Privacy Notice

1. This notice

Futures Fundamentals and each of its affiliates (collectively known as 'we', 'us', ‘our’) are committed to safeguarding your personal data.

This Notice is specifically provided for Futures Fundamentals, which is an industry-wide education initiative providing a clear look at the world of derivatives. Futures Fundamentals is a 501(c)(3) organization. Through this platform, we aim to help you learn the intricacies of the derivatives marketplace, including how futures and options participants manage risk and capture opportunities and how futures impact everyday life, from food and gas prices to mortgage rates.

The purpose of this Notice is to explain how we process your personal data so that you understand what we collect, what we do with it, who we disclose it to and the rights available to you. The processing we undertake may include the collection, storage, modification, access, or destruction of personal data, and may be completed manually or through automatic means, including through the use of artificial intelligence (‘AI’) technologies. See Section 19 below for details on how you can contact us. Personal data (also referred to as 'personal information' or 'data') means any information that can be used to identify you, your device, or, if you live in California, your household. This includes direct identifiers such as your name and contact details, but also indirect identifiers such as data that we may collect from the electronic device that you use to access our services.

If you have any questions about this Notice or how we use your data, our details are provided in the 'Contact details' Section below.

2. Who this Notice applies to

This Notice applies to you if you have any of the following relationships with us:

• Communicator – an individual who contacts us either online, by telephone, post or any other method.

• Professional services - an individual providing services such as accounting, auditing, or other specialized professional support to us.

• Supplier – an individual who provides services to us or is employed by a company that provides services to us.

• Web visitor – an individual who visits the Futures Fundamentals website at https://www.futuresfundamentals.org/, any of our social media pages or interacts with us via any third-party websites (e.g., comment on any of our blogs or posts published on a third-party website).

You can find out more about how we use your data via our Cookie Notice.

3. What personal data we collect

We may collect, store, and use the following categories of personal data about you to the extent relevant, necessary and permitted by applicable local laws and depending on the nature of the relationship you have with us:

• Communication records
  Records of any communications between you and us, including via email, telephone, social media, and letter.

• Contact details
  Information that is provided to us so that we can contact you such as your name, title, telephone numbers, and personal email address.

• Device and electronic information
  Details of resource usage or information about your interaction with areas of our network and details we collect from your devices when you access our services, including your IP address, cookies, activity logs related to interactions with our systems, online identifiers, device type, operating system, browser, unique device identifiers and geolocation data.

• Social network information
  Social media account information and personal data collected from social media accounts.

• User preferences and analytics
  Information regarding your stated preferences and relating to your use of our services.

Where we collect your personal data outside of the scope above or for purposes beyond those specified in this Notice, we will communicate this to you.

4. How your data is collected

In addition to any personal data that you provide to us directly, we may also collect and derive data about you through the following means:

• Automated means – for example, when you interact with areas of our website.

• Cookies and similar technologies – when you visit our website, we may employ cookies and similar technologies. See Section 15 below for further details.

• Data analytics – we may infer or derive certain data about you through our analytical processes, including those driven by AI, which are further explained in Section 6 below.

• Third party sources – other organizations, including the one that you may work for, may provide us with access to certain data, as further detailed in Section 5 below.

You may not be required to provide us with certain information requested and the provision of such is voluntary. However, some information is necessary for the purposes described in this Notice. If you fail to provide certain information requested as mandatory, we may not be able to administer our relationship with you, where applicable, or we may be prevented from complying with our legal obligations.

5. Who we may receive your data from and why

We may receive certain data about you from various third parties from time to time, including:

• Electronic devices – including data sourced from any electronic devices (e.g., mobile devices and laptops) used to access our services.

• Social media platforms – such as publicly available information sources from social media pages or via services provided via social media platforms (e.g., LinkedIn, WeChat, Weibo, Facebook, X (formerly Twitter), etc.).

• Third parties in connection with Futures Fundamentals - such as FIA, NFA, the Institute for Financial Markets (IFM), CME Group, and the CME Group Foundation, all of whom are involved with FuturesFundamentals.org.

6. How we use your data

The purposes for which we may process your personal data are as follows to the extent relevant, necessary and permitted by applicable laws.

PROCESSING PURPOSE	CATEGORIES OF DATA & TYPE OF RELATIONSHIP WITH US	LEGAL BASIS FOR PROCESSING (RELEVANT JURISDICTIONS ONLY)
Administration of our organization Managing relationships with our vendors and professional advisors (e.g., paying invoices, managing contracts, and general administration).	Categories of data Contact details Communication records Relationship type Professional services Supplier	Legal requirement Legitimate interest Performance of a contract
Communicating with you Communicating with you as necessary to administer our relationship with you. Providing you with assistance with access to and use of our website. Reviewing and responding to any queries, issues and complaints you may have.	Categories of data Communication records Contact details Device and electronic information Social network information User preferences and analytics Relationship type Communicator Supplier Web visitor	Consent Legal requirement Legitimate interest Performance of a contract
Compliance with laws applicable to us Cooperating fully with state, local, federal, and international legal, governmental and regulatory entities, authorities and officials in any investigation or governmental, legal or regulatory proceeding relating to any information collected or to any purported unlawful activities. Handling your requests in relation to the rights you have regarding your personal data.	Categories of data Contact details Communication records Device and electronic information Relationship type Communicator Professional Services Supplier Web visitor	Legal requirement Legitimate interest
Enforcing and defending our legal rights Cooperating fully with state, local, federal, and international legal, governmental and regulatory entities, authorities and officials in any investigation or governmental, legal or regulatory proceeding relating to any information collected or to any purported unlawful activities. Dealing with legal disputes involving you, the organization and/or other employees, workers, contractors and third parties, including accidents at work and to protect our interests. Defending against legal claims. Enforcing our legal rights. Notifying law enforcement regarding alleged or potential criminal activities.	Categories of data Contact details Communication records Relationship type Communicator Professional Services Supplier Web visitor	Legal requirement Legitimate interest
Improving our website and content Analyzing how you use our website to evaluate whether we can improve them and to assess the performance of our systems. Reviewing and using data and metrics from your interactions with our website to improve and develop products, services, and enterprise technologies. Undertaking market research and satisfaction surveys to help us understand how our products/services can be improved.	Categories of data Communication records Contact details Device and electronic information User preferences and analytics Relationship type Communicator Web visitor	Legitimate interest
Operating and securing our website Maintaining access logs (i.e. application access and authentication, database access and authentication), file integrity logs (e.g., file integrity for internet facing environments), firewall logs (e.g., for external public or internet facing firewalls), network logs (e.g., DNS query, flow data, router/switch logs), security logs (e.g., anti-virus, whitelisting, data loss prevention activity, etc.), and web server logs (e.g. web access logs for internet facing servers). Safeguarding the use of our services to prevent malicious behavior through the monitoring of the use of our services.	Categories of data Communication records Contact details Device and electronic information Relationship type Communicator Supplier Web visitor	Consent Legal requirement Legitimate interest

Additional information

We may de-identify, aggregate or anonymize your personal data in such a way that you may not reasonably be re-identified by us or any other party. We may use such de-identified information as permitted under applicable local law. To the extent we de-identify any personal data and are not required to re-identify it to comply with applicable laws, we will make reasonable efforts to maintain and use such data in a de-identified form and will not attempt to re-identify the data.

If you are located in the People's Republic of China ("PRC"), for the purpose of this Notice, excluding the Hong Kong SAR, the Macau SAR and Taiwan), we process your personal data based on lawful basis permitted under Chinese data privacy laws (and not based on legitimate interests).

7. To whom we may disclose your data and why

We may disclose your data to third parties in connection with Futures Fundamentals, service providers or other third parties for various purposes, to achieve our business objectives, and/or to comply with applicable laws as described in this Section.

• Law enforcement agencies – in relation to the detection and prevention of criminal activities, as permitted by applicable laws.

• Prospective purchasers and assignees – to the extent reasonably necessary to proceed with the consideration, negotiation, or completion of a merger, reorganization, or acquisition of our business, or a sale, liquidation or transfer of some or all our assets, in the event our business, or part of it, may be or is sold or reorganized.

• Governmental authorities – to comply with applicable laws. This may include filing returns with tax authorities.

• Service providers – to assist us in conducting activities related to the operation of our organization and website. Such service providers may include IT or systems maintenance providers, systems or data hosts (like our website host), communications providers, record-keeping companies, accountants, auditors, other professional advisors or other vendors.

• Third parties as required by law – to comply with laws to which we are subject, as permitted by applicable laws. For example, we may share your personal data in response to a court order or subpoena, in response to a valid request from law enforcement or with your future employers where required by law.

• Third parties in connection with Futures Fundamentals – such as FIA, NFA, the Institute for Financial Markets (IFM), CME Group, and the CME Group Foundation, all of whom are involved with FuturesFundamentals.org.

• Third parties for other purposes – to protect our legitimate business interests in protecting our rights; enforcing our Terms of Use; detecting, preventing, or responding to fraud, intellectual property infringement, or other illegal activities; and protecting the safety and security of tangible or intangible property belonging to us or a related third party.

We may also disclose de-identified or aggregated information to anyone and for any purpose permitted under applicable local law. To receive more information about the service providers or third parties to which we may disclose your data, you can contact us through the information provided in the 'Contact details' Section below.

8. International transfers of data

We may process information collected from or about you in any country in which we operate, as permitted by applicable laws.

In some cases, your information may be transferred to, stored, and processed in a country that is not regarded as ensuring an adequate level of protection for information under applicable laws (such as those in the EU/UK/EEA). When we conduct such transfers, we rely on your explicit consent (as required under applicable laws) or ensuring that we have put in place appropriate safeguards (including without limitation signing standard contractual clauses) in accordance with applicable legal requirements. Information located outside of your home country may be subject to access by that country's government or its agencies under a lawful order, as permitted by applicable laws.

We put in place appropriate procedures and safeguards in accordance with applicable legal requirements when conducting such transfers. For more information on the appropriate safeguards in place or to obtain a copy of these safeguards, please contact us through the information provided in the 'Contact details' Section.

People’s Republic of China (“PRC”):

All data, including personal data, as defined under the Personal Information Protection Law of the PRC, provided to us by you will be used, distributed, and maintained in accordance with this Notice, which forms a part of the contractual terms that you agree to. If you, as an institution, are providing us with this data, you confirm that you have obtained all the necessary consents from the relevant data subjects concerned, and your processing, use and transfer of data to us complies with all applicable PRC data privacy laws. If you, as a natural person, are providing us with your personal data, you expressly give us consent to any processing, use or transfer of such data. In each data transfer above, you acknowledge and agree that the data may be transferred outside of the territory of the PRC.

9. Additional information for California residents

This Section provides California residents with additional information regarding our collection, use, disclosure, and retention of their personal data, as well as the rights that California residents may have under applicable law.

Categories of personal data we collect

The chart below describes the categories of personal data we collect from the sources identified above in Sections 3, 4 and 5 of this Notice, as well as the categories of third parties to whom we may disclose, “sell” or “share” (as those terms are defined under California law) each category of personal data for the business and commercial purposes described in Section 6 of this Notice.

Category of personal data	Categories of third parties to whom we may disclose personal data for a business purpose	Categories of third parties to whom we may "sell"1 or "share"1 personal data
Communication records, such as records of any communications between you and us, including via email, telephone, social media, and letter.	Law enforcement agencies Prospective purchasers and assignees Governmental authorities Service providers Third parties as required by law Third parties in connection with Futures Fundamentals Third parties for other purposes	N/A
Contact details, such as information that is provided to us so that we can contact you such as your name, title, telephone numbers, and personal email address	Law enforcement agencies Prospective purchasers and assignees Governmental authorities Service providers Third parties as required by law Third parties in connection with Futures Fundamentals Third parties for other purposes	N/A
Device and electronic information, such as details of resource usage or information about your interaction with areas of our network and details we collect from your devices when you access our services, including your IP address, cookies, activity logs related to interactions with our systems, online identifiers, device type, operating system, browser, unique device identifiers and geolocation data.	Law enforcement agencies Prospective purchasers and assignees Governmental authorities Service providers Third parties as required by law Third parties in connection with Futures Fundamentals Third parties for other purposes	Advertising and analytics partners
Social network information, such as social media account information and personal data collected from social media accounts.	Law enforcement agencies Prospective purchasers and assignees Governmental authorities Service providers Third parties as required by law Third parties in connection with Futures Fundamentals Third parties for other purposes	Advertising and analytics partners
User preferences and analytics, such as your stated preferences and relating to your use of our services.	Law enforcement agencies Prospective purchasers and assignees Governmental authorities Service providers Third parties as required by law Third parties in connection with Futures Fundamentals Third parties for other purposes	Advertising and analytics partners

We may "sell"¹ or "share"¹ your personal data for cross-contextual behavioral advertising. While we do not engage in selling your data as part of a monetary transaction, the Company does engage in the sharing of data through web tracking technologies, like cookies. For more information on these technologies, please refer to our Cookie Notice. We do not have actual knowledge of "selling"¹ or "sharing"¹ the personal data of consumers under the age of 16.

¹ As defined under California law.

Your California Privacy Rights

In addition to certain rights described in Section 10 of this Notice, you may have the following rights under California law:

• Not be discriminated against – not be unlawfully discriminated against for exercising your rights.

• Opt-out – opt-out of “sales” of personal data or “sharing” of personal data for cross-contextual behavioral advertising purposes (as these terms are defined under California law).

Submitting Requests

To exercise your rights to know, access, correct and delete, please review the additional information provided in Section 10 of this Notice. You may also exercise these rights via our Cookies Settings. To exercise your right to opt out of our "sale"¹ or "sharing"¹ of your personal data, please submit a request via email at the address in Section 19, or update your Cookies Settings.

Verification

We may request that you provide sufficient information that allows us to verify, to a reasonable degree of certainty, that you are the person about whom we collected personal data. Authorized agents may also be required to provide a copy of your signed permission authorizing the agent to submit requests on your behalf.

10. Your rights

Subject to local law, you may have the following rights regarding your personal data. These rights may be limited or denied in some circumstances. For example, we may retain your personal data where required or permitted by applicable law.

• Access/Know – request a copy of your personal data and information relating to how it is processed.

• Rectify/Correct – request any inaccuracies in the personal data we hold about you be corrected.

• Erasure/Deletion – request that we erase your personal data from our records.

• Restrict – request that your data is no longer processed by us.

• Object – object to certain ways that we process your personal data.

• Transfer – request that your personal data be disclosed to a third party.

• Withdraw your consent – where we are relying on your consent to process your personal data, then you can withdraw your consent at any time.

• Lodge a complaint – you may be entitled to lodge a complaint with your local data protection authority.

In some jurisdictions, you may also have post-mortem privacy rights. For example, you may have the right to designate an individual to exercise your privacy rights in the event of your death or incapacitation, where applicable by law.

In certain jurisdictions, such as the PRC, you may have the right to opt-out of receiving personalized content and recommendations based on automated processing, including profiling.

Submitting Requests

To exercise your rights to know, access, correct, delete, restrict, object, portability, or withdraw your consent under applicable local law or if you are an authorized agent seeking to exercise rights on behalf of a consumer under applicable local law, please contact us on the details set out in the 'Contact details' Section of this Notice below. You may also exercise your right to withdraw consent for cookies or opt-out of 'sharing' via rights via your Cookies Settings.

Please note that some of your rights are not absolute and there may be certain circumstances where we are unable to fulfill a request that you have made. In some circumstances we may also require that you provide additional personal data to confirm your identity.

11. Automated decisions

Automated decision-making takes place when an electronic system uses personal data to make a decision without human intervention.

We and our affiliates may use automated analytics to identify individuals who would be most interested in our product, which may result in individuals being contacted about our products or services. Decisions that significantly affect individuals will not be made solely by automated means.

12. Use of artificial intelligence

We may use artificial intelligence ('AI') to help process your personal data for the purposes explained in this Notice, including to enhance operational efficiency and improve service functionality.

13. Data security

We use technical, administrative, and physical security safeguards and other reasonable security measures to protect the information that we collect or receive against loss and unauthorized access, use modification, or disclosure. Please be aware that, despite our ongoing efforts, no security measures are perfect or impenetrable. Moreover, we are not responsible for the security of information that you transmit to us over networks that we do not control, including Internet and wireless networks.

14. Data retention

We retain personal data for the duration of the relationship we have with you or where required, in accordance with our internal records management and retention policies, as well as regulatory requirements that may be applicable to us.

To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve these purposes through other means, and the applicable legal requirements.

We make reasonable attempts to ensure that all instances of such information (e.g., production, backups, etc.) are deleted in their entirety, including any of your personal data. For requests for access, corrections, or deletion please see the "Contact Us" Section below.

15. Cookies

Please see our Cookies Notice for further information on how we use cookies and other tracking technologies on our website.

16. Children's data

Our website and services are generally not directed at persons/users under the age of 18. If we obtain actual knowledge that any personal data we collect has been provided by a child under the age of 13, we will promptly delete that information. If you access our website from the EU/UK/EEA or if you access an EU/UK/EEA website, the age limit will be 16. If you access our website from the PRC or if you access a PRC website (if any), the age limit will be 14.

17. Futures Fundamentals as processor or service provider

There may be certain circumstances where we process your personal data as a ‘processor’ and do not use it for our own purposes. For instance, if we provide educational content as part of a joint program with a school, university, or other partner organization, we may process participant data on their behalf to administer the program. In these circumstances, we are acting as a processor or a service provider in relation to the partner organization that is the controller or business responsible for the handling of your personal data, as these terms are used in applicable data protection laws. This Notice will not apply to us as a processor or service provider, and you should instead refer to the privacy notice of the organization that provides us with your personal data.

The above does not apply to us under the applicable PRC data privacy laws, where no distinction between "data controller" and "data processor" is made. You should however still refer to the privacy notice of the organization that provides us with your personal data, where we would be deemed a third-party data processor.

18. Updates to this notice

We may update this Notice from time to time. For instance, there may be changes in the data we collect about you or the purposes for which we use it.

Whenever there are significant changes to the Notice, we will notify you.

19. Contact details

If you have any comments, questions or concerns about how we process your data or to exercise any right, then please contact Privacy Compliance at Privacy@cmegroup.com. We can also be reached by post at below address and via telephone at the below telephone numbers.

ATTN: Privacy Compliance
CME Group Inc.
20 S. Wacker Drive
Chicago, IL 60606

+1 312 930-1000
+1 866 716-7274 (US Only)

Privacy@cmegroup.com

For the purposes of data protection in the EU/UK/EEA, Singapore or India:

This Notice is provided for Futures Fundamentals, a 501(c)(3) organization. Futures Fundamentals and CME Group Inc. are considered joint data controllers for the purposes of processing personal data collected on this domain, with CME Group Inc. primarily responsible for the management and processing of data rights requests.

CME Group has a designated Data Protection Officer registered for a number of CME entities. They can be contacted at Privacy@cmegroup.com.