Table of Contents:

1. Introduction

2. What Are Tracking Technologies?

3. How Does Drata Use Tracking Technologies?

4. Your Choices

5. Supplemental Information for the EEA, Switzerland, and U.K.

6. Notice Updates

7. English-Version Controls

8. Contact Information

1. Introduction

This Cookie Notice (“Notice”) explains how Drata Inc.  (“Drata,” “us”, “we,” or “our”) collect and use cookies, web beacons, pixels, tags, session replay tools, and other tracking technologies (collectively, “Tracking Technologies”) on our Site. For the purposes of this Notice, the term “Site” refers collectively to www.drata.com, as well as all other websites that Drata operates and which link to this Notice. Capitalized terms that we use but are not defined in the Notice (such as Site, Services, Customer, etc.) have the meaning provided in our Terms of Service - Subscription Agreement (“Agreement”). Scope: This Notice does not apply to in-product cookies in connection with Drata products and Services.  2. What are Tracking Technologies?

• Web cookies: A web cookie is a small text file that is placed on your hard drive by a web page server. Cookies contain information that can later be read by a web server in the domain that issued the cookie to you. Some cookies will only be used if you use certain features or select certain preferences, while other cookies will always be used. You can learn more about each type of cookie by reviewing Section 3 below.

• Pixels, web beacons, and tags: Pixels, web beacons, and tags are types of code or transparent graphics that contain a unique identifier. These technologies provide analytical information about user experience and help us customize our marketing activities. In contrast to cookies, these technologies are embedded invisibly on web pages or in emails.

• Session replay tools (in accordance with applicable law): Session replay tools log your interactions with the Site, such as how you move throughout our Site and engage with our webforms. This information helps us understand your Site experience and identify and fix technical issues visitors may be having with the Site.

3. How Does Drata Use Tracking Technologies?

In general, we use Tracking Technologies to ensure basic functionality of our Sites; remember user preferences (including your preferences regarding Tracking Technologies); to improve the provision of our Services to you; maximize the performance of our Sites; provide you with offers that may be of interest to you; measure the effectiveness of our Sites, marketing campaigns, and email communications; and personalize online content. Specifically, we may use Tracking Technologies for the following purposes:

• Session Usage: We use first-party cookies to hold session information as you navigate from page to page within the Site. For example, we use cookies on our Sites to understand visitor and user preferences, improve your experience, and track and analyze usage, navigational, and other statistical information.

• Site Performance & Effectiveness: We use Tracking Technologies to understand, improve, and research our products, features, and services, including as you navigate through our Sites or when you access our Site from other websites, applications, or devices. We gather this analytics information to determine and measure the performance of advertisements; to understand usage and campaign effectiveness; and to learn whether you have interacted with our Sites, content, or emails (including whether an email has been opened and acted upon). We utilize analytics vendors to help understand how you use our Sites. We may receive reports based on the use of these technologies by our analytics vendors on an individual and aggregated basis. We also use these technologies to provide aggregated information to our marketing and advertising vendors.

• Advertising: We utilize third-party marketing and advertising vendors to display advertising on our Sites and/or to manage our advertising on other websites, in order to suggest advertisements based on your browsing activities and interests. We may also use Tracking Technologies cross-device matching to tailor our Site and offer you a personalized experience across your devices by using the probabilistic and deterministic data we collect to make educated guesses that match you to each device you use. For instance, by matching you to both your mobile device and computer, we can then use Tracking Technologies to save your preferences on both devices and better tailor our marketing and advertisements to you. Additionally, we may use the data we collect through Tracking Technologies and combine it with other data we collect to create a profile about you. We may disclose this profile data to marketing and advertising vendors, including ad networks, so that they can show you advertisements that they think will interest you. Our marketing and advertising vendors may also use this information to recognize you across different channels and platforms (including but not limited to computers, mobile devices, and smart TVs), over time for analytics, attribution, and reporting purposes. If your IP address indicates that you are located outside of the European Union and you do not wish to have this information used for the purpose of serving you interest-based ads, you may opt-out by clicking here and here. Please note this does not opt you out of being served ads and you will continue to receive generic, untargeted ads.

• Security: We use Tracking Technologies to help protect the safety, security, and integrity of our web properties and those who interact with us. This includes to detect, prevent, and respond to security incidents, as well as other malicious, deceptive, fraudulent, or illegal activity.

Categories of Cookies: We may use the following categories of cookies on our Site in order to accomplish the purposes described above:

• Essential Cookies: Essential cookies enable core site functionality. These cookies are necessary for the Site to function and cannot be switched off in our systems. You may set your browser to block or alert you about these cookies, but parts of the website may not function properly.

• Functional Cookies: Functional cookies enable the Site to provide enhanced functionality and personalisation. These cookies may be set by us or by third-party providers whose services we have added to our Site.

• Analytics Cookies: Analytics cookies allow us to count visits and traffic sources so we can measure and improve the performance of our Site. These cookies help us to know which pages are the most and least popular and see how visitors move around the Site.

• Targeting Cookies: Targeting cookies, such as social media cookies, may be set through our Site by our advertising service providers, third-party advertisers, ad networks, or data exchange partners. These cookies may be used to show you relevant advertising on other third-party sites.

Please see Section 4 for more information about how you may exercise choice with respect to web cookies on our Site.

4. Your Choices

a. Managing Cookies at the Browser Level: Please review the below information to understand your options for managing cookies at the browser level depending on your geographic location. You can set your cookie preferences by visiting here.

Individuals located in the EEA, Switzerland, or the U.K.: Please see Section 5 for instructions on how to exercise choice with respect to cookies.

Individuals located outside the EEA, Switzerland, or the U.K.: You may control the use of non-Essential cookies at the individual browser level by visiting the “Cookie Settings” link in our Site footer and selecting which category of cookies described in Section 3 you wish to disable. If you are located in California, you may visit the “Do Not Sell or Share My Personal Information” link in our website footer to disable third-party cookies. Please note that you will need to ensure that each web browser is adjusted to reflect your preferences if you use different computers or mobile devices. If you elect to disable Functional cookies, you may still visit our Site, but your ability to use some features or areas of the Site may be limited.

Additionally, you may generally activate or later deactivate the use of cookies through functionality built into your web browser. To learn more about how to control cookie settings through your browser:

• Click here to learn more about the “Private Browsing” setting and managing cookie settings in Firefox;

• Click here to learn more about “Incognito” and managing cookie settings in Chrome;

• Click here to learn more about “InPrivate” and managing cookie settings in Internet Explorer; or

• Click here and here to learn more about “Private Browsing” and managing cookie settings in Safari.

For further information on how to manage Flash cookies please click here. If you want to learn more about cookies, or how to control, disable or delete them, please visit this link for detailed guidance. In addition, certain third-party advertising networks, such as Google, may permit users to opt out of or customize preferences associated with your internet browsing. To learn more about this Google feature, please click here.

b. Opting Out of Interest-Based Advertising: To opt-out of interest-based advertising by third parties, please see the below resources:

• Individuals located in the United States:

  • Digital Advertising Alliance (DAA) self-regulatory opt-out page

  • Digital Advertising Alliance (DAA) mobile application-based “AppChoices” download page

  • Network Advertising Initiative (NAI) self-regulatory opt-out page

• Individuals located in the EEA, Switzerland, or U.K.:

  • European Interactive Digital Advertising Alliance (EDAA) consumer opt-out page

In the mobile environment, most mobile operating systems offer device-based opt-out choices that are transmitted to companies providing interest-based advertising. To set an opt-out preference for a mobile device identifier (such as Apple’s IDFA or Android’s GAID), please visit the device manufacturer’s current choice instructions pages, or read more about sending signals to limit ad tracking for your operating system here. Please note that these settings must be performed on each device (including each web browser on each device) for which you wish to opt-out, and if you clear your cookies or if you use a different browser or device, you will need to renew your opt-out preferences. 5. Supplemental Information for the EEA, Switzerland, and U.K.

In the event of any conflict or inconsistency between the other parts of this Notice and the terms of this Section 5, Section 5 shall govern and prevail with regard to the processing of EEA, Swiss, and U.K. personal data.

Unless and until you provide your consent, only Essential Cookies will be enabled. Other non-Essential types of cookies and Tracking Technologies on our Site, such as Functional, Analytics, and Targeting Cookies, are only enabled if you provide opt-in consent by using our Site cookie banner. In the “Cookie Settings” link in our Site footer, you can at any time withdraw your consent (with future effect) by clicking on the link and disabling cookies through the toggles, or you can adjust your preferences by utilizing the toggle settings. 6. Notice Updates

If there are any material changes to this Notice, you will be notified on our Site prior to the change becoming effective. We encourage you to periodically review this page for the latest information on the Notice. Your continued use of the Site constitutes your agreement to be bound by such changes to this Notice. Your only remedy, if you do not accept the terms of this Notice, is to discontinue use of and access to the Site, subject to applicable law. You acknowledge that this information may contain inaccuracies or errors and is subject to change, and we expressly exclude liability for any such inaccuracies or errors to the fullest extent permitted by law. 7. English-Version Controls

Non-English translations of this Notice are provided for convenience only. In the event of any ambiguity or conflict between translations, the English version is authoritative and controls. 8. Contact Information

If you have questions or concerns regarding this Notice or about our privacy practices, please contact us by email at [email protected], or at:

Drata Inc. Attn: Privacy Team 4660 La Jolla Village Drive, Suite 100 San Diego, CA 92122 United States

For further information about our privacy practices, please also refer to our online Privacy Notice.