Table of Contents - Updated June 30, 2024

About This Policy

Hunt Companies, Inc. and its subsidiaries and affiliates that principally operate within the real estate, infrastructure, and financial services spaces in the United States (collectively, “we,” “our,” or “the Company”) recognize and respect that privacy is important to you. We created this Privacy Policy to help you understand how our business units collect Personal Information, what types of Personal Information we collect, how we use it, the steps we take to safeguard it, and the choices you have regarding how it may be used and disclosed. By “Personal Information,” we mean information about you that identifies, describes, or is reasonably capable of being associated with you or your household.

This Privacy Policy outlines our practices with respect to the use and handling of Personal Information collected from users who access certain websites owned and/or operated by the Company (collectively, “Site” or “Sites”), or who share Personal Information with us by other means (collectively, “Users”). If you have arrived at this Privacy Policy through one of our businesses’ Sites, then this Privacy Policy governs your use of the Site, any current or future mobile application (the “Mobile Application”), all interactive features, applications, widgets, social networks and social network “tabs”, and other online or wireless offerings that post a link to this Privacy Policy (collectively, the “Services” and, together with the Sites and the Mobile Application, the “System”).

When we refer to “you,” or “your,” we mean Users and persons accessing this Privacy Policy. If the person accessing this Privacy Policy through a Site acts on behalf of, or for the purposes of, another person, including a business or other organization, “you” or “your” also means that other person, including a business organization.

When you use one or more of the Sites, you consent to the collection, storage, use, disclosure, and other uses of your Personal Information as described in this Privacy Policy. Capitalized terms used herein without definition shall have the meanings given such terms in our Terms of Use.

We encourage you to carefully read this Privacy Policy and use it to make informed decisions. In the event that you have any questions or concerns about this Privacy Policy or our uses of your Personal Information, please contact us at privacy@huntcompanies.com.

Note that if you are an investor or potential investor in one of our funds, you may also receive separate notices regarding our privacy practices concerning non-public Personal Information that we collect from you as an investor in us or in any funds that we sponsor or manage. The privacy practices contained in those notices to investors or potential investors are summarized below.

What Information Do We Collect?

The following is a description of (1) the categories of Personal Information we may have collected in the preceding 12 months; (2) the sources from which we may have collected it; (3) the business purposes for which we may have collected it; and (4) with whom we share the personal information we collect.

  1. Personal Information That You Provide to Us Directly.
    We collect from you directly Personal Information, which identifies, relates, describes, or is reasonably capable of being associated with, a particular individual or household. We may collect Personal Information from you when you:
    • Voluntarily provide us your personal details in order to register on our Site;
    • Open an investment management account with us;
    • Apply for a loan with us;
    • Enter into an agreement with us or request other financial services; and
    • Submit an application for housing.

    Although not all are applicable to each User or a Site, the categories of Personal Information that we may collect include:
    • Client login or Site registration information: We collect information from you (or about you) when you provide it to us directly. When you register on our Site or fill out a contact form, you will be asked to provide us certain details such as: full name; email or physical address; telephone number; site registration username and password; occupation and in some cases, salary, social security number, driver’s license information, and other information.
    • Financial services information: We may collect the following from you: name, mailing address, email address, phone number, date of birth, social security number or tax identification number; driver’s license or state identification information; passport information; salary range and net worth; financial account information; and certain “bad actor” disqualification and disclosure information, and tax status. For institutional investors, we may also collect the individual’s title and position with their company.
    • Housing application information: If you complete an application for housing, you may also be asked to provide us with information such as your name, physical address, date of birth, mailing address, telephone number, email address, social security number; driver’s license, passport information, military ID or state identification information; vehicle registration; marital status; criminal history; dependent verification; financial account information, credit report; military service records; photo ID; military orders and employment information, including pay level and employment history.

  2. Information Collected Through Your Use Of The Site.

    IP Address

    We also collect Personal Information from your device when you access the Site, including:
    • Geolocation data;
    • IP address;
    • Unique identifiers (e.g., MAC address and UUID); and
    • Other information which relates to your activity through the Site.

    Cookies
    We and our service providers use cookies and other technologies in our related services, including when you visit our Site or access our services. A “cookie” is a small piece of information that a website assigns to your device while you are viewing a website. Cookies are very helpful and can be used for various different purposes. These purposes include allowing you to navigate between pages efficiently, enable automatic activation of certain features, remembering your preferences, and making the interaction between you and our Services quicker and easier.

    Cookies do not contain any information that personally identifies you. Nevertheless, you may remove the cookies by following the instructions of your device preferences. However, if you choose to disable cookies, some features of our Site may not operate properly, and your online experience may be limited. For more information on how to modify your browser settings or how to block, manage, or filter cookies can be found in your browser’s help file or through such sites as: www.allaboutcookies.org.

    Analytics Information
    We may also use a third-party tool called “Google Analytics” to collect information about your use of the Site. Google Analytics collects information such as how often users access the Site, what pages they visit when they do so, etc. We use the information we get from Google Analytics only to improve our Site and services. Google Analytics collects the IP address assigned to you on the date you visit sites, rather than your name or other identifying information. We do not combine the information collected through the use of Google Analytics with personally identifiable information. Google’s ability to use and share information collected by Google Analytics about your visits to this Site is restricted by the Google Analytics Terms of Use and the Google Privacy Policy.

    For more information on Google Analytics cookies, visit www.google.com/policies. According to its own policy, Google does not collect any personal data with this process. Nevertheless, to opt-out of being tracked by Google Analytics across all websites, visit http://tools.google.com/dlpage/gaoptout. This will allow you to download and install a Google Analytics cookie-free web browser.

  3. Information Provided To Us By Others.
    We may receive your Personal Information from third parties that you ask to share your information with us.

Generally speaking, we may collect two types of data and information:

Personal Information: The first type is personal information that identifies, relates to, describes, or is reasonably capable of being associated with a particular individual or a household. Although not all of the following are applicable to each User, the categories and types of Personal Information that we may collect either online or off-line include:

Non-personal Information: The second type is non-personal information that is un-identified and non-identifiable information pertaining to Users that may be made available or gathered by your use of the Site. Non-personal Information may include your aggregated usage information and technical information transmitted by your device, including certain software and hardware information (e.g., the type of browser and operating system your device uses, language preference, access time, etc.) in order to enhance the functionality of our Site. We may also collect information on your activity on the Site (e.g., pages viewed, clicks, actions, etc.). We do not know the identity of a User from which Non-personal Information is collected.

How Do We Use Your Personal Information?

We may use Personal Information that we collect from or about you for any of the following business purposes:

We will not use Sensitive Personal Information that we collect from or about you for any other business purpose other than described above.

What Personal Information Do We Share And Why?

We do not sell, disclose, or share our Users’ Personal Information with any third parties for their own use, and have not done so for the preceding 12 months.

We will not use disclose, share, or transfer your Personal Information with or to any other person or entity, except as follows:

Corporate Transaction

In the event of a sale, assignment, or transfer of our assets or of any portion of our business, we reserve the right to transfer any and all information that we collect from individuals, or that we otherwise collect in connection with the Site, to unaffiliated third-party purchasers.

Job Applicants

Any Personal Information you provide us, such as identifiers or employment history, when applying for a career position with the Company will be used solely to consider and act upon your application. We may retain your Personal Information for a period of time, but only for as long as necessary for such purposes, please see Data Retention and Rectification section below. We may disclose your Personal Information to our service providers for the purpose of evaluating your qualifications for the particular position you applied for, or other available positions.

Company Promotional Correspondence

We may use your Personal Information, such as your name, email address, telephone number, etc. ourselves or through our service providers for the purpose of providing you with promotional materials concerning our products or services that we believe may interest you. We provided within such marketing materials a means by which to decline receiving further promotional materials from us. If you unsubscribe from these materials, we will remove your email address or telephone number from our marketing distribution lists.

How Can I Opt-Out Of Receiving Promotional Correspondence?

You may receive emails from the Company for a variety of other reasons. If you have an account with the Company on the Site, you can select your preferences through your account settings. You can also manage your receipt of certain types of communication by following the instructions included in the email we send you. Alternatively, you may contact us at privacy@huntcompanies.com with the word “UNSUBSCRIBE” or “REMOVE” in the subject line. Your email address will be removed from our marketing list. Please allow us a reasonable period of time in order to satisfy your request. Please note that, even if you unsubscribe from certain email correspondences, we may still need to email you with important transactional or administrative information.

Accessing, Reviewing, And Changing Your Personal Information

If you have an account on the Site, you can see, review, and change most of your Personal Information by logging into your account on the Site and editing your Account Profile or by contacting us at the addresses in "How To Contact Us." NOTE: California, Colorado, Connecticut, Montana, Oregon, Texas, Utah and Virginia Residents who wish to make a consumer rights request related to their data should follow the instructions in the sections specific to their state in this Policy, below.

Data Retention And Rectification

We will retain your Personal Information for as long as necessary to provide our services, comply with our legal obligations, resolve disputes, and enforce our policies, as outlined in the below Retention Schedule. Retention periods will be determined taking into account the type of information that is collected and the purpose for which it is collected, bearing in mind the requirements applicable to the situation and the need to destroy outdated, unused information at the earliest reasonable time. Under applicable regulations, we will keep records containing client personal data, account opening documents, communications, and anything else as required by applicable laws and regulations. We may rectify, replenish, or remove incomplete or inaccurate information, at any time and at our own discretion.

Personal Information Collected Retention Period
Device Information (e.g., IP addresses, geolocation data, unique identifiers) 2 years
Housing Application Information and supporting data from client 10 years
Low income housing tenant application and related documentation Permanent
Financial Services Information 5 years
Client Login and Site Registration 5 years
Job Applications for hired employees 10 years
Job Applications for non-hires 5 years

Our Privacy Policy only addresses the use and disclosure of Personal Information we collect from or about you. This Privacy Policy does not apply to any website owned and/or operated by or on behalf of any third party, even if we provide a link to such website on one of our Sites. To the extent you disclose your information to other parties or sites throughout the internet, different rules may apply to their use or disclosure of the information you disclose to them. Accordingly, we encourage you to read the Terms and Conditions and Privacy Policy of each third party that you choose to disclose information to.

Social Media Platforms and Websites

Anything that you submit to any of our pages contained on a social media platform or website by email, posting, messaging, uploading, downloading, or otherwise is done at your own risk and without any expectation of privacy. We cannot control the actions of other users of a social media platform, and we are therefore not responsible for any submissions contained on a social media platform or website. By visiting any of our pages that are contained on any social media platform or website, you are representing and warranting to us that you have reviewed the applicable Privacy Policy and Terms of Use of such website or social media platform, and that you will abide by all such provisions contained therein.

How Do We Safeguard Your Information?

We take great care in implementing and maintaining the security of the Site and your information. We employ industry standard procedures and policies to ensure the safety of the information we collect and retain, and prevent unauthorized use of any such information, and we require any service provider to comply with similar security requirements, in accordance with this Privacy Policy. We restrict access to non-public information about you to those employees who need to know that information to provide products and services to our clients, our tenants, and our funds and their investors. Although we take reasonable steps to safeguard information, we cannot be responsible for the acts of those who gain unauthorized access or abuse our Site, and we make no warranty, express, implied, or otherwise, that we will prevent such access.

Minors And Children

We understand the importance of protecting children’s privacy, especially in an online environment. The Site is not designed for or directed at children. You must be at least eighteen (18) years of age to use our Site and the Company’s services. If you are not at least 18 years of age, please do not provide any Personal Information through this Site. Under no circumstances shall we allow the use of our services by minors without prior consent or authorization by a parent or legal guardian. We do not knowingly collect Personal Information from minors or children. If a parent or guardian becomes aware that his or her child has provided us with Personal Information without their consent, he or she should contact us, below.

Updates Or Amendments To This Privacy Policy

We reserve the right to periodically amend or revise the Privacy Policy; material changes will be effective immediately upon the display of the revised Privacy Policy. The latest revision will be reflected by the “Last Updated” date first shown above. Your continued use of the Site, following the notification of such amendments on our website, constitutes your acknowledgment and consent of such amendments to the Privacy Policy, and your agreement to be bound by the terms of such amendments.

How To Contact Us

If you have any general questions about the Site or the information we collect about you and how we use it, you can contact us at privacy@huntcompanies.com, at 1-866-566-9438, or at the following address:

Hunt Companies, Inc.
Attention: Chief Compliance Officer
1330 Avenue of the Americas 28th Floor
New York, NY 10019
USA

FUND INVESTORS: GLBA Notice To Investors Regarding Privacy Of Financial Information

Pursuant to the Gramm-Leach-Bliley Act (“GLBA”), Pub. L. No. 106-102, the rule issued by the Securities and Exchange Commission regarding the Privacy of Consumer Financial Information (Regulation S-P) 17 C.F.R. Part 248, and/or the rule issued by the Federal Trade Commission regarding the Privacy of Consumer Financial Information, 16 C.F.R. Part 313, institutions that provide certain financial products or services to individuals to be used for personal, family, or household purposes are required to provide written notices to their customers regarding disclosure of nonpublic personal information. This notice is being provided to you to comply with this requirement.

We understand that it is our obligation to maintain the confidentiality of non-public personal information with regard to our investors. As a consequence, we do not disclose any non-public personal information about our investors or former investors to anyone other than our affiliates and service providers, except as permitted by law. Affiliates are companies related by common ownership or control and can be financial or nonfinancial companies. Service providers include businesses such as our attorneys, accountants, and entities that assist us with the distribution of stock to our investors.

Furthermore, consistent with industry practice, we will continue to distribute certain non-public personal information, such as the schedule of investors to the fund agreement and capital account information for all investors in each specific fund, to any regulatory authority having jurisdiction over us or any of our funds; or in connection with any litigation or other dispute or otherwise as necessary or appropriate to enforce the terms of our agreements with you.

In order to accurately and efficiently conduct the fund’s investment program, we must collect and maintain certain non-public personal information about you and the fund’s other investors and former investors. We collect, and may disclose to our affiliates and service providers (e.g., our attorneys, accountants, and entities that assist us with the distribution of stock to our investors) on a “need to know” basis, certain non-public personal information about you from the following sources:

To the extent authorized by law, we also may disclose non-public personal information to other nonaffiliated companies for our everyday business purposes, such as to process transactions, maintain accounts, respond to court orders and legal investigations, or report to credit bureaus.

We restrict access to non-public personal information about you to those employees who need to know that information to provide services to the fund and its investors. We maintain physical, electronic, and procedural safeguards to guard your non-public personal information. In addition, we will continue to assess new technology for protecting information with regard to our investors. If we have your consent and it has not been revoked, we may also share your non-public personal information with entities other than our affiliates and service providers. We will provide notice of our GLBA Privacy Policy annually, as long as you maintain an investment with us. This policy may change from time to time, but you can always review our current policy by contacting us for a copy. To make such a request, please send an email to privacy@huntcompanies.com or call 1-866-566-9438.

CALIFORNIA RESIDENTS: Shine The Light Law

The State of California enacted the Shine the Light law (CA Civil Code § 1798.83) that permits customers who are California residents to request certain information regarding our disclosure of personal information during the past year for marketing purposes. To make such a request, please send an email to privacy@huntcompanies.com or call 1-866-566-9438.

CALIFORNIA RESIDENTS: Summary Of Rights Under The California Consumer Privacy Act ("CCPA")

A. Overview

The California Consumer Privacy Act of 2018, Cal. Civ. Code §1798.100 et seq., (“CCPA”) took effect on January 1, 2020 and grants new privacy rights to California consumers. The California Privacy Rights Act of 2020 (“CPRA”), is a California ballot proposition that voters approved, which expands and builds on the CCPA and went into effect on January 1, 2023. Together, the CCPA and the CPRA provide California consumer rights, including:

A business subject to the CCPA that collects a California consumer’s Personal Information must, at or before the point of collection, inform the consumer as to the categories of Personal Information to be collected and the purposes for which the categories of Personal Information shall be used.

A covered business must disclose and deliver the Personal Information the business collected about the consumer in response to a verifiable consumer request

For purposes of the CCPA, “Personal Information” does not include:

A further summary of consumer rights provided by the CCPA follows.

B. Right to Know.

A business subject to the CCPA must disclose in its Privacy Policy the Personal Information about consumers that the business has collected, sold, or disclosed for a business purpose in the past 12 months.

A business that collects Personal Information must also disclose, in response to a verifiable consumer request, the following:

A business that sells or shares a consumer’s Personal Information or discloses a consumer’s Personal Information for a business purpose must disclose the following in response to a verifiable consumer request:

C. Right to Correct Inaccurate Personal Information.

California consumers have the right to request that a business that maintains inaccurate Personal Information about the consumer correct that inaccurate Personal Information, considering the nature of the Personal Information and the purposes of the processing of the Personal Information. A business must use commercially reasonable efforts to correct inaccurate Personal Information as directed by the consumer.

D. Right to Deletion.

You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our Service Providers to delete) your Personal Information from our records, unless an exception applies.

However, the CCPA provides for certain exceptions to the Right to Deletion. We may deny your deletion request if retaining the information is necessary for us or our Service Providers to:

  1. Complete the transaction for which we collected the Personal Information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you;
  2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;
  3. Debug products to identify and repair errors that impair existing intended functionality;
  4. Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law;
  5. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.);
  6. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement if you previously provided informed consent;
  7. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;
  8. Comply with a legal obligation; and/or
  9. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

E. Right to Portability.

California consumers may obtain a copy of their Personal Information that the consumer previously provided to a business in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another business without hinderance.

F. Right to Non-Discrimination.

A business must not discriminate against a consumer who exercises any of the consumer’s rights under the CCPA. However, a business may charge different prices or provide a different quality of goods or services if the difference is reasonably related to the value provided to the consumer by the consumer’s data and may offer financial incentives to a consumer for the collection, sale, or deletion of Personal Information on a prior opt-in consent basis.

G. Right to Opt-Out.

If a business sells consumers' Personal Information to third parties, then the business needs to provide notice to consumers thereof and that consumers have the right to opt out of the sale of their Personal Information. Such a business must provide a “Do Not Sell My Personal Information” link on its Internet homepage that links to an Internet webpage that enables a consumer to opt out of the sale of the consumer’s Personal Information.

A business must not sell the Personal Information of consumers if the business has actual knowledge that the consumer is less than 16 years of age, unless the consumer, in the case of consumers between 13 and 16 years of age, or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale of the consumer's Personal Information.

H. Right to Limit Use and Disclosure of Sensitive Personal Information.

You have the right to limit the Company’s use and disclosure of sensitive Personal Information to that which is necessary for providing products or services to you. You can click on the link titled “Limit the Use of My Sensitive Personal Information” which will take you to a page that enables you to limit the use of sensitive Personal Information to only that which is essential for providing goods or services.

Sensitive Personal Information includes any private information that divulges any of the following:

Publicly available information is not sensitive Personal Information under the CCPA.

I. Privacy Policy Requirements.

A business must describe in its online privacy policy or in any California-specific description of consumer privacy rights the following, which must be updated at least once every 12 months:

CALIFORNIA RESIDENTS: How To Make A CCPA Consumer Rights Request.

A. Instructions for Submitting a CCPA Consumer Rights Request to Us.

If you wish to exercise any of the CCPA consumer rights summarized above, such as a Request to Know or a Request to Delete Personal Information, you can do so in one of the following ways:

Upon receiving a verifiable Request to Know or a Request to Delete, we will confirm receipt of the request within ten (10) business days and provide some information about how we will verify and handle the request, and by when you should expect to receive a response.

Please note that you may only make a verifiable consumer Request to Know or Request to Access your data under the CCPA two times within any 12-month period.

B. Verification of the Person Making a Consumer Rights Request.

Of course, we need to be reasonably sure that the person making the request is actually you! So, we may need some information from you to verify that you are the person whose Personal Information you are asking to know about or to delete. Accordingly, the verifiable consumer request must:

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request. Requests to delete or to know specific household Personal Information will not be granted unless each member of the household is verified.

C. Designating An Authorized Agent to Make a Request for You.

Only you or a person registered with the California Secretary of State that you designate and authorize to act on your behalf, may make a verifiable consumer request related to your Personal Information. For your protection, we will need some proof that someone seeking to act on your behalf is actually authorized by you to do so. You may also make a verifiable consumer request on behalf of your minor child.

D. Response Timing and Format.

We will try to respond to a verifiable consumer request within forty-five (45) calendar days of its receipt. If we need more time (up to a total of 90 calendar days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt.

If you are making a Request to Delete your Personal Information, we may re-confirm with you that you really want your information deleted after verifying your request.

If we cannot respond to or comply with your Request to Know or Request to Delete, for instance, because we cannot verify your identity or because an exception applies, we will explain the reasons we cannot comply with your request. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

COLORADO RESIDENTS: Summary Of Rights Under the Colorado Privacy Act (“CPA”)

A. Overview

The Colorado Privacy Act, Colo. Rev. Stat. §6‐1‐1301 et seq. ("CPA") took effect on July 1, 2023, and grants new privacy rights to Colorado consumers, including:

A covered business must disclose and deliver the Personal Information the business collected about the consumer in response to a verifiable consumer request.

For purposes of the CPA, “Personal Information” does not include:

A further summary of consumer rights provided by the CPA follows.

B. Right to Access

Colorado consumers have the right to (1) confirm whether a business is processing the consumer’s personal data and (2) access such data. See below for additional information on how to submit a request to access your Personal Information.

C. Right to Correct Inaccurate Personal Information

Colorado consumers have the right to request that a business that maintains inaccurate personal information about the consumer correct that inaccurate personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information. A business must use commercially reasonable efforts to correct inaccurate personal information as directed by the consumer.

D. Right to Deletion

You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our Service Providers to delete) your Personal Information from our records, unless an exception applies.

However, the CPA provides for certain exceptions to the Right to Deletion. We may deny your deletion request if retaining the information is necessary for us or our Service Providers to:

  1. To comply with federal, state, or local laws, rules, or regulations.
  2. To investigate, establish, exercise, prepare for, or defend legal claims.
  3. Cooperate with law-enforcement agencies concerning conduct or activity that we reasonably and in good faith believe may violate federal, state, or local laws, rules, or regulations.
  4. Provide a product or service specifically requested by a consumer, perform a contract to which the consumer is a party, including fulfilling the terms of a written warranty, or take steps at the request of the consumer prior to entering into a contract.
  5. Take immediate steps to protect an interest that is essential for the life or physical safety of the consumer or another natural person, and where the processing cannot be manifestly based on another legal basis.
  6. Prevent, detect, protect against, or respond to security incidents, identify theft, fraud, harassment, malicious or deceptive activities, or any illegal activity; preserve the integrity or security of systems; or investigate, report or prosecute those responsible for any such action.
  7. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement if you previously provided informed consent.
  8. Debug products to identify and repair errors that impair existing intended functionality.
  9. Effectuate a product recall.
  10. Conduct internal research, develop, or improve or repair products, services, or technology.
  11. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.

E. Right to Portability

Colorado consumers may obtain a copy of their Personal Information that the consumer previously provided to a business in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another business without hinderance.

F. Right to Non-Discrimination

A business must not discriminate against a consumer who exercises any of the consumer's rights under the CPA. However, a business may charge different prices or provide a different quality of goods or services if the difference is reasonably related to the value provided to the consumer by the consumer's data and may offer financial incentives to a consumer for the collection, sale, or deletion of Personal Information on a prior opt-in consent basis.

G. Right to Opt-Out

Colorado consumers have a right to opt-out of the processing of their Personal Information for purposes of (1) targeted advertising, (2) the sale of Personal Information, and (3) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. A business that sells consumers' Personal Information to third parties needs to provide notice to consumers thereof and those consumers have the right to opt out of the sale of their Personal Information. A business must provide a "Do Not Sell My Personal Information" link on its Internet homepage that links to an Internet webpage that enables a consumer to opt out of the sale or sharing of the consumer's Personal Information.

H. Right to Appeal

Under the CPA, consumers have the right to appeal the Company’s decision to refuse to take action on a consumer request. A consumer must submit an appeal within a reasonable timeframe following receipt of the decision to refuse to process the consumer request. The Company will respond in writing to the consumer within 60 days of receipt of an appeal explaining any action taken or not taken in response to the appeal and an explanation for the decision.

To appeal the Company’s decision, submit a request to:

I. Right to Limit Use and Disclosure of Sensitive Personal Information

You have the right to limit the Company’s use and disclosure of sensitive personal information to that which is necessary for providing products or services to you. The Company cannot process sensitive personal information without your consent.

Sensitive personal information includes any private information that divulges any of the following:

Publicly available information is not sensitive personal information under the CPA.

J. Privacy Policy Requirements

A business must describe in its online privacy policy or in any Colorado-specific description of consumer privacy rights the following;

COLORADO RESIDENTS: How To Make A CPA Consumer Rights Request

A. Instructions for Submitting a CPA Consumer Rights Request to Us

If you wish to exercise any of the CPA consumer rights summarized above, such as a Request to Know or a Request to Delete Personal Information, you can do so in one of the following ways:

Upon receiving a verifiable Request to Know or a Request to Delete, we will confirm receipt of the request within ten (10) business days and provide some information about how we will verify and handle the request, and by when you should expect to receive a response.

Please note that you may only make a verifiable consumer request under the CPA two times within any 12-month period.

B. Verification Of the Person Making a Consumer Rights Request

Of course, we need to be reasonably sure that the person making the request is actually you! So, we may need some information from you to verify that you are the person whose Personal Information you are asking to know about or to delete. Accordingly, the verifiable consumer request must:

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request. Requests to delete or to know specific household Personal Information will not be granted unless each member of the household is verified.

C. Response Timing and Format

We will try to respond to a verifiable consumer request within forty-five (45) calendar days of its receipt. If we need more time (up to a total of 90 calendar days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt.

If you are making a Request to Delete your Personal Information, we may re-confirm with you that you really want your information deleted after verifying your request.

If we cannot respond to or comply with your Request to Know or Request to Delete, for instance, because we cannot verify your identity or because an exception applies, we will explain the reasons we cannot comply with your request. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

CONNECTICUT RESIDENTS: Summary Of Rights Under the Connecticut Data Privacy Act (“CTDPA”)

A. Overview

The Connecticut Data Privacy Act, Senate Bill 6 (“CTDPA)” took effect on July 1, 2023, and grants new privacy rights to Connecticut consumers, including:

A covered business must disclose and deliver the Personal Information the business collected about the consumer in response to a verifiable consumer request.

For purposes of the CTDPA, “Personal Information” does not include:

A further summary of consumer rights provided by the CTDPA follows.

B. Right to Access

Connecticut consumers have the right to (1) confirm whether a business is processing the consumer’s personal data and (2) access such data. See below for additional information on how to submit a request to access your Personal Information.

C. Right to Correct Inaccurate Personal Information

Connecticut residents have the right to request that a business that maintains inaccurate personal information about the consumer correct that inaccurate personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information. A business must use commercially reasonable efforts to correct inaccurate personal information as directed by the consumer.

D. Right to Deletion

You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our Service Providers to delete) your Personal Information from our records, unless an exception applies.

However, the CTDPA provides for certain exceptions to the Right to Deletion. We may deny your deletion request if retaining the information is necessary for us or our Service Providers to:

  1. To comply with federal, state, or local laws, rules, or regulations.
  2. To investigate, establish, exercise, prepare for, or defend legal claims.
  3. Cooperate with law-enforcement agencies concerning conduct or activity that we reasonably and in good faith believe may violate federal, state, or local laws, rules, or regulations.
  4. Provide a product or service specifically requested by a consumer, perform a contract to which the consumer is a party, including fulfilling the terms of a written warranty, or take steps at the request of the consumer prior to entering into a contract.
  5. Take immediate steps to protect an interest that is essential for the life or physical safety of the consumer or another natural person, and where the processing cannot be manifestly based on another legal basis.
  6. Prevent, detect, protect against, or respond to security incidents, identify theft, fraud, harassment, malicious or deceptive activities, or any illegal activity; preserve the integrity or security of systems; or investigate, report or prosecute those responsible for any such action.
  7. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement if you previously provided informed consent.
  8. Debug products to identify and repair errors that impair existing intended functionality.
  9. Effectuate a product recall.
  10. Conduct internal research, develop, or improve or repair products, services, or technology.
  11. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
  12. Maintain evidentiary privilege.

E. Right to Portability

Connecticut consumers may obtain a copy of their Personal Information that the consumer previously provided to a business in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another business without hinderance.

F. Right to Non-Discrimination

A business must not discriminate against a consumer who exercises any of the consumer's rights under the CTDPA. However, a business may charge different prices or provide a different quality of goods or services if the difference is reasonably related to the value provided to the consumer by the consumer's data and may offer financial incentives to a consumer for the collection, sale, or deletion of Personal Information on a prior opt-in consent basis. This consent may be revoked at any time.

G. Right to Opt-Out

Connecticut consumers have a right to opt-out of the processing of their Personal Information for purposes of (1) targeted advertising, (2) the sale of Personal Information, and (3) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. A business that sells consumers' Personal Information to third parties needs to provide notice to consumers thereof and those consumers have the right to opt out of the sale of their Personal Information. A business must provide a "Do Not Sell My Personal Information" link on its Internet homepage that links to an Internet webpage that enables a consumer to opt out of the sale or sharing of the consumer's Personal Information.

H. Right to Appeal

Under the CTDPA, consumers have the right to appeal the Company’s decision to refuse to take action on a consumer request. A consumer must submit an appeal within a reasonable timeframe following receipt of the decision to refuse to process the consumer request. The Company will respond in writing to the consumer within 60 days of receipt of an appeal explaining any action taken or not taken in response to the appeal and an explanation for the decision.

To appeal the Company’s decision, submit a request to:

I. Right to Limit Use and Disclosure of Sensitive Personal Information

You have the right to limit the Company’s use and disclosure of sensitive personal information to that which is necessary for providing products or services to you. The Company cannot process sensitive personal information without your consent. You may revoke your consent at any time.

Sensitive personal information includes any private information that divulges any of the following:

Publicly available information is not sensitive personal information under the CTDPA.

J. Privacy Policy Requirements

A business must describe in its online privacy policy or in any Connecticut-specific description of consumer privacy rights the following;

CONNECTICUT RESIDENTS: How To Make A CTDPA Consumer Rights Request

A. Instructions for Submitting a CPA Consumer Rights Request to Us

If you wish to exercise any of the CPA consumer rights summarized above, such as a Request to Know or a Request to Delete Personal Information, you can do so in one of the following ways:

Upon receiving a verifiable Request to Know or a Request to Delete, we will confirm receipt of the request within ten (10) business days and provide some information about how we will verify and handle the request, and by when you should expect to receive a response.

Please note that you may only make a verifiable consumer request under the CTDPA two times within any 12-month period..

B. Verification Of the Person Making a Consumer Rights Request

Of course, we need to be reasonably sure that the person making the request is actually you! So, we may need some information from you to verify that you are the person whose Personal Information you are asking to know about or to delete. Accordingly, the verifiable consumer request must:

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request. Requests to delete or to know specific household Personal Information will not be granted unless each member of the household is verified.

C. Response Timing and Format

We will try to respond to a verifiable consumer request within forty-five (45) calendar days of its receipt. If we need more time (up to a total of 90 calendar days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt.

If you are making a Request to Delete your Personal Information, we may re-confirm with you that you really want your information deleted after verifying your request.

If we cannot respond to or comply with your Request to Know or Request to Delete, for instance, because we cannot verify your identity or because an exception applies, we will explain the reasons we cannot comply with your request. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

MONTANA RESIDENTS: Summary Of Rights Under the Montana Consumer Data Privacy Act (“MTCDPA”)

A. Overview

The Montana Consumer Data Privacy Act, Senate Bill 384 (“MTCDPA)” will take effect on October 1, 2024, and grants new privacy rights to Montana consumers, including:

A covered business must disclose and deliver the Personal Information the business collected about the consumer in response to a verifiable consumer request.

For purposes of the MTCDPA, “Personal Information” does not include:

A further summary of consumer rights provided by the MTCDPA follows.

B. Right to Access

Montana consumers right to (1) confirm whether a business is processing the consumer’s personal data and (2) access such data. See below for additional information on how to submit a request to access your Personal Information.

C. Right to Correct Inaccurate Personal Information

Montana residents have the right to request that a business that maintains inaccurate personal information about the consumer correct that inaccurate personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information. A business must use commercially reasonable efforts to correct inaccurate personal information as directed by the consumer.

D. Right to Deletion

You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our Service Providers to delete) your Personal Information from our records, unless an exception applies.

However, the MTCDPA provides for certain exceptions to the Right to Deletion. We may deny your deletion request if retaining the information is necessary for us or our Service Providers to:

  1. To comply with federal, state, or local laws, rules, or regulations.
  2. To investigate, establish, exercise, prepare for, or defend legal claims.
  3. Cooperate with law-enforcement agencies concerning conduct or activity that we reasonably and in good faith believe may violate federal, state, or local laws, rules, or regulations.
  4. Provide a product or service specifically requested by a consumer, perform a contract to which the consumer is a party, including fulfilling the terms of a written warranty, or take steps at the request of the consumer prior to entering into a contract.
  5. Take immediate steps to protect an interest that is essential for the life or physical safety of the consumer or another natural person, and where the processing cannot be manifestly based on another legal basis.
  6. Prevent, detect, protect against, or respond to security incidents, identify theft, fraud, harassment, malicious or deceptive activities, or any illegal activity; preserve the integrity or security of systems; or investigate, report or prosecute those responsible for any such action.
  7. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement if you previously provided informed consent.
  8. Debug products to identify and repair errors that impair existing intended functionality.
  9. Effectuate a product recall.
  10. Conduct internal research, develop, or improve or repair products, services, or technology.
  11. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
  12. Maintain evidentiary privilege.

E. Right to Portability

Montana consumers may obtain a copy of their Personal Information that the consumer previously provided to a business in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another business without hinderance.

F. Right to Non-Discrimination

A business must not discriminate against a consumer who exercises any of the consumer's rights under the MTCDPA. However, a business may charge different prices or provide a different quality of goods or services if the difference is reasonably related to the value provided to the consumer by the consumer's data and may offer financial incentives to a consumer for the collection, sale, or deletion of Personal Information on a prior opt-in consent basis. This consent may be revoked at any time.

G. Right to Opt-Out

Montana consumers have a right to opt-out of the processing of their Personal Information for purposes of (1) targeted advertising, (2) the sale of Personal Information, and (3) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. A business that sells consumers' Personal Information to third parties needs to provide notice to consumers thereof and those consumers have the right to opt out of the sale of their Personal Information. A business must provide a "Do Not Sell My Personal Information" link on its Internet homepage that links to an Internet webpage that enables a consumer to opt out of the sale or sharing of the consumer's Personal Information.

H. Right to Appeal

Under the MTCDPA, consumers have the right to appeal the Company’s decision to refuse to take action on a consumer request. A consumer must submit an appeal within a reasonable timeframe following receipt of the decision to refuse to process the consumer request. The Company will respond in writing to the consumer within 60 days of receipt of an appeal explaining any action taken or not taken in response to the appeal and an explanation for the decision.

To appeal the Company’s decision, submit a request to:

I. Right to Limit Use and Disclosure of Sensitive Personal Information

You have the right to limit the Company’s use and disclosure of sensitive personal information to that which is necessary for providing products or services to you. The Company cannot process sensitive personal information without your consent. You may revoke your consent at any time.

Sensitive personal information includes any private information that divulges any of the following:

Publicly available information is not sensitive personal information under the MTCDPA.

J. Privacy Policy Requirements

A business must describe in its online privacy policy or in any Montana-specific description of consumer privacy rights the following;

MONTANA RESIDENTS: How To Make A MTCDPA Consumer Rights Request

A. Instructions for Submitting a CPA Consumer Rights Request to Us

If you wish to exercise any of the MTCDPA consumer rights summarized above, such as a Request to Know or a Request to Delete Personal Information, you can do so in one of the following ways:

Upon receiving a verifiable Request to Know or a Request to Delete, we will confirm receipt of the request within ten (10) business days and provide some information about how we will verify and handle the request, and by when you should expect to receive a response.

Please note that you may only make a verifiable consumer request under the MTCDPA two times within any 12-month period.

B. Verification Of the Person Making a Consumer Rights Request

Of course, we need to be reasonably sure that the person making the request is actually you! So, we may need some information from you to verify that you are the person whose Personal Information you are asking to know about or to delete. Accordingly, the verifiable consumer request must:

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request. Requests to delete or to know specific household Personal Information will not be granted unless each member of the household is verified.

C. Response Timing and Format

We will try to respond to a verifiable consumer request within forty-five (45) calendar days of its receipt. If we need more time (up to a total of 90 calendar days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt.

If you are making a Request to Delete your Personal Information, we may re-confirm with you that you really want your information deleted after verifying your request.

If we cannot respond to or comply with your Request to Know or Request to Delete, for instance, because we cannot verify your identity or because an exception applies, we will explain the reasons we cannot comply with your request. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

OREGON RESIDENTS: Summary Of Rights Under the Oregon Consumer Privacy Act (“OCPA”)

A. Overview

The Oregon Consumer Privacy Act, Senate Bill 619 ("OCPA") will take effect on July 1, 2024, and grants new privacy rights to Oregon consumers, including:

A covered business must disclose and deliver the Personal Information the business collected about the consumer in response to a verifiable consumer request.

For purposes of the OCPA, “Personal Information” does not include:

A further summary of consumer rights provided by the OCPA follows.

B. Right to Access

Oregon consumers have the right to (1) confirm whether a business is processing the consumer’s personal data and (2) access such data. See below for additional information on how to submit a request to access your Personal Information.

C. Right to Correct Inaccurate Personal Information

Oregon residents have the right to request that a business that maintains inaccurate personal information about the consumer correct that inaccurate personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information. A business must use commercially reasonable efforts to correct inaccurate personal information as directed by the consumer.

D. Right to Deletion

You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our Service Providers to delete) your Personal Information from our records, unless an exception applies.

However, the OCPA provides for certain exceptions to the Right to Deletion. We may deny your deletion request if retaining the information is necessary for us or our Service Providers to:

  1. To comply with federal, state, or local laws, rules, or regulations.
  2. To investigate, establish, exercise, prepare for, or defend legal claims.
  3. Cooperate with law-enforcement agencies concerning conduct or activity that we reasonably and in good faith believe may violate federal, state, or local laws, rules, or regulations.
  4. Provide a product or service specifically requested by a consumer, perform a contract to which the consumer is a party, including fulfilling the terms of a written warranty, or take steps at the request of the consumer prior to entering into a contract.
  5. Take immediate steps to protect an interest that is essential for the life or physical safety of the consumer or another natural person, and where the processing cannot be manifestly based on another legal basis.
  6. Prevent, detect, protect against, or respond to security incidents, identify theft, fraud, harassment, malicious or deceptive activities, or any illegal activity; preserve the integrity or security of systems; or investigate, report or prosecute those responsible for any such action.
  7. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement if you previously provided informed consent.
  8. Debug products to identify and repair errors that impair existing intended functionality.
  9. Effectuate a product recall.
  10. Conduct internal research, develop, or improve or repair products, services, or technology.
  11. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
  12. Maintain evidentiary privilege.

E. Right to Portability

Oregon consumers may obtain a copy of their Personal Information that the consumer previously provided to a business in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another business without hinderance.

F. Right to Non-Discrimination

A business must not discriminate against a consumer who exercises any of the consumer's rights under the OCPA. However, a business may charge different prices or provide a different quality of goods or services if the difference is reasonably related to the value provided to the consumer by the consumer's data and may offer financial incentives to a consumer for the collection, sale, or deletion of Personal Information on a prior opt-in consent basis. This consent may be revoked at any time.

G. Right to Opt-Out

Oregon consumers have a right to opt-out of the processing of their Personal Information for purposes of (1) targeted advertising, (2) the sale of Personal Information, and (3) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. A business that sells consumers' Personal Information to third parties needs to provide notice to consumers thereof and those consumers have the right to opt out of the sale of their Personal Information. A business must provide a "Do Not Sell My Personal Information" link on its Internet homepage that links to an Internet webpage that enables a consumer to opt out of the sale or sharing of the consumer's Personal Information.

H. Right to Appeal

Under the OCPA, consumers have the right to appeal the Company’s decision to refuse to take action on a consumer request. A consumer must submit an appeal within a reasonable timeframe following receipt of the decision to refuse to process the consumer request. The Company will respond in writing to the consumer within 60 days of receipt of an appeal explaining any action taken or not taken in response to the appeal and an explanation for the decision.

To appeal the Company’s decision, submit a request to:

I. Right to Limit Use and Disclosure of Sensitive Personal Information

You have the right to limit the Company’s use and disclosure of sensitive personal information to that which is necessary for providing products or services to you. The Company cannot process sensitive personal information without your consent. You may revoke your consent at any time.

Sensitive personal information includes any private information that divulges any of the following:

Publicly available information is not sensitive personal information under the OCPA.

J. Privacy Policy Requirements

A business must describe in its online privacy policy or in any Oregon-specific description of consumer privacy rights the following;

OREGON RESIDENTS: How To Make A OCPA Consumer Rights Request

A. Instructions for Submitting an OCPA Consumer Rights Request to Us

If you wish to exercise any of the OCPA consumer rights summarized above, such as a Request to Know or a Request to Delete Personal Information, you can do so in one of the following ways:

Upon receiving a verifiable Request to Know or a Request to Delete, we will confirm receipt of the request within ten (10) business days and provide some information about how we will verify and handle the request, and by when you should expect to receive a response.

Please note that you may only make a verifiable consumer request under the OCPA two times within any 12-month period.

B. Verification Of the Person Making a Consumer Rights Request

Of course, we need to be reasonably sure that the person making the request is actually you! So, we may need some information from you to verify that you are the person whose Personal Information you are asking to know about or to delete. Accordingly, the verifiable consumer request must:

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request. Requests to delete or to know specific household Personal Information will not be granted unless each member of the household is verified.

C. Response Timing and Format

We will try to respond to a verifiable consumer request within forty-five (45) calendar days of its receipt. If we need more time (up to a total of 90 calendar days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt.

If you are making a Request to Delete your Personal Information, we may re-confirm with you that you really want your information deleted after verifying your request.

If we cannot respond to or comply with your Request to Know or Request to Delete, for instance, because we cannot verify your identity or because an exception applies, we will explain the reasons we cannot comply with your request. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

TEXAS RESIDENTS: Summary Of Rights Under the Texas Data Privacy and Security Act (“TDPSA”)

A. Overview

The Texas Data Privacy and Security Act ("TDPSA") took effect on July 1, 2024, and grants new privacy rights to Texas consumers, including:

A covered business must disclose and deliver the Personal Information the business collected about the consumer in response to a verifiable consumer request.

For purposes of the TDPSA, “Personal Information” does not include:

A further summary of consumer rights provided by the TDPSA follows.

B. Right to Access

Texas consumers have the right to (1) confirm whether a business is processing the consumer’s personal data and (2) access such data. See below for additional information on how to submit a request to access your Personal Information.

C. Right to Correct Inaccurate Personal Information

Texas residents have the right to request that a business that maintains inaccurate personal information about the consumer correct that inaccurate personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information. A business must use commercially reasonable efforts to correct inaccurate personal information as directed by the consumer.

D. Right to Deletion

You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our Service Providers to delete) your Personal Information from our records, unless an exception applies.

However, the TDPSA provides for certain exceptions to the Right to Deletion. We may deny your deletion request if retaining the information is necessary for us or our Service Providers to:

  1. To comply with federal, state, or local laws, rules, or regulations.
  2. To investigate, establish, exercise, prepare for, or defend legal claims.
  3. Cooperate with law-enforcement agencies concerning conduct or activity that we reasonably and in good faith believe may violate federal, state, or local laws, rules, or regulations.
  4. Provide a product or service specifically requested by a consumer, perform a contract to which the consumer is a party, including fulfilling the terms of a written warranty, or take steps at the request of the consumer prior to entering into a contract.
  5. Take immediate steps to protect an interest that is essential for the life or physical safety of the consumer or another natural person, and where the processing cannot be manifestly based on another legal basis.
  6. Prevent, detect, protect against, or respond to security incidents, identify theft, fraud, harassment, malicious or deceptive activities, or any illegal activity; preserve the integrity or security of systems; or investigate, report or prosecute those responsible for any such action.
  7. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement if you previously provided informed consent.
  8. Debug products to identify and repair errors that impair existing intended functionality.
  9. Effectuate a product recall.
  10. Conduct internal research, develop, or improve or repair products, services, or technology.
  11. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.

Additionally, the statutory requirements imposed on a controller or processor under the TDPSA do not apply if compliance would require violating an evidentiary privilege under Texas law or the disclosure of a trade secret, or "adversely affect [] the rights or freedoms of any person, including the right of free speech."

E. Right to Portability

Texas consumers may obtain a copy of their Personal Information that the consumer previously provided to a business in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another business without hinderance.

F. Right to Non-Discrimination

A business must not discriminate against a consumer who exercises any of the consumer's rights under the TDPSA. However, a business may charge different prices or provide a different quality of goods or services if the difference is reasonably related to the value provided to the consumer by the consumer's data and may offer financial incentives to a consumer for the collection, sale, or deletion of Personal Information on a prior opt-in consent basis.

G. Right to Opt-Out

Texas consumers have a right to opt-out of the processing of their Personal Information for purposes of (1) targeted advertising, (2) the sale of Personal Information, and (3) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. A business that sells consumers' Personal Information to third parties needs to provide notice to consumers thereof and those consumers have the right to opt out of the sale of their Personal Information. A business must provide a "Do Not Sell My Personal Information" link on its Internet homepage that links to an Internet webpage that enables a consumer to opt out of the sale or sharing of the consumer's Personal Information.

H. Right to Appeal

Under the TDPSA, consumers have the right to appeal the Company’s decision to refuse to take action on a consumer request. A consumer must submit an appeal within a reasonable timeframe following receipt of the decision to refuse to process the consumer request. The Company will respond in writing to the consumer within 60 days of receipt of an appeal explaining any action taken or not taken in response to the appeal and an explanation for the decision.

To appeal the Company’s decision, submit a request to:

I. Right to Limit Use and Disclosure of Sensitive Personal Information

You have the right to limit the Company’s use and disclosure of sensitive personal information to that which is necessary for providing products or services to you. The Company cannot process sensitive personal information without your consent. You may revoke your consent at any time.

Sensitive personal information includes any private information that divulges any of the following:

Publicly available information is not sensitive personal information under the TDPSA.

J. Privacy Policy Requirements

A business must describe in its online privacy policy or in any Texas-specific description of consumer privacy rights the following;

TEXAS RESIDENTS: How To Make A TDPSA Consumer Rights Request

A. Instructions for Submitting an TDPSA Consumer Rights Request to Us

If you wish to exercise any of the TDPSA consumer rights summarized above, such as a Request to Know or a Request to Delete Personal Information, you can do so in one of the following ways:

Upon receiving a verifiable Request to Know or a Request to Delete, we will confirm receipt of the request within ten (10) business days and provide some information about how we will verify and handle the request, and by when you should expect to receive a response.

Please note that you may only make a verifiable consumer request under the TDPSA two times within any 12-month period.

B. Verification Of the Person Making a Consumer Rights Request

Of course, we need to be reasonably sure that the person making the request is actually you! So, we may need some information from you to verify that you are the person whose Personal Information you are asking to know about or to delete. Accordingly, the verifiable consumer request must:

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request. Requests to delete or to know specific household Personal Information will not be granted unless each member of the household is verified.

C. Response Timing and Format

We will try to respond to a verifiable consumer request within forty-five (45) calendar days of its receipt. If we need more time (up to a total of 90 calendar days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt.

If you are making a Request to Delete your Personal Information, we may re-confirm with you that you really want your information deleted after verifying your request.

If we cannot respond to or comply with your Request to Know or Request to Delete, for instance, because we cannot verify your identity or because an exception applies, we will explain the reasons we cannot comply with your request. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

UTAH RESIDENTS: Summary Of Rights Under the Utah Consumer Privacy Act (“UCPA”)

A. Overview

The Utah Consumer Privacy Act, Utah Code Ann. §13-2-1, et seq. (“UCPA)” took effect on December 31, 2023, and grants new privacy rights to Utah consumers, including:

A covered business must disclose and deliver the Personal Information the business collected about the consumer in response to a verifiable consumer request.

For purposes of the UCPA, “Personal Information” does not include:

A further summary of consumer rights provided by the UCPA follows.

B. Right to Access

Utah consumers have the right to (1) confirm whether a business is processing the consumer’s personal data and (2) access such data. See below for additional information on how to submit a request to access your Personal Information.

C. Right to Deletion

You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our Service Providers to delete) your Personal Information from our records, unless an exception applies.

However, the UCPA provides for certain exceptions to the Right to Deletion. We may deny your deletion request if retaining the information is necessary for us or our Service Providers to:

  1. To comply with federal, state, or local laws, rules, or regulations.
  2. To investigate, establish, exercise, prepare for, or defend legal claims.
  3. Cooperate with law-enforcement agencies concerning conduct or activity that we reasonably and in good faith believe may violate federal, state, or local laws, rules, or regulations.
  4. Provide a product or service specifically requested by a consumer, perform a contract to which the consumer is a party, including fulfilling the terms of a written warranty, or take steps at the request of the consumer prior to entering into a contract.
  5. Take immediate steps to protect an interest that is essential for the life or physical safety of the consumer or another natural person, and where the processing cannot be manifestly based on another legal basis.
  6. Prevent, detect, protect against, or respond to security incidents, identify theft, fraud, harassment, malicious or deceptive activities, or any illegal activity; preserve the integrity or security of systems; or investigate, report or prosecute those responsible for any such action.
  7. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement if you previously provided informed consent.
  8. Debug products to identify and repair errors that impair existing intended functionality.
  9. Effectuate a product recall.
  10. Conduct internal research, develop, or improve or repair products, services, or technology.
  11. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.

D. Right to Portability

Utah consumers may obtain a copy of their Personal Information that the consumer previously provided to a business in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another business without hinderance.

E. Right to Non-Discrimination

A business must not discriminate against a consumer who exercises any of the consumer's rights under the UCPA. However, a business may charge different prices or provide a different quality of goods or services if the difference is reasonably related to the value provided to the consumer by the consumer's data and may offer financial incentives to a consumer for the collection, sale, or deletion of Personal Information on a prior opt-in consent basis.

F. Right to Opt-Out

Utah consumers have a right to opt-out of the processing of their Personal Information for purposes of (1) targeted advertising, (2) the sale of Personal Information, and (3) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. A business that sells consumers' Personal Information to third parties needs to provide notice to consumers thereof and those consumers have the right to opt out of the sale of their Personal Information. A business must provide a "Do Not Sell My Personal Information" link on its Internet homepage that links to an Internet webpage that enables a consumer to opt out of the sale or sharing of the consumer's Personal Information.

G. Right to Appeal

Under the UCPA, consumers have the right to appeal the Company’s decision to refuse to take action on a consumer request. A consumer must submit an appeal within a reasonable timeframe following receipt of the decision to refuse to process the consumer request. The Company will respond in writing to the consumer within 60 days of receipt of an appeal explaining any action taken or not taken in response to the appeal and an explanation for the decision.

To appeal the Company’s decision, submit a request to:

H. Right to Limit Use and Disclosure of Sensitive Personal Information

You have the right to limit the Company’s use and disclosure of sensitive personal information to that which is necessary for providing products or services to you. The Company cannot process sensitive personal information without your consent. You may revoke your consent at any time.

Sensitive personal information includes any private information that divulges any of the following:

Publicly available information is not sensitive personal information under the UCPA.

I. Privacy Policy Requirements

A business must describe in its online privacy policy or in any Utah-specific description of consumer privacy rights the following;

UTAH RESIDENTS: How To Make A UCPA Consumer Rights Request

A. Instructions for Submitting an UCPA Consumer Rights Request to Us

If you wish to exercise any of the UCPA consumer rights summarized above, such as a Request to Know or a Request to Delete Personal Information, you can do so in one of the following ways:

Upon receiving a verifiable Request to Know or a Request to Delete, we will confirm receipt of the request within ten (10) business days and provide some information about how we will verify and handle the request, and by when you should expect to receive a response.

Please note that you may only make a verifiable consumer request under the TDPSA two times within any 12-month period.

B. Verification Of the Person Making a Consumer Rights Request

Of course, we need to be reasonably sure that the person making the request is actually you! So, we may need some information from you to verify that you are the person whose Personal Information you are asking to know about or to delete. Accordingly, the verifiable consumer request must:

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request. Requests to delete or to know specific household Personal Information will not be granted unless each member of the household is verified.

C. Response Timing and Format

We will try to respond to a verifiable consumer request within forty-five (45) calendar days of its receipt. If we need more time (up to a total of 90 calendar days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt.

If you are making a Request to Delete your Personal Information, we may re-confirm with you that you really want your information deleted after verifying your request.

If we cannot respond to or comply with your Request to Know or Request to Delete, for instance, because we cannot verify your identity or because an exception applies, we will explain the reasons we cannot comply with your request. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

VIRGINIA RESIDENTS: Summary Of Rights Under the Virginia Consumer Data Protection Act (“VDCPA”)

A. Overview

The Virginia Consumer Data Protection Act, Va. Code §59.1-575, et seq. ("VCDPA") took effect on January 1, 2023, and grants new privacy rights to Virginia consumers, including:

A covered business must disclose and deliver the Personal Information the business collected about the consumer in response to a verifiable consumer request.

For purposes of the VCDPA, “Personal Information” does not include:

A further summary of consumer rights provided by the VCDPA follows.

B. Right to Access

Virginia consumers have the right to (1) confirm whether a business is processing the consumer’s personal data and (2) access such data. See below for additional information on how to submit a request to access your Personal Information.

C. Right to Correct Inaccurate Personal Information

Virginia residents have the right to request that a business that maintains inaccurate personal information about the consumer correct that inaccurate personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information. A business must use commercially reasonable efforts to correct inaccurate personal information as directed by the consumer.

D. Right to Deletion

You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our Service Providers to delete) your Personal Information from our records, unless an exception applies.

However, the VCDPA provides for certain exceptions to the Right to Deletion. We may deny your deletion request if retaining the information is necessary for us or our Service Providers to:

  1. To comply with federal, state, or local laws, rules, or regulations.
  2. To investigate, establish, exercise, prepare for, or defend legal claims.
  3. Cooperate with law-enforcement agencies concerning conduct or activity that we reasonably and in good faith believe may violate federal, state, or local laws, rules, or regulations.
  4. Provide a product or service specifically requested by a consumer, perform a contract to which the consumer is a party, including fulfilling the terms of a written warranty, or take steps at the request of the consumer prior to entering into a contract.
  5. Take immediate steps to protect an interest that is essential for the life or physical safety of the consumer or another natural person, and where the processing cannot be manifestly based on another legal basis.
  6. Prevent, detect, protect against, or respond to security incidents, identify theft, fraud, harassment, malicious or deceptive activities, or any illegal activity; preserve the integrity or security of systems; or investigate, report or prosecute those responsible for any such action.
  7. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement if you previously provided informed consent.
  8. Debug products to identify and repair errors that impair existing intended functionality.
  9. Effectuate a product recall.
  10. Conduct internal research, develop, or improve or repair products, services, or technology.
  11. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.

E. Right to Portability

Virginia consumers may obtain a copy of their Personal Information that the consumer previously provided to a business in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another business without hinderance.

F. Right to Non-Discrimination

A business must not discriminate against a consumer who exercises any of the consumer's rights under the VCDPA. However, a business may charge different prices or provide a different quality of goods or services if the difference is reasonably related to the value provided to the consumer by the consumer's data and may offer financial incentives to a consumer for the collection, sale, or deletion of Personal Information on a prior opt-in consent basis.

G. Right to Opt-Out

Virginia consumers have a right to opt-out of the processing of their Personal Information for purposes of (1) targeted advertising, (2) the sale of Personal Information, and (3) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. A business that sells consumers' Personal Information to third parties needs to provide notice to consumers thereof and those consumers have the right to opt out of the sale of their Personal Information. A business must provide a "Do Not Sell My Personal Information" link on its Internet homepage that links to an Internet webpage that enables a consumer to opt out of the sale or sharing of the consumer's Personal Information.

H. Right to Appeal

Under the VCDPA, consumers have the right to appeal the Company’s decision to refuse to take action on a consumer request. A consumer must submit an appeal within a reasonable timeframe following receipt of the decision to refuse to process the consumer request. The Company will respond in writing to the consumer within 60 days of receipt of an appeal explaining any action taken or not taken in response to the appeal and an explanation for the decision.

To appeal the Company’s decision, submit a request to:

I. Right to Limit Use and Disclosure of Sensitive Personal Information

You have the right to limit the Company’s use and disclosure of sensitive personal information to that which is necessary for providing products or services to you. The Company cannot process sensitive personal information without your consent. You may revoke your consent at any time.

Sensitive personal information includes any private information that divulges any of the following:

Publicly available information is not sensitive personal information under the VCDPA.

J. Privacy Policy Requirements

A business must describe in its online privacy policy or in any Virginia-specific description of consumer privacy rights the following;

VIRGINIA RESIDENTS: How To Make A VCDPA Consumer Rights Request

A. Instructions for Submitting an VCDPA Consumer Rights Request to Us

If you wish to exercise any of the VCDPA consumer rights summarized above, such as a Request to Know or a Request to Delete Personal Information, you can do so in one of the following ways:

Upon receiving a verifiable Request to Know or a Request to Delete, we will confirm receipt of the request within ten (10) business days and provide some information about how we will verify and handle the request, and by when you should expect to receive a response.

Please note that you may only make a verifiable consumer request under the TDPSA two times within any 12-month period.

B. Verification Of the Person Making a Consumer Rights Request

Of course, we need to be reasonably sure that the person making the request is actually you! So, we may need some information from you to verify that you are the person whose Personal Information you are asking to know about or to delete. Accordingly, the verifiable consumer request must:

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request. Requests to delete or to know specific household Personal Information will not be granted unless each member of the household is verified.

C. Response Timing and Format

We will try to respond to a verifiable consumer request within forty-five (45) calendar days of its receipt. If we need more time (up to a total of 90 calendar days), we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt.

If you are making a Request to Delete your Personal Information, we may re-confirm with you that you really want your information deleted after verifying your request.

If we cannot respond to or comply with your Request to Know or Request to Delete, for instance, because we cannot verify your identity or because an exception applies, we will explain the reasons we cannot comply with your request. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.