Multi-State Privacy Notice

Residents of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Virginia and Utah

Privacy Rights Notice

This Notice is incorporated into our privacy policy. If you are a resident of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Virginia and Utah you may have certain rights under your state’s laws. Those laws include the California Consumer Privacy Act (“CCPA”), the Colorado Privacy Act, the Connecticut Personal Data Privacy Act, the Delaware Personal Data Privacy Act, the Indiana Consumer Data Protection Act, the Iowa Consumer Data Protection Act, the Kentucky Consumer Data Protection Act, the Maryland Online Data Privacy Act, the Minnesota Consumer Data Privacy Act, the Montana Consumer Data Privacy Act, the Oregon Consumer Privacy Act, the Rhode Island Data Transparency and Privacy Protection Act, the Tennessee Information Protection Act, the Texas Data Privacy and Security Act, the Virginia Consumer Data Protection Act, and the Utah Consumer Privacy Act (collectively, the “Privacy Laws”).

If you are a resident of one of the above named states, the following provisions may apply to our processing of information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“personal information”) if we are subject to the Privacy Law of your state.

California defines a ‘Consumer’ as any resident of the state regardless of the capacity in which they interact with us.

All of the other states define a ‘Consumer’ as a resident of the state who is acting in an individual or household capacity, but this excludes state residents who are acting in an employment capacity (as one of our current, former or prospective employees) or in a commercial capacity (as an employee, owner, director, officer, etc. of an entity communicating with us in that context). As a result, if you reside in one of these states and have interacted with us in an employment or commercial capacity you are not provided the rights described below by the Privacy Laws.

Our California employees (current, former or applicants) can learn about our information collection and disclosure practices and how to exercise their CPRA rights by contacting the Director of Human Resources.

For Consumers, the provisions of this section prevail over any conflicting provisions of this Privacy Statement. We adopt this section of our Privacy Statement to comply with the Privacy Laws of and any terms defined in the Privacy Laws have the meaning set forth in the law of your state of residence when used in this section.

I. Information Collected, Sources, and Business Purpose for Collection

The following table lists the categories of Consumer personal information, whether we have collected information in the category during the past 12 months, the sources of the information, and the business purposes for which we collect and use the information. The categories of information include information we collect from our website visitors, registered users, employees, vendors, suppliers and any other person that interacts with us either online or offline. Not all information is collected about all individuals. For instance, we may collect different information from applicants for employment or from vendors or from customers.

*More specifically, the business purposes include:

1. Performing services for you:

   • To administer or otherwise carry out our obligations in relation to any agreement to which we are a party;
   • To assist you in completing a transaction or order;
   • To allow tracking of shipments;
   • To prepare and process invoices;
   • To respond to queries or requests and to provide services and support;
   • To provide aftersales customer relationship management;
   • To create and manage our customer accounts;
   • To notify you about changes to our services and products;
   • To administer any promotion, contest, survey, or competition;
   • To provide you information regarding our products and services,
   • To offer our products and services to you in a personalized way, for example, we may provide suggestions based on your previous requests to enable you to identify suitable products and services more quickly.

2. Advertising customization:

   • For marketing and promotions we believe you may find of interest and to provide you, or allow selected third parties to provide you, with information about products and services that may interest you.

3. Auditing relating to transactions, internal research and development:

   • To provide for internal business administration and operations, including troubleshooting, Site customization, enhancement or development, testing, research, administration and operation of our Sites and data analytics;
   • To create products or services that may meet your needs;
   • To measure performance of marketing initiatives, ads, and websites “powered by” another company on our behalf.

4. Security detection, protection and enforcement; functionality debugging, error repair:

   • As part of our efforts to keep our Sites safe and secure;
   • To ensure the security of your account and our business, preventing or detecting fraud, malicious activity or abuses of our Sites, for example, by requesting verification information in order to reset your account password (if applicable);
   • To ensure the physical security of our premises through the monitoring of surveillance images;
   • To resolve disputes, to protect the rights, safety and interests ourselves, our users or others, and to comply with our legal obligations.

5. Quality control:

   • To monitor quality control and ensure compliance with our legal obligations, codes and ordinances, policies and procedures,
   • To develop and improve our products and services, for example, by reviewing visits to the Sites and various subpages, demand for specific products and services and user comments.

II. Processing Sensitive Personal Information

We collect and process Sensitive Personal Information for the purposes disclosed at the time we collect this information and as permitted under the Privacy Laws. We do not process or disclose this information for purposes other than those purposes. The following are permitted purposes under the Privacy Laws:

• To perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services.
• To prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information.
• To resist malicious, deceptive, fraudulent, or illegal actions directed at the business and to prosecute those responsible for those actions.
• To ensure the physical safety of natural persons.
• For short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumer’s current interaction with the business, provided that the personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumer’s experience outside the current interaction with the business.
• To perform services on behalf of our business.
• To verify or maintain the quality or safety of products or services that we own or control, and to improve, upgrade, or enhance such products or services.
• To collect or process sensitive personal information where such collection or processing is not for the purpose of inferring characteristics about a consumer.

III. Disclosing Personal Information

From time to time we disclose Consumer information as described below. This includes disclosing information to our service providers such as professional advisers, lawyers, bankers, staffing partners, auditors and accountants, and, when required by law, to regulators or law enforcement.

A. Disclosure of Personal Information for a Business Purpose.

We may disclose Consumer personal information to service providers and others for a business purpose. The business purposes are listed above. When we disclose Consumer personal information for a business purpose, we enter into a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.

In the preceding twelve (12) months, we may have disclosed the following categories of Consumer personal information to service providers (such as payment processors, mail houses, marketing partners, shipping partners, employee benefits partners; professional advisors);affiliated companies; government regulators; strategically aligned businesses; or, when required by law, regulators or law enforcement. Not all information is disclosed to the above; photographs or other Consumer content posted by site users are available to the public.

• Category A: Identifiers.
• Category B: Protected personal information.
• Category D: Commercial Information
• Category E: Electronic network activity information
• Category H: Geolocation
• Category I: Professional or employment-related information.
• Category J: Non-public education information.
• Category K: Sensitive personal information

B. Disclosing Personal Information in Sale Arrangements

We do not sell Consumer personal information for monetary consideration but we may transfer Consumer information to a third party that provides us with services such as helping us with advertising, data analysis and analytics, and security, which may fall under the definition of for “other valuable consideration” and which may therefore be considered a “sale” under some of the Privacy Laws. We do not sell the personal information of individuals we actually know are less than sixteen (16) years of age. Please see below for opting out of having your information sold. In the preceding twelve (12) months we may have disclosed the following categories of information for a business purpose which falls within the definition of a ‘sale.’

• Category A: Identifiers.
• Category B: Protected personal information.
• Category D: Commercial Information
• Category E: Electronic network activity information
• Category H: Geolocation

C. Sharing Personal Information for Cross-Context Behavioral Marketing or Targeted Marketing

“Sharing” Consumer personal information means making it available to a third party so that they can use it to display targeted or cross-context behavioral advertisements to you. Cross-context behavioral or targeted advertising means that we display an advertisement to you that is selected based on personal information about you that we obtained or inferred over time from Consumers’ activities across other companies’ websites, applications or online services that we use to predict Consumers’ preferences or interests. Targeted advertising does not include using Consumers’ interactions with us or information that Consumers provide to us to select advertisements to show them. In the preceding twelve (12) months, we have shared the following categories of personal information of non-minors for behavioral or cross context or targeted advertising.

• Category A: Identifiers.

IV. Consumers’ Rights and Choices.

The Privacy Laws provide Consumers in the above listed states with specific rights regarding their personal information.

This section describes Consumers’ rights under the Privacy Laws, explains how to exercise those rights, and provides information about the response timing and format and your rights to appeal our decisions.

A. Access to Information and Data Portability Rights

Consumers have the right to request that we disclose certain information upon request about our information collection and disclosure practices. Consumers also have the right to request a copy of the specific pieces of personal information we collected about you. Once we receive and confirm your verifiable Consumer request, we will:

• Confirm that we hold personal information about you and disclose to you the categories of personal information we collected about you, the sources of the information, our business or commercial purpose for collecting the information and whether the information was disclosed for a business purpose, shared or sold.
• Disclose to you the categories of information we disclosed for a business purpose and the categories of information we sold or shared during the prior 12 months along with the categories of recipients of such information.
• Provide to you the specific pieces of personal information we collected about you during the prior 12 months, or, at your option, since January 1, 2022. Please note that this disclosure will not include data generated to help ensure security and integrity or as prescribed by regulation. We will endeavor to provide the information in a format that is readily useable, including by mailing you a paper copy or providing an electronic copy to your registered account, if you have registered an account with us.

B. Consumers’ Deletion Request Rights

Consumers have the right to request that we delete any of their personal information that we collected from them and retained, subject to certain exceptions. Once we receive and confirm a verifiable Consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

• Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities and to help to ensure security and integrity to the extent the use of your personal information is reasonably necessary and proportionate for those purposes.
• Debug products to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
• Engage in public or peer-reviewed scientific, historical, or statistical research that conforms or adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s ability to complete such research, if you previously provided informed consent.
• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us and compatible with the context in which you provided the information.
• Comply with a legal obligation.
• Make other internal and lawful uses of that information that are compatible with the context in which you provided it

C. Consumers’ Information Correction Rights

Consumers have the right to request that we correct information that we hold which is inaccurate. We will require that you provide information about yourself so that we can verify your identity before we can make any change in the information we hold about you and we will use commercially reasonable efforts to make the requested corrections. In some cases, for instance if you have an account with us, you can update your information by logging into your account.

D. Consumers’ Opt-Out Rights

• Do Not Sell My Personal Information. If you are 16 years of age or older, you have the right, at any time, to direct us to not sell your personal information. We do not sell the personal information of consumers we actually know are less than 16 years of age, unless we receive affirmative authorization (the “right to opt-in”) from either the consumer who is at least 13 but not yet 16 years of age, or the parent or guardian of a consumer less than 13 years of age. Consumers who opt-in to personal information sales may opt-out of future sales at any time.

• Do Not Share My Personal Information. Consumers have the right at any time to opt out of having your personal information shared with others for cross-context or behavioral advertising purposes and having their information used for targeted advertisements. When Consumers opt out we will not share their personal information with others that they can use to send the Consumer targeted advertisements and we will not use information we obtain over time from Consumers’ activities with third party companies to show advertisements. We can still use information that we receive from your interactions with us to select advertisements we think may be of interest to you.

• Limit Processing of Sensitive Personal Information. Consumers have the right to tell us not to process or disclose Sensitive Personal Information for any purpose other than the purposes disclosed at or before the time we originally collected it or as permitted by the Privacy Laws. We only process Sensitive Personal Information for the purpose for which we originally collected it or as permitted by law.

• Do Not Profile. We do not engage in Profiling. Consumers have the right to tell us not to use any form of solely automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual’s economic situation, health, personal preferences, interests, reliability, behavior, location, or movements in order for us to make decisions resulting in the provision or denial of credit, housing or insurance services.

V. Exercising Consumer Rights

A. Making a Consumer Request.

Consumers may make a verifiable Consumer request for access or data portability only twice within a 12-month period. All other requests may be made at any time. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. We will only use personal information provided in a verifiable Consumer request to verify the requestor’s identity or authority to make the request.

• Access, Portability, Correction and Deletion. To exercise the access, portability, correction, and deletion rights Consumers may contact us by email to datacompliance@notus.com or via mail at NOTUS Media LLC, Attn: Data Compliance, 1000 Wilson Blvd, Ste. 2700, Arlington, VA 22209. We will ask you for information that allows us to reasonably verify your identity (that you are the person about whom we collected personal information) and will use that information only for that purpose. We may request that you submit a signed statement under penalty of perjury that you are the individual you claim to be. Any disclosures we provide will only cover the 12-month period preceding receipt of your request, but you may request that expand the 12-month period to cover information collected since January 1, 2022, and we will honor that expanded request unless doing so would involve a disproportionate effort. You may make these requests up to twice in a 12 month period.

• Opt-Out Rights. We do not provide an opt out for profiling because we do not engage in those activities or for limiting processing of Sensitive Information because we only process Sensitive Information for permitted purposes.

You may also opt out by activating a user-enabled global privacy control, such as a browser plug-in or privacy setting, device setting, or other mechanism, that communicates or signals your choice to opt-out of the sale and sharing of personal information. When we receive such a signal we will stop setting third party, analytics, or advertising partner cookies on your browser. This will prevent the sale or sharing of information relating to that specific device through cookies to our advertising or analytics partners. This option does not stop all sales or sharing of your information because we cannot match your device’s identification or internet protocol address with your personally identifiable information like your name, phone number, email address or ZIP Code. If you delete cookies on your browser, any prior do not sell or do not share signal is also deleted and you should make sure that your user-enabled setting is always activated.

B. Using an Authorized Agent. You may submit a request through someone holding a formal Power of Attorney. Otherwise, Consumers may submit a request using an authorized agent only if (1) the person is registered with the Secretary of State to do business in your state, (2) you provide the authorized agent with signed written permission to make a request, (3) you verify directly with us that you have authorize the person to make the request on your behalf, (4) you verify your own identity directly with us and (5) your agent provides us with proof that they are so authorized. We will require the agent to submit proof to us that they have been authorized to make requests on your behalf.

C. Our Responses.

We will acknowledge receipt of your request for access, portability, correction or deletion within 10 business days and will endeavor to respond within forty-five days of receipt of your request, but if we require more time (up to an additional forty-five days) we will notify you of our need for additional time.

For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance (e.g. Microsoft Excel file and/or Adobe PDF file).

For requests for deletion of your information, please understand that Privacy Laws permit us to retain certain information and not delete it under certain circumstances noted above in the description of Information Deletion Request Rights.

For requests that we not sell your information we will comply with your request promptly, and at least within 15 business days. Once we receive your request we will wait at least 12 months before asking you to reauthorize personal information sales or sharing.

We cannot respond to your request or provide you with personal information if we cannot verify your identity and confirm that the personal information relates to you.

We do not charge a fee to process or respond to your verifiable Consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

VI. Non-Discrimination

We will not discriminate against you as a result of your exercise of any of these rights. Unless permitted by the Privacy Laws, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

VII. Retention of Personal Information

We will store Consumer personal information in a form which permits us to identify Consumers, for as long as necessary for the purpose for which the personal information is processed. We may retain and use such personal information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements and rights, or if it is not technically reasonably feasible to remove it. We retain information Consumers provide in connection with requests made under the Privacy Laws for a period of two years.

VIII. Appealing denied requests

If we have denied your Consumer request you have the ability to file an appeal with us. To file an appeal with us, contact us at: NOTUS Media, LLC, Attn: Data Compliance, 1000 Wilson Blvd, Ste 2700, Arlington, VA 22209.

We will respond to you in writing within 45 days explaining the reasons for our decisions. If we deny your appeal you can contact your state Attorney General at:

Colorado residents:

Office of the Attorney General

Colorado Department of Law

Ralph L. Carr Judicial Building

1300 Broadway, 10th Floor

Denver, CO 80203

(720) 508-6000

Connecticut residents:

Office of the Attorney General

165 Capitol Avenue

Hartford, CT 06106

860-808-5318

Delaware residents:

Department of Justice

Carvel State Building

820 N. French St.

Wilmington, DE 19801

attorney.general@delaware.gov

Indiana residents:

Office of the Indiana Attorney General

Consumer Protection Division Indiana Government Center South

302 W. Washington St., 5th Floor

Indianapolis, IN 46204

Phone: (317) 232-6330 or (800) 382-5516

Iowa residents:

Office of the Attorney General of Iowa

Consumer Protection Division

Hoover State Office Building

1305 E. Walnut Street

Des Moines, Iowa 50319-0106

Email: consumer@ag.iowa.gov

Phone: 515-281-5926 or 888-777-4590

Kentucky residents:

Kentucky Attorney General

1024 Capital Center Drive, Suite 200, Frankfort, KY 40601

Main Line: (502) 696-5300

Main Fax: (502) 564-2894

Maryland residents:

Office of the Attorney General

200 St. Paul Place, Baltimore, MD 21202

https://www.marylandattorneygeneral.gov/Pages/CPD/default.aspx

Main number: 410-576-6300

En español 410-230-1712

toll-free: 1-888-743-0023

consumer@oag.state.md.us

Minnesota residents:

Office of Minnesota Attorney General Keith Ellison

445 Minnesota Street, Suite 600

St. Paul, MN 55101-2131

Tel: (651) 296-3353 (Twin Cities Calling Area)

(800) 657-3787 (Outside the Twin Cities)

Montana residents:

Office of the Attorney General,

215 N Sanders St.

Helena, MT 59601

Nebraska residents:

Consumer Affairs Response Team

Nebraska Attorney General’s Office

2115 State Capitol, Lincoln, NE 68509

https://www.nebraska.gov/apps-ago-complaints/?preSelect=CP_COMPLAINT

New Hampshire residents:

NH Department of Justice

1 Granite Place South

Concord, NH 03301

Telephone: (603) 271-3658

Fax: (603) 271-2110

TDD Access: Relay NH 1-800-735-2964

Email: attorneygeneral@doj.nh.gov

New Jersey residents:

Division of Consumer Affairs

Department of Law and Public Safety

124 Halsey Street

Newark, NJ 07102

800-242-5846

https://www.njconsumeraffairs.gov/Pages/Consumer-Complaints.aspx

Oregon residents:

Oregon Department of Justice

Office of the Attorney General

1162 Court St. NE

Salem, OR 97301-4096

AttorneyGeneral@doj.oregon.gov

Rhode Island residents:

Rhode Island Office of the Attorney General

150 South Main Street

Providence, RI 02903

(401)274-4400

Tennessee residents:

Office of the Attorney General and Reporter

P.O. Box 20207

Nashville, TN 37202-0207

Telephone: (615) 741-3491

Fax: (615) 741-2009

Texas residents:

Office of Attorney General

PO Box 12548

Austin, TX 78711-2548

https://www.texasattorneygeneral.gov/consumer-protection

Utah residents:

Utah State Capitol Office Mailing Address

Office of the Attorney General

PO Box 142320

Salt Lake City, UT 84114-2320

General Office Number:

1-801-366-0260

Virginia residents:

Office of the Attorney General

202 North Ninth Street

Richmond, Virginia 23219

(804)786-2071

California residents (not available)

VIX. Changes to This Notice

We reserve the right to amend this Notice at our discretion at any time. When we make changes to this Notice, we will post the updated notice on our website and update the Notice’s effective date.