SPIDERROCK BIOMETRIC INFORMATION PRIVACY POLICY

This Biometric Information Privacy Policy (“Policy”) is adopted by SpiderRock Technology Solutions, LLC, on behalf of itself and each of its present and future subsidiaries and affiliates (collectively, “SpiderRock”), effective as of September 15, 2026.

1. Purpose and Scope

SpiderRock is committed to complying with the Illinois Biometric Information Privacy Act, 740 ILCS 14/1 et seq. (“BIPA”). This Policy establishes SpiderRock’s practices for the collection, storage, use, retention, and destruction of biometric identifiers and biometric information, and sets out the retention schedule and destruction guidelines required by 740 ILCS 14/15(a). This Policy applies to biometric identifiers and biometric information SpiderRock collects from employees, contractors, and other individuals in the course of its operations in Illinois.

 

2. Definitions

2.1 “Biometric identifier” means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. It does not include writing samples, written signatures, photographs, human biological samples used for valid scientific testing or screening, demographic data, tattoo descriptions, or physical descriptions such as height, weight, hair color, or eye color, consistent with BIPA’s statutory definition.

2.2 “Biometric information” means any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual.

 

3. Biometric Data SpiderRock Collects

As of the effective date of this Policy, SpiderRock may collect voice recordings and derived voiceprints and/or AI voice models from employees who separately and voluntarily consent to participate in creating AI-generated voiceover content describing the features of SpiderRock’s trading platform. Any such collection is governed by an individual written disclosure and consent/release agreement executed with the participating individual, in addition to this Policy.

 

4. Written Disclosure and Consent Required Before Collection (740 ILCS 14/15(b))

Before collecting any individual’s biometric identifier or biometric information, SpiderRock will: (a) inform the individual in writing that biometric data is being collected or stored; (b) inform the individual in writing of the specific purpose and length of time for which the biometric data will be collected, stored, and used; and (c) obtain a written release, which may be provided by electronic signature, from the individual or the individual’s legally authorized representative.

 

5. Retention Schedule (740 ILCS 14/15(a))

SpiderRock will retain biometric identifiers and biometric information only for as long as reasonably necessary to fulfill the purpose for which it was collected, as stated in the applicable written disclosure and consent, and in no event longer than the earliest of:

  • the date on which the initial purpose for collecting the biometric data has been satisfied (for example, completion of the specific project for which an individual’s voice was recorded);
  • three (3) years after the individual’s last interaction with SpiderRock (including, for an employee or contractor, separation from SpiderRock); or
  • the effective date of a valid revocation of consent by the individual, where revocation is available under the applicable consent agreement.

 

6. Destruction Guidelines

Upon expiration of the retention period described in Section 5, SpiderRock will permanently destroy the biometric identifiers and biometric information in its possession, using a secure deletion method reasonably designed to render the data unrecoverable, including by instructing any third-party vendor holding the data on SpiderRock’s behalf to do the same.

6.1 What Must Be Destroyed. “Biometric identifiers and biometric information” subject to destruction include, without limitation:

    • the original audio Recordings, in every location where a copy exists (local devices, shared drives, email, collaboration tools, and cloud storage);
    • any voiceprint, embedding, or other feature data extracted or derived from the Recordings;
    • Employee-specific training data, fine-tuning artifacts, or model checkpoints created to build or adapt an AI Voice Model on that individual’s voice;
    • copies held by any third-party vendor or service provider processing the data on Company’s behalf; and
    • associated metadata that identifies the individual (for example, file names, transcripts, or labels tying a recording or voiceprint to a specific person).

Finished Voiceover Content that has already been publicly released is addressed separately in the applicable individual consent agreement and is not, by itself, “biometric information” requiring destruction under this Section, unless it embeds a recoverable voiceprint or model file.

6.2 Destruction Method. Standard operating-system deletion (e.g., moving a file to a recycle bin) does not by itself satisfy “permanently destroy.” Company will use one or more of the following, as appropriate to where the data is stored:

    • secure/permanent deletion tools or processes for on-premises and endpoint storage that overwrite or otherwise render the data unrecoverable, not simply hidden from ordinary view;
    • cryptographic erasure for encrypted data at rest (destroying the encryption key so the underlying ciphertext is permanently unreadable), where supported by the storage platform;
    • use of the applicable cloud or SaaS provider’s “hard delete” or permanent-deletion function, followed by confirmation that the provider’s own backup/retention cycle has purged the data (cloud platforms often retain “deleted” data in backups for a defined window — that window should be tracked and closed out, not assumed);
    • physical destruction (e.g., degaussing or shredding) of any physical media that cannot be securely wiped; and
    • for any third-party vendor (including an AI voiceover-generation vendor): a written deletion request, and a written or system-generated confirmation from the vendor that the data was deleted from its production systems and backups within the timeframe required by Company’s vendor agreement.

6.3 AI Voice Model Handling. Because a trained AI Voice Model does not store an individual’s voice data as a separately deletable file, “destruction” of Employee-specific data embedded in a model is handled as follows: (a) Company will immediately stop using the AI Voice Model to generate any new Synthetic Voice Output upon the retention trigger described in Section 5; (b) Company will delete the individual-specific model checkpoint, fine-tuning weights, or voice-cloning profile associated with that individual; and (c) where the individual’s voice data cannot practicably be isolated and removed from a shared or base model without retraining, Company will decommission and delete that model version entirely rather than continue to rely on techniques (such as partial “machine unlearning”) that are not presently reliable enough to treat as equivalent to destruction.

6.4 Timing. Destruction will be completed promptly, and in any event within ninety (90) days, after the applicable retention trigger in Section 5, except to the extent a litigation hold, regulatory inquiry, or other legal obligation requires Company to preserve the data longer, in which case destruction will occur promptly once that obligation ends.

6.5 Recordkeeping. For each destruction event, Company will document the individual (or category) whose data was destroyed, the date of destruction, the data destroyed, the method used, and, where a vendor was involved, the vendor’s confirmation of deletion. These records will be retained for five (5) years to demonstrate compliance with this Policy.

6.6 Responsible Party. SpiderRock Chief Compliance Officer, together with IT/Information Security, is responsible for tracking each individual’s retention period, triggering the destruction process on schedule, and confirming and documenting completion.

7. No Sale or Profit (740 ILCS 14/15(c))

SpiderRock will not sell, lease, trade, or otherwise profit from any individual’s biometric identifier or biometric information.

 

8. Restrictions on Disclosure (740 ILCS 14/15(d))

SpiderRock will not disclose, redisclose, or otherwise disseminate an individual’s biometric identifier or biometric information unless:

  • the individual consents to the disclosure;
  • the disclosure completes a financial transaction requested or authorized by the individual;
  • the disclosure is required by state or federal law or municipal ordinance; or
  • the disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction. Any third-party vendor engaged to process biometric data on SpiderRock’s behalf will be contractually bound to use, retention, and disclosure restrictions consistent with this Policy and the applicable individual consent.

 

9. Data Security (740 ILCS 14/15(e))

SpiderRock will store, transmit, and protect from disclosure all biometric identifiers and biometric information using the reasonable standard of care within SpiderRock’s industry, and in a manner that is the same as or more protective than the manner in which SpiderRock stores, transmits, and protects other confidential and sensitive information.

 

10. Individual Inquiries

An individual with questions about this Policy, or requests concerning their own biometric data, may contact SpiderRock at legal@spiderrock.net.

 

11. Availability of This Policy

Consistent with 740 ILCS 14/15(a), this Policy is made available to the public at SpiderRock’s website – www.spiderrock.net and upon request directed to legal@spiderrock.net.

 

12. Relationship to Individual Consent Agreements

This Policy describes SpiderRock’s general retention schedule, destruction practices, and related BIPA obligations. It supplements, and does not replace, any individual written disclosure and consent or release agreement SpiderRock obtains from a specific individual before collecting that individual’s biometric identifiers or biometric information (for example, a Voice Recording, Biometric Information, and AI Voice Replica Consent and Release Agreement). Where an individual agreement states a shorter or more specific retention period or purpose, that agreement controls for that individual’s data, subject to the outer limits of this Policy.

 

13. Policy Administration; Amendment

SpiderRock may review and update this Policy from time to time; the version then made publicly available under Section 11 is the operative version.

 

14. Effective Date

This Policy is effective as of September 15, 2026