NOTICE TO CALIFORNIA RESIDENTS

The California Consumer Privacy Act (CCPA) requires that we provide California residents with a privacy policy that contains a comprehensive description of our online and offline practices regarding the collection, use, disclosure, and sale of personal information and of the rights of California residents regarding their personal information. This section of the Privacy Policy is intended solely for, and is applicable only as to, California residents. If you are not a California resident, this does not apply to you.

The CCPA defines “personal information” to mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California resident or household. Personal information does not include information publicly available, deidentified or aggregated information. For purposes of this “NOTICE TO CALIFORNIA RESIDENTS” section we will refer to this information as “Personal Information.”

Right to Know About Personal Information Collected, Disclosed, or Sold

If you are a California resident, you have the right to request that we disclose what Personal Information we have collected about you in the 12-month period preceding your request. This right includes the right to request any or all of the following:

(1) Specific pieces of Personal Information that we have collected about you;
(2) Categories of Personal Information that we have collected about you;
(3) Categories of sources from which the Personal Information was collected;
(4) Categories of Personal Information that we sold (if applicable) or disclosed for a business purpose about you;
(5) Categories of third parties to whom the Personal Information was sold (if applicable) or disclosed for a business purpose; and
(6) The business or commercial purpose for collecting or, if applicable, selling Personal Information.

The CCPA defines “sell” to mean selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a California resident’s Personal Information to another business or a third party for monetary or other valuable consideration.

Collection of Personal Information

We currently collect and, in the 12 months prior to the Effective Date of this Privacy Policy, have collected the following categories of Personal Information about California residents directly from them and from advertising networks, internet service providers, operating systems and platforms, social networks, and lead providers:

• Name
• Alias
• Postal address
• Unique personal identifiers (device identifier; cookies, beacons, pixel tags, mobile ad identifiers, or other similar technology; customer number, unique pseudonym or user alias; telephone numbers, or other forms of persistent or probabilistic identifiers that can be used to identify a particular consumer or device)
• Online identifier
• Internet Protocol address
• Email address
• Social Security number
• Telephone number
• Signature
• Insurance policy number or subscriber identification number
• Internet or other electronic network activity information (browsing history; search history; and information regarding consumer’s interaction with website, application or advertisement)
• Geolocation data
• Professional or employment-related information (including employment history)

We collected the above Personal Information for the following business or commercial purposes:

• Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards
• Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity
• Debugging to identify and repair errors that impair existing intended functionality
• Short-term, transient use, provided that the personal information is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction
• Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider
• Undertaking internal research for technological development and demonstration.
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business
• Advancing a person’s commercial or economic interests, such as by inducing another person to buy, rent, lease, join, subscribe to, provide, or exchange products, goods, property, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction

Disclosure or Sale of Personal Information

The following table identifies the categories of Personal Information that we disclosed for a business purpose to service providers or sold to third parties in the 12 months preceding the Last Updated date of this Privacy Policy and, for each category, the category of service providers or third parties to whom the Personal Information was sold or disclosed:

In addition, when you apply for a loan using our Services, you must agree to our Terms of Use, in which you will consent to the disclosure of your Personal Information to other entities, such as financial institutions, as part of your application process. In so doing, you are directing us to intentionally disclose your personal information and using us to intentionally interact with third parties. If you do not consent to these transfers, do not use our Services. We do not knowingly collect or sell the Personal Information of minors under 16 years of age.

Right to Request Deletion of Personal Information

If you are a California resident, you have the right to request that we delete the Personal Information about you that we have collected or maintain. However, per the CCPA, we are not required to comply with a request to delete if it is necessary for us to maintain the Personal Information in order to, for example, complete a transaction, detect security incidents, comply with a legal obligation, or otherwise use the Personal Information, internally, in a lawful manner that is compatible with the context in which you provided the information.

How to Submit a Request to Know or Delete

You may submit a request to know or delete by sending an email to privacy@openroadlending.com or by calling us at (888) 536-3024. If you submit a request to delete online, you may be asked to confirm separately that you want your Personal Information deleted.  You can submit directly with this link.  https://www.openroadlending.com/CCPA

Our Process for Verifying a Request to Know or Delete

We will comply with your request upon verification of your identity and, to the extent applicable, the identity of the California resident on whose behalf you are making such request.

For requests to access categories of Personal Information and for requests to delete Personal Information that is not sensitive and does not pose a risk of harm by unauthorized deletion, we will verify your identity to a “reasonable degree of certainty” by verifying at least two data points that you previously provided to us and which we have determined to be reliable for the purpose of verifying identities.

For requests to access specific pieces of Personal Information or for requests to delete Personal Information that is sensitive and poses a risk of harm by unauthorized deletion, we will verify your identity to a “reasonably high degree of certainty” by verifying at least three pieces of Personal Information previously provided to us and which we have determined to be reliable for the purpose of verifying identities. In addition, you will be required to submit a signed declaration under penalty of perjury stating that you are the individual whose Personal Information is being requested.

Right to Opt-Out of Sale of Personal Information

If you are a California resident, you have the right to direct us to stop selling your Personal Information. To opt-out of our use of third-party advertising Cookies, please see the section “How You Can Opt-Out of Cookies” above. In addition, you may submit a request to opt-out of sales through our interactive webform available by clicking on this link: “Do Not Sell My Personal Information.” You also may submit a request by calling us toll-free at 888-536-3024 or emailing us at privacy@openroadlending.com.

Only you, or a person registered with the California Secretary of State whom you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may only make a verifiable consumer request twice within a 12-month period.

For a verifiable consumer request, you must be able to:

• Describe your request with sufficient detail to allow us to properly understand, evaluate, and respond; and
• Provide sufficient information to allow us to reasonably verify you are the California resident about whom we collected Personal Information or an authorized representative of such resident. The information you provide must include:
  • Confirmation of California residency;
  • Full name;
  • Address;
  • Email address; and
  • Other information that authenticates you (if a customer) or verifies you (if non-customer or authorized party).

Right to Non-Discrimination for the Exercise of a California Resident’s Privacy Rights

We will not discriminate against California residents if they exercise any of the rights provided in the CCPA as described in this section “Notice to California Residents.” As such, we will not deny goods or services to that California resident; charge different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; provide a different level or quality of goods or services to the California resident; or suggest that the California resident will receive a different price or rate for goods or services or a different level or quality of goods or services. However, we are permitted to charge a California resident a different price or rate, or provide a different level or quality of goods or services, if that difference is reasonably related to the value provided to us by the individual’s data.

Authorized Agents

If you are submitting a request on behalf of a California resident, please submit the request through one of the designated methods discussed above. After submitting the request, we will require additional information to verify your authority to act on behalf of the California resident.

Response Time and Method

We will respond to your verifiable request within 10 days of receipt. We will provide access to personal information within 45 days of receiving your request. If we require more time (up to 90 days), we will notify you in writing and inform you of the reason.

We will deliver our written response by mail or electronically (provided we can do so securely) at your direction. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

Further, we will not provide personal information, such as a Social Security number or any other specific pieces of Personal Information, if the disclosure could result in unauthorized access, causing fraud or other security risks. We will only use the personal information you provide to verify your identity or the identity of the individual on whose behalf you are making the request.

Shine the Light Law

If you are a California resident, California Civil Code § 1798.83 permits you to request information regarding the disclosure of your personal information by us to third parties for the third-parties’ direct marketing purposes (as those terms are defined in that statute). To make such a request, please send an email to privacy@openroadlending.com or write to us at 5555 N. Beach Street Ste 4100, Fort Worth, TX 76248