Personal information we collect” section in the main body of the Statement.

C. Purposes of processing the personal information

Please refer to the “How Sling uses your personal information” section in the main body of the Statement.

D. Categories of information disclosed to third parties and a description of those third parties 

Please refer to the “How Sling discloses your personal information” section in the main body of the Statement.

E. Description of rights available to consumers

A number of individual rights are available to individuals under the CPA relating to personal information that we have collected (subject to certain limitations at law), including: 

• The right to access: you have the right to confirm whether a controller is processing your personal information and to access such information.
• The right to correction: you have the right to correct inaccuracies in your personal information, taking into account the nature of the personal information and purposes of the processing.
• The right to deletion: you have the right to delete your personal information you have provided or that has been collected.
• The right to portability: you have the right to obtain a copy of your personal information that was previously provided in a portable, and to the extent technically feasible, readily usable format that can be transmitted to another entity.
• The right to opt out: you have the right to opt out of (as defined by the CPA) (i) targeted advertising, (ii) the sale of personal information and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects.

F. How to invoke your rights

Sling has established an individual rights portal as well as other channels for the purposes of submitting the individual rights requests above, including the right of access and deletion. Individual rights requests can be submitted to Sling through the below channels:

• Web portal: Individual Rights Portal
• By email:     privacy@getsling.com 
• By post:
  Attn: Toast Privacy Office
  Toast, Inc.
  333 Summer Street, Boston, MA 02210
• By phone (toll-free): (866) 226-4484

Once an individual rights request has been submitted, Sling may ask you for additional information in order to verify your identity or to provide additional details to help us respond to your request. This may include your name, email address, phone number or other details related to your use of Sling’s Services. Where applicable, these requests can be submitted by an authorized agent through the channels described above in accordance with the applicable law. These include requests made on behalf of a minor by the individual’s parent or legal guardian can also be made via the individual rights portal above. In these cases, in order to verify the authorized agent’s authority, we generally require evidence of that individual’s authority to act on behalf of the individual. All individual rights requests will be managed in line with the requirements set out in the CPA.

Please note that in certain circumstances, we may refuse to act or impose limitations on your rights, as permitted by the applicable law.  In the event we decline to take action on a request, we will notify you within 45 days of receipt of the original request with our justification for declining to take action and how you may appeal that decision (including an overview of the appeals process and how you can initiate an appeal).  All appeal requests should be submitted by emailing us at privacy@getsling.com with the subject line, “Colorado Privacy Request Appeal”.

G. Sale of personal information 

While Sling does not “sell” personal information in the traditional sense, we do, however, sell personal information for the purpose of displaying advertisements that are selected based on personal information obtained or inferred over time from an individual’s activities across businesses or distinctly-branded websites, applications or other services (otherwise known as “targeted advertising” or “cross-context behavioral advertising”), for personalization features and for tracking and analytics purposes. The categories of personal information may include:

• Identifiers;
• Internet/network information; and
• Inferences

Each of the above categories of information may be disclosed to third-parties, which may include our business partners depending on the nature of a user’s interactions.

Consumers can exercise their right to opt out of these sales through our cookie management tool that can be accessed by clicking on our “Do not sell or share my personal information” link at the bottom of https://getsling.com. You can also opt out of the “sale” of personal information or “sharing” for targeted advertising purposes by enabling the Global Privacy Control or a similar opt-out preference setting within the browser you use to access our Websites. Please note that your opt out will be specific to the device and browser you use when you opt out, and our Websites will recognize opt-out preference settings only on domains of our Websites where any “selling” or “sharing” occurs.  You may also review our Privacy Statement section titled “Cookies and other tracking technologies” for more information on how Sling uses cookies, analytics and personalized advertising. 

H. Targeted advertising

Sling carries out limited targeted advertising (as that term is defined by the CPA) via cookies and related tracking technologies. You will only be served with targeted advertising when you visit  https://getsling.com and this can be managed by clicking the “Do not sell or share my personal information” link at the bottom of https://getsling.com.

I. Profiling

Presently, Sling does not carry out any profiling (as defined by the CPA) in furtherance of decisions that produce legal or similarly significant effects concerning consumers that are presently in scope for CPA purposes.

J. Deidentified information

We may at times receive, or process personal data to create, deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by law.

K. Updates to this Statement

We will update this Statement from time to time. When we make changes to this Statement, we will change the “Last updated” date at the beginning of this Statement. All changes shall be effective from the date of publication unless otherwise provided in the notification.

Addendum C – United States (Connecticut)

Last updated: May 1, 2024

A. Privacy Statement for Connecticut residents as required by the Connecticut Data Privacy Act (“CTDPA”).

The provisions below supplement the information provided in the generally applicable portion of our Privacy Statement and apply solely to individuals that are residents of Connecticut and qualify as a “Consumer” under the CTDPA. This Connecticut-specific Statement provides additional information about how we collect, use, disclose and otherwise process the personal information of these individuals, either online or offline, within the scope of the CTDPA. Any terms defined in the CTDPA or as otherwise defined in our Privacy Statement have the same meaning as used in this Addendum. 

When we use the term “personal information” in this Addendum, we mean “personal data” pursuant to the CTDPA, including information that is linked or reasonably linkable to an identified or identifiable natural person.

B. Categories of personal information processed 

Please refer to the “Personal information we collect” section in the main body of the Statement.

C. Purposes of processing the personal information

Please refer to the “How Sling uses your personal information” section in the main body of the Statement.

D. Categories of information disclosed to third parties and a description of those third parties 

Please refer to the “How Sling discloses your personal information” section in the main body of the Statement.

E. Description of rights available to consumers

A number of individual rights are available to individuals under the CTDPA relating to personal information that we have collected (subject to certain limitations at law), including: 

• The right to access: you have the right to confirm whether a controller is processing your personal information and to access such information.
• The right to correction: you have the right to correct inaccuracies in your personal information, taking into account the nature of the personal information and purposes of the processing.
• The right to deletion: you have the right to delete your personal information you have provided or that has been collected.
• The right to obtain a copy of your personal information: you have the right to obtain a copy of your personal information that was previously provided in a portable, and to the extent technically feasible, readily usable format that can be transmitted to another entity.
• The right to opt out: you have the right to opt out of (as defined by the CTDPA) (i) targeted advertising, (ii) the sale of personal information and (iii) profiling in furtherance of solely automated decisions that produce legal or similarly significant effects.

F. How to invoke your rights

Sling has established an individual rights portal as well as other channels for the purposes of submitting the individual rights requests above, including the right of access and deletion. Individual rights requests can be submitted to Sling through the below channels:

• Web portal: Individual Rights Portal
• By email:     privacy@getsling.com 
• By post:  Attn: Toast Privacy Office
                  Toast, Inc.
                  333 Summer Street, Boston, MA 02210
• By phone (toll-free): (866) 226-4484

Once an individual rights request has been submitted, Sling may ask you for additional information in order to verify your identity or to provide additional details to help us respond to your request. This may include your name, email address, phone number or other details related to your use of Sling’s Services. Where applicable, these requests can be submitted by an authorized agent through the channels described above in accordance with the applicable law. These include requests made on behalf of a minor by the individual’s parent or legal guardian can also be made via the individual rights portal above. In these cases, in order to verify the authorized agent’s authority, we generally require evidence of that individual’s authority to act on behalf of the individual. All individual rights requests will be managed in line with the requirements set out in the CTDPA.

Please note that in certain circumstances, we may refuse to act or impose limitations on your rights, as permitted by the applicable law.  In the event we decline to take action on a request, we will notify you within 45 days of receipt of the original request with our justification for declining to take action and how you may appeal that decision (including an overview of the appeals process and how you can initiate an appeal).  All appeal requests should be submitted by emailing us at privacy@getsling.com with the subject line, “Connecticut Privacy Request Appeal”.

G. Sale of personal information 

While Sling does not “sell” personal information in the traditional sense, we do, however, sell personal information for the purpose of displaying advertisements that are selected based on personal information obtained or inferred over time from an individual’s activities across businesses or distinctly-branded websites, applications or other services (otherwise known as “targeted advertising” or “cross-context behavioral advertising”), for personalization features and for tracking and analytics purposes.
Consumers can exercise their right to opt out of these sales through our cookie management tool that can be accessed by clicking on our “Do not sell or share my personal information” link at the bottom of https://getsling.com. You can also opt out of the “sale” of personal information or “sharing” for targeted advertising purposes by enabling the Global Privacy Control or a similar opt-out preference setting within the browser you use to access our Websites. Please note that your opt out will be specific to the device and browser you use when you opt out, and our Websites will recognize opt-out preference settings only on domains of our Websites where any “selling” or “sharing” occurs. You may also review our Privacy Statement section titled “Cookies and other tracking technologies” for more information on how Sling uses cookies, analytics and personalized advertising. 

H. Targeted advertising

Sling carries out limited targeted advertising (as that term is defined by the CTDPA) via cookies and related tracking technologies. You will only be served with targeted advertising when you visit https://getsling.com and this can be managed by clicking the “Do not sell or share my personal information” link at the bottom of  https://getsling.com.

I. Profiling

Presently, Sling does not carry out any profiling (as defined by the CTDPA) in furtherance of decisions that produce legal or similarly significant effects concerning consumers that are presently in scope for CTDPA purposes.

J. Deidentified information

We may at times receive, or process personal data to create, deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by law.

K. Updates to this Statement

We will update this Statement from time to time. When we make changes to this Statement, we will change the “Last updated” date at the beginning of this Statement. All changes shall be effective from the date of publication unless otherwise provided in the notification.

Addendum D – United States (Virginia)

Last updated: May 1, 2024

A. Privacy Statement for Virginia Residents as required by the Virginia Consumer Data Protection Act (“VCDPA”).

The provisions below supplement the information provided in the generally applicable portion of our Privacy Statement and apply solely to individuals that are residents of Virginia and qualify as a “Consumer” under the VCDPA. This Virginia-specific Statement provides additional information about how we collect, use, disclose and otherwise process the personal information of these individuals, either online or offline, within the scope of the VCDPA. Any terms defined in the VCDPA or as otherwise defined in our Privacy Statement have the same meaning as used in this addendum. 

When we use the term “personal information” in this Addendum, we mean “personal data” pursuant to the VCDPA, including information that is linked or reasonably linkable to an identified or identifiable natural person.

B. Categories of personal information processed 

Please refer to the “Personal information we collect” section in the main body of the Statement.

C. Purposes of processing the personal information

Please refer to the “How Sling uses your personal information” section in the main body of the Statement.

D. Categories of information disclosed to third parties

Please refer to the “How Sling discloses your personal information” section in the main body of the Statement.

E. Description of rights available to consumers

A number of individual rights are available to individuals under the VCDPA relating to personal information that we have collected (subject to certain limitations at law), including:

• The right of access: you have the right to confirm whether a controller is processing your personal information and to access such information.
• The right of correction: you have the right to correct inaccuracies in your personal information, taking into account the nature of the personal information and purposes of the processing.
• The right of deletion: you have the right to delete your personal information you have provided or that has been collected.
• The right of portability: you have the right to obtain a copy of your personal information that was previously provided in a portable, and to the extent technically feasible, readily usable format that can be transmitted to another controller where the processing is carried out by automated means.
• The right to opt out: you have the right to opt out of (as defined by the VCDPA) (i) targeted advertising, (ii) the sale of personal information and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects.

F. How to invoke your rights

Sling has established an individual rights portal as well as other channels for the purposes of submitting the individual rights requests above, including the right of access and deletion. Individual rights requests can be submitted to Sling through the below channels:

• Web portal: Individual Rights Portal
• By email:     privacy@toasttab.com 
• By post:    Attn: Toast Privacy Office
                    Toast, Inc.
                    333 Summer Street, Boston, MA 02210
• By phone (toll-free): (866) 226-4484

Once an individual rights request has been submitted, Sling may ask you for additional information in order to verify your identity or to provide additional details to help us respond to your request. This may include your name, email address, phone number or other details related to your use of Sling’s Services. Where applicable, these requests can be submitted by an authorized agent through the channels described above in accordance with the applicable law. These include requests made on behalf of a minor by the individual’s parent or legal guardian can also be made via the individual rights portal above. In these cases, in order to verify the authorized agent’s authority, we generally require evidence of that individual’s authority to act on behalf of the individual. All individual rights requests will be managed in line with the requirements set out in the VCDPA. 

Please note that in certain circumstances, we may refuse to act or impose limitations on your rights, as permitted by the applicable law.  In the event we decline to take action on a request, we will notify you within 45 days of receipt of the original request with our justification for declining to take action and how you may appeal that decision (including an overview of the appeals process and how you can initiate an appeal).  All appeal requests should be submitted by emailing us at privacy@getsling.com with the subject line, “Virginia Privacy Request Appeal”.

G. Sale of personal information 

Presently, Sling does not carry out any “sales” of personal data as defined by the VCDPA.

H. Targeted advertising

Sling carries out limited targeted advertising (as that term is defined by the VCDPA) via cookies and related tracking technologies. You will only be served with targeted advertising when you visit  https://getsling.com and this can be managed by clicking the “Do not sell or share my personal information” link at the bottom of https://getsling.com.

I. Profiling

Presently, Sling does not carry out any profiling (as defined by the VCDPA) in furtherance of decisions that produce legal or similarly significant effects concerning consumers that are presently in scope for VCDPA purposes.

J. Deidentified information

We may at times receive, or process personal data to create, deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by law.

K. Updates to this Statement

We will update this Statement from time to time. When we make changes to this Statement, we will change the “Last updated” date at the beginning of this Statement. All changes shall be effective from the date of publication unless otherwise provided in the notification.

Addendum E – United States (Utah)

Last updated: May 1, 2024

A. Privacy Statement for Utah Residents as required by the Utah Consumer Privacy Act (“UCPA”).

The provisions below supplement the information provided in the generally applicable portion of our Privacy Statement and apply solely to individuals that are residents of Utah and qualify as a “Consumer” under the UCPA. This Utah-specific Statement provides additional information about how we collect, use, disclose and otherwise process the personal information of these individuals, either online or offline, within the scope of the UCPA. Any terms defined in the UCPA or as otherwise defined in our Privacy Statement have the same meaning as used in this addendum.

When we use the term “personal information” in this Addendum, we mean “personal data” pursuant to the UCPA, including information that is linked or reasonably linkable to an identified or identifiable natural person. 

B.   Categories of personal information processed

Please refer to the “Personal information we collect” section in the main body of the Statement.

C.    Purposes of processing the personal information

Please refer to the “How Sling uses your personal information” section in the main body of the Statement.

D.   Categories of information disclosed to third parties

Please refer to the “How Sling discloses your personal information” section in the main body of the Statement.

E.    Description of rights available to consumers

A number of individual rights are available to individuals under the UCPA relating to personal information that we have collected (subject to certain limitations at law), including:

• The right of access: you have the right to confirm whether a controller is processing your personal information and to access such information.

• The right of deletion: you have the right to delete your personal information you have provided or that has been collected.

• The right of portability: you have the right to obtain a copy of your personal information that was previously provided in a portable, and to the extent technically feasible, readily usable format that can be transmitted to another controller where the processing is carried out by automated means.

• The right to opt out: you have the right to opt out of (as defined by the UCPA) (i) targeted advertising and (ii) the sale of personal information.

F.       How to invoke your rights

Sling has established an individual rights portal as well as other channels for the purposes of submitting the individual rights requests above, including the right of access and deletion. Individual rights requests can be submitted to Sling through the below channels:

• Web portal: Individual Rights Portal
• By email:    privacy@toasttab.com 
• By post:  Attn: Toast Privacy Office

                Toast, Inc.
                333 Summer Street, Boston, MA 02210

• By phone (toll-free): (866) 226-4484

Once an individual rights request has been submitted, Sling may ask you for additional information in order to verify your identity or to provide additional details to help us respond to your request. This may include your name, email address, phone number or other details related to your use of Slingt’s Services. Where applicable, these requests can be submitted by an authorized agent through the channels described above in accordance with the applicable law. These include requests made on behalf of a minor by the individual’s parent or legal guardian can also be made via the individual rights portal above. In these cases, in order to verify the authorized agent’s authority, we generally require evidence of that individual’s authority to act on behalf of the individual. All individual rights requests will be managed in line with the requirements set out in the UCPA.

G.       Sale of personal information

Presently, Sling does not carry out any “sales” of personal information as defined by the UCPA.

H.      Targeted advertising

Sling carries out limited targeted advertising (as that term is defined by the UCPA) via cookies and related tracking technologies. You will only be served with targeted advertising when you visit  https://getsling.com and this can be managed by clicking the “Do not sell or share my personal information” link at the bottom of https://getsling.com.

I. Deidentified information

We may at times receive, or process personal information to create, deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual. Where we maintain deidentified information, we will maintain and use the information in de identified form and not attempt to reidentify the information except as required or permitted by law.

J.   Updates to this Statement

We will update this Statement from time to time. When we make changes to this Statement, we will change the “Last updated” date at the beginning of this Statement. All changes shall be effective from the date of publication unless otherwise provided in the notification.

____________________________________________________________________________

Addendum F – Canada

Last updated: May 1, 2024

A. Privacy addendum for individuals located in Canada

The provisions below supplement the information provided in the generally applicable portion of our Privacy Statement and apply solely to individuals that are residents of Canada or are otherwise covered under any applicable Canadian federal or provincial privacy laws or regulations, including but not limited to the federal  Personal Information Protection and Electronic Documents Act (“PIPEDA”), Alberta’s Personal Information Protection Act, and British Columbia’s Personal Information Protection Act.  Sling is committed to collecting, using, and disclosing your personal information in accordance with applicable laws and regulations.

B. Consent

By using our Services and accessing our Website, you accept the terms of this privacy addendum and consent to the collection, use, processing, disclosure and retention of your information as described in this Privacy Statement. Typically, we will provide notice of the purpose for collecting your personal information and/or seek your consent (which may be express or implied, depending on the nature and sensitivity of the personal information) in line with applicable law at the time that we collect your personal information. In certain circumstances, we may collect non-sensitive personal information automatically. In general, you may change or withdraw your consent at any time subject to legal or contractual obligations and providing reasonable notice. Your  withdrawal of consent may impact the ability of Sling to provide you with some or all of the Services. Upon receiving notice that you would like to withdraw your consent, we will inform you of the likely consequences of your withdrawal of consent. 

Sling will not collect, use, or disclose your personal information except for the purposes we have identified for collection, unless we have received your consent (which may be express or implied, depending on the nature and sensitivity of the personal information) or the processing is authorized without consent.

C. Accessing and correcting your personal information  

If you are located in Canada, you have the right to request access to and to correct the personal information that we hold about you, subject to certain conditions and limitations. Subject to the applicable law and the nature of your relationship with Sling, this may include a right to review, correct, update, suppress, delete or otherwise limit our use of your personal information that has been previously provided to us. You may also have the right to access information about the ways in which your personal information is or has been used and the names of individuals and/or organizations to which your information has been disclosed.

Sling has established an individual rights portal for the purposes of submitting such individual rights requests. The link to Sling’s individual rights portal can be found here. Individual rights requests can also be submitted to Sling through the below channels:

• Web portal: Individual Rights Portal
• By email: privacy@toasttab.com  
• By post:  Attn: Toast Privacy Office
                  Toast, Inc.
                  333 Summer Street, Boston, MA 02210
                  United States of America

In your request, please specify what information you would like to access or have corrected. We will respond to your request as soon as reasonably practicable, and within the time period required by law. The exercise of these rights is free of charge. Once an individual rights request has been submitted, Sling may ask you for additional information in order to verify your identity or to provide additional details to help us respond to your request. This may include your name, email address, phone number or other details related to your use of Sling’s Services or Websites.

If we correct your information, we will also send the corrected information to organizations to which we disclosed the information during the year before the date the correction was made.

Please note that in certain circumstances, we may refuse to act or impose limitations on your rights, as permitted by the applicable law. If we cannot provide you with access to your personal information or are unable to correct your personal information, we will inform you of the reasons why, subject to any legal or regulatory restrictions, and outline further steps available to you. If we refuse to act on a request to correct your personal information, we will nonetheless annotate the information, noting the correction that was requested but not made. 

In certain cases, depending on the nature of your request, there may also be residual information that will remain within our databases and other records, which, due to applicable law or as part of Services that are in the process of being carried out, will not be removed or changed. We will also retain information relating to your request for recordkeeping and compliance purposes.

D. International transfers 

We may process, store, and transfer your personal information in and to a foreign country, with different privacy laws that may or may not be as comprehensive as Canadian law. In these circumstances, the governments, courts, law enforcement, or regulatory agencies of that country may be able to obtain access to your personal information through the laws of the foreign country. 

Specifically, the personal information collected as part of the Services or as otherwise contemplated by this Statement is primarily processed and stored in the United States. However, as Sling is an international organization with business processes, offices and third parties around the world, your information may be sent to any other country in the world where we do business or maintain third-party relationships. When you provide personal information to us through the Services and as part of this Statement and addendum, you consent to the transfer of your information and the processing of your information in this manner. Any international transfers made will be in accordance with the Statement, this addendum and the applicable law. 

We also impose appropriate safeguards for the transfer of personal information among our affiliates and to third-party service providers in various jurisdictions, and have implemented appropriate contractual arrangements or other measures for such purposes. 

To obtain a current list of the countries where personal information subject to this Statement is collected, used, disclosed and/or stored, including with our service providers, as well as the purposes for which our service providers outside Canada have been authorized to collect, use or disclose personal information for or on behalf of Sling, please contact privacy@getsling.com.

E. Right to challenge compliance and file a complaint

If you believe any privacy laws relating to the protection of your personal information or the practices described in this Statement have not been respected, you may file a complaint with our Assistant General Counsel, Privacy at the address listed below: 

• Web portal: Individual Rights Portal
• By email: privacy@getsling.com 
• By post:  Attn: Assistant General Counsel, Privacy
                  Toast, Inc.
                  333 Summer Street, Boston, MA 02210
                  United States of America
• By phone (toll-free): +1 (866) 226-4484

Sling may ask you for additional information in order to verify your identity or to provide additional details to help us respond to your complaint. 

We will investigate all complaints. If, after an investigation, your complaint is deemed justified, Sling will take appropriate steps to correct the situation, including, if necessary, amending our policies and practices. If you are not satisfied with the results of the investigation or the corrective measures taken by Sling, you may exercise the remedies available under law by contacting the Office of the Privacy Commissioner of Canada at the address below:

Office of the Privacy Commissioner of Canada
30 Victoria Street
Gatineau, Quebec
K1A 1H3
https://www.priv.gc.ca

If you reside in the Province of Alberta, you may also contact the Office of the Information and Privacy Commissioner of Alberta at the address below:

Office of the Information and Privacy Commissioner of Alberta
#410, 9925 – 109 Street NW
Edmonton, Alberta
T5K 2J8
https://www.oipc.ab.ca/ 

If you reside in the Province of British Columbia, you may also contact the Office of the Information and Privacy Commissioner for British Columbia at the address below:

Office of the Information and Privacy Commissioner for British Columbia
PO Box 9038 Stn. Prov. Govt.
Victoria B.C.
V8W 9A4 
https://www.oipc.bc.ca

We will retain personal information used to make a decision that directly affects you for at least one year after we make that decision.

Addendum G – European Union/European Economic Area

Addendum where European Union and the European Economic Area data protection law applies

Last updated: May 1, 2024

The provisions below supplement the information provided in the generally applicable portion of our Statement and are relevant where the data protection laws of the European Union (“EU”) and the European Economic Area (“EEA”) apply. To the extent that there is a conflict between the provisions of this Addendum G and the provisions of the main body of the Statement, the provisions of this Addendum G shall prevail.

A. Data controller(s)

For the purposes of the processing pursuant to this Statement, the joint data controllers will include:

• Sling ehf. (“Sling Iceland”)
  Gudrunartuni 8
  105 Reykjavik
  Iceland 

• Toast, Inc. (“Toast US”)
  333 Summer Street
  Boston, MA 02210
  United States of America 

Toast US is primarily responsible for ensuring that personal information is collected and processed pursuant to the applicable law. These obligations include (a) the implementation of appropriate data protection policies, (b) the management and notification of security incidents involving personal information, (c) the completion of data protection impact assessments (where appropriate) and (d) the implementation of appropriate technical and organizational security measures to protect personal information. Toast US is also responsible for managing any requests you make to exercise your rights under the GDPR or other applicable data protection legislation, on behalf of both Sling Iceland and Toast US.

Toast US is primarily responsible for managing aspects of the processing that are within its control as part of the joint controller relationship. This includes support and management pertaining to the provision of the Services, obtaining consents from data subjects (where applicable) as well as support with providing notice to data subjects.  Where Sling Iceland receives a data subject request under the GDPR, Sling Iceland will promptly notify Toast US of the request.

Where we are a Controller, we are free to rely on “data processors” (as defined within the GDPR) and have engaged various third-party service providers in order to provide the Services as well as for other purposes described in the main body of the Privacy Statement. For more information, see the “How Sling discloses your personal information” section of the Privacy Statement.

Sling Iceland and Toast US also act as processors on behalf of our Account Holders in connection with certain aspects of our Services.  The Account Holder is the data controller in respect of this relationship.

B. Purposes and legal basis for processing

We collect and process your personal information based on the following legal bases:

Where we process personal information on the basis of a legitimate interest (as identified above), as required by data protection law, we have carried out a balancing test to document our interests, to consider what the impact of the processing will be on individuals and to determine whether individuals’ interests outweigh our interests in the processing taking place. You can obtain more information about this balancing test by using the contact details at the end of this Addendum.

Where we collect personal information to administer our contract with you or to comply with our legal obligations, this is mandatory and we will not be able to perform the contract we have entered into with you or otherwise provide the Services without this information. In all other cases, provision of the requested personal information is optional, but this may affect your ability to use our Services or our websites.

C. International transfers

We may transfer the personal information we collect about you for the purposes described in this Privacy Statement to countries that have not been found to provide an adequate level of data protection by the European Commission.

In particular, we may transfer your personal information to third parties, including to parties located in the United States. We use appropriate safeguards for the transfer of personal information to third party service providers.  Where required, we have implemented the EU/EEA approved standard contractual clauses, rely on a service provider’s processor binding corporate rules or have implemented/rely on other legally recognized safeguards for data transfer purposes.

We also use appropriate safeguards for the transfer of personal information among our affiliates in the United States. We have implemented the EU/EEA approved standard contractual clauses or have implemented/rely on other legally recognized safeguards for data transfer purposes.

To obtain a copy of the standard contractual clauses or other transfer safeguards, please send a request to privacy@getsling.com.
 

D. Choice and access

You have additional rights regarding how your personal information is processed, including the right to:

• request access to and obtain a copy of your personal information;
• request the transfer of your personal information you have provided to us to you or another company in a structured, commonly used and machine-readable format;
• request rectification of your personal information when it is inaccurate or incomplete; 
• request erasure of your personal information where permitted under the applicable law, such as where the information is no longer necessary or lawful for us to store or where your information is outdated;
• restrict or object to the processing of your personal information (as applicable), including to object to the processing of personal information for direct marketing purposes; and
• withdraw your consent at any time where this is the legal basis on which we are processing your personal information. If you ask to withdraw your consent, this will not affect any processing which has already taken place at that time.
• Please note that if you choose to withdraw your consent, you may not be able to participate in or benefit from the programs, services and initiatives for which you provided consent to the processing of your personal information. Your rights will in each case be subject to the restrictions set out in applicable data protection laws.

You may exercise these rights free of charge by submitting your request here or to privacy@getsling.com. Where Sling is the data processor and the Account Holder is the data controller in respect of your personal information, you may be required to submit your request directly with the Account Holder in accordance with applicable law or alternatively Sling may require approval from the Account Holder as controller prior to proceeding with your request, in accordance with applicable law. Subject to the applicable law, Sling may charge a reasonable fee or refuse to act on a request if it is manifestly unfounded or excessive, in particular because of its repetitive character. In some situations, Sling may refuse to act or impose limitations on the information disclosed if, for instance, if fulfilling your request would reveal personal information about another person, or if you ask us to delete information which we are required by law or have compelling legitimate interests to keep. 

You also have the right to lodge a complaint about our processing of your personal information with a Supervisory Authority in the Member State of your habitual residence, place of work or place of the alleged infringement as defined in Section I below.

E. Retention 

We will retain your personal information for only as long as needed for the purpose of the processing activity or where we have a legitimate business need to retain it, subject to our legal and regulatory obligations to retain it longer and our applicable records retention periods. The duration of these periods will vary depending on your relationship with Sling and the Service you are using. For example,

• Account Holders: Account Holder account and ownership information will generally be maintained for seven (7) years following the termination of the relationship absent a legal or regulatory obligation to retain longer;
• Application Users: Application User is maintained pursuant to the retention schedule of the Application Holder or alternatively, seven (7) years following the termination of the relationship absent a legal or regulatory obligation to retain longer.  Application Users may request that their Sling accounts used to access the platform and the Services be removed on an ad hoc basis. 

Other periods are set out within Sling’s records retention policy and schedule. Our retention periods are also subject to any rights of individuals or other requirements that might dictate a shorter retention period (e.g., deletion requests). In certain cases, Sling may also maintain information for a longer period of time, such as in cases where the information is subject to a legal claim or complaint. Following those periods and other determinations on the duration of the processing of personal information by Sling, we will delete or take measures to anonymize your personal information.

F. Cookies and other technologies

In addition to the information found in the section of the main body of the Statement titled “Cookies and other tracking technologies”, see Sling’s Cookie Policy which provides some supplemental information for users in the EU/EEA and UK.

G. Children

Our Services are not targeted or directed at children under the age of 16, and we do not intend to, or knowingly, collect or solicit personal information from children under the age of 16.  If you have reason to believe that a child under the age of 16 has provided personal information to us, we encourage the child’s parent or guardian to contact us as described in the “How to contact us” section within the main body of the Privacy Statement to request that we remove the information from our systems. If we learn that any personal information we collected has been provided by a child under the age of 16, we will promptly delete that personal information.

H. How to contact Sling Iceland and Toast US

If you have data protection questions, you can reach us at:

• Web portal: Individual Rights Portal
• By email: privacy@getsling.com 
• By post:  Attn: Assistant General Counsel, Privacy
                  Toast, Inc.
                  333 Summer Street, Boston, MA 02210
                  United States of America
• By phone (toll-free): +1 (866) 226-4484

I. Lodging a complaint

If you are not satisfied with the processing of your personal information, you have the right to lodge a complaint with the The Icelandic Data Protection Authority (https://www.personuvernd.is)

Addendum H – United Kingdom (“UK”)

Last updated: May 1, 2024

The provisions below supplement the information provided in the generally applicable portion of our Privacy Statement and applies where the UK General Data Protection Regulation (“UK GDPR”) and the UK Data Protection Act 2018 (together the “UK Data Protection Law”) apply, which includes where Sling Iceland provides Services.  To the extent that there is a conflict between the provisions of this Addendum H and the provisions of the main body of the Privacy Statement, the provisions of this Addendum H shall prevail.

A. Data controller(s)

For the purposes of the processing pursuant to this Statement, the joint data controllers will include:

Sling ehf. (“Sling Iceland”)

Gudrunartuni 8

105 Reykjavik

Iceland

• Toast, Inc. (“Toast US”)
  333 Summer Street,
  Boston, MA 02210
  United States of America 

Toast US is primarily responsible for ensuring that personal information is collected and processed pursuant to UK Data Protection Law. These obligations include (a) the implementation of appropriate data protection policies, (b) the management and notification of security incidents involving personal information, (c) the completion of data protection impact assessments (where appropriate) and (d) the implementation of appropriate technical and organizational security measures. Toast US is also responsible for managing any requests that you may make to exercise your rights under UK Data Protection Law, on behalf of both Sling Iceland and Toast US.

Toast US is primarily responsible for managing aspects of the processing that are within its control as part of the joint controller relationship. This includes support and management pertaining to the provision of the Services, obtaining consents from data subjects (where applicable) as well as support with providing notice to data subjects.  Where Sling Iceland receives a data subject request under the UK Data Protection Law, Sling Iceland will promptly notify Toast US of the request.

Where we are a Controller, we are free to rely on “data processors” (as defined within UK Data Protection Law) and have engaged various third-party service providers in order to provide the Services as well as for other purposes described in the main body of the Privacy Statement. For more information, see the “How Sling discloses your personal information” section of the Privacy Statement.

Sling Iceland and Toast US also act as processors on behalf of our Account Holders in connection with certain aspects of our Services.  The Account Holder is the data controller in respect of this relationship.

B. Purposes and legal basis for processing

We collect and process your personal information based on the following legal bases:

Where we process personal information on the basis of a legitimate interest (as identified above), as required by data protection law, we have carried out a balancing test to document our interests, to consider what the impact of the processing will be on individuals and to determine whether individuals’ interests outweigh our interests in the processing taking place. You can obtain more information about this balancing test by using the contact details at the end of this Addendum.

Where we collect personal information to administer our contract with you or to comply with our legal obligations, this is mandatory and we will not be able to perform the contract we have entered into with you or otherwise provide the Services without this information. In all other cases, provision of the requested personal information is optional, but this may affect your ability to use our Services or our websites.

C. International transfers

We may transfer the personal information we collect about you for the purposes described in this Privacy Statement to countries that have not been found to provide an adequate level of data protection by UK Data Protection Law.

In particular, we may transfer your personal information to third parties, including to parties located in the United States. We use appropriate safeguards for the transfer of personal information to third party service providers.  Where required, we have implemented the UK approved standard contractual clauses or the UK approved addendum to the European Commission approved standard contractual clauses, rely on a service provider’s processor binding corporate rules or have implemented/rely on other legally recognized safeguards for data transfer purposes.

We also use appropriate safeguards for the transfer of personal information among our affiliates in the United States. We have implemented the UK approved standard contractual clauses or the UK approved addendum to the European Commission approved standard contractual clauses or have implemented/rely on other legally recognized safeguards for data transfer purposes.

To obtain a copy of the standard contractual clauses or other transfer safeguards, please send a request to privacy@getsling.com.

D. Choice and access

You have additional rights regarding how your personal information is processed, including the right to: 

• request access to and obtain a copy of your personal information;
• request the transfer of your personal information you have provided to us to you or another company in a structured, commonly used and machine-readable format;
• request rectification of your personal information when it is inaccurate or incomplete; 
• request erasure of your personal information where permitted under the applicable law, such as where the information is no longer necessary or lawful for us to store or where your information is outdated;
• restrict or object to the processing of your personal information (as applicable), including to object to the processing of personal information for direct marketing purposes; and
• withdraw your consent at any time where this is the legal basis on which we are processing your personal information. If you ask to withdraw your consent, this will not affect any processing which has already taken place at that time. 

Please note that if you choose to withdraw your consent, you may not be able to participate in or benefit from the programs, services and initiatives for which you provided consent to the processing of your personal information. Your rights will in each case be subject to the restrictions set out in UK Data Protection Law.

You may exercise these rights free of charge by submitting your request here or to privacy@getsling.com.  Subject to the applicable law, Sling may charge a reasonable fee or refuse to act on a request if it is manifestly unfounded or excessive, in particular because of its repetitive character. In some situations, Sling may refuse to act or impose limitations on the information disclosed if, for instance, if fulfilling your request would reveal personal information about another person, or if you ask us to delete information which we are required by law or have compelling legitimate interests to keep.

You also have the right to lodge a complaint about our processing of your personal information with the UK Information Commissioner’s Office. 

E. Retention

We will retain your personal information for only as long as needed for the purpose of the processing activity or where we have a legitimate business need to retain it, subject to our legal and regulatory obligations to retain it longer and our applicable records retention periods. The duration of these periods will vary depending on your relationship with Sling and the Service you are using. For example,

• Account Holders: Account Holder account and ownership information will generally be maintained for seven (7) years following the termination of the relationship absent a legal or regulatory obligation to retain longer;
• Application Users: Application User is maintained pursuant to the retention schedule of the Application Holder or alternatively, seven (7) years following the termination of the relationship absent a legal or regulatory obligation to retain longer.  Application Users may request that their Sling accounts used to access the platform and the Services be removed on an ad hoc basis. 

Other periods are set out within Sling’s records retention policy and schedule. Our retention periods are also subject to any rights of individuals or other requirements that might dictate a shorter retention period (e.g., deletion requests). In certain cases, Sling may also maintain information for a longer period of time, such as in cases where the information is subject to a legal claim or complaint. Following those periods and other determinations on the duration of the processing of personal information by Sling, we will delete or take measures to anonymize your personal information.

F. Cookies and other technologies

In addition to the information found in the section of the main body of the Statement titled “Cookies and other tracking technologies”, see Sling’s Cookie Policy which provides some supplemental information for users in the EU/EEA and UK.

G. Children

Our Services are not targeted or directed at children under the age of 18, and we do not intend to, or knowingly, collect or solicit personal information from children under the age of 18.  If you have reason to believe that a child under the age of 18 has provided personal information to us, we encourage the child’s parent or guardian to contact us as described in the “How to contact us” section within the main body of the Privacy Statement to request that we remove the information from our systems. If we learn that any personal information we collected has been provided by a child under the age of 18, we will promptly delete that personal information.

H.  How to contact Sling Iceland and Toast US

If you have data protection questions, you can reach us at:

• Web portal: Individual Rights Portal
• By email: privacy@getsling.com 
• By post:  Attn: Assistant General Counsel, Privacy
                  Toast, Inc.
                  333 Summer Street, Boston, MA 02210
                  United States of America
• By phone (toll-free): +1 (866) 226-4484

I. Lodging a complaint

If you are not satisfied with the processing of your personal information, you have the right to lodge a complaint with the UK Information Commissioner’s Office (https://ico.org.uk/).