Privacy Policy of Quantum DSP Solutions

1Important Definitions

For purposes of this Privacy Policy:

"Customer" means the business entity, delivery service provider, logistics company, fleet operator, warehouse operator, or other organization that subscribes to or uses Quantum’s Services.

"User" means an individual who accesses or uses the Services, including administrators, managers, dispatchers, drivers, employees, contractors, support users, and authorized personnel.

"Personal Information" means information that identifies, relates to, describes, can reasonably be linked to, or could reasonably be associated with an individual or household.

"Customer Data" means information submitted, uploaded, generated, stored, processed, or managed by or on behalf of a Customer through the Services.

"Tenant" means a logically separated customer environment within the Quantum platform.

"Processing" means any operation performed on personal information, including collection, storage, use, access, disclosure, analysis, deletion, modification, or transmission.

2Quantum’s Role

Quantum primarily provides a business-to-business SaaS platform.

In many situations, Quantum acts as a service provider, processor, contractor, or vendor that processes personal information on behalf of its Customers. The Customer determines what information is collected, who may access it, how it is used in business operations, and how long it should be retained, subject to the configuration of the Services and applicable agreements.

Quantum is not the employer of drivers, dispatchers, warehouse staff, administrators, or other workforce users employed or contracted by Customers.

Customers are responsible for providing any required notices, obtaining any required consents, and ensuring that their use of the Services complies with applicable employment, labor, privacy, monitoring, biometric, location tracking, consumer protection, and data protection laws.

Quantum may also process limited information for its own business purposes, such as account administration, platform security, billing, support, fraud prevention, service improvement, legal compliance, and enforcement of agreements.

3Scope of This Policy

This Privacy Policy applies to personal information processed through:

• The Quantum DSP web platform
• The Quantum DSP mobile application
• Customer dashboards
• Administrative panels
• APIs
• Reporting tools
• Scorecard tools
• Dispatch and scheduling tools
• Media upload and storage tools
• Photo, video, uniform, vehicle, phone, employee, warehouse, route, schedule, and report modules
• AI-assisted or automation features, if enabled
• Support communications
• Security monitoring and audit logs

This Policy does not apply to third-party websites, systems, applications, platforms, or services that Quantum does not own or control.

4Categories of Personal Information We May Collect

Depending on how the Services are configured and used by a Customer, Quantum may collect or process the following categories of information.

A. Account and Identity Information

We may process:

• Name
• Email address
• Phone number
• Username
• User ID
• Employee ID or internal identifier
• Contractor ID or internal identifier
• User role
• Permissions
• Company or tenant assignment
• Warehouse assignment
• Account status
• Authentication status
• Login credentials in encrypted or hashed form
• Session data
• Password reset records
• Multi-factor authentication status, if enabled

B. Company, Tenant, and Business Assignment Information

We may process:

• Customer company name
• Tenant ID
• Company ID
• Warehouse ID
• Business location
• Operational region
• Role assignment
• Permission group
• User-to-company relationship
• User-to-warehouse relationship
• User-to-route relationship
• User-to-vehicle relationship
• User-to-device relationship

C. Workforce and Operational Information

The Services may process workforce and operational information, including:

• Work schedules
• Shift assignments
• Dispatch assignments
• Route information
• Delivery-related records
• Daily reports
• Weekly reports
• Attendance or availability records
• Work activity records
• Vehicle assignments
• Phone or mobile device assignments
• Uniform assignments
• Notes entered by authorized users
• Task completion records
• Operational comments
• Internal performance-related operational information
• Scorecard information
• Metrics and dashboard data
• Report exports
• Schedule changes
• Dispatch changes
• Warehouse activity records

D. Uploaded Photos, Videos, and Files

The Services may allow authorized users to upload, store, transmit, or review files, including:

• Vehicle photos
• Damage photos
• Incident-related photos
• Operational photos
• Uniform photos
• Warehouse photos
• Delivery-related photos
• Videos
• Uploaded reports
• Spreadsheets
• PDF documents
• Supporting operational documents
• File names
• File metadata
• File type
• File size
• Upload timestamp
• Uploader user ID
• Related company ID
• Related warehouse ID
• Related vehicle ID
• Related route or dispatch ID
• Related operational record

Uploaded media may incidentally include faces, license plates, addresses, uniforms, vehicles, packages, homes, businesses, or other identifiable information. Customers and Users should avoid uploading unnecessary sensitive information.

E. Device, Technical, and Usage Information

When Users access the Services, we may collect:

• IP address
• Browser type
• Device type
• Operating system
• Mobile device type
• Application version
• Session identifiers
• Login timestamps
• Logout timestamps
• Access dates and times
• Pages or screens viewed
• Features used
• API requests
• Error logs
• Performance logs
• Security logs
• Crash logs
• Approximate location derived from IP address
• Device identifiers where permitted

F. Location Information

The Services may process location-related information if enabled by a Customer or necessary for operational functionality.

This may include:

• Approximate location derived from IP address
• Warehouse location
• Route location
• Delivery area
• Assigned service area
• GPS or precise geolocation, only if enabled and legally permitted

Quantum does not require Customers to enable precise geolocation unless it is necessary for the configured Services. Customers are responsible for providing any legally required workforce or user notice before enabling precise location features.

G. Security and Audit Information

We may collect and retain information necessary to protect the Services, including:

• Login attempts
• Failed login attempts
• Password reset activity
• Permission changes
• Role changes
• Administrative actions
• API access logs
• User access logs
• Tenant access logs
• Data export events
• File upload events
• File download events
• Suspicious activity indicators
• Security alerts
• IP addresses associated with security events
• Audit trails
• System events

H. Support and Communication Information

If a User or Customer contacts Quantum, we may collect:

• Name
• Email address
• Phone number
• Company name
• Support request content
• Screenshots
• Attachments
• Diagnostic information
• Communications with support personnel
• Billing or account administration communications

I. Payment and Billing Information

Quantum may collect or process business billing information, including:

• Customer name
• Billing contact
• Billing email
• Company address
• Subscription details
• Invoice details
• Payment status
• Limited payment-related information

Quantum does not intentionally store full payment card numbers unless processed through an authorized payment provider.

J. Sensitive Personal Information

Quantum does not intentionally require Users or Customers to upload sensitive personal information unless necessary for a configured business purpose, legal requirement, security purpose, or Customer-directed workflow.

Sensitive personal information may include, depending on configuration:

• Precise geolocation
• Government identifiers
• Account credentials
• Images or videos that reveal sensitive traits
• Health or injury-related information if voluntarily uploaded in incident contexts
• Employment-related records
• Authentication information

Customers and Users must not upload sensitive personal information unless it is necessary, authorized, legally permitted, and consistent with Customer policy.

K. Biometric Information

Quantum does not intentionally collect biometric identifiers or biometric templates for the purpose of identifying an individual unless expressly enabled under a separate written agreement.

Quantum does not perform facial recognition by default.

If any biometric, face recognition, driver verification, or identity verification feature is enabled in the future, additional notice, consent, contractual terms, and legal review may be required.

5Sources of Personal Information

Quantum may receive personal information from:

• The User directly
• The Customer
• Customer administrators
• Dispatchers or managers
• Uploaded files
• Integrated systems
• Mobile or web applications
• APIs
• Devices used to access the Services
• Support communications
• Security monitoring tools
• Service providers
• AI or automation providers, if enabled
• Business records generated through use of the Services

6How We Use Personal Information

Quantum may use personal information for the following purposes:

• Provide, operate, maintain, and improve the Services
• Create and manage user accounts
• Authenticate users
• Maintain secure sessions
• Assign users to the correct tenant, company, warehouse, role, or permission group
• Enable dispatch, scheduling, reporting, warehouse, vehicle, phone, uniform, scorecard, and media workflows
• Store and manage uploaded files, photos, videos, and documents
• Generate dashboards, reports, exports, and operational views
• Maintain tenant isolation between Customers
• Apply role-based access controls
• Monitor platform usage
• Detect and prevent unauthorized access
• Investigate suspicious activity
• Maintain audit logs
• Troubleshoot errors
• Provide technical support
• Communicate with Customers and Users
• Manage subscriptions, billing, and customer accounts
• Enforce agreements and acceptable use rules
• Comply with legal obligations
• Respond to lawful requests
• Protect the rights, property, safety, and security of Quantum, Customers, Users, and others
• Improve security, reliability, performance, and functionality
• Support AI-assisted or automation features if enabled by the Customer

7Artificial Intelligence and Automation

Quantum may provide or enable AI-assisted or automated features to support business operations.

These features may include:

• Extracting data from uploaded files
• Organizing reports
• Reading or summarizing operational records
• Assisting with scorecard processing
• Assisting with photo or video review
• Detecting operational patterns
• Supporting dashboard insights
• Supporting workflow automation

Unless expressly stated in a separate agreement, Quantum does not use Customer Data or personal information to train public AI models.

Quantum may use AI service providers to process data only when necessary to provide enabled features, subject to contractual, technical, and security controls.

AI-assisted outputs may be inaccurate, incomplete, or require human review. Customers must not rely solely on AI-assisted outputs for employment decisions, disciplinary decisions, compensation decisions, legal decisions, safety decisions, termination decisions, or decisions that produce significant effects on individuals without appropriate human review.

Customers are responsible for determining whether their use of AI-assisted features requires additional notice, consent, risk assessment, human review, or other compliance measures under applicable law.

8How We Disclose Personal Information

Quantum may disclose personal information in the following circumstances.

A. To the Customer

If you use the Services through a Customer, authorized Customer administrators and personnel may access information associated with your account, activity, uploads, reports, schedules, dispatch records, files, photos, videos, scorecards, and operational records.

B. To Authorized Users

Personal information may be visible to other authorized Users based on their role, permissions, warehouse assignment, company assignment, and Customer configuration.

C. To Service Providers and Vendors

We may disclose information to trusted service providers that support the Services, including:

• Cloud hosting providers
• Database providers
• File storage providers
• Content delivery networks
• Email providers
• Notification providers
• SMS providers, if enabled
• Error monitoring providers
• Cybersecurity providers
• Logging providers
• Customer support tools
• Payment processors
• Analytics tools
• AI or automation providers, if enabled
• Development, maintenance, and infrastructure providers

These providers are authorized to process information only as needed to provide services to Quantum or our Customers.

D. To Integration Partners

If a Customer enables an integration, data may be shared with or received from third-party systems selected or authorized by the Customer.

Customers are responsible for ensuring that any integration they enable is authorized and legally permitted.

E. For Legal, Security, or Safety Reasons

We may disclose information if we believe disclosure is necessary to:

• Comply with applicable law
• Respond to subpoenas, court orders, warrants, or legal process
• Respond to lawful requests from public authorities
• Protect the rights, safety, property, or security of Quantum, Customers, Users, or others
• Investigate fraud, misuse, or security incidents
• Enforce agreements
• Prevent harm
• Defend legal claims

F. Business Transfers

If Quantum is involved in a merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or similar transaction, personal information may be transferred as part of that transaction, subject to appropriate protections.

G. Professional Advisors

We may disclose information to attorneys, accountants, auditors, insurers, consultants, and other professional advisors when necessary for business, legal, compliance, accounting, insurance, or risk management purposes.

9We Do Not Sell Personal Information

Quantum does not sell personal information for money.

Quantum does not share personal information for cross-context behavioral advertising unless expressly disclosed and legally permitted.

Quantum does not use Customer Data for third-party targeted advertising.

If this practice changes, Quantum will update this Privacy Policy and provide any legally required notices, rights, and opt-out mechanisms.

10Cookies and Similar Technologies

The Services may use cookies, local storage, session storage, software development kits, pixels, or similar technologies for:

• Login and authentication
• Session management
• Security
• Fraud prevention
• User preferences
• Performance monitoring
• Error detection
• Feature functionality
• Analytics
• Platform improvement

Users may control certain browser-based cookies through browser settings. Disabling cookies may affect the functionality or security of the Services.

Quantum does not use cookies in the Services for third-party behavioral advertising unless expressly disclosed and legally permitted.

11Data Retention

Quantum retains personal information only as long as reasonably necessary for the purposes described in this Privacy Policy, the applicable Customer agreement, legal obligations, security obligations, dispute resolution, backups, audit requirements, and legitimate business needs.

Unless a different period is configured by agreement, law, or Customer instruction, the following retention approach may apply:

When personal information is no longer required, Quantum will delete, anonymize, de-identify, aggregate, or securely retain it as permitted by law and applicable agreements.

Deletion from active systems may not immediately delete information from backups, logs, or archives, but such information will be protected and retained only as necessary.

12Data Security

Quantum uses reasonable administrative, technical, and organizational safeguards designed to protect personal information from unauthorized access, disclosure, alteration, loss, misuse, or destruction.

These safeguards may include:

• Encryption in transit
• Encryption at rest where appropriate
• Role-based access controls
• Tenant isolation
• Least-privilege access
• Authentication controls
• Session management
• Audit logs
• Access logs
• Security monitoring
• Secure software development practices
• Dependency monitoring
• Secrets management
• File validation
• Malware risk reduction controls
• Backup and recovery processes
• Administrative access restrictions
• Vendor security controls
• Incident response procedures

No system is completely secure. Quantum does not guarantee that unauthorized access, cyberattacks, data loss, or security incidents will never occur.

Users are responsible for maintaining the confidentiality of their credentials and must promptly report suspected unauthorized access.

13Tenant Isolation and Access Controls

Quantum is designed as a multi-tenant platform.

Each Customer’s data is intended to be logically separated from other Customers’ data through tenant, company, warehouse, role, and permission controls.

Quantum uses access-control mechanisms designed to ensure that Users access only the information authorized for their company, tenant, warehouse, role, and assigned permissions.

Customers are responsible for assigning appropriate roles and promptly removing or modifying access for Users who no longer require access.

14User Responsibilities

Users must not:

• Share credentials
• Use another person’s account
• Attempt to access another Customer’s data
• Attempt to bypass access controls
• Upload unnecessary sensitive information
• Upload malware or executable files
• Upload unlawful content
• Upload information they are not authorized to provide
• Use the Services for unauthorized surveillance
• Use the Services to violate employment, labor, privacy, consumer protection, or data protection laws
• Copy, scrape, extract, or export data without authorization
• Interfere with the security or operation of the Services

Quantum may suspend or restrict access if it detects misuse, unauthorized activity, security risks, or violation of applicable terms.

15Customer Responsibilities

Customers are responsible for:

• Ensuring they have the legal right to upload and process information in the Services
• Providing required notices to employees, contractors, drivers, dispatchers, managers, and other Users
• Obtaining required consents where legally required
• Configuring User roles appropriately
• Limiting access to authorized personnel
• Maintaining accurate User records
• Deactivating Users who no longer need access
• Avoiding unnecessary collection of sensitive information
• Ensuring that use of photos, videos, GPS, AI, scorecards, and monitoring tools complies with applicable law
• Responding to workforce or consumer privacy requests when the Customer controls the relevant information
• Complying with employment, labor, monitoring, privacy, biometric, consumer protection, data protection, and recordkeeping laws

16Privacy Rights

Depending on your state, residency, relationship to Quantum or a Customer, and applicable law, you may have certain privacy rights.

These rights may include:

• Right to know or confirm whether personal information is processed
• Right to access personal information
• Right to correct inaccurate personal information
• Right to delete personal information
• Right to obtain a copy of personal information
• Right to data portability
• Right to opt out of sale of personal information
• Right to opt out of sharing for cross-context behavioral advertising
• Right to opt out of targeted advertising
• Right to opt out of certain profiling or automated decisionmaking
• Right to limit the use or disclosure of sensitive personal information where applicable
• Right to appeal a denied request where required by law
• Right to non-discrimination for exercising privacy rights

Because Quantum often processes information on behalf of Customers, if your information is controlled by your employer, contractor, delivery service provider, or other organization, Quantum may refer your request to that Customer or assist the Customer in responding.

17How to Submit a Privacy Request

To submit a privacy request, contact: Support Email: itmanager@merllcdsp.com Mailing Address: Quantum DSP Solutions LLC, Florida Address

Please include:

• Your name
• Your email address
• Your company or organization
• Your role, if applicable
• The nature of your request
• The state where you reside
• The information you are requesting, correcting, or seeking to delete

We may need to verify your identity before processing your request.

If you are submitting a request through an authorized agent, we may require proof of authorization and may verify your identity directly where permitted by law.

If we deny a request, in whole or in part, we will explain the reason where required by law and provide appeal instructions where applicable.

18State-Specific Privacy Notice

Quantum provides this section to address privacy laws that may apply in certain U.S. states.

Depending on your state, you may have rights related to access, correction, deletion, portability, opt-out of certain processing, limitation of sensitive information, and appeal.

Quantum’s approach is to provide a consistent privacy request process across U.S. states where reasonably practicable, even when a specific state law may not apply to a particular request.

A. California Privacy Notice

If you are a California resident, you may have rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act.

In the preceding 12 months, Quantum may have collected the following categories of personal information:

Quantum collects and uses these categories for the purposes described in this Privacy Policy.

Quantum does not sell personal information for money.

Quantum does not share personal information for cross-context behavioral advertising unless expressly disclosed.

Quantum does not use sensitive personal information for purposes other than permitted business, security, legal, operational, or Customer-directed purposes.

California residents may have the right to know, access, correct, delete, obtain a copy, opt out of sale or sharing, limit certain uses of sensitive personal information, and be free from discrimination for exercising privacy rights.

B. Florida Privacy Notice

Quantum is headquartered in Florida.

Florida residents may have privacy rights under applicable Florida law, including rights related to access, correction, deletion, portability, and certain opt-outs if the relevant law applies.

Quantum does not sell personal information and does not use Customer Data for third-party targeted advertising.

Quantum will process Florida privacy requests as required by applicable law and may also provide a reasonable request process even where a specific statutory requirement does not apply.

C. Other U.S. State Privacy Rights

Residents of other states may have similar rights under applicable state privacy laws.

Quantum will review privacy requests based on the User’s state of residence, the nature of the information, Quantum’s role, the Customer’s role, and applicable law.

19Workforce and Contractor Data

If you are an employee, contractor, driver, dispatcher, warehouse worker, manager, or other workforce member of a Customer, the information processed through the Services may be controlled by that Customer.

Quantum does not make employment decisions on behalf of Customers.

Quantum does not determine compensation, discipline, termination, hiring, firing, scheduling policy, or employment status.

Customers are solely responsible for their employment, contractor, labor, scheduling, compensation, monitoring, evaluation, and disciplinary decisions.

Quantum provides tools that Customers may use to manage operations, but Customers remain responsible for how they use information generated by the Services.

20Automated Decisionmaking and Profiling

Quantum may provide automated or AI-assisted tools, but Quantum does not intend for such tools to be used as the sole basis for decisions that produce legal or similarly significant effects on individuals.

Customers must ensure that any use of automated outputs, AI outputs, scorecards, rankings, metrics, or dashboards complies with applicable law and includes appropriate human review.

Users may contact their Customer or Quantum to ask questions about automated or AI-assisted processing where applicable.

21Children’s Privacy

The Services are intended for business and workforce use.

The Services are not directed to children under 21, and Quantum does not knowingly collect personal information from children under 21.

Customers must not create accounts for children or use the Services to collect children’s personal information unless expressly authorized by law and by a separate written agreement with Quantum.

If Quantum learns that it has collected personal information from a child under 21 without appropriate authorization, it will take reasonable steps to delete it.

22International Access and Transfers

Quantum is headquartered in the United States.

If you access the Services from outside the United States, your information may be processed and stored in the United States or in other jurisdictions where Quantum or its service providers operate.

Privacy laws in those jurisdictions may differ from the laws in your location.

Customers are responsible for ensuring that any international use of the Services complies with applicable data transfer and employment laws.

23De-Identified, Aggregated, and Anonymous Information

Quantum may use de-identified, aggregated, or anonymous information for:

• Security analysis
• Service improvement
• Product development
• Performance monitoring
• Statistical analysis
• Business reporting
• Benchmarking
• Reliability improvement

Quantum will not attempt to re-identify de-identified information except as permitted by law, such as for security testing or legal compliance.

24Data Breach and Security Incidents

If Quantum becomes aware of a security incident involving personal information, Quantum will investigate and take reasonable steps consistent with applicable law and contractual obligations.

Where required, Quantum will notify affected Customers, regulators, or individuals in accordance with applicable law and agreements.

Customers may be responsible for notifying their own employees, contractors, drivers, users, regulators, or business partners depending on the nature of the incident and applicable law.

25Third-Party Services and Links

The Services may contain links to third-party websites or may integrate with third-party services.

Quantum is not responsible for the privacy, security, or data practices of third parties that it does not own or control.

Customers and Users should review the privacy policies and terms of third-party services before enabling integrations or sharing information with them.

26Changes to This Privacy Policy

Quantum may update this Privacy Policy from time to time.

If we make material changes, we will provide notice through the Services, by email, or by other reasonable means.

The updated Privacy Policy will indicate the effective date.

Continued use of the Services after an updated Privacy Policy becomes effective means that the updated Policy applies to information processed after that date, unless otherwise required by law.

27Contact Us

If you have questions about this Privacy Policy, privacy practices, or privacy rights, contact: Quantum DSP Solutions LLC Principal Office: Florida, United States Support Email: itmanager@merllcdsp.com

28Important Notice

This Privacy Policy is intended to describe Quantum’s privacy practices. It does not replace any applicable Customer agreement, data processing agreement, terms of service, employment notice, contractor notice, monitoring notice, or legally required disclosure.

If there is a conflict between this Privacy Policy and a signed agreement between Quantum and a Customer, the signed agreement may control to the extent permitted by law.