US State privacy notice

1. Scope of Disclosures.

This additional US State privacy notice (the “US State Law Notice”) supplements the information contained in our Privacy Policy and applies solely to individual residents of the States of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia (“consumers” or “you”).

This US State Law Notice provides additional information about how we collect, use, disclose and otherwise process personal information of individual residents of the States of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, either online or offline.

Unless otherwise expressly stated, all terms in this US State Law Notice have the same meaning as defined in our Privacy Policy or as otherwise defined under applicable privacy laws.

2. Personal Information Disclosures.

When we use the term “personal information” in this US State Law Notice, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. It does not include aggregated or anonymized deidentified information that is maintained in a form that is not capable of being associated with or linked to you. Where we maintain de-identified information, we will maintain and use such information in de-identified form and will not attempt to re-identify the information, except as permitted by applicable law.

2.1. Collection and Use of Personal Information

In the last 12 months, we have collected the following categories of personal information from the following sources of personal information for the following purposes, which reference the personal information, sources and purposes described in What Personal Information We Collect and How We Collect It and The Way We Use Personal Information sections of our Privacy Policy:

2.2. Disclosure of Personal Information

In the last 12 months, we have disclosed for a business purpose and sold the following categories of personal information, which reference the categories of personal information described above:

*Note about “Sales” of information: We may “sell” (as such term is defined under the CCPA and other applicable state privacy laws) or “share/use for targeted advertising” (as such terms are defined under the CCPA and other applicable state privacy laws) the following categories of personal information:

• Identifiers;
• Characteristics of protected classifications under California and federal law;
• Internet/electronic activity;
• Commercial information; and
• Inferences drawn from the categories described above in order to create a profile about you reflecting your preferences, characteristics, behavior and attitudes.

We “sell” and “share/use for targeted advertising” your personal information to digital advertising networks. We utilize these third-party providers to engage in online analytics and advertising involving the collection of personal information directly from your browser or device through cookies or related technologies when you visit or interact with our online services or otherwise engage with us online. We use these third-party providers to analyze and optimize our online services, provide more relevant content and ads to users of our online services and other third parties, and perform other services related to analytics or advertising consistent with this US State Law Notice and our Privacy Policy. These third-party businesses may use the information they collect directly from you for their own purposes in accordance with their own privacy notices, which may include using this information for services provided to other third parties, including other parties operating in advertising networks.

To the extent that these practices qualify as “sales” under the CCPA or other state privacy laws, you may have the right to opt out as described below. Please see the Cookies and Other Data Collection Technologies section of our Privacy Policy for more information about the choices and opt-out options you may have in relation to those practices.

2.3. To Whom We Disclose Personal Information

As described in The Way We Use Personal Information section of our Privacy Policy, we share personal information within Fundbox and with a variety of recipients for business purposes.
In addition to the categories of recipients identified in The Way We Use Personal Information section of our Privacy Policy, we disclose personal information to, or allow access to personal information by, the following categories of recipients:

• Broker and Loan Provider Partners
• Customer Service Vendors
• Cloud Computing Service Providers
• IT and Quality Assurance Vendors
• Marketing and Advertising Partners
• Payment and Auditing Processors
• Security Safety Vendors and Service Providers

3. Your US State Privacy Rights

As a resident of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, you may be able to exercise the following rights in relation to the Personal Information about you that we have collected (subject to certain limitations at law):

The Right to Know

You have the right to request any or all of the following information relating to the personal information we have collected about you or disclosed in the last 12 months, upon verification of your identity:

• The specific pieces of personal information we have collected about you;
• The categories of personal information we have collected about you;
• The categories of sources of the personal information we have collected about you;
• The categories of personal information that we have disclosed about you to third parties for a business purpose, and the categories of recipients to whom this information was disclosed;
• The categories of personal information we have sold about you, and the categories of third parties to whom this information was sold; and
• The business or commercial purposes for collecting or selling personal information about you.

If you are a Delaware, Maryland, Minnesota or Oregon resident, you can also request a list of specific third parties, as defined under Delaware, Maryland, Minnesota and Oregon laws, to which we have disclosed personal information.

The Right to Request Deletion

You have the right to request the deletion of personal information that we have collected from you, subject to certain exceptions.

The Right to Correct

You have the right to request that we correct inaccurate personal information that we maintain about you, subject to certain exceptions.

The Right to Data Portability

You have the right to request that we provide your personal information in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the information to another entity without hindrance.

The Right to Opt Out

The right to direct us not to “sell” personal information we have collected about you to third parties or to share or use your personal information for targeted advertising purposes.

The Right to Non-Discrimination

You have the right not to receive discriminatory treatment for exercising any of the rights described above.
However, please note that if the exercise of the rights described above limits our ability to process personal information (such as in the case of a deletion request), we may no longer be able to provide you our products or services or engage with you in the same manner.

“Shine the Light”

California residents that have an established business relationship with us have rights to know how their information is disclosed to third parties for their direct marketing purposes under California’s “Shine the Light” law (Civ. Code § 1798.83).

3.1. How to Exercise Your Right to Know, Right to Deletion, Right to Correction or Right to Data Portability

To exercise your right to know, right to deletion, right to correction and right to data portability, please submit a request by:

• Emailing support@fundbox.com with the subject line “US State Law Rights Request,” or
• Calling (855) 572-7707.

We will need to verify your identity before processing your request. In order to verify your identity, we will generally either require the successful login to your account or the matching of sufficient information you provide us to the information we maintain about you in our systems.
Although we try to limit the personal information collected in connection with a request to exercise the right to know and the right to deletion, certain requests may require us to obtain additional personal information from you. In certain circumstances, we may decline a request to exercise the right to know and right to deletion, particularly where we are unable to verify your identity.

3.2. Do Not Sell or Share/Use My Personal Information for Targeted Advertising

Under California law, “share” means disclosing your personal information by us to a third party for cross-context behavioral advertising, in exchange for money or anything else of value. Thus, when we use the term “share” under this section, we are using it in the narrow meaning of how it is defined under California law. Other State Privacy Laws do not use the term “share,” but describe the concept as using personal information for targeted advertising.

Under some state privacy laws (such as California) “sell” means exchanging your personal information by us with a third party for money or anything else of value. Under other laws (such as Virginia), “sell” is the exchange of personal information for money only. We do not engage in the latter.

We participate in digital advertising networks to deliver advertising that is tailored to your interests, and participation in certain advertising networks can constitute a “sale” or “sharing/using for digital advertising” personal information under the CCPA and other state privacy laws. In order to opt out of this activity, please visit optout.aboutads.info and optout.networkadvertising.org. Alternatively, you may opt out of the sale or sharing/use of your personal information for targeted advertising for online activity by enabling an opt-out preference signal through your browser or a browser plug-in or extension (such as Global Privacy Control) that clearly signals your intent to opt out of the sale and sharing of your personal information.

We recognize and process the Global Privacy Control (“GPC”) opt-out preference signal. If you visit our Site with GPC enabled on your browser or device, we will treat that signal as a valid request to opt out of the sale or sharing/use of your personal information for targeted advertising, to the extent required by applicable law, including the California Consumer Privacy Act (as amended by the California Privacy Rights Act), the Colorado Privacy Act, and any other applicable state privacy law that requires recognition of universal opt-out mechanisms. Please note that because GPC signals are processed at the browser or device level, your opt-out preference may not be automatically linked to your Fundbox account if you are logged in at the time. To ensure your opt-out preference is applied across all of your interactions with Fundbox, we recommend also submitting a direct opt-out request using the contact information provided in Section 3.1 above.

3.3. Minors Under Age 16

We do not sell the personal information of consumers we know to be less than 16 years of age, unless we receive affirmative authorization (the “Right to Opt In”) from either the minor who is between 13 and 16 years of age, or the parent or guardian of a minor less than 13 years of age.

3.4. “Shine the Light”

California Civil Code Section 1798.83 permits our customers who are California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please send an email to support@fundbox.com. Please note that we are only required to respond to one request per customer each year.

3.5. Authorized Agent

In certain circumstances, you are permitted to use an authorized agent to submit requests on your behalf where (i) you provide sufficient evidence to show that the requestor is an authorized agent with written permission to act on your behalf and (ii) you successfully verify your own identity with us.

3.6. Profiling

Certain state privacy laws, including the laws of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah and Virginia, provide consumers with the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. We do not engage in profiling of consumers in furtherance of decisions that produce legal or similarly significant effects, as defined under applicable state privacy laws. If our practices change in the future, we will update this US State Law Notice accordingly and provide any required opt-out mechanisms.

4. Financial Incentives.

We do not offer any financial incentives in exchange for the retention or sale of personal information. If we do offer any financial incentives in the future, we will provide a summary of the incentive offered the categories of personal information implicated, how a consumer can opt-in and an explanation of why the financial incentive is permitted under applicable law.

5. Right to Appeal

If you are a California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia resident and we denied your request, you may appeal the denial we sent when your original request was completed by contacting us at support@fundbox.com.

6. Sensitive Personal Information

We do not collect or process Sensitive Personal Information, as defined by California Law or other state privacy laws, for inferring characteristics or use or disclose Sensitive Personal Information for purposes other than those permitted by law.

7. Retention

We will store your personal information for as long as is reasonably necessary to fulfill the purposes described in this Privacy Policy or as required by law.

8. Updates to This Notice.

We will update this US State Law Notice from time to time. When we make changes to this US State Law Notice, we will change the “Last Updated” date at the beginning of this US State Law Notice. All changes shall be effective from the date of publication unless otherwise provided in the notification.

9. Questions.

We are committed to protecting your privacy. Protecting your privacy online is an evolving area, and we are constantly evolving our Service to meet these demands. If you have any comments or questions regarding this US State Law Notice, our Privacy Policy, or your Personal Information that we may be storing and using, please contact us at support@fundbox.com.