Privacy Policy

Last Updated & Effective Date: August 31, 2023

This Privacy Policy ("Privacy Policy") describes the information that Francesca’s Holdings Corporation and its affiliated brands (such as franki by francesca's), companies, subsidiaries (collectively, "francesca's", we or us) collect about you; how we use and protect this information; and the choices you can make about how we use this information. By using our website, stores, platforms, goods or services, you agree to our collection, use and disclosure of information as set forth herein.

1. Personal Information We Collect, the Categories of Source of Collection and the Purpose for Collection.

"Personal information" is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household. Personal information does not include information that is publicly available, de-identified, or aggregated. We also collect sensitive personal information, which is a subset of personal information.

The chart below summarizes the categories of personal information we collect. Please note that we may not collect all of this information regarding you.

Category of Personal Information

Examples

Categories of Sources

Business Or Commercial Purposes

Personal Identifiers

Name Alias Postal addresses Phone Number Username and password for our websites IP address Email address Month and day of birth

Directly from you* Indirectly from you by observing your actions on our website. This includes us automatically collecting information when you engage in certain actions, cookies and tracking technologies and website analytics information.** Third-party payment vendor and third-party fraud assessment tool when you place an order via one of our websites. Other sources***

To fulfill orders and deliver your purchases To handle returns To communicate with you about products we sell To detect and prevent fraud against you and/or us To help you find one of our boutiques or outlets To show you relevant products while you are browsing the web or using social media To provide you with a more relevant personalized experience when receiving email, SMS, social ads, direct mail, and product offerings To contact you in order to obtain information about your product preferences and how we can improve our business To provide you with information about your status and rewards earned as a member of our loyalty program To develop new products and services To enroll you in contests, programs, or offers you request To provide you with other services To create and manage your account To protect against or identify possible fraudulent transactions To provide you with customized, unsolicited offers and information about francesca’s products and services To develop and provide advertising tailored to your interests To analyze the use of our products, services and sites To understand how you arrived at our site To determine the effectiveness of our advertising To enforce our Terms and Conditions and otherwise manage or protect our business In the event of a sale of francesca's, we may transfer your information as part of the transaction To make birthday offers

Commercial Information

Products or services purchased, obtained, or considered Other purchasing or consuming histories or tendencies Information from surveys and promotions Communication preferences

Directly from you as you visit our websites or transact in our stores using your loyalty account.* Indirectly from you by observing your actions on our website.** Third-party fraud assessment tool when you place an order via one of our websites. Other sources***

To fulfill your orders To handle returns To provide you with appropriate products, recommendations, and updates To help you find relevant products more quickly To provide customer service and support To handle returns

Internet or Other Electronic Network Activity Information

Browser type and language Operating system Website access time Duration of visit Referring website address Browsing and search history on our website Webpages viewed immediately before and after our website Emails sent to us Information related to use of links contained in our emails and advertisements App usage data Links you click IP address. Emails you open, click or purchase from Offers or links you link to via emails

Directly from you as you visit our websites or transact in our stores using your loyalty account.* Indirectly from you by observing your actions on our website or interact with our emails.** Third-party fraud assessment tool when you place an order via one of our websites. Other sources.***

To make it easier for you to log into our website To provide you with appropriate products, recommendations, and updates To help you find relevant products more quickly To help you find one of our boutiques or outlets To show you relevant products and/or services while you are browsing the web or using social media To provide you with a more relevant personalized experience when receiving email, SMS, social ads, direct mail, and product offerings To improve our website, set default options, and provide you with a better website experience To protect the security of our website To detect and prevent fraud against you and/or us

Geolocation Data

Your physical location based on information you provide directly when placing an order with us, creating a francescas.com account, signing up for our loyalty program or inferred from your IP address

Indirectly from you by observing your actions on our website or interact with our emails.** Third-party fraud assessment tool and directly from you when you place an order via one of our websites. Other sources.***

To fulfill your orders To provide you with appropriate products, recommendations, and updates To help you find relevant products more quickly To provide customer service and support To handle returns To provide you with a more relevant personalized experience when receiving email, SMS, social ads, direct mail, and product offerings To improve our website, set default options, and provide you with a better website experience To protect the security of our website To detect and prevent fraud against you and/or us

Audio, Electronic, or Visual Information

Security camera recordings in our stores Pictures or videos you submit to us

Via security camera recordings when you visit our stores Directly from you when you submit picture or videos to us

To protect the security of our stores To detect and prevent fraud against you and/or us To show or promote product you are wearing or using when you submit pictures or videos to us.

Professional or Employment-Related Information

For prospective employees and applicants

Directly from you as you apply for or become employed by us. Other sources.***

To consider you for employment with us More information can be found here: https://www.francescas.com/careers

Inferences About You From Any Other Category of Information We Collect

Information reflecting your preferences, characteristics, trends, or attitudes, including your interests and hobbies, purchase behaviors and consumer and market research data

Directly from you based on purchases you make from our websites or stores.* Our service providers. Other sources.***

To provide you with appropriate products, recommendations, and updates To help you find relevant products more quickly To provide customer service and support To improve our website, set default options, and provide you with a better website experience To protect the security of our website To detect and prevent fraud against you and/or us

Payment Information

Credit card or other payment information used to purchase our products

Directly from you when you transact with us. Third-party payment vendor and third-party fraud assessment tool.

To confirm that your payment was processed

*Information You Provide to Us. As indicated above, we collect personal information you provide directly to us. This includes when you, or someone on your behalf, provides information to us to:

• Purchase products from us
• Register or maintain an account with us, or subscribing to marketing emails or text program
• Enter search terms or fill out forms on our website
• Post comments, photos, or videos on our website or social media pages
• Post a review of our products or user experience
• Download or use our apps
• Obtain technical support
• Participate in a survey, testimonial, marketing promotion, sweepstakes, or contest
• Sign up for an event with us
• Contact us via phone, email, text, online chat, or postal mail
• Connect with us via social media

**Information We Collect Automatically. In addition to information you provide to us, we as well as our service providers, may automatically collect some personal information about you, including when you:

• Browse or search our website
• Open an email or text message from us or click on a link contained in our emails or texts
• Download or use our apps
• Click on an online advertisement for our products
• View our social media profiles and sites
• Use our hashtags (such as #frankibyfrancescas) on your social media posts
• Post or share information about us or our products

Cookies and Tracking Technology. We and our service providers use cookies and other tracking technologies (such as web beacons, tracking pixels, and HTTP referrers) to collect and store information about your interactions with our website, including information about your browsing and purchasing behavior. Please see the Cookies section below.

Website Analytics Information. We use Google Analytics to ensure website functionality and improve our websites. This software may record information such as your IP address, location, age and gender, browser type and language, operating system, access time, duration of visit, pages you view within our website, search terms you enter, and other actions you take while visiting us, the pages you view immediately before and after you access our website, how often you use our website, aggregated usage and performance data, application errors, and debugging information. Google Analytics is owned and controlled by Google LLC. Data collected by Google is subject to its privacy policy. We also use a technology that allows us to recreate a user experience on our Sites.

***Information We Collect from Other Sources.

We may obtain information about you from other sources, including commercially available sources, such as data aggregators and public databases. The following are examples of information we may collect from other sources, including those that we may start doing so in early 2023:

• Email
• SMS
• Name
• Postal address
• Age
• Your interests such as hobbies and pets
• Consumer and market research data
• Purchase behavior
• Publicly observed data or activities, such as blogs, videos, internet postings, user generated content, and in-store shopping behavior
• All of the information we collect about you may be combined, which helps us tailor our communications to you and maximize your customer experience with francesca’s

Devices and App Stores

For more details on personal information being collected by Apple and Google while using Apple or Android devices or upon downloading our mobile apps, please review the following links:

Apple Devices: https://www.apple.com/legal/privacy/california/

Android Devices: https://policies.google.com/privacy?hl=en

We only use sensitive personal information for purposes disclosed herein. We do not use or disclose sensitive personal information for purposes other than authorized purposes.

2. Personal Information We Disclose, Share for Targeted Advertising or Sell and the Purpose for It.

Disclosure of Personal Information to Service Providers

We disclose personal information to our service providers and contractors for various business purposes, identified below.

We disclose personal information to our service providers and contractors for various business purposes, identified below.

• Auditing of Ad Impression: We disclose personal information for auditing purposes related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
• Security and Fraud Detection: We disclose personal information for our security and fraud detection services including detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity; and prosecuting those responsible for that activity.
• Functionality & Debugging: We disclose personal information to engage in debugging to identify and repair errors that impair existing intended functionality.
• Short-Term / Transient Use: We disclose personal information for short-term, transient use, including, but not limited to, non-personalized advertising shown as part of a consumer's current interaction with the business, provided that the consumer's personal information is not disclosed to another third party and is not used to build a profile about the consumer or otherwise alter the consumer’s experience outside the current interaction with the business.
• Services on Our Behalf: We disclose personal information in order to receive services performed on our behalf, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on our behalf.
• Advertising and Marketing Services: We disclose personal information to provide advertising or marketing services on our own behalf.
• Research & Development: We disclose personal information for internal research related to technological development and demonstration.
• Quality Control & Improvement of Products and Services: We disclose personal information to verify, maintain, and improve our products and services.

We engage service providers and contractors to perform certain business-related functions on our behalf. These companies may include marketing agencies, database service providers, website analytics providers, backup and disaster recovery service providers, email service providers, payment processors, and others. When we engage another company to perform such functions, we may provide it with personal information, log data, or aggregated information about our customers, sales, website traffic patterns, and related website information, in connection with its performance of such functions. We take measures to select service providers that are responsible and require that our service providers use personal information only in accordance with the terms of this Privacy Policy and only to provide services to us.

The following chart sets forth the categories of personal information we disclose to service providers and contractors for a business purpose.

Categories of Personal Information

Business Purposes

Personal Identifiers

Auditing of Ad Impression Security and Fraud Detection Functionality & Debugging Short-Term / Transient Services on Our Behalf Advertising and Marketing Services Research & Development Quality Control & Improvement of Products and Services

Commercial Information

Auditing of Ad Impression Security and Fraud Detection Functionality & Debugging Short-Term / Transient Services on Our Behalf Advertising and Marketing Services Research & Development Quality Control & Improvement of Products and Services

Internet or Other Electronic Network Activity information (Including Geolocation Data and information collected via website analytics or through cookies and other tracking technologies)

Auditing of Ad Impression Security and Fraud Detection Functionality & Debugging Short-Term / Transient Advertising and Marketing Services Research & Development

Audio, Electronic or Visual Information

Auditing of Ad Impression Security and Fraud Detection Services on Our Behalf Advertising and Marketing Services

Inferences From Other Categories of Personal Information We Collect Payment Information

Auditing of Ad Impression Advertising and Marketing Services Research & Development Security and Fraud Detection

As Necessary: We may also disclose personal information, as necessary: (a) to our insurers and professional advisers for the purposes of managing risks, obtaining professional advice, exercising or defending against legal claims, etc.; (b) to comply with any legal process; (c) to respond to requests from public and government authorities; (d) to enforce our terms and conditions; (e) to protect our operations and protect our rights, privacy, safety or property, and/or that of you or others; and (f) to allow us to pursue available remedies or limit the damages that we may sustain. As we develop our business, we might sell or buy businesses or assets. In the event of a corporate sale, merger, reorganization, dissolution, or similar event, personal information may be part of the transferred assets. Any successor to or acquirer of franki by francesca's^® (or its assets) will continue to have the right to use your personal information and other information in accordance with the terms of this Privacy Policy.

Selling and Sharing (for Targeted Advertisement) of Personal Information

We do not sell your personal information as that term is commonly understood to be disclosure of your personal information in exchange for money. Rather, as used herein, definition of sale includes situations where another company can use your personal information for its own purposes. As noted herein, we use various companies, such as website analytics companies and social media companies, who may have access to your personal information for their own purposes. We may also disclose your personal information to our affiliates, subsidiaries and brands. Such disclosures of personal information can be deemed to constitute a sale under California law. We may also share with others certain personal information we have collected from you for cross-context behavioral advertising (targeted advertising).

The chart below shows the categories of personal information we sell (as defined herein) or share for cross-context behavioral advertising (targeted advertising) or that we have sold or shared in the past 12 months, the categories of third parties to whom we have sold or shared personal information and the purpose for the sale or sharing of the personal information.

Categories of Personal Information

Categories of Third Parties

Business or Commercial Purpose

Personal Identifiers

Third party advertising companies Analytics companies Social media companies* Affiliates, subsidiaries and brands

Ad targeting Remarketing Customized advertising content Analytics Site personalization

Commercial Information

Third party advertising companies Analytics companies Social media companies* Affiliates, subsidiaries and brands

Ad targeting Remarketing Customized advertising content Analytics Site personalization

Internet or Other Electronic Network Activity information (including Geolocation Data, and information collected via website analytics or through cookies and other tracking technologies)

Third party advertising companies Analytics companies Social media companies* Affiliates, subsidiaries and brands

Ad targeting Remarketing Customized advertising content Analytics Site personalization

Audio, Electronic, or Visual Information

Other Consumers

To show or promote product you are wearing or using when you submit pictures or videos to us in digital channels as user generated content

Inferences From Other Categories of Personal Information We Collect

Third party advertising Analytics companies Social media companies* Affiliates, subsidiaries and brands

Ad targeting Remarketing Customized advertising content Analytics Site personalization

*Social Media Companies. We work with social media sites like Facebook and Instagram, and with application developers who specialize in social commerce so you can connect with francesca's and franki by francesca's^® through your social networks and share your opinions about our products. We provide our social media service providers with access to our website so we can generate interest in our products among members of your social networks and to allow you to share your interest in our products with friends in your network. These social media service providers may collect or register your views (including whether you liked or purchased a product) and make those views available to us and on public portions of their sites. For example, when you use the hashtag #francescas in a social media post, your post is shared with us, and may appear on our website. By using our hashtag, you are consenting to our use of the information you post (including your likeness) for commercial purposes and without compensation. For more information, please see our Terms of Use.

We reserve the right to select what content appears on our social media accounts or website and may choose not to display your content even if you express an opinion about our services or products. We reserve the right to remove content from our website and social media accounts at our sole discretion. We also use third party advertising companies to place ads on other sites. We do this by allowing our advertising and social media partners to place their cookies on a browser of an individual who visits our sites and accepts the use of cookies. The data received by our third-party advertising and social media partners allows them to measure the effectiveness of such advertising and to provide advertisements on other websites about our services which are tailored to your interests. The disclosure of data received by our third-party advertising and social media partners may be considered a sale of personal information.

Cookies and Other Tracking Technologies.

Cookies. Please see our Cookies section below. Third-parties may have access to your personal information through the use of cookies. As noted, such access may constitute a sale under certain laws.

Third Party Cookies, Pixels and Web Beacon. When you visit our website, log in, register or open an email, cookies, pixels, beacons, and similar technologies may be used by our online data partners or vendors to associate these activities with information they or others have about you, including your email address. We or our partners may then send communications and marketing to these email addresses. Web beacons are small bits of code embedded in web pages or in emails. We use web beacons to deliver or communicate with cookies, to count users who have visited a web page, and to understand usage patterns. We also include web beacons in e-mails to learn if messages have been opened, acted on, or forwarded.

You can opt-out of third party cookies through your Privacy Choices here:. One of the entities that uses third-party cookies on our platform is Retention. You may opt out of receiving advertising from Retention by visiting https://app.retention.com/optout.

Other Technologies. Examples of other technologies we may use to provide better service to you include:

• Web Session Variables. Information that is passed from one web URL to another as you browse.
• Browser plug-ins/add-ons. Additional web components that may need to be installed to enable certain web features on our sites. You have the option not to install these components.

Third-Party Advertising. We share information about the use of our platforms and your interaction with us with third-parties to place advertisements on their platforms that may be of interest to you. We share some of this information directly with those parties, and in some cases through the use of cookies or other similar technologies.

Aggregated and De-Identified Data.We may also aggregate and/or de-identify your personal information so that it can no longer be linked to you. We may use and disclose aggregated/de-identified information for any purpose at our sole discretion.

User Generated Content.

francesca's Sites enable users to submit their own content for contests, blogs, videos, and other functions. Please remember that any such information you disclose becomes public information. You should exercise caution when deciding to disclose your personal, financial or other information in a submission. francescas’s cannot prevent such information from being used in a manner that may violate this Privacy Policy, the law, or your personal privacy and safety. francesca's is not responsible for user generated content. User generated content remains the sole responsibility of the person who submitted it.

3. Cookies

As noted above, we cookies for a variety of purposes. By using the website, you are consenting to the use of the technologies described herein to collect your personal information and to the storage of information on your device or web browser as described here.

What are cookies?

A cookie is a small file placed on your computer when you visit a site that can be understood by the site that issued the cookie. We use cookies to monitor how our sites are used and to help personalize your online experience. For example, when you register on our sites, we may store a unique code in a cookie on your computer. The next time you come back to the site from that computer, our servers use the cookie to recognize you. We can then use the information you provided when you registered combined with your activities on our sites to provide you advertising and offers of interest. Most browsers automatically accept cookies. Your browser gives you the ability to delete or reject browser cookies. If you block cookies, certain features on our website may not work. We do not store any sensitive personal information about you in the cookie. Emails that we and our marketing service providers send may include tracking tools that provide us with information related to whether you’ve opened an email or clicked on a link contained in an email. More information on how to unsubscribe from our marketing emails is found below. If you block or delete cookies, not all of the tracking that we have described in this policy will stop.

How can I manage cookies?

Your web browser may include settings that allow you to: (a) receive notifications when you are receiving new cookies; (b) disable cookies; or (c) delete cookies. Please refer to your web browser's help section for information on how to do this.

What do we use these technologies for?

In general, we and our service providers use cookies and other tracking technologies to optimize the functionality of our website (including by storing your browsing preferences for future visits), to help us understand how our website is used, to collect and store information about your interactions with our website, including information about your browsing and purchasing behavior, and to provide users with content or advertising based on their browsing activities. These uses are described in more detail below.

Essential Uses

We use these technologies in a way that is essential for the operation of the website or parts of it. For example, we may use cookies to determine where to route your traffic to effectively distribute the website workload across numerous servers. Web server logs allow us to count how many people visit the website and evaluate their capacity.

Performance/Analytics

We use these technologies to monitor and analyze how you use the website. We may place cookies that allow us to measure the time of your requests to our servers and our responses, to test new features, to record statistics about usage, to track your activities on the website, and to track the places from which you come to the website. We may also use third party cookies to collect information about behavior on the website for these Performance/Analytics purposes.

Functionality

We use these technologies to allow us to provide certain functionality on the website and to remember your preferences. For instance, cookies allow us to track your order history and returns and to auto-populate shipping and billing addresses. If you disable or delete cookies, you may not be able to use some functions of the website.

Advertising (including behavioral/interest based advertising)

We may use these technologies to deliver focused online banner advertisements to you both on and off the website. By using these technologies, we hope to better tailor these advertisements to your interests. Sometimes this is called online behavioral, interest based, or retargeted advertising.

4. Third Party Links.

Our emails and/or the website may contain links to other websites not operated or controlled by us ("Third Party Sites"). The policies and procedures we describe here do not apply to Third Party Sites. The links from our emails and/or the website do not imply that we endorse or have reviewed the Third Party Sites. Always review the privacy policy of any Third Party Site before sharing personal information with them, to ensure you understand their practices.

5. How Long We Keep Your Personal Information

We may retain your personal information as long as you continue to use the website or shop in our stores, and as permitted or required by law. You may close your account by contacting us using our “Contact Us” form listed at the bottom of this document. However, we may retain personal information for an additional period as is permitted or required under applicable laws. Even if we delete your personal information, it may persist on backup or archival media for an additional period of time.

We will retain your personal information for as long as necessary to fulfil the purposes we collected it. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

6. Information Security

We are committed to the protection of your personal information, and have implemented appropriate and reasonable physical, technical, and administrative safeguards to help prevent unauthorized access to, use of, and disclosure of, your personal information. When you place an order through the website, we protect your information using encryption technology. Please know, however, that no system or network can be guaranteed to be 100% secure. You should take special care in deciding what information you send to us electronically. Please keep this in mind when disclosing any personal information. Users are responsible for maintaining the secrecy of their own passwords. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you might have with us has been compromised), please immediately notify us by contacting us.

7. Age Restriction

We do not sell products for purchase by children. We sell children’s products for purchase by adults. If you are under the age of eighteen (18), you may use our websites only with the involvement of a parent or guardian.

We do not knowingly or intentionally collect any personal information from children under the age of sixteen (16), and our emails and the website are neither directed nor targeted to children less than sixteen (16). No one under sixteen (16) may provide any personal information to or on our website. As such, if you are under sixteen (16), please do not submit any personal information through our websites and do not make purchase on our websites.

If we learn we have collected or received personal information from a child under sixteen (16) without verification of parental consent (where required), we will delete that information. If you have reason to believe that a child under the age of sixteen (16) has provided personal information to us through our website, please contact us using our "Contact Us" form https://francescas.com/contact-us/

8. Email Communications

You may unsubscribe from our marketing communications by clicking the “unsubscribe” link found in every commercial email we send or by sending a request to unsubscribe using our "Contact Us" form https://francescas.com/contact-us/. If you opt-out of receiving our marketing email communications, we may still send you email messages related to your account or specific transactions with us. Unsubscribing yourself from our marketing emails will not affect our service to you.

Emails that we and our marketing service providers send may include tracking tools that provide us with information related to whether you’ve opened an email or clicked on a link contained in an email.

9. Accessing and Correcting Your Information.

If you have registered for an account on the website, you may request access to or correction of all of your personal information that we collect online and maintain by contacting us using our "Contact Us" form https://francescas.com/contact-us/ or accessing our data privacy portal here. We will take reasonable steps to respond to requests relating to personal information; however, we may reject requests that we find to be unreasonable (i.e., require disproportionate efforts or material changes to our information systems), impractical, abusive (i.e., repetitive requests, requests made in bad faith, requests that would compromise third party information), or when your identity cannot be verified. For residents of California, please see the section entitled Your Rights if You Are a California Resident.

10. Your Rights If You Are a California Resident.

If you are a resident of California, your right to submit certain requests relating to your personal information is described below. Please note that these rights are subject to certain exceptions and certain of these rights are subject to verification mechanisms. You may designate an authorized agent to make the requests below on your behalf; however, you will still need to verify your identity directly with us before your request can be processed.

Rights to Know, Correct and Delete

Rights to Know Personal Information Collected About You

If you are a California resident, you have the right to know: (1) the categories of personal information we have collected about you; (2) the categories of sources from which the personal information is collected; (3) the business or commercial purpose for collecting, selling, or sharing personal information; (4) the categories of third parties to whom we disclose personal information; and (5) the specific pieces of personal information we have collected about you. You also have the right to know the list of all third parties to whom we have disclosed personal information, as defined under California Civil Code Section 1798.83(e) (a/k/a the "Shine the Light Law"), during the preceding year for third party direct marketing purposes.

Right to Know Personal Information Disclosed, Sold or Shared and to Whom

For California residents, since we share and/or disclose your personal information, as described above, you have the right to request that we tell to you: (1) the categories of personal information that we collected about you; (2) the categories of personal information that we sold or shared about you and the categories of third parties to whom the personal information was sold or shared, by category or categories of personal information for each category of third parties to whom the personal information was sold or shared; and (3) the categories of personal information that we disclosed about you for a business purpose and the categories of persons to whom it was disclosed for a business purpose.

Right to Correct Inaccurate Information

California residents also have the right to request that we correct your personal information collected or maintained by us. If you believe that any of the personal information we maintain about you is inaccurate, you have the right to submit a request for us to correct that information. Upon receipt of a request, we will use commercially reasonable efforts to correct the information as you direct.

Right to Request Deletion of Your Personal Information

California residents also have the right to request that we delete your personal information collected or maintained by us. We will let you know what, if any, personal information we can delete from our records, and we will direct any service providers that may have collected personal information about you to delete your personal information from their records. There may be circumstances where we cannot delete your personal information or direct service providers to delete your personal information from their records. For example, if we need to: (1) retain your personal information to complete a transaction or provide services; (2) detect security incidents; (3) protect against unlawful activities; (4) identify, debug or repair errors; or (5) comply with a legal obligation.

Exercising Rights to Know, Correct and Delete, and Related Verification Measures

You may submit a request regarding your rights to know, correct and/or delete via by clicking here or by calling us at 1-800-980-1180. Upon submission of a request to know, correct or delete, we will take reasonable steps to confirm that the person submitting the request to know or request to delete is the person to whom the information relates (or his or her authorized agent), and to prevent unauthorized access or deletion of information. The specific steps taken to verify the identity of the requesting person may vary based on the nature of the request, including the type, sensitivity, and value of the information requested, the risk of harm posed by unauthorized access or deletion, the likelihood that fraudulent or malicious actors may seek the information, the robustness of personal information provided to verify your identity, the nature of our business relationship with you, and available technology for verification. We will generally try to avoid requesting additional information from you for the purpose of verification, but we may need to do so if we cannot verify your identity based on the information already maintained by us. If we request additional information to verify your identity, it will be for that purpose only and will be deleted as soon as practical after processing the request, except as otherwise provided by law. The following generally describes the verification processes we use:

• Password Protected Accounts If you have a password-protected account with us, we may use existing authentication practices to verify your identity but will require re-authentication before disclosing, correcting or deleting data. If we suspect fraudulent or malicious activity relating to your account, we will require further verification (as described below) before complying with a request to know or delete.
• Verification for Non-Accountholders. If you do not have, or cannot access, a password-protected account with us, we will generally verify your identity as follows:
• For requests to know categories of personal information, we will verify your identity to a reasonable degree of certainty by matching at least two data points provided by you with reliable data points maintained by us.
• For requests to know specific pieces of personal information, we will verify your identity to a reasonably high degree of certainty by matching at least three data points provided by you with reliable data points maintained by us. We will also require a declaration, signed under penalty of perjury, that the person requesting the information is the person whose information is the subject of the request or that person’s authorized representative. We will maintain all signed declarations as part of our records.
• For requests to correct or delete personal information, we will verify your identity to a reasonable degree or a reasonably high degree of certainty depending on the sensitivity of the personal information and the risk of harm posed by unauthorized deletion. We will act in good faith when determining the appropriate standard to apply.

If there is no reasonable method by which we can verify your identity, we will state so in response to a request to know or delete personal information, including an explanation of why we have no reasonable method to verify your identity.

If you use an authorized agent to submit a request to know, delete or correct, we may require the authorized agent to provide proof that you gave the agent signed permission to submit the request. We may also require you to do either of the following: (a) verify your own identity directly with us; or (b) directly confirm with us that you provided the authorized agent permission to submit the request. This requirement does not apply if you have provided the authorized agent with power of attorney pursuant to Probate Code sections 4121 to 4130.

We will respond to requests to know, requests to delete and / or delete no later than 45 calendar days. If we cannot verify your request within 45 days, we may deny your request. If necessary, we may take up to an additional 45 days to respond to your request but in such an event will provide you a notice and an explanation of the reason that we will take more than 45 days to respond to your request.

Right to Opt-Out of the Sale or Sharing of Your Personal Information. You may opt-out of the sale or sharing of your personal information by clicking here:

Right to Limit the Use of Your Sensitive Personal Information. You may request that we limit the use or disclosure of your sensitive personal information : (i) to that use which is necessary to perform the services or provide the goods reasonably expected by you; (ii) to help to ensure security and integrity; (iii) to perform services on our behalf; (iv) to undertake activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us; and (v) to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us. Since we do not collect or use your sensitive personal information, this right does not apply to you.

Regarding your rights to opt-out of the sale and sharing of personal information, in addition to the links above, you can also exercise your right to opt-out by using a browser that supports an opt-out preference signal (also known as a Global Privacy Control (GPC)). If you choose to use this signal, you will need to turn it on for each browser you use.

Right to Non-Discrimination for the Exercise of Your Privacy Rights

If you choose to exercise any of the privacy rights conferred by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, you also have the right not to receive discriminatory treatment by us. This means that, consistent with California law, we will not deny providing our services to you, charge you different prices or provide a different level or quality of service to you unless those differences are related to the value of your personal information.

11. Your Rights If You Are a Resident of Colorado, Connecticut, Utah or Virginia.

If you are a resident of Colorado, Connecticut, Utah or Virginia (except as noted), you have (or may soon have) certain additional rights set forth below. Please note that these rights are subject to certain exceptions and certain of these rights are subject to verification mechanisms.

The Right to Know: You have the right to know whether we are processing your personal information.

The Right of Access: You have the right to access your personal information, and to obtain a copy of it in a readily usable format, if feasible.

The Right to Correct Inaccuracies: You may request that inaccuracies in your personal information be corrected. Utah law does not provide for this right.

The Right to Delete. You have the right to request that your personal information be deleted, except in cases where retention is required by law or contractual obligation.

The Right to Data Portability: You have the right to obtain a copy of your data in a portable and, if feasible, readily usable format.

The Right to Opt-Out: You may elect to prevent your personal information from being:

(1) Used in targeted advertising;

(2) Sold; or

(3) *Used for profiling purposes that may produce legal or similarly significant effects.

* Utah law does not provide for this right.

Furthermore, in connection with your sensitive personal data: (a) if you are a resident of Utah, we will not process that information without first presenting you with clear notice and an opportunity to opt out of the processing; and (b) if you are a resident of Colorado, Connecticut or Virginia, we will not process sensitive personal data without obtaining your consent.

You may submit a request by clicking here or by calling us at 1-800-980-1180. Information requests under "Right of Access" will be transmitted securely. If we cannot fulfill your request, we will notify you of that decision and the reasons why within 45 days. At that point if you believe our decision was in error, you can submit an appeal using the method(s) above. If the result is the same, you can also seek assistance and/or redress from your state attorney general.

12. Nevada Privacy Notice.

Nevada law provides that Nevada residents may opt-out of the "sale" of "covered information" to third parties, including but not limited to names, addresses, social security numbers, and online service activity. Our uses of your personal information are not sales under Nevada law, so no opt-out is required.

13. Visitors from Outside of the United States.

Our websites are intended for a U.S. audience. This Privacy Policy is intended to meet the laws and requirements of the United States, which may not necessarily be consistent with or as comprehensive as the laws and regulations of other countries. If you are located outside of the United States, please be advised that any information you provide to us will be transferred to the United States and that by submitting information, you explicitly authorize its transfer.

14. Updates to this Privacy Policy

We periodically review this Privacy Policy for compliance with legal requirements, and corporate policies and procedures governing the security, confidentiality, and quality of personal information we collect and use. The last updated and effective date of this version of the Privacy Policy can be seen on top of this page.

15. How to Contact Us.

If you have any comments or questions about how we collect and use your personal information, please reach out to us. You can contact us by clicking here or by calling us at 1-800-980-1180.