PRIVACY STATEMENT

Xpedite Systems, Inc. ("Xpedite") recognizes and respects the importance of protecting individuals' privacy. To that end, we have adopted the principles set forth in this Privacy Policy ("Policy") to govern our use and disclosure of individuals' personally identifying information ("Personal Information").

1. Scope: This Policy applies to all Personal Information that Xpedite collects or receives, whether manually or digitally processed.
2. Our Basic Services: Xpedite provides high-volume and value-added electronic mail, facsimile and voice messaging services ("Services") for subscribers located around the globe. Our subscribers retain Xpedite to transmit messages and provide information to their recipients ("Recipients"). In the course of those Services, we are provided by our subscribers with Personal Information relating to their Recipients. In all cases, whether with the basic or value-added Services, we simply act as agent for our subscribers and at their direction. At no time do we do anything other than format or transmit the content of the messages we are asked to send. Our subscriber service agreement requires that our subscribers comply with all applicable personal-data privacy laws in compiling and providing us with the Recipient Personal Information.
3. Our Value-Added Services: Through some of our value-added services, like our messageREACH+^SM service, we may collect Personal Information from Recipients. For example, with messageREACH+, we store attachments to messages provided to us by our subscriber on our server. When the Recipient decides to access the attachment, we are able to report back to our subscriber that this access has taken place. However, at all times we use any Personal Information we receive only for the purposes and at the direction of the subscriber associated with that Personal Information.
4. Our Voice Messaging Service: In addition to facsimile and electronic mail, we also offer voice messaging through our voiceREACH^SM service. With voiceREACH, we dial Recipients whose telephone numbers our subscribers have provided us, in order to deliver pre-recorded messages supplied by our subscribers. Xpedite complies with all applicable laws governing the time and manner of our voiceREACH calls. We also require our subscribers to provide appropriate identifying and contact information at the beginning or end of the message through which the Recipient may contact us to have his or her number removed from the subscriber's list or obtain contact information for the subscriber. Where we collect Personal Information (such as the fact that a call was successfully completed, that a Recipient has requested to receive no further calls or that the Recipient has a new number), we provide it only to the subscriber on whose behalf the call was made.
5. Other Information Collection: You also may provide us with Personal Information when you contact us with a question or concern about this Policy or about our Services. If you choose to provide your Personal Information in this context, we will use it only to respond to your inquiry or otherwise as required by law.
6. Transfer of Personal Information: As noted above, we utilize the Personal Information of Recipients only as directed by our subscribers in the performance of the Services. We do not disclose the Personal Information to third parties except to the specific subscriber with whom the Recipient is associated unless otherwise required by law.
7. Access to Personal Information: Individuals seeking access to their Personal Information that we have received from a subscriber must contact the subscriber directly. Xpedite requires messages to contain the name or contact information of the subscriber on whose behalf the message was sent. We also would be happy to provide that information to any interested Recipient upon request.
8. Security: We utilize reasonable and appropriate protections to ensure that Personal Information in our care is not misused or accessed without authorization. Personal Information is stored on our own servers, with access restricted to those employees or contractors who have a need for such access to perform a legitimate business purpose relating to the Services or to maintenance, internal security or related issues. Moreover, we generate audit logs that record all access and use of Recipients' Personal Information stored in our databases. Any contractor whom we retain to provide services for us and who will have access to Personal Information must agree in writing to abide by the terms of this Policy.
9. Data Integrity: We only use Personal Information that is necessary to perform the Services requested. Occasionally, a subscriber provides us with more Personal Information than is necessary for that purpose (for example, providing us with a name, street address and e-mail address, when only the name and e-mail address are necessary). In those cases, we identify and utilize only those data that are needed. The rest remain secure and unused until destroyed or returned to the subscriber. We also only store Personal Information when specifically requested to do so by a subscriber or as part of our ordinary back-up, archiving process. Archived files are secured as set forth in paragraph 8 above and are destroyed on a regular cycle.
10. Review of Compliance: Xpedite will review its compliance with this Policy on a periodic basis.
11. Acquisition, Merger or Bankruptcy: In the event Xpedite, its parent or any of its affiliates or subsidiaries is acquired by another entity, or merges with a third party, the successor entity will be bound to respect the provisions of this Policy with regard to any Personal Information in its possession prior to the acquisition or merger. In the event of bankruptcy, the provisions of applicable law will apply.
12. Enforcement: Concerns regarding our adherence to this Policy should be raised first with our Privacy Compliance Officer, through the contact information provided below.
13. European Union Safe Harbor Compliance Statement: European data-privacy laws protect Personal Information that is transferred from the European Union to the United States. The U.S. and E.U. have entered into a "Safe Harbor" that allows U.S. entities receiving Personal Information from the E.U. to satisfy those obligations. The provisions of this Policy satisfy the Safe Harbor Principles. Xpedite has certified that compliance with the United States Department of Commerce. Because, as explained above, we simply use the Personal Information provided to us to deliver messages and provide related services for our subscribers, under the Safe Harbor our subscribers remain responsible for that Personal Information with respect to the individuals concerned. Any additional Personal Information we collect as a result of our Services is provided only to the subscriber for whom it is collected. Xpedite's compliance with this Policy is subject to the ultimate authority of the United States Federal Trade Commission, to which complaints that are not adequately resolved through the procedure set forth in paragraph 12 above also may be directed.
14. Corporate Privacy Officer: To contact our Corporate Privacy Officer when indicated by this Policy or to address questions regarding Xpedite's privacy practices, please e-mail [email protected] or call 1-800-966-3297.