PRIVACY POLICY

1. Introduction

This Privacy Policy explains how PitstopHealth Limited ("Pitstop", "we", "us", "our") collects, uses, stores, and protects personal data when you access or use the Pitstop platform and related services (collectively, the "Services").

Pitstop is the Continuous Sales Coaching Company. Our platform connects AI role-play practice, analysis of real customer conversations, AI coaching, and measurement against the Pitstop Standard or a custom Company Standard, in one continuous improvement system. Our products include Challenge (AI role-play practice), Rep Score (free individual-level coaching, contracted directly with the individual sales professional, the "Rep"), Team Score (free team-level coaching for a client organization), and Company Score (a paid, bespoke engagement for an organization). The data we process relates primarily to professional sales activity, role-play practice, and organizational performance.

PitstopHealth Limited is registered in Ireland (company address: 77 Sydney Parade Avenue, Dublin 4, D04 K0N0, Ireland). As an Irish-registered entity, Pitstop operates in compliance with the EU General Data Protection Regulation ("GDPR") and the Irish Data Protection Acts.

If you have any questions about this Policy, please contact us at support@takeapitstop.com.

Summary of key points. We collect account, call, role-play, usage, and marketing data to deliver AI sales coaching. We never use identifiable call recordings, transcripts, or coaching outputs to train AI models, and never share them with third parties for model training. Under Rep Score, your individual results are yours: they are not visible to your employer unless you grant permission. We do not sell personal data. Depending on where you live, you have rights to access, correct, delete, and port your data, and to object to processing; see Sections 14 and 15. Full details are below.

2. Our Role: Controller or Processor

Our role under data protection law depends on the product and the data involved:

• Pitstop as controller. We act as controller for: account, contact, and billing data; website visitor, marketing, and lead data (including AI GTM Lab and Workflow Pack sign-ups); usage and platform data; and the personal data of individual Reps who activate Rep Score directly with Pitstop, including their Practice Content, Customer Content they submit, and Rep Score outputs.
• Pitstop as processor. Where a client organization activates Team Score or purchases Company Score and submits call recordings or related content containing personal data, we process that content on the organization's behalf and on its instructions, as a processor. A Data Processing Agreement (DPA) governs this processing and is available to Team Score and Company Score clients on request at support@takeapitstop.com. In that scenario the organization is the controller, and questions about its handling of your data should be directed to it.

3. Personal Data We Collect

We collect and process the following categories of personal data in connection with the Services:

Account and Contact Data

• Name, job title, and work email address
• Organization name and billing details
• Account credentials

Call and Coaching Data

• Sales call recordings and transcripts uploaded or integrated through the Services
• AI-generated coaching outputs, execution scores, skill assessments, and improvement metrics
• Pre-call preparation notes and session inputs
• Metadata associated with call submissions (date, duration, participant count)

Practice and Role-play Data

• AI role-play session transcripts and, where applicable, audio, generated through Challenge or other AI role-play features
• Rep Score, Team Score, and Company Score results and other feedback generated against the Pitstop Standard or a Company Standard
• A Company Standard configured for your organization, where enabled

Usage and Platform Data

• Log data, device and browser information, and IP addresses
• Feature usage, session activity, and interaction data within the platform

Marketing and Lead Data

• Work email address, role, and company name submitted to access a Workflow Pack, request a demo, or otherwise engage with AI GTM Lab content
• Engagement data relating to marketing content, such as resources downloaded

Third-Party Integration Data

Where you connect calendar or communication tools to the Services, we may receive data from those integrations as necessary to provide the Services.

4. Call Participants' Data

Real sales calls submitted as Customer Content may contain the personal data of other call participants, such as prospects and customers of the submitting Rep or organization (for example, their voice, name, and things they say on the call).

The Rep or organization submitting a recording is responsible for ensuring it was made lawfully and with all necessary notices and consents, as set out in Section 6 of our Terms of Service. Where Pitstop processes call participants' data as a processor, the submitting organization is the controller of that data. Where Pitstop acts as controller (for example under Rep Score), we process call participants' data on the basis of legitimate interests, solely to deliver coaching and scoring to the submitting Rep; we do not use it to build profiles of, or market to, call participants.

If you took part in a recorded call analyzed through the Services and have questions or wish to exercise your rights, contact us at support@takeapitstop.com and we will respond or refer your request to the relevant controller.

5. Lawful Basis for Processing

We process personal data on the following lawful bases under the GDPR:

• Contract: Processing necessary to provide the Services under your agreement with us (including a Rep Score Activation Agreement, Team Score Activation Agreement, or Company Score commercial agreement), including delivering coaching and role-play outputs, managing your account, and processing payments.
• Legitimate Interests: Processing for platform security, fraud prevention, service improvement (including through the analytics and advertising cookies described in our Cookie Policy), the provision of permitted performance analytics to organizational account holders, the delivery of coaching on lawfully submitted call recordings, and business-to-business marketing communications to professional contacts, in each case where these interests are not overridden by your rights.
• Legal Obligation: Processing required to comply with applicable law, including tax, financial reporting, and law enforcement obligations.
• Consent: Where we rely on consent (for example, for certain optional communications), you may withdraw consent at any time without affecting the lawfulness of prior processing.

6. How We Use Personal Data

We use personal data to:

• Provide, operate, and maintain the Services
• Deliver AI-generated coaching outputs, role-play feedback through Challenge, and execution scores including Rep Score, Team Score, and Company Score
• Configure and apply a Company Standard where enabled for an organization
• Enable team dashboards, leaderboards, and organizational analytics, in accordance with the access model described in Section 12
• Process payments and manage accounts
• Respond to support requests and communicate service updates
• Deliver Workflow Packs and other requested marketing content, and send related marketing communications where permitted, always with the ability to opt out
• Monitor platform security and prevent fraudulent or unauthorized activity
• Improve the reliability and performance of our AI systems, using anonymized and aggregated data only (see Section 9)
• Comply with legal and regulatory obligations

7. Disclosure of Personal Data

We do not sell personal data. We may share personal data in the following circumstances:

• Service Providers: With third-party technology providers who process data on our behalf to deliver the Services, including AI infrastructure providers, hosting services, and payment processors. All providers are bound by data processing agreements and may only process data for the purposes we specify. We do not provide identifiable Customer Content, Practice Content, or Outputs to any third party for AI model training. A current list of our subprocessors is available on request at support@takeapitstop.com, and will be published on our trust page.
• Organizational Administrators: Under Team Score or Company Score, where your employer or organization holds the account, administrators may access team-level and, where you have granted permission, your individual performance data, coaching outputs, role-play activity, and call recordings, in accordance with Section 10 of our Terms of Service. Under Rep Score, your individual outputs are controlled by you and are not shared with your employer by default.
• Advertising and Analytics Partners: With advertising and analytics partners, such as Amplitude and LinkedIn, to understand how visitors engage with our website and marketing content and to measure the performance of our marketing campaigns. Our analytics provider, Amplitude, identifies you by an individual identifier, currently your email address where available, which we also use for support and account-related purposes. These partners may act as independent controllers of data collected through their technologies. See our Cookie Policy for further detail.
• Legal Compliance: Where required by law, regulation, court order, or to protect the rights, safety, or property of Pitstop or others.
• Business Transfers: In connection with a merger, acquisition, or sale of assets, personal data may be transferred to the relevant third party subject to equivalent privacy protections.

8. International Data Transfers

Pitstop primarily stores and processes data within the European Economic Area (EEA). Our analytics provider, Amplitude, is based in the EEA and processes data within the EEA. Where data is transferred outside the EEA, for example to service providers or partners based in the United States, such as AI infrastructure, hosting, or advertising (LinkedIn) providers, we ensure appropriate safeguards are in place in accordance with GDPR requirements, including Standard Contractual Clauses, adequacy decisions issued by the European Commission, and/or certification under the EU-US Data Privacy Framework where applicable.

9. AI Model Improvement

We do not use identifiable Customer Content, identifiable Practice Content, or identifiable Outputs, including identifiable call recordings or transcripts, to train our AI models, and we do not provide identifiable data to any third party for training their models. This applies whether you use Rep Score, Team Score, or Company Score, and whether or not you are a paying customer.

Pitstop may use anonymized and aggregated data derived from Customer Content, Practice Content, and coaching outputs to improve the performance and reliability of its products and AI systems. Such data is processed in a form that does not reasonably identify you, your organization, or individual call participants.

You may opt out of this aggregated-data improvement process at any time by submitting a written request to support@takeapitstop.com. Valid opt-out requests will be processed within 30 days. Opt-out applies to data processed after the request takes effect and does not require deletion of data that has already been anonymized and aggregated.

10. Automated Processing and Scoring

The Services use AI to generate coaching feedback, scores, and benchmarks. These Outputs are informational and developmental. Pitstop does not use them to make decisions that produce legal or similarly significant effects about you, and our Terms of Service prohibit client organizations from treating Outputs as the sole or decisive basis for any such decision (for example, dismissal or disciplinary action). Human judgment and professional oversight remain essential.

11. Data Retention

We retain personal data for as long as necessary to provide the Services and fulfill the purposes described in this Policy, unless a longer retention period is required by law.

Specifically:

• Account and contact data is retained for the duration of your relationship with Pitstop and for a period of up to 12 months following account closure, after which it is deleted or anonymized.
• Under Rep Score and Team Score, raw call audio is deleted within 90 days after transcription is completed, unless a shorter period is agreed or configured. Transcripts, coaching reports, and associated scores are retained for the duration of your activation and for 90 days after termination, unless deletion is requested earlier or retention is required by law.
• Role-play sessions and other Practice Content generated through Challenge are retained for the duration of your account and deleted or anonymized within 90 days of account closure, unless you request earlier deletion.
• Under Company Score, retention is set out in the applicable commercial agreement. Clients may request deletion of specific content at any time.
• Usage and platform data is retained for up to 24 months for security and service improvement purposes.
• Marketing and lead data is retained for as long as necessary to respond to your request and for marketing purposes until you unsubscribe or object, after which it is deleted or suppressed from further contact.
• Financial and billing records are retained for the period required under applicable tax and accounting law.

12. Organizational Accounts and Employee Data

Access to performance data depends on which Pitstop product is used:

• Rep Score: Rep Score is contracted directly between Pitstop and the individual Rep. The Rep controls their individual outputs, and by default Rep Score outputs are not visible to the Rep's employer. Pitstop will not share a Rep's individual Rep Score outputs with their employer or any other third party unless the Rep has granted permission.
• Team Score: the client organization may access team-level dashboards, leaderboards, and aggregated benchmarks. Rep-level outputs are shared with the organization's managers only where the relevant Rep has granted permission through the applicable permission flow.
• Company Score: the organization may access company-wide analytics, its configured Company Standard, and individual, team, and company-level scores, as agreed in its commercial agreement and DPA.

Where your employer or organization is the account holder for Team Score or Company Score, it acts as controller for the content it submits and the data it accesses. If you have questions about how your employer processes your data through the Services, you should refer to your employer's own privacy policies and internal data handling practices.

Team Score and Company Score clients may request a Data Processing Agreement (DPA) by contacting support@takeapitstop.com.

13. Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, disclosure, or destruction. These include encryption of data in transit and at rest, access controls, and regular security assessments.

No system is entirely secure. If you become aware of any security vulnerability or incident involving the Services, please notify us immediately at support@takeapitstop.com.

14. Your Rights

Under the GDPR, you have the following rights in relation to your personal data:

• Right of Access: To request a copy of the personal data we hold about you.
• Right to Rectification: To request correction of inaccurate or incomplete data.
• Right to Erasure: To request deletion of your personal data, subject to our legal obligations and legitimate interests.
• Right to Restriction: To request that we restrict processing of your data in certain circumstances.
• Right to Data Portability: To receive your data in a structured, commonly used, machine-readable format.
• Right to Object: To object to processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent: Where processing is based on consent, to withdraw that consent at any time.

To exercise any of these rights, please contact us at support@takeapitstop.com. We will respond within one month of receipt. Where requests are complex or numerous, we may extend this period by a further two months with notice. Where Pitstop processes your data as a processor on behalf of your organization, we may refer your request to your organization as controller and will assist it in responding as required by the DPA.

You also have the right to lodge a complaint with the Irish Data Protection Commission (www.dataprotection.ie) or any other competent supervisory authority.

15. US State Privacy Rights

If you are a resident of a US state with a comprehensive privacy law (including California, Colorado, Connecticut, Texas, Virginia, and others), you may have the right to: access the personal data we hold about you; correct inaccurate data; delete your data; receive a portable copy of your data; and opt out of the "sale" or "sharing" of personal data and of targeted advertising, as those terms are defined under applicable state law.

We do not sell personal data for money. To the extent that the use of advertising cookies (such as the LinkedIn Insight Tag on our marketing website) constitutes "sharing" or targeted advertising under applicable state law, you can opt out at any time by contacting us at support@takeapitstop.com.

To exercise any of these rights, contact us at support@takeapitstop.com. We will verify your request and respond within the timeframe required by applicable law. We will not discriminate against you for exercising your privacy rights. You may use an authorized agent to submit a request on your behalf, subject to verification.

16. Children

The Services are designed for business use and are not directed at anyone under 18. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided us with personal data, please contact us at support@takeapitstop.com and we will delete it.

17. Do-Not-Track and Opt-Out Preference Signals

Some browsers transmit "Do Not Track" (DNT) signals. No uniform standard for responding to DNT signals has been adopted, and we do not currently respond to them. You can manage cookies directly through your browser settings, as described in our Cookie Policy.

18. Cookies and Tracking

We use cookies and similar tracking technologies on our website and platform to support authentication, remember preferences, understand how the Services and our marketing content are used, and measure the performance of our marketing campaigns. You can manage cookie preferences through your browser settings. Certain cookies are necessary for the Services to function and cannot be disabled. See our Cookie Policy for full detail.

19. Changes to This Policy

We may update this Policy from time to time to reflect changes to our practices or applicable law. We will notify you of material changes by posting an updated Policy with a revised date and, where appropriate, by direct notification. Continued use of the Services after changes take effect constitutes acceptance of the updated Policy.

20. Contact

For questions, requests, or concerns regarding this Policy or our data practices, please contact:

PitstopHealth Limited

77 Sydney Parade Avenue, Dublin 4, D04 K0N0, Ireland

Email: support@takeapitstop.com