Global Privacy Policy

Effective Date: August 7, 2026

EquiLend

Privacy Policy

Overview and Scope

We at EquiLend Holdings LLC and all of its affiliates (the “Company,” “we,” “our,” or “us”) recognize the importance of protecting the privacy of personally identifiable information (“Personal Information” or “PII”) collected about you and other individuals (collectively, “Users”) who visit our website, use our mobile applications, communicate with us via electronic means, engage with us in person, or otherwise interact with us in connection with our products and services. “Users” includes, without limitation, clients, prospective clients, business contacts, vendors, service providers, and any other individuals whose Personal Information we collect or process. Our website, mobile applications, electronic communications, telephone interactions, in-person meetings, client onboarding processes, and any other means through which we collect Personal Information are collectively referred to as our “Services.” Our corporate websites, including but not limited to https://equilend.com, https://datalend.com, its subdomains, and all websites and internet properties owned or operated by us, is referred to as the “Site.” We are committed to ensuring that your privacy is protected. To that end, this Privacy Policy (“Policy”) discloses our practices regarding the collection, use, and disclosure of the PII we receive through Users’ interactions with us and use of our Services. By using our Services or otherwise providing PII to us, you accept the terms of this Policy.

This Policy applies to all Personal Information we collect through our Services. This Policy is also applicable to data subjects within the European Economic Area and the United Kingdom (collectively, the “EEA”). Therefore, this Policy is drafted to comply with the E.U. General Data Protection Regulation (EU) 2016/679 and the U.K. GDPR (collectively, the “GDPR”). Users are under no statutory or contractual obligation, or other obligation to provide PII to us. For the purposes of compliance with the GDPR, we are the data controller of information we collect from data subjects through our Services. For the purposes of this Policy, “data subject” means an identified or identifiable natural person located in the EEA.

PLEASE READ THIS ENTIRE PRIVACY POLICY CAREFULLY BEFORE INTERACTING WITH US OR USING OUR SERVICES. BY USING OUR SERVICES, PROVIDING PERSONAL INFORMATION TO US, OR OTHERWISE INTERACTING WITH US, YOU: (A) ACKNOWLEDGE THAT YOU HAVE READ THIS PRIVACY POLICY; (B) UNDERSTAND THE COLLECTION, USE, AND DISCLOSURE OF YOUR INFORMATION AS DESCRIBED IN THIS PRIVACY POLICY; AND (C) AGREE TO THE TERMS OF THIS POLICY AND ARE DEEMED TO HAVE ACCEPTED THE TERMS OF THIS POLICY IN THEIR ENTIRETY. IF YOU DO NOT AGREE, PLEASE DISCONTINUE YOUR USE OF OUR SERVICES.

Information We Collect

We collect several types of information from and about Users, including:

Personal Information: We may collect PII (i.e., “personal data” under the GDPR) from you when you complete forms (whether online or in paper format), navigate web pages, communicate with us via electronic means or telephone, meet with us in person, attend events or conferences, participate in client onboarding, exchange business contact information, and in connection with other activities, services, features, or resources we make available through our Services. “PII” includes any information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. PII does not include publicly available information from government records, deidentified or aggregate information, or information excluded from the scope of “Personal Information” or “PII” as defined by the applicable law. The types of PII we have collected, used, stored, and disclosed in the last twelve (12) months include the following categories of information:

Sensitive PII: We may, if necessary, collect more sensitive categories of PII revealing: driver’s license, government identification card, account log-in, financial account, precise geolocation, (“Sensitive PII”). Any Sensitive PII collected will only be used to the extent necessary to provide our Services to you, or as otherwise permitted by applicable data privacy laws and regulations.

Deidentified Information: We may collect deidentified information from you that may not by itself reasonably identify you as the source when you interact with us through the Site or other digital Services (“Deidentified Information”). Deidentified Information may include: (i) device type, (ii) device operating system, (iii) internet browser type, (iv) internet service provider, (v) referring/exit pages, (vi) date/time stamp, and (vii) clickstream information. We will take reasonable measures to ensure that Deidentified Information we collect is not personally identifiable and may not later be easily used to identify you as required by applicable law.

Children’s Information: We do not offer our services or promote the Site to, nor do we intentionally collect or retain PII from, children who are younger than 18 years of age. If we discover that we have inadvertently collected information from a child under 18 years of age, we will promptly take all reasonable measures to delete such information from our systems.

The information we collect depends on how Users interact with us and utilize our Services. We collect PII and Deidentified Information in various ways, including:

How We Collect Information

The information we collect depends on how Users interact with us and use our Services. We collect PII and Deidentified Information in various ways, including:

Directly from You: We collect PII when you voluntarily submit PII to us, including when you complete forms in any format, communicate with us via email, telephone, or other correspondence, meet with us in person, attend trade shows or conferences, participate in client onboarding, exchange business cards, or otherwise provide information to us in connection with our Services. The PII we collect depends on the nature of your interaction with us and how you choose to communicate with us.

Through Email and Business Communications: We may collect PII when you correspond with our employees or representatives via email, telephone, or other business communications. Such information may include your name, email address, phone number, job title, employer, and the content of your communications with us. We may also collect information from business cards, email signatures, and professional networking platforms in connection with our business relationships.

Through Offline Interactions: We may collect PII through in-person meetings, trade shows, conferences, seminars, client onboarding processes, and paper-based forms. Information collected through these interactions may include your name, contact details, professional information, and any other information you voluntarily provide to us during the course of such interactions.

Through Your Use of the Site: We may collect Deidentified Information that your browser transmits when you visit the Site. We may also collect Deidentified Information about how you access and interact with the Site through the use of automated tracking technologies, such as session cookies, persistent cookies, and web beacons.

A cookie is a small data file that is transferred to an internet browser, which enables the Site to remember and customize your subsequent visits. We may use session cookies to make it easier for you to navigate the Site. In particular, we may use session cookies to record session information, such as which web pages you visited and to track your activity on the Site. Session cookies expire when you close your browser. We may also use persistent cookies to track and target your interests to enhance your experience on the Site. Persistent cookies remain on your device for an extended period of time.

Please refer to your internet browser’s instructions to learn more about cookie functions. If you reject cookies, the functionality of the Site may be limited and you may not be able to participate in several of the Site’s features. Additionally, we may use web beacons, which are single-pixel, electronic images embedded in the Site that allow us to gather information about your browsing activities on the Site.

From Third Party Services: We may collect PII about you from third parties whose privacy practices may differ from the practices described in this Policy. We do not make any representations or warranties concerning, and will not in any way be liable for, any informational content, products, services, software, or other materials available through third parties. Your use of third parties’ services and/or third party websites is governed by and subject to the terms and conditions of those third parties and/or third party websites. We encourage you to carefully review the privacy policies and statements of such third parties and/or third-party websites.

How We Use Information

We may use Users’ PII for various general, lawful business purposes, legitimate interest, including to provide, maintain, and improve our Services, to communicate with Users, and to fulfill our business or legal obligations. These purposes include:

Transactional Purposes: We use your contact information, other identifying information, and commercial information to:

Receive, confirm and process your order or account registration;

Communicate with you about your account.

• Analytical Purposes: We use your other identifying information, internet activity and browsing history and commercial information to analyze preferences, trends and statistics.

• Marketing and Promotional Purposes: We use your contact information, commercial information, internet or other electronic activity, and inferences to:

Inform you of our new products, services and offers;

Provide you with targeted advertising;

• Provide you with other information from and about our Company, including personalized marketing communications.

• Maintenance and Improvement of the Site and Services: We use your contact information, commercial information, and internet activity and browsing history to:

Provide you with the Site and Services, including sending you alerts about your account;

Handle your customer services requests;

Help us diagnose technical and service problems and administer the Site and Services.

• Security and Fraud Prevention: We use your contact information, other identifying information, commercial information, internet activity and browsing history, and inferences to protect our Services, our Company, and others and to prevent fraud, theft and misconduct.

Company will not collect additional categories of PII or use PII we collected for materially different, unrelated, or incompatible purposes without providing you notice. If required by law, we will also seek your consent before using your personal information for a new or unrelated purpose.

How We Disclose Information

We may disclose PII collected through any of our Services, or other interactions with Users, to third parties for a business purpose as described below. Otherwise, we do not sell PII and will not disclose Users’ PII to third parties without your permission.

To Service Providers: We may disclose your PII to third party service providers that assist us in providing user support, communicating with Users, and promoting our services, as well as third party service providers that provide other services to us relating to our Services.

Our Affiliates: We may share Personal Information with businesses controlling, controlled by, or under common control with our Company.

Law Enforcement, Safety, and Legal Processes: We may disclose your PII to law enforcement or other government officials if it relates to a criminal investigation or alleged criminal activity. We may also disclose your PII: (i) if required or permitted to do so by law; (ii) for fraud protection and credit risk reduction purposes; (iii) in the good-faith belief that such action is necessary to protect our rights, interests, or property; (iv) in the good-faith belief that such action is necessary to protect your safety or the safety of others; or (v) to comply with a judicial proceeding, court order, subpoena, or other similar legal or administrative process.

Sale or Acquisition of Assets: If we become involved in a transaction involving the sale of our assets, such as a merger or acquisition, or if we are transferred to another company, we may disclose and/or transfer your PII as part of the transaction. If the surviving entity in that transaction is not us, the surviving company may use your PII pursuant to its own privacy policies, and those policies may be different from this Policy.

Consent to Collection, Use, Storage, and Disclosure

By providing any PII, Deidentified Information, or other information to us through any channel – including through the Site, email, telephone, in-person interactions, or any other means – you expressly consent to us collecting, using, storing, and disclosing that information for any purpose set forth in this Privacy Policy or otherwise allowed by law. By initiating or responding to any written, oral, or electronic communication to or from us, you expressly consent to the recording, collection, use, storage, and disclosure of the contents of such communications and any associated metadata, logs, notes, recordings, or other information related to or derived from such communication for any purpose set forth in this Privacy Policy or otherwise allowed by law.

By providing your contact information to us, you agree to be contacted by us and consent to receive sales, marketing, and other calls or messages from us at any mailing address, email address, or phone number provided, regardless of whether you cancel your products and services with us or are on a do-not-call list. Agreeing to receive such communications is not required to buy products or services from us. Authorization for phone calls may be revoked by c sending an email to privacyandprotection@equilend.com. Authorization for receipt of other communications may be revoked as set forth in Accessing, Updating, and Controlling Information below.

Analytics

For the purpose of website analytics, third-party analytic service provider(s) (“Third-Party Analytics”) may automatically collect and store data (IP address, time of visit, device and browser information as well as information on your use of our website), from which usage profiles are created using pseudonyms. Cookies can be used for this purpose. The data processing is based on a data processing agreement with Third-Party Analytics. We may also use extension functions of Third-Party Analytics to create and run tests.

For web analytics purposes, the extension function of Third-Party Analytics enables so-called “cross-device tracking”. For instance, if your internet-enabled devices are linked to your Google account and you have activated the “personalized advertising” setting in your Google account, Google can generate reports on your usage behavior (in particular cross-device user numbers), even if you change your device. We do not process personal data in this respect; we only receive statistics based on Third-Party Analytics signals.

For website analysis and event tracking, we use third-party services to measure your subsequent usage behavior when you arrive on our website via tracking technologies. For this purpose, cookies may be used and data (IP address, time of visit, device and browser information as well as information on your use of our website based on events specified by us, such as a visit to a website or newsletter registration) may be collected, from which usage profiles are created using pseudonyms.

Security

The security and confidentiality of your PII is very important to us. We use commercially reasonable security measures to protect all PII we collect and maintain. However, no method of transmission or storage of data can be guaranteed to be 100% secure. As a result, while we attempt to protect your PII, we cannot guarantee or warrant that your PII will be completely secure (i) from misappropriation by hackers or from other nefarious or criminal activities, or (ii) in the event of a failure of computer hardware, software, or a telecommunications networks.

Data Retention

We retain PII (including Sensitive PII, where applicable) only for the duration we require it to provide our Services, to serve our business purposes or other uses disclosed above, as required by law or regulation, and to enforce or protect our rights, in each case in a manner consistent with any retention periods established by law.

Do Not Track Disclosure/Advertising and Online Tracking

Some internet browsers may transmit “do-not-track” signals to websites with which the browser communicates. The Site does not currently respond to these “do-not-track” signals.

We may allow third-party companies to serve ads and collect certain information when you visit the Site and Services. These companies may use certain information (e.g. click stream information, web browser type, time and date, subject of advertisements clicked or scrolled over) during your visits to the Site and other websites in order to provide advertisements about goods and services likely to be of interest to you. Our advertising partners may collect information about your activities on our Sites and combine it with information about your activities on other websites, mobile apps, and devices. This means that information about your activity on websites or apps on your current browser or device may be combined and used with information collected from your other browsers or devices. These third-party partners use this information for our and their own advertising, analytics, attribution, and reporting purposes. Our systems do not recognize browser “Do Not Track” signals, but several of our Service Providers who utilize these cookies on our Site enable you to opt out of targeted advertising practices. To learn more about these advertising practices or to opt out of this type of advertising, you can visit www.networkadvertising or www.aboutads.info/choices/. We also provide you with additional tools to opt out of marketing from us.

Selling of Information

We do not sell or disclose customer lists or email address lists to unrelated third parties. Except as otherwise provided herein, we do not share PII with any third party advertisers.

Third Party Links

Our Services, including the Site, may contain links to other websites or applications (“Linked Sites”) that are not owned by the Company. We do not control the collection or use of any information, including PII, which occurs while you visit Linked Sites. Therefore, we make no representations or warranties for – and will not in any way be liable for – any content, products, services, software, or other materials available on Linked Sites, even if one or more pages of the Linked Sites are framed within a page of the Site.

Furthermore, we make no representations or warranties about the privacy policies or practices of the Linked Sites, and the Company is not responsible for the privacy practices of those Linked Sites. We encourage you to be aware of when you leave the Site and read the privacy policies of Linked Sites.

Modifications

We reserve the right to update this Policy from time-to-time in our sole discretion. If our privacy practices change materially in the future, we will post an updated version of the privacy policy to the Site and may also notify you through other channels, such as email or other direct communication. It is your responsibility to review this Policy for any changes periodically. We will not lessen your rights under this Policy without your explicit consent. If you do not agree with the changes made, we will honor any opt-out requests made after the Effective Date of a new privacy policy.

Accessing, Updating, and Controlling Information (Opt-Out Requests)

If you ever wish to access, update, change, or delete your PII, or cancel your user account (if applicable), you may do so by making such changes by contacting us at the Contact Information provided below. To help us process your request, please provide sufficient information to allow us to identify you in our records. A request to access, update, change, or delete your PII may be made by your designated authorized agent where permitted by applicable law. We reserve the right to ask for additional information verifying your identity prior to disclosing any PII to you. Should we ask for verification, the information you provide will be used only for verification purposes, and all copies of the information will be destroyed when the process is complete.

If you do not wish for us to share your PII with third parties working on our behalf to serve our Users, please make your request by contacting us at the Contact Information provided below. A request not to share PII with third parties may be made by your designated authorized agent where permitted by applicable law. To help us process your request, please provide sufficient information to allow us to identify you in our records. Please allow a reasonable time for us to process your request. Please note that exercising these opt-out rights may limit your ability to receive the full range of Company’s products and services.

If you do not wish to receive update messages and/or direct marketing communications from us, you may opt-out by making such changes by contacting us at the Contact Information provided below. A request to opt-out of such communications may be made by your designated authorized agent where permitted by applicable law. To help us process your request, please include sufficient information for us to identify you in our records. Please be aware that although you may opt-out of update messages and/or direct marketing communications, we reserve the right to email you administrative notices regarding the Site, if applicable.

We will make commercially reasonable efforts to respond to opt-out requests, respond to account cancellation requests, and handle requests to access, update, change, or delete PII as quickly as possible.

Global Privacy Control Disclosure

Some browsers and browser extensions support the Global Privacy Control (“GPC”) that can send a signal to process your request to opt out from certain types of data processing, including data “sales” as defined under certain laws. When we detect such a signal, we will respect your choices indicated by a GPC setting as required by applicable law. You can activate the GPC signal by visiting the Global Privacy Control website and installing a supported browser or extension. When we detect a valid GPC signal, we will treat it as a request to opt out of data sharing/selling under applicable law.

File a Complaint

If you would like to file a complaint with us about our privacy practices, please contact us at the Contact Information provided below. If you are a data subject located in the EEA, the GDPR grants you the right to lodge a complaint with a competent supervisory authority as well. To find a competent supervisory authority, please use the following resource: https://edpb.europa.eu/about-edpb/board/members_en. UK data subjects can utilized the following resource: https://ico.org.uk/global/contact-us/.

Contact Information

If you have questions about this Policy or wish to contact us with questions or comments, please contact us at: privacyandprotection@equilend.com or call +1 212 901 2240

No Waiver

The reference in this Policy to any particular state or other jurisdiction is not meant as an admission or a concession as to the applicability of that state’s or jurisdiction’s law (including decisional law or common law), statute, regulation, or ordinance. Nothing in this Privacy Policy shall be construed as an admission, acknowledgement, or concession by us that we are governed by, subject to, or not exempt from any particular federal, national, state, or local law, statute, regulation, or ordinance. Reference to a particular state or other jurisdiction in this Privacy Policy shall not be construed as an admission, acknowledgement, or concession by us as to amount of any revenue or proceeds derived from or goods or services sold to any particular state or jurisdiction during any particular period of time or the number of consumers or residents from any particular state or jurisdiction whose PII or personal data we processed during any particular period of time. Nothing in this Privacy Policy shall be construed as a waiver of any rights or defenses, including any defenses related to jurisdiction or venue, we or our employees, agents, representatives, contractors, or affiliates have or may have under any federal, national, state, or local law (including decisional law or common law), constitution, statute, regulation, rule, ordinance, administrative or regulatory order or decision, or other source of law or authority.

Effective Date

This Policy was last modified as of the effective date printed above. This version replaces and supersedes any prior versions.

United State of America State-Specific Provisions

Some states in the United States of America, such as California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Oregon, Tennessee, Texas, Utah, and Virginia grant (now and in the future) their residents certain data privacy rights, which may include the following:

• Right to Access: You may have the right to request a copy of the specific pieces of PII that we have collected about you in the previous twelve (12) months. The information will be delivered by mail or electronically. Upon receipt of a Verifiable Consumer Request, we will disclose:

The categories of PII we have collected about you;

The categories of sources from which PII is collected;

Our business purpose for collecting or selling PII;

The categories of third parties with whom we share or sell PII, if any; and

The specific pieces of PII we have collected about you.

• Right to Data Portability: You may have the right to receive your PII in a portable, readily usable format that allows you to transmit your information to another entity without hindrance.

• Right to Correct Inaccurate Information: You may have the right to request that we correct inaccurate information about you that we maintain.

Right to Deletion: You may have the right request that we delete your PII.

• Right to Be Free from Discrimination: You may have the right to not be discriminated against by us for exercising any of your rights under applicable law or regulation. Unless permitted by applicable law or regulation, we will not:

Deny goods or services to you;

• Charge different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties;

Provide a different level or quality of goods or services to you; or

• Suggest that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

If you are a data subject located in the EEA, the GDPR grants you certain data privacy rights. Your rights include the:

Right to Access: You have the right to request a copy of your PII.

• Right to Rectification: You have the right to request that we correct any mistakes in your PII.

Right to Erasure: You have the right to request that we delete your PII.

Right to Restrict Processing: You have the right to restrict processing of your PII.

• Right to Object to Processing: You have the right to object to our processing or your PII.

• Right to Data Portability: You have the right to receive your PII in a structured, commonly used and machine-readable format.

• Right to Not be Subject to Automated Individual Decision Making: You have the right not to be subject to a decision based solely on automated processing.

To exercise these jurisdictional legal rights, please use the Verifiable Consumer Request method described below. Please be aware that your rights (including those enumerated elsewhere in this Policy) are limited to the extent permitted by applicable law. The exact scope of these rights may vary by state or applicable jurisdiction.

California Opt-Out of Sale or Sharing of Personal Information

If the California Consumer Privacy Act applies to you, you have the right to opt-out of the sale or sharing of your PII. If you exercise your right to opt-out of the sale or sharing of your PII, we will refrain from selling or sharing your PII, unless you subsequently provide express authorization for the sale or sharing of your PII. To exercise your right to opt-out, you may submit a request to us to privacyandprotection@equilend.com titled “Do Not Sell or Share my Personal Information – California” or call +212 901 2240.

Additional California Privacy Rights

California’s “Shine the Light” law permits California residents to request certain information regarding our disclosure of PII to third parties for their direct marketing purposes. To make such a request, please contact us at the Contact Information provided below.

Only you, or someone legally authorized to act on your behalf, may make a Verifiable Consumer Request related to your PII. Making a Verifiable Consumer Request does not require you to create an account with us. You may only make a Verifiable Consumer Request for access to PII as often as is required by law (e.g. in California: twice in a 12-month period).

The Verifiable Consumer Request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative; and

• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with PII if we cannot verify your identity or authority to make the request and confirm the PII relates to you. We will only use PII provided in a Verifiable Consumer Request to verify the requestor’s identity or authority to make the request.

California Response Timing and Format

We will acknowledge receipt of a Verifiable Consumer Request within ten (10) days. We endeavor to respond to Verifiable Consumer Requests within forty-five (45) days of its receipt. If we require more time (up to ninety (90) days), we will inform you of the reason and extension period in writing. Any disclosures we provide will only cover the 12-month period preceding the Verifiable Consumer Request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

We do not charge a fee to process or respond to Verifiable Consumer Requests, unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

The following provisions may or may not apply to you if you are a resident of one of the states listed below. As set forth in the No Waiver section above, the reference to any particular state or jurisdiction is not an indication that that state’s or jurisdiction’s laws, statutes, regulations, or ordinances actually apply to us or to you, even if you are a resident of that state or jurisdiction. The reference to any particular state or jurisdiction below does not constitute a voluntary agreement, undertaking, or assumption of duty by us to abide by any law, statute, regulation, or ordinance that does not otherwise apply to or regulate us.

California Residents: California law provides or may provide individuals who are California residents and whose Personal Information we process with certain rights, including the right to request certain information regarding our disclosure of PII to third parties for their direct marketing purposes. To make such a request or otherwise exercise any rights that are or may be available under California law, please contact us at any of the methods set forth in Contact Information above. You may also exercise many of the rights that may be available to you under California law as set forth in Accessing, Updating, and Controlling Information above.

Connecticut Residents: Connecticut law provides or may provide certain rights to individuals who are Connecticut residents and whose Personal Information we process. To exercise any rights that are or may be available under Connecticut law (including to appeal any decision with regard to a requests under Connecticut law), please contact us at the Contact Information provided above. You may also exercise many of the rights that may be available to you under Connecticut law as set forth in Accessing, Updating, and Controlling Information above.

Colorado Residents: Colorado law provides or may provide individuals who are Colorado residents and whose Personal Information we process (or their designated representative) with the following rights related to their PII or other personal data: (1) the right to opt out of the processing of personal data concerning you for purposes of: (a) targeted advertising, (b) the sale of personal data, or (c) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you; (2) the right to confirm whether we are processing personal data concerning you and to access your personal data; (3) the right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data; (4) the right to delete personal data concerning you; and (5) when exercising the right to access personal data pursuant to clause (2) above, the right to obtain the personal data in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance (You may exercise this right no more than two times per calendar year. We are not required to provide the data to you in a manner that would disclose our trade secrets.). To exercise any rights that are or may be available under Colorado law (including to appeal any decision with regard to a request under this paragraph), please contact us at the Contact Information provided above. You may also exercise many of the rights that may be available to you under Colorado law as set forth in Accessing, Updating, and Controlling Information above.

Delaware Residents: Delaware law permits or may permit individuals who are Delaware residents and whose Personal Information we process to: (1) confirm whether we are processing your personal data and access such personal data, unless such confirmation or access would require use to reveal a trade secret; (2) correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data; (3) delete personal data provided by, or obtained about, you; (4) obtain a copy of your personal data processed by us, in a portable and, to the extent technically feasible, readily-usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means, provided we shall not be required to reveal any trade secret; (5) obtain a list of the categories of third parties to which we have disclosed your personal data; (6) opt out of the processing of the personal data for purposes of any of the following: (a) targeted advertising, (b) the sale of personal data, except as provided in Del. Code tit. 6, § 12D-106(b); (c) profiling in furtherance of solely-automated decisions that produce legal or similarly significant effects concerning you. To exercise any rights that are or may be available under Delaware law (including to appeal any decision with regard to a request under this paragraph), please contact us at the Contact Information provided above. You may also exercise many of the rights that may be available to you under Delaware law as set forth in Accessing, Updating, and Controlling Information above.

Florida Residents: Florida law permits or may permit individuals who are Florida residents and whose Personal Information we process to: (1) to confirm whether we are processing your personal data and to access the personal data; (2) to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data; (3) to delete any or all personal data provided by or obtained about you; (4) to obtain a copy of your personal data in a portable and, to the extent technically feasible, readily usable format if the data is available in a digital format; (5) to opt out of the processing of the personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of a decision that produces a legal or similarly significant effect concerning you; (6) to opt out of the collection of sensitive data, including precise geolocation data, or the processing of sensitive data; and (7) to opt out of the collection of personal data collected through the operation of a voice recognition or facial recognition feature. To exercise any rights that are or may be available under Florida law (including to appeal any decision with regard to a request under this paragraph), please contact us at the Contact Information provided above. You may also exercise many of the rights that may be available to you under Florida law as set forth in Accessing, Updating, and Controlling Information above.

Indiana Residents: Indiana law permits or may permit individuals who are Indiana residents and whose Personal Information we process to: (1) to confirm whether or not we are processing your personal data and, subject to the limitations set forth in clause (4) below, to access such personal data; (2) to correct inaccuracies in your personal data that you previously provided to us, taking into account the nature of the personal data and the purposes of the processing of your personal data (Upon receiving a request from you under this clause, we shall correct inaccurate information as requested by you, taking into account the nature of the personal data and the purposes of the processing of your personal data); (3) to delete personal data provided by or obtained about you; (4) to obtain either a copy of or a representative summary of your personal data that you previously provided to us (Information provided to you under this clause must be in a portable and, to the extent technically practicable, readily usable format that allows you to transmit the data or summary to another controller without hindrance, in any case in which the processing is carried out by automated means. We have the discretion to send either a copy or a representative summary of your personal data under this clause, taking into account the nature of the personal data and the purposes of the processing of your personal data. We are not required to provide a copy or a representative summary of your personal data to you under this clause more than one time in a twelve-month period); (5) to opt out of the processing of your personal data for purposes of: (A) targeted advertising; (B) the sale of personal data; or (C) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. To exercise any rights that are or may be available under Indiana law (including to appeal any decision with regard to a request under this paragraph), please contact us at the Contact Information provided above. You may also exercise many of the rights that may be available to you under Indiana law as set forth in Accessing, Updating, and Controlling Information above.

Iowa Residents: Iowa law permits or may permit individuals who are Iowa residents and whose Personal Information we process to: (1) to confirm whether we are processing your personal data and to access such personal data; (2) to delete personal data provided by you; (3) to obtain a copy of your personal data, except as to personal data that is defined as “personal information” pursuant to Iowa Code 715C.1 that is subject to security breach protection, that you previously provided to us in a portable and, to the extent technically practicable, readily usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means; and (4) to opt out of the sale of personal data. To exercise any rights that are or may be available under Iowa law (including to appeal any decision with regard to a request under this paragraph), please contact us at the Contact Information provided above. You may also exercise many of the rights that may be available to you under Iowa law as set forth in Accessing, Updating, and Controlling Information above.

Kentucky Residents (effective January 1, 2026): As of January 1, 2026, Kentucky law provides or may provide individuals who are Kentucky residents and whose Personal Information we process the right to: (1) confirm whether or not we are processing your personal data and to access the personal data, unless the confirmation and access would require us to reveal a trade secret; (2) correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of processing the data; (3) delete personal data provided by or obtained about you; (4) obtain a copy of your personal data that you previously provided to us in a portable and, to the extent technically practicable, readily usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means, provided, however, that we are not required to reveal any trade secrets; and (5) opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. To exercise any rights that are or may be available under Kentucky law (including to appeal any decision with regard to a request under this paragraph), please contact us at the Contact Information provided above. You may also exercise many of the rights that may be available to you under Kentucky law as set forth in Accessing, Updating, and Controlling Information above.

Maryland Residents (effective October 1, 2025): As of October 1, 2025, Maryland law provides or may provide individuals who are Maryland residents and whose Personal Information we process the right to: (1) confirm whether we are processing your personal data; (2) if we are processing your personal data, access your personal data; (3) considering the nature of your personal data and the purposes of the processing of the personal data, correct inaccuracies in your personal data; (4) require us to delete personal data provided by, or obtained about, you unless retention of the personal data is required by law; (5) if the processing of personal data is done by automatic means, obtain a copy of the your personal data processed by us in a portable and, to the extent technically feasible, readily usable format that allows you to easily transmit the data to another controller without hindrance; (6) obtain a list of the categories of third parties to which we have disclosed your personal data or a list of the categories of third parties to which we have disclosed your personal data if we do not maintain this information in a format specific to you; (7) and opt out of the processing of personal data for purposes of: (i) targeted advertising; (ii) the sale of personal data; or (iii) profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning you. To exercise any rights that are or may be available under Maryland law (including to appeal any decision with regard to a request under this paragraph), please contact us at the Contact Information provided above. You may also exercise many of the rights that may be available to you under Maryland law as set forth in Accessing, Updating, and Controlling Information above.

Minnesota Residents (effective July 31, 2025): As of July 31, 2025, Minnesota law provides or may provide individuals who are Minnesota residents and whose Personal Information we process with the right to: (1) confirm whether or not we are processing personal data concerning you and access the categories of personal data we are processing; (2) correct inaccurate personal data concerning you, taking into account the nature of the personal data and the purposes of the processing of the personal data; (3) delete personal data concerning you; (4) obtain personal data concerning you, which you previously provided to us, in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means; (5) to opt out of the processing of personal data concerning you for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of automated decisions that produce legal effects concerning you or similarly significant effects concerning you; (6) (if your personal data is profiled in furtherance of decisions that produce legal effects concerning you or similarly significant effects concerning you) to question the result of the profiling, to be informed of the reason that the profiling resulted in the decision, and, if feasible, to be informed of what actions you might have taken to secure a different decision and the actions that you might take to secure a different decision in the future (you have the right to review your personal data used in the profiling; if the decision is determined to have been based upon inaccurate personal data, taking into account the nature of the personal data and the purposes of the processing of the personal data, you have the right to have the data corrected and the profiling decision reevaluated based upon the corrected data); and (7) to obtain a list of the specific third parties to which we have disclosed your personal data (if we do not maintain the information in a format specific to you, a list of specific third parties to whom we have disclosed any consumers’ personal data may be provided instead). To exercise any rights that are or may be available under Minnesota law (including to appeal any decision with regard to a request under this paragraph), please contact us at the Contact Information provided above. You may also exercise many of the rights that may be available to you under Minnesota law as set forth in Accessing, Updating, and Controlling Information above.

Montana Residents: Montana law provides or may provide individuals who are Montana residents and whose Personal Information we process with the right to: (1) confirm whether we are processing your personal data and access your personal data, unless such confirmation or access would require us to reveal a trade secret; (2) correct inaccuracies in your personal data, considering the nature of the personal data and the purposes of the processing of your personal data; (3) delete personal data about you; (4) obtain a copy of your personal data previously provided by you to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the personal data to another controller without hindrance when the processing is carried out by automated means, provided that we are not required to reveal any trade secret; and (5) opt out of the processing of your personal data for the purposes of: (i) targeted advertising; (ii) the sale of your personal data, except as provided in Montana Code 30-14-2812(2); or (iii) profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning you. To exercise any rights that are or may be available under Montana law (including to appeal any decision with regard to a request under this paragraph), please contact us at the Contact Information provided above. You may also exercise many of the rights that may be available to you under Montana law as set forth in Accessing, Updating, and Controlling Information above.

Nebraska Residents: Nebraska law provides or may provide individuals who are Nebraska residents and whose Personal Information we process with the right to: (1) confirm whether we are processing your personal data and to access the personal data; (2) correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data; (3) delete personal data provided by or obtained about you; (4) if the data is available in a digital format and the processing is completed by automated means, obtain a copy of your personal data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance; or (5) opt out of the processing of the personal data for purposes of: targeted advertising, the sale of personal data, or profiling in furtherance of a decision that produces a legal or similarly significant effect concerning you. To exercise any rights that are or may be available under Nebraska law (including to appeal any decision with regard to a request under this paragraph), please contact us at the Contact Information provided above. You may also exercise many of the rights that may be available to you under Nebraska law as set forth in Accessing, Updating, and Controlling Information above.

New Hampshire Residents: New Hampshire law provides or may provide individuals who are New Hampshire residents and whose Personal Information we process with the right to: (1) confirm whether or not we are processing your personal data and access such personal data, unless such confirmation or access would require us to reveal a trade secret; (2) correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data; (3) delete personal data provided by, or obtained about, you; (4) Obtain a copy of your personal data processed by us, in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means, provided that we shall not be required to reveal any trade secret; and (5) opt-out of the processing of your personal data for purposes of targeted advertising, the sale of personal data (except as provided in N.H. Rev. Stat. Ann. 507-H:6), or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning you. To exercise any rights that are or may be available under New Hampshire law (including to appeal any decision with regard to a request under this paragraph), please contact us at the Contact Information provided above. You may also exercise many of the rights that may be available to you under New Hampshire law as set forth in Accessing, Updating, and Controlling Information above.

New Jersey Residents: New Jersey law provides or may provide individuals who are New Jersey residents and whose Personal Information we process with the right to: (1) confirm whether we process your personal data and access such personal data, provided that we are not required to provide the data to you in a manner that would reveal our trade secrets; (2) correct inaccuracies in your personal data, taking into account the nature of the information and the purposes of the processing of the information; (3) delete personal data concerning you; (4) obtain a copy of your personal data held by us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance, provided that we are not required to provide the data to you in a manner that would reveal our trade secrets; and (5) opt out of the processing of personal data for the purposes of (a) targeted advertising, (b) the sale of personal data, or (c) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. To exercise any rights that are or may be available under New Jersey law (including to appeal any decision with regard to a request under this paragraph), please contact us at the Contact Information provided above. You may also exercise many of the rights that may be available to you under New Jersey law as set forth in Accessing, Updating, and Controlling Information above.

Oregon Residents: Oregon law provides or may provide individuals who are Oregon residents and whose Personal Information we process with the right to: (1) obtain from us: (a) confirmation as to whether we are processing or have processed your personal data and the categories of personal data we are processing or have processed; (b) at our option, a list of specific third parties, other than natural persons, to which we have disclosed (i) your personal data or (ii) any personal data; and (c) a copy of all of your personal data that we have processed or are processing (in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the personal data to another person without hindrance); (2) require us to correct inaccuracies in personal data about you, taking into account the nature of the personal data and our purpose for processing the personal data; (3) require us to delete personal data about you, including personal data you provided to us, personal data we obtained from another source and derived data; or (4) opt out from our processing of your personal data that we process for any of the following purposes: (a) targeted advertising, (b) selling the personal data; or (c) profiling you in furtherance of decisions that produce legal effects or effects of similar significance. Nothing in this paragraph requires us to disclose our trade secrets, as defined in Oregon Rev. Stat. 646.461. To exercise any rights that are or may be available under Oregon law (including to appeal any decision with regard to a request under this paragraph), please contact us at the Contact Information provided above. You may also exercise many of the rights that may be available to you under Oregon law as set forth in Accessing, Updating, and Controlling Information above.

Rhode Island Residents (effective January 1, 2026): Effective January 1, 2026, Rhode Island law provides or may provide individuals who are Rhode Island residents and whose Personal Information we process with the right to: (1) confirm whether or not we are processing your personal data and access such personal data, unless such confirmation or access would require us to reveal a trade secret; (2) correct inaccuracies in your personal data and delete personal data provided by, or obtained about, you, taking into account the nature of the personal data and the purposes of the processing of your personal data; (3) obtain a copy of your personal data processed by us, in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without undue delay, where the processing is carried out by automated means, provided that we are not required to reveal any trade secret; and (4) opt out of the processing of your personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning you. To exercise any rights that are or may be available under Rhode Island law (including to appeal any decision with regard to a request under this paragraph), please contact us at the Contact Information provided above. You may also exercise many of the rights that may be available to you under Rhode Island law as set forth in Accessing, Updating, and Controlling Information above.

Tennessee Residents: Tennessee law provides or may provide individuals who are Tennessee residents and whose Personal Information we process with the right to: (1) confirm whether we are processing your personal information and to access the personal information; (2) correct inaccuracies in your personal information, taking into account the nature of the personal information and the purposes of the processing of your personal information; (3) delete personal information provided by or obtained about you (we are not required to delete information that we maintain or use as aggregate or de-identified data; provided, that such data in our possession is not linked to a specific consumer); (4) obtain a copy of your personal information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means; and (5) opt out of our processing of personal information for purposes of: (i) selling personal information about you; (ii) targeted advertising; or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. To exercise any rights that are or may be available under Tennessee law (including to appeal any decision with regard to a request under this paragraph), please contact us at the Contact Information provided above. You may also exercise many of the rights that may be available to you under Tennessee law as set forth in Accessing, Updating, and Controlling Information above.

Texas Residents: Texas law provides or may provide individuals who are Texas residents and whose Personal Information we process with the right to: (1) confirm whether we are processing your personal information and to access the personal information; (2) correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data; (3) delete personal information provided by or obtained about you; (4) if the data is available in a digital format, obtain a copy of your personal data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance; and (5) opt out of the processing of the personal data for purposes of: (A) targeted advertising; (B) the sale of personal data; or (C) profiling in furtherance of a decision that produces a legal or similarly significant effect concerning you. To exercise any rights that are or may be available under Texas law (including to appeal any decision with regard to a request under this paragraph), please contact us at the Contact Information provided above. You may also exercise many of the rights that may be available to you under Texas law as set forth in Accessing, Updating, and Controlling Information above.

Utah Residents: Utah law provides or may provide individuals who are Utah residents and whose Personal Information we process with the right to: (1) confirm whether we are processing your personal data; (2) access your personal data; (3) delete your personal data that you provided to us; (4) obtain a copy of the your personal data, that you previously provided to us, in a format that to the extent technically feasible, is portable, to the extent practicable, is readily usable, and allows you to transmit the data to another controller without impediment, where the processing is carried out by automated means; and (5) opt out of the processing of your personal data for purposes of targeted advertising or the sale of personal data. To exercise any rights that are or may be available under Utah law (including to appeal any decision with regard to a request under this paragraph), please contact us at the Contact Information provided above. You may also exercise many of the rights that may be available to you under Utah law as set forth in Accessing, Updating, and Controlling Information above.

Virginia Residents: Virginia law provides or may provide individuals who are Virginia residents and whose Personal Information we process with the right to: (1) to confirm whether or not we are processing your personal data and to access such personal data; (2) to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data; (3) to delete personal data provided by or obtained about you; (4) to obtain a copy of your personal data that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another controller without hindrance, where the processing is carried out by automated means; and (5) to opt out of the processing of the personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. To exercise any rights that are or may be available under Virginia law (including to appeal any decision with regard to a request under this paragraph), please contact us at the Contact Information provided above. You may also exercise many of the rights that may be available to you under Virginia law as set forth in Accessing, Updating, and Controlling Information above.