Privacy Notice for California Residents

PRIVACY NOTICE FOR CALIFORNIA RESIDENTS

This Privacy Notice for California Residents supplements the information contained in CreditIQ, LLC’s (“CreditIQ” “we” “us” or “our”) general Privacy Notice (“Privacy Notice”) and applies solely to all visitors, users, and others who reside in the State of California (“consumers” or “you”). If you are a California resident, California law provides you with additional rights regarding our use of your Personal Information. We provide this notice in accordance with the California Consumer Privacy Act of 2018 and California Privacy Rights Act of 2020 (collectively the “CCPA”) and any terms defined in the CCPA have the same meaning when used in this Notice. References to “Site” shall mean the CreditIQ website located at www.creditiq.com and “Service” shall refer to the services offered by CreditIQ on the Site, and other services used to service our products and Service.

Information We Collect.

Please see our Privacy Notice for a description of the Personal Information we collect.

In particular, we have collected the following categories of Personal Information from or about consumers within the last twelve (12) months:

Category	Examples	Collected
A. Identifiers.	Real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.	YES
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	Name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.	YES
C. Protected classification characteristics under California or federal law.	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).	YES
D. Commercial information.	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	YES
E. Biometric information.	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.	NO
F. Internet or other similar electronic network activity.	Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.	YES
G. Geolocation data.	Physical location or movements.	NO
H. Sensory data.	Audio, electronic, visual, thermal, olfactory, or similar information.	NO
I. Professional or employment-related information.	Current or past job history or performance evaluations.	YES
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	NO
K. Inferences drawn from other personal information.	Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	NO
L. Sensitive Information	Government identifiers (social security, driver’s license, state identification card, or passport number); Complete account access credentials (usernames, account numbers, or card numbers combined with required access/security code or password); Precise geolocation; Racial or ethnic origin; Religious or philosophical beliefs; Union membership; Genetic data; Mail, email, or text messages contents; Unique identifying biometric information; Health, sex life, or sexual orientation information.	YES

We obtain the categories of Personal Information listed above:

Directly from you when you provide it to us, including any correspondence or communication with us, such as through e-mail, webforms, or through your use of the Sites and/or Services.
Automatically as you navigate the Site and/or interact with the Service. Information collected automatically may include usage details, IP addresses, and information collected through cookies, web beacons, and other tracking technologies.
From third parties, such as our business partners, who have a right to provide us with that information.

Use of Personal Information.

Please see our Privacy Notice for a description of how we use your Personal Information.

Sharing Personal Information.

We may share the Non-Personal Information we collect and obtain for any lawful business purpose without any duty or obligation of accounting or otherwise to you, provided that the information remains Non-Personal Information. This will include, by way of example, sharing that Non-Personal Information with third parties.

We may share your Personal Information to a third party for a business purpose. When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.

We may disclose personal information that we collect or that you provide as described in our Privacy Notice:

To our parent company, subsidiaries, and affiliates.
When you use the Site and/or Service, we may share information with contractors, service providers, and other third parties that help us provide the Site and/or Service. For example, we may use third parties to: (a) host, maintain, or manage the Service; (b) collect or analyze information; (c) customize or assist us in managing our databases; or (d) provide other services relating to the Services. We require that these third parties agree to use the Personal Information we share with them only to perform their obligations to us, to treat all Personal Information they receive from us as confidential, and to comply with this Privacy Notice.
We may share Personal Information and Sensitive Personal Information that we collect through your use of our Service with third-party service providers. This Privacy Notice does not govern any information you provide directly to a third-party service provider. We may also use third party service provides to collect your Personal Information and Sensitive Personal Information.
To third parties to market their products or services to you if you have consented to/not opted out of these disclosures. We contractually require these third parties to keep Personal Information confidential and use it only for the purposes for which we disclose it to them.
When you use our Service, we may share collected Personal Information with lending partners or automotive dealerships that utilize our Service.
For any other purpose disclosed by us when you provide the information.
With your consent.

We may also disclose your personal information:

To comply with any court order, law, or legal process, including to respond to any government or regulatory request.
To enforce or apply any agreement we have with you.
If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of CreditIQ, our customers, or others.
If we transfer ownership or control of any portion of CreditIQ or the Site and/or Service to a third party, whether or not in the context of an acquisition, merger, or reorganization, we may transfer information to that third party, provided that the use of any of your Personal Information by that third party remains subject to the terms of this Privacy Notice.

Disclosures of Personal Information for a Business Purpose.

In the preceding twelve (12) months, CreditIQ has disclosed the following categories of Personal Information for a business purpose:

Category A: Identifiers.

Category B: California Customer Records personal information categories.

Category C. Protected classification characteristics under California or federal law.

Category D: Commercial information.

Category F: Internet or other similar network activity.

Category I: Professional or employment related evaluations.

Category L: Sensitive Information

We have disclosed your Personal Information for a business purpose to the following categories of third parties:

Service providers
Marketing and advertising providers
Dealers
Banking partners/lenders

Opting Out of the Sale and Sharing of Personal Information.

California residents may opt out of the “sale” or “sharing” of their Personal Information. While CreditIQ does not exchange Personal Information for payment, we share information with businesses who provide cross-platform advertising and related tracking and analytics for our products in a way that falls under the CCPA’s broad definition of “sale” or “share.” Under the CCPA, “sale” is defined such that it may include allowing third parties to receive certain information, such as cookies, IP address, and/or browsing behavior, to deliver targeted advertising related to the services. “Sharing” is defined as any disclosure, transfer, or other communication of Personal Information to third parties for purposes of advertising that is targeted based on a consumer’s activities on third-party and distinctly branded digital platforms, whether or not for monetary gain. CreditIQ does not knowingly sell the information of minors under the age of 18 without affirmative consent.

IIf you would like to opt out of the use of your Personal Information for such purposes that may be considered a “sale” or “sharing” under California law, you may do so by emailing support@creditiq.com.

Your Rights and Choices.

The CCPA provides California residents with specific rights regarding their Personal Information. This section describes your CCPA rights and explains how to exercise those rights. Please note that we may limit the information we provide you, or deny your request, if the access request for information is governed by a superseding federal regulation (ie: GLBA, FCRA, etc).

Access, Use Limitation, and Data Portability Rights.

You have the right to request that we limit the use and disclosure of certain Personal Information, opt-out of the use of certain Personal Information, as well as disclose certain information to you about our collection and use of your Personal Information over the past 12 months. Please note that the rights below are not unqualified, we may be entitled to refuse requests, wholly or partly, where exceptions under applicable law apply You may request that we:

Disclose to you the categories of Personal Information we collected about you.
Disclose to you the categories of sources for the Personal Information we collected about you.
Disclose to you our business or commercial purpose for collecting or selling that Personal Information.
Disclose to you the categories of third parties with whom we share that Personal Information.
Disclose to you the specific pieces of Personal Information we collected about you (also called a data portability request).
Disclose to you if we sold, shared, or otherwise disclosed your Personal Information for a business purpose, separately disclosing:
- Sales, identifying the Personal Information categories that each category the recipient purchased;
- Sharing, identifying the Personal Information categories that we shared with each category of recipient; and
- Disclosures for a business purpose, identifying the Personal Information categories that each category of recipient obtained.
Disclose to you if we used automated decision-making technology to evaluate or create a profile of you and provide information about the logic involved in such decision-making processes, including descriptions of the likely outcome.
Stop using automated decision-making technology to evaluate you, create a profile of you, and make predictions about your future behavior.
Limit the use and disclosure of your “sensitive personal information,” as that term is defined in the CCPA. At your request, we will use “sensitive personal information” only for purposes necessary to provide the Service.

Deletion Request Rights.

You have the right to request that we delete your Personal Information that we have collected from you and retained, subject to certain exceptions. Once we receive and confirm your consumer rights request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.

We may deny your deletion request if retaining the information is necessary for us, or our service provider(s), to:

Complete the transaction for which we collected the Personal Information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform our contract with you.
Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
Debug products to identify and repair errors that impair existing intended functionality.
Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
Comply with a legal obligation.
Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
Comply with applicable federal regulations with different retention, deletion, access, disclosure, or storage requirements which take precedence over state regulations

Correcting Your Personal Information.

You have the right to request that we correct any inaccurate Personal Information we hold about you. Upon receipt and verification of your request to correct inaccurate Personal Information, we will use commercially reasonable efforts to correct your Personal Information as directed by you, pursuant to the law and applicable regulations.

Exercising Access, Use Limitation, Data Portability, Deletion, and Correction Rights.

To exercise the access, use limitation, data portability, and deletion rights described above, please submit a consumer rights request to us by any of the following methods:

By calling 1.888.977.7773
By emailing support@creditiq.com

Only you, or someone legally authorized to act on your behalf, may make a consumer rights request related to your Personal Information. To designate an authorized agent, please contact us through the methods noted above. Only the consumer or authorized agent may make a consumer rights request related to their personal information. An “authorized agent” is a person (or a business entity registered with the California Secretary of State) that consumers have authorized to act on their behalf, or an individual granted authority under a written power of attorney issued pursuant to California Probate Code sections 4000 to 4465.

If you are an authorized agent who wishes to submit a request to know, a request to limit use, a request to delete, or a request to opt-out on behalf of another consumer, please submit to us sufficient information to allow us to verify your identity to a reasonably high degree of certainty and either:

Proof of authorization to submit the request, written and signed by the consumer; or
A power of attorney pursuant to Probate Code sections 4000 to 4465.

We may deny a request from an authorized agent who does not submit adequate proof that they have been authorized by the consumer to act on the consumer’s behalf. We may also contact the consumer directly to confirm their identity and that they provided you permission to submit the request on the consumer’s behalf.

You may only make a consumer rights request for deletion, access, or data portability twice within a 12-month period. The consumer rights request must:

Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative.
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you.

Making a consumer rights request does not require you to create an account with us. However, we do consider requests made through your password protected account sufficiently verified when the request relates to Personal Information associated with that specific account.

We will only use Personal Information provided in a consumer rights request to verify the requestor’s identity or authority to make the request.

Response Timing and Format.

We endeavor to respond to a consumer rights request within thirty (30) days of its receipt. If we require more time (up to 45 days), we will inform you of the reason and extension period in writing.

We will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your consumer rights request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights.

California Do Not Track Disclosure.

Do Not Track (“DNT”) is a privacy preference that you can set in your web browsers, which allows you to opt out of tracking by websites and online services. We do not currently support DNT browser settings and do not currently recognize or respond to DNT signals.

California Shine the Light.

California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our Service who are California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please send an email to support@creditiq.com.

Changes to this Privacy Notice.

We reserve the right to update and periodically amend this Privacy Notice at our discretion and at any time. If we make changes to this Privacy Notice, amendments will be posted online, and the date of update will be included. Your continued use of CreditIQ and its affiliated sites after any such update indicates your agreement to the same.

Contact Information.

If you have any questions or comments about this notice, the ways in which CreditIQ collects and uses your information, or your choices and rights regarding such use, please do not hesitate to contact us at:

Phone: 1.888.977.7773
Email:support@creditiq.com

You may also mail us with general questions at:

CreditIQ, LLC
300 S. Riverside Plaza, Suite 1000
Chicago, IL 60606

Effective Date: January 1, 2023