This Privacy Policy explains how TMF FITUNATE LLC ("we," "us," or "our"), an Illinois limited liability company, collects, uses, shares, and protects information in connection with our website, our workshops, our resource library, our structured audits and business engagements, our newsletter, and every other product, service, and piece of content we make available (collectively, our "Offerings").

By using our website or any of our Offerings, you agree to the practices described in this Privacy Policy. This Privacy Policy is incorporated into our Terms of Use. If you do not agree, please do not use our website or Offerings.

1. Information We Collect

Information you provide directly. We collect information you choose to give us, which may include:

• Contact and account information, such as your name, email address, business name, login credentials for any account you create, and any profile details you provide when you subscribe to our newsletter, download a resource, join an interest list, or register for a workshop.

• Purchase and billing information, such as the Offerings you buy, whether you hold an active Resource Library subscription, your billing cycle, and your billing details. Payment card numbers are collected and processed by our third-party payment processors, and we do not store full card numbers on our own systems.

• Intake and engagement information, if you purchase a structured audit, planning session, or business build engagement. Intake questionnaires and working sessions may involve information about your business structure, collaborations, agreements, and operations, including personal information about business partners, collaborators, or other individuals you identify to us as part of that process. You are responsible for confirming you have the right to share information about other people with us, as described in our Terms of Use. We treat this information as confidential as described in Section 5 and in our Terms of Use.

• Communications, such as emails you send us, survey responses, feedback, and questions you submit for content or workshops.

• Participant content, such as comments, posts, questions, and contributions you share in a live session, comment section, or other interactive space.

Information collected automatically. When you visit our website or interact with our communications, we and our service providers may automatically collect information such as your IP address, device and browser type, operating system, referring pages, pages viewed, links clicked, email open and click activity, and the dates and times of your visits, using cookies, pixels, and similar technologies described in Section 6.

Information from third parties. We may receive information about you from the platforms we use to deliver our Offerings, such as our workshop, scheduling, email, and payment platforms, consistent with their own terms and privacy practices.

Sensitive information. We do not ask for or knowingly collect sensitive information, such as details about race or ethnicity, religious or philosophical beliefs, sexual orientation, health or medical information, genetic or biometric data, or criminal history. If you choose to include this kind of information in a comment, submission, or other content you voluntarily share with us, we treat it the same as any other content you provide, and we do not seek it out or use it to profile you.

2. How We Use Information

We use the information we collect to:

• Provide, operate, and improve our website and Offerings, including delivering workshop access, resource library content, and structured audits and business engagements.

• Process payments, manage billing, and maintain records of transactions.

• Communicate with you, including sending the resources you request, transactional and account messages, newsletters, and marketing communications you can opt out of at any time.

• Personalize and improve your experience and understand how our website, content, and communications are used.

• Deliver, moderate, and record live workshops and interactive spaces as described in our Terms of Use.

• Protect our rights, enforce our Terms of Use, prevent fraud and abuse, and comply with legal obligations.

3. Legal Bases for Processing (EEA and UK)

If you are located in the European Economic Area or the United Kingdom, we process your personal data on the following legal bases: performance of a contract, when we deliver an Offering you have purchased or requested; consent, for marketing communications and non-essential cookies, which you may withdraw at any time; legitimate interests, such as operating, securing, and improving our Offerings and communicating with our audience, balanced against your rights; and legal obligation, where processing is required by law.

4. How We Share Information

We do not sell your personal information, and we do not share it with third parties for their own independent marketing. We share information only as follows:

• Service providers. We share information with third-party platforms and providers that help us deliver our Offerings, including workshop hosting, scheduling, audio hosting, email marketing, analytics, cloud hosting and storage, payment processing, and artificial intelligence and productivity tools that assist us in content creation and service delivery. These providers may access information only as needed to perform services for us. You may request a current list of our primary service providers by emailing the address in Section 15.

• Legal and safety. We may disclose information when we believe in good faith that disclosure is required by law, subpoena, or other legal process, or is necessary to protect our rights, your safety, or the safety of others, to investigate fraud or abuse, or to enforce our Terms of Use.

• Business transfers. If we are involved in a merger, acquisition, financing, reorganization, or sale of all or part of our business, information may be transferred as part of that transaction, subject to this Privacy Policy or an equivalent standard of protection.

• With your direction or consent. We share information in other circumstances when you direct us to or give your consent.

Content you post in a live session, comment section, or other interactive space is visible to other participants as described in our Terms of Use, and this Privacy Policy does not restrict what other participants may do with information you choose to share with them.

5. Structured Audit and Engagement Client Information

If you engage us for a structured audit, planning session, or business build engagement, the non-public business, financial, and operational information you share through intake materials and working sessions is used only to deliver your engagement and for our internal recordkeeping. We do not disclose it to third parties except to our own service providers as needed to deliver the Service, as required by law, or with your permission, and we do not use your name, business name, or engagement details in testimonials, case studies, or marketing without your consent. If a working session is recorded, the recording is treated as confidential business information under this section, retained and protected on the same terms as the rest of your engagement records, and is not used for marketing or promotional purposes without your consent. Where artificial intelligence tools assist us in delivering an engagement, we configure and use those tools under settings or commercial terms designed to exclude your information from being used to train third-party AI models, consistent with these confidentiality commitments and with our Terms of Use.

6. Cookies and Tracking Technologies

Our website and communications use cookies, pixels, and similar technologies, which may include:

• Strictly necessary technologies that make the website function, such as session and security cookies.

• Analytics technologies that help us understand how visitors use our website and content, which pages perform well, and where visitors come from.

• Functional technologies that remember your preferences.

• Email technologies such as open and click tracking in the emails we send.

• Advertising technologies, if and when we run advertising, which may track activity across other websites.

You can control cookies through your browser settings, including blocking or deleting them, though some features of the website may not function properly without them. Where required by law, we present a consent tool for non-essential cookies, and you may change your choices at any time through that tool.

7. Email Communications

If you subscribe to our newsletter, download a resource, join an interest list, or make a purchase, we may send you marketing emails about our Offerings in addition to transactional messages. Every marketing email includes an unsubscribe link, and you may opt out at any time. Opting out of marketing does not stop transactional messages, such as receipts, account notices, and messages necessary to deliver an Offering you purchased.

8. Data Retention

We retain personal information for as long as needed to deliver our Offerings, comply with legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. If you hold a Resource Library subscription, we retain your billing and subscription history for the duration of the subscription and for the period afterward required by our tax and accounting obligations. We retain structured audit and engagement records for as long as reasonably necessary to support the engagement, maintain our own business records, and comply with applicable law. When information is no longer needed, we delete it or de-identify it.

9. Security

We use commercially reasonable administrative, technical, and organizational measures designed to protect personal information, and we rely on reputable third-party platforms with their own security programs for hosting, payments, and delivery. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a breach affecting your personal information, we will notify you and the relevant authorities as required by applicable law.

10. International Transfers

We are based in the United States, and the information we collect is processed in the United States and in other countries where our service providers operate. Those countries may have data protection laws different from the laws of your country. Where required, we rely on appropriate safeguards for international transfers, such as standard contractual clauses adopted by the European Commission or the UK equivalent.

11. Your Privacy Rights

EEA and UK residents. Subject to applicable law, you have the right to access, correct, delete, or receive a portable copy of your personal data, to restrict or object to certain processing, and to withdraw consent at any time without affecting processing that occurred before withdrawal. You also have the right to lodge a complaint with your local supervisory authority or, in the UK, with the Information Commissioner's Office.

California and other US state residents. Depending on your state of residence, you may have the right to know what personal information we collect, use, and disclose, to access and receive a copy of it, to correct inaccuracies, to delete it, and to be free from discrimination for exercising these rights. We do not sell personal information, and we do not share personal information for cross-context behavioral advertising as those terms are defined under the California Consumer Privacy Act as amended by the California Privacy Rights Act. If our practices change, we will update this Privacy Policy and provide any required notices and opt-out mechanisms.

Limits on deletion and other requests. The rights described above are subject to exceptions permitted by applicable law. We may decline or limit a request, including a request to delete your information, where retention is necessary for us to comply with a legal, tax, or accounting obligation, to establish, exercise, or defend a legal claim, to complete a structured audit, planning session, or business build engagement already underway, or to maintain our own business records of the findings, recommendations, and Deliverables provided as part of an engagement.

Exercising your rights. You may exercise any applicable right by emailing the address in Section 15 with the subject line "Privacy Request." We will verify your identity using the email address associated with your records and any additional information reasonably necessary, and we will respond within the time required by applicable law. Where permitted, you may use an authorized agent to submit a request, and we may require proof of the agent's authority. Where not prohibited by law, we may charge a reasonable fee to cover the administrative cost of a request that is excessive, repetitive, or unfounded, and California residents may make a verifiable request of a given type no more than twice within a twelve-month period.

12. Do Not Track and Global Privacy Control

Some browsers offer "Do Not Track" signals and Global Privacy Control (GPC) settings. Where applicable law requires us to honor an opt-out preference signal such as GPC, we honor it for the browser or device from which it is sent.

13. Children

Our website and Offerings are intended for adults and are not directed to anyone under eighteen (18) years of age. We do not knowingly collect personal information from anyone under eighteen. If you believe a person under eighteen has provided us personal information, please contact us and we will delete it.

14. Changes to This Privacy Policy

We may update this Privacy Policy at any time by posting the revised version on our website and updating the "Last Updated" date above. Changes are effective when posted, and material changes will be highlighted through reasonable means, such as a notice on our website or an email. Your continued use of our website or Offerings after a change is posted means you accept the change.

15. Contact

Questions, requests, and complaints regarding this Privacy Policy or your personal information can be sent to support@toniafisher.com or by mail to TMF FITUNATE LLC, PO Box 805732, Chicago, IL 60680.