Your privacy is important to us. At BondAval Insurance Services, Inc. (hereinafter referred to as “BondAval”), we are committed to protecting your non-public personal information as required by law. This notice is to advise you of how we will handle this information.

WHAT IS PERSONAL DATA?

In this privacy policy, references to “personal information” or “personal data” are references to information that relates to an identified or identifiable individual. Some examples of personal data are:

• Your name

• Company

• E-mail address

• Address

• Telephone number

• IP address and location (in certain jurisdictions)

TYPES OF INFORMATION WE COLLECT ON THIS WEBSITE

You can visit the website of BondAval without revealing who you are or providing any personal information about yourself.

There will be times, such as when you request information or a publication, when we will need to obtain personally identifiable information from you or about you. However, this information will not be collected without your knowledge.

The information we receive about you or from you may be used by us to process your inquiry or request, to comply with any law, regulation, or court order, and to help improve our website or the products or services we offer.

When you visit this website, we may collect usage information (including, but not limited to, IP addresses, browser and platform types, domain names, access times, and referral data) to help us understand how our website is navigated and used. This data does not include any personal information about you and is used only to measure and improve the effectiveness of our website.

HOW WE USE YOUR INFORMATION/USE OF COLLECTED PERSONAL INFORMATION

BondAval only processes personal information for the purposes described in this Privacy Policy and/or privacy notice for specific services. Such services may include:

• Providing our insurance services to users;

• Auditing, research, and analysis in order to maintain, protect, and improve our services;

• Ensuring the technical functioning of our network; and

• Developing new services.

Promotional Messaging or Advertising: Any Promotional Messaging or Advertising material is for general informational purposes only and does not constitute an offer to sell or a solicitation of an offer to buy any product or service.

ABILITY TO OPT-IN/OUT

If we propose to use your personal information for any purposes other than those described in this Policy and/or in the specific service notices, you may "opt-out" or say no to having your information shared by contacting us through our contact page. We will not collect or use sensitive information for purposes other than those described in this Policy and/or in the specific service notices unless we have obtained your prior consent.

If you do choose to decline to submit personal information to any of our services, there may be some instances in which we may not be able to provide those services to you.

INFORMATION PROVIDED BY YOU

When you engage us to provide insurance services, we may ask you for personal information (such as your name, address, social security number, date of birth, phone numbers, credit card information, and email address) which we maintain in encrypted form on secure servers. We may combine the information submitted under various forms and services in order to provide customers with a better experience and to improve the quality of our services.

We may need to use your personal data in order to carry out the following activities:

• To set you up as a new client (including carrying out ‘know your customer’ checks);

• To provide you with an insurance quote;

• To provide our products and services to you;

• To respond to your inquiries;

• To accept payments from you;

• To communicate with you about your policy;

• To renew your policy;

• To obtain reinsurance for your policy;

• To process insurance and reinsurance claims;

• For general insurance administration purposes;

• To comply with our legal and regulatory obligations;

• To model our risks;

• To defend or prosecute legal matters;

• When you sign up for an online account;

• To make our products and services better and to develop new products and services; and

• To send you notices and information regarding our products or services, including notifying you about special promotions or offers, where we are legally permitted to do so.

INFORMATION COLLECTED FROM OTHER SOURCES

From time to time, we may receive personal information about you from third party sources but only where we have checked that these third parties either have your consent or are otherwise legally permitted or required to disclose your personal information to us. This Privacy Policy applies to how we handle your information. We do not exercise control over the websites that are displayed in other browser windows opened by links from within our various services. These other sites may place their own cookies or other files on your computer, collect data, or solicit personal information from you.

DISCLOSURE OF PERSONAL INFORMATION TO THIRD PARTIES, VENDORS, SERVICE PROVIDERS, OR FOR COMPANY COMMUNICATIONS

We may disclose personal information that we collect, or you provide, as described in this privacy policy under the following circumstances:

• To transfer data to our affiliates from time to time for our legitimate business purposes. Affiliates are defined as group companies, subsidiaries, parent companies, joint ventures, and other corporate entities under common BondAval ownership;

• To contractors, service providers, and other third parties we use to support our business that are bound by an obligation to keep personal information confidential and use it only for the purposes for which we disclose it to them;

• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of the Company's assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by the Company about our Website users is among the assets transferred; and

• To fulfil the purpose for which you provide it.

CHOICES ABOUT THE COLLECTION AND USE OF YOUR INFORMATION

This website may use "cookies" to enhance your viewing experience. A cookie is a tiny element of data that is sent to your browser to be stored on your hard drive so that we can recognize you when you return. You may set your browser to notify you when you receive a cookie or refuse cookies from all websites. Please note, if you reject cookies, it is possible that some web pages may not load properly, your access to certain information might be denied, or you might be required to enter information more than once.

• Promotional Offers from the Company: If you do not wish to have your e-mail address/contact information used by the Company to promote our own or third parties' products or services, you can opt-out by using one of the methods described above in 'How We Use Your Information'.

• Targeted Advertising: If you do not want us to use information that we collect or that you provide to us to deliver advertisements according to our advertisers' target-audience preferences, you can opt-out by using one of the methods described above in 'How We Use Your Information'.

ACCESS TO AND CORRECTION OF PERSONAL INFORMATION

If you believe that any personal information we have collected about you is inaccurate, you may send a written request via our contact page to correct or delete any personal information that you have provided to us. We will investigate your request and make appropriate changes if warranted.

We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect.

COLLECTION OF INFORMATION FROM CHILDREN

We do not knowingly collect personal information from anyone under the age of 13. If you believe that we are processing personal information pertaining to a child inappropriately, we ask you to contact us using the information provided under the “Contact Us” section.

For more information about protecting your child's privacy online, visit the Federal Trade Commission website at https://www.ftc.gov.

OTHER CONSIDERATIONS

When you use some BondAval products, services, or applications or post on a BondAval forum, chat room, or social networking service such as Facebook, X (Twitter), or other such social media sites, the personal information and content you share is visible to other users and can be read, collected, or used by them.

THE HEALTH INSURANCE PORTABILITY AND ACCOUNTABILITY ACT OF 1996 (HIPAA)

BondAval is required by law to take reasonable steps to ensure the privacy of your personally identifiable health information, and to inform you about:

• The Company's uses and disclosures of Protected Health Information ("PHI");

• Your privacy rights with respect to your PHI;

• The Company's duties with respect to your PHI;

• Your right to file a complaint with the Company and to the Secretary of the U.S. Department of Health and Human Services ("HHS"); and

• The person or office to contact for further information regarding the Company's privacy practices.

PHI includes all individually identifiable health information transmitted or maintained by BondAval, regardless of form (e.g. oral, written, electronic). A federal law, the Health Insurance Portability and Accountability Act of 1996 ("HIPAA"), regulates PHI use and disclosure by BondAval. You may find these rules at 45 Code of Federal Regulations Parts 160 and 164.

STATE SPECIFIC PRIVACY LAWS

Many states and territories have their own privacy regulations which apply to individuals and corporations that live or do business in, frequent, or offer good and services to its residents. The individual laws of these states vary and as such you should familiarize yourself with your individual state laws.

Addendum 1 which can be found at the end of this notice summarizes each current state privacy regulation.

CONFIDENTIALITY AND SECURITY

We will not add your name to mailing lists unless you specifically request that we do so. We do not share, sell, lease, or rent our mailing or customer lists to third parties. We may use third parties to help us administer e-mail alerts. If personally identifiable information (i.e. name, address, e-mail address, telephone number) is provided to any of these third parties, we will require that they maintain such information in strictest confidence in compliance with this policy. We also assess new technology for protecting customer information on an ongoing basis.

We take the security of your personal information seriously and take appropriate technical and organizational measures against unauthorized or unlawful processing of personal data, and against accidental loss, destruction of, or damage to, personal data. Please contact us immediately if you believe your Personal Information has been exposed.

Although we take appropriate measures to protect the security of the information communicated through the website, no Internet connected computer system can be made absolutely secure from intrusion. We, therefore, cannot and do not guarantee that information communicated by you to us will be received or that it will not be altered before or after its transmission to us. If you elect to use the website to communicate with us, you do so at your own risk.

QUESTIONS AND CONCERNS

If you have any questions or comments in regards to this privacy statement, or if you have any concerns as to the validity of information made available within these pages, we recommend you seek verification by contacting us via our ‘Contact Us’ page.

Please note that we may update and modify this Privacy Statement. It remains your responsibility to access and check these terms and conditions whenever you access the Website as the latest version of these terms and conditions will govern. We do not accept any liability for any errors or omissions.

ADDENDUM 1

CALIFORNIA PRIVACY RIGHTS

California Civil Code Section §1798.83 and the California Consumer Privacy Act (CCPA) permits users of our Website that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. The CCPA also provides California residents the right ‘To Be Forgotten’ by a company.

A California resident has the right to know what Personal Information is collected, used, disclosed, or sold, to delete any Personal Information collected, to opt-out of the sale of Personal Information, and to not be discriminated against for exercising such rights.

• Right to Know: A California resident has the right to request that we disclose what Personal Information we collect, use, disclose or sell. You may request that we disclose the following information upon receipt of a verifiable consumer request:

• The categories of Personal Information collected and categories of sources from which the Personal Information is collected;

• The business or commercial purpose for collecting or selling Personal Information;

• The categories of third parties with whom we share Personal Information; and

• The specific pieces of Personal Information we have collected about you.

• Right to Delete: As a California resident, you have the right to request that we delete any Personal Information about you which we have previously collected. If it is necessary for us to maintain the Personal Information for certain purposes, we are not required to comply with your deletion request. If we determine that we will not delete your Personal Information when you request us to do so, we will inform you and tell you why we are not deleting it.

• Right to Opt-Out of Sale of Personal Information: We do not sell Personal Information, including the Personal Information of minors under the age of 16. However, pursuant to applicable law, a California resident may request that their information not be sold in the future. To do so please send a request via our ‘Contact Us’ page.

• No Discrimination: You have the right not to be discriminated against because you exercised any of your rights under the CCPA.

If you would like to exercise any such rights or have any questions related to this regulation, please send a request via our ‘Contact Us’ page.

COLORADO PRIVACY ACT

The Colorado Privacy Act (CPA) provides consumers with certain rights related to their personal data. The CPA provides six main rights for the consumer:

• Right of Access: You have the right to confirm whether a controller is processing your personal data and to have the sole right to access your personal data.

• Right to Correction: You have the right to correct inaccuracies in any personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data.

• Right to Delete: You have the right to delete personal data concerning the consumer.

• Right to Data Portability: You have the right to obtain your personal data in a portable and, to the extent technically feasible, readily usable format that allows you the consumer to transmit the data to another entity without hindrance.

• Right to Opt-Out: You have the right to opt out of the processing of your personal data for any and all purposes.

• Right to Appeal: You have the right to appeal any denial to take action. We will provide a response to your appeal request within 45 days of receipt.

If you would like to exercise any such rights or have any questions related to this regulation, please send a request via our ‘Contact Us’ page.

CONNECTICUT DATA PRIVACY ACT

The Connecticut Data Privacy Act (CTDPA) gives Connecticut residents certain rights over their personal data and establishes responsibilities and privacy protection standards for data controllers that process personal data.

What is considered personal data? Personal data is any information that can be linked to an identifiable individual, excluding publicly available information. Examples of personal data include:

• A home address

• A driver’s license or state identification number

• Passport information

• A financial account number

• Login credentials

• Payment card information

Consumer Rights:

• Access: Consumers have the right to confirm whether a controller is processing their personal data and access such personal data, unless such actions reveal a trade secret.

• Correction: Consumers have the right to correct inaccuracies in their personal data (with some limitation) and the right to delete personal data which is not publicly available.

• Data Portability: Consumers have the right to obtain a portable copy of their personal data to the extent technically feasible and provided the controller will not be required to reveal any trade secret.

• Opt-Out of Certain Data Processing: Consumers have the right to opt out of any and all processing of personal data for purposes of:

  • Targeted advertising;

  • The sale of personal data; or

  • Profiling in connection with automated decisions that produce legal or similarly significant effects concerning the consumer.

• Right to Know: Right to know about processing.

• Minor Data Access: Right to access your data and that of any minors under the age of 13 of which you are the guardian.

• Third-Party Disclosures: Right to obtain a list of the categories of third parties to which the controller has disclosed the consumer's personal data.

If you would like to exercise any such rights or have any questions related to this regulation, please send a request via our ‘Contact Us’ page.

DELAWARE DATA PRIVACY ACT

What constitutes personal data under the Delaware Data Privacy Act (DDPA)? The DDPA covers any personally identifiable information (PII) about a Delaware resident (User), who may use an application or service publicly available. Examples of PII include, but are not limited to:

• Data revealing racial or ethnic origin

• Religious beliefs

• Mental or physical health condition

• Any other information that can be directly tied to you

We will always obtain your consent when we collect such data.

Consumer rights and requests: As a User, you have rights regarding your data. These requests will be completed within 45 days.

• Right to Delete: You have the right to request that we delete any PII about you which we have previously collected. If it is necessary for us to maintain the PII for certain purposes, we may not be required to comply with your deletion request. If we determine that we cannot delete your PII, we will inform you and advise why the information cannot be deleted.

Questions or Concerns? If you would like to exercise any such rights or have any questions related to this regulation, please send a request via our ‘Contact Us’ page.

FLORIDA DATA PRIVACY LAW

What is considered personal data under the Florida Data Privacy Law (FDPL)? Personal data is any information that can be linked to an identifiable individual, excluding publicly available information. Examples of personal data include, but are not limited to:

• Home address

• Driver’s license or state identification number

• Passport information

• Financial account number

• Login credentials

• Payment card information

Consumer Rights and Requests:

• The right to access and confirm processing, and obtain a copy of any data that the controller may hold (data portability, applicable to data provided by the consumer).

• The right to delete or correct inaccuracies in their personal data (applicable to data provided by the consumer).

• The right to opt-out of the selling and/or sharing of personal data for targeted advertising, including removal of personal data from voice or facial recognition technologies.

• Permits parents and guardians to exercise rights on behalf of their children.

We will respond to any request within forty-five (45) days of receipt of such request. If we cannot honor your request, you have the right to appeal that decision.

Privacy Notice & Disclosures: We provide information regarding:

• Categories of and purposes for personal data being processed;

• How you may exercise your data rights;

• Categories of personal data that we may share with third parties; and

• Categories of third parties with whom we may share your personal data.

Selling Personal Data: We will not sell your personal data except under the following circumstances:

• To a third party for purposes of providing a product or service requested by you;

• That has been made available to the general public through a mass media channel and access is not restricted; or

• As part of a merger or an acquisition under the condition of a non-disclosure agreement.

Targeted Advertising: We may use the personal data that you have provided for targeted advertising purposes, including through unaffiliated websites or companies. You may opt-out of any and all targeted advertising at any time.

Consumers Right of Action: If you are not satisfied by any response or action related to your personal information, you may file a formal complaint with the Florida Department of Legal Affairs.

Questions or Concerns? If you would like to exercise any such rights or have any questions related to this regulation, please send a request via our ‘Contact Us’ page.

IOWA CONSUMER DATA PRIVACY ACT

The Iowa Consumer Data Privacy Act (ICDPA) provides Iowa residents or other individuals (Consumers) rights when it comes to accessing and managing their personal information.

Sensitive Data Processing Requirements: The ICDPA requires that we provide you with "clear notice and an opportunity to opt out" of the processing of sensitive data (which includes biometric information to the extent it is "processed for the purpose of uniquely identifying a natural person").

Privacy Notices: Privacy details and parameters regarding your data rights will be provided to you upon request.

Questions or Concerns? If you would like to exercise any such rights or have any questions related to this regulation, please send a request via our ‘Contact Us’ page.

MASSACHUSETTS INFORMATION PRIVACY ACT

MGL c.214, § 1B Right of Privacy of the Massachusetts Information Privacy Act (MIPA) provides that any Massachusetts resident shall have a right against unreasonable, substantial, or serious interference with their privacy. Information may only be collected with the resident’s express permission and any company that holds such information must immediately delete it upon a request to do so from the impacted resident.

If you would like to exercise any such rights or have any questions related to this regulation, please send a request via our ‘Contact Us’ page.

MONTANA CONSUMER DATA PRIVACY ACT

What rights does the Montana Consumer Data Privacy Act (MCDPA) grant consumers? The MCDPA grants Montana residents acting in an individual context ("consumers") certain access and control rights concerning their personal data. Consumers do not include those in a commercial or employment context.

As a consumer, you may submit authenticated requests to:

• Confirm whether we are processing your personal data.

• Ask us to provide access to your data or obtain a copy in a portable and readily usable format (data portability).

• Ask us to correct inaccurate personal data or delete any personal data about you (right to 'Be Forgotten').

• Opt-out of the processing of your personal data for purposes of targeted advertising, personal data sales, or profiling for decisions that produce legal or similarly significant effects.

Sensitive personal data handled under these protections includes:

• Personal data collected from a known child under the age of 13.

• Genetic or biometric data processed to uniquely identify an individual.

• Personal data that reveals an individual's race or ethnic origin, religion, mental or physical health condition, sexuality, or immigration status.

• Precise geolocation data.

We will respond to all requests within 45 days. Furthermore, if we refuse to grant your request, we must explain the reasons behind our decision in writing. If you disagree with our decision, you have the right to appeal in writing within 60 days from the date of denial.

What are our obligations under the MCDPA? We will limit the collection of personal data to what is adequate, relevant, reasonably necessary, and proportionate in relation to the purposes for which it is processed. We have established, implemented, and maintain administrative, technical, and physical data security practices to protect the confidentiality, integrity, and security of your personal data. We will notify you if we sell your personal data to third parties or engage in targeted advertising. You have the right to opt out at any time.

Disputes Concerning Consumer Data Privacy: If you are not satisfied with our response or actions, a formal complaint may be filed with the Montana Attorney General Investigations and Enforcement unit.

Questions or Concerns? If you would like to exercise any such rights or have any questions related to this regulation, please send a request via our ‘Contact Us’ page.

NEBRASKA DATA PRIVACY ACT

What is Personal Data? Personal Data is defined as any information that is linked or reasonably linkable to an identified or identifiable individual, including pseudonymous data such as when used in combination with other identifying information. It excludes de-identified or publicly available information.

Personal Data Processing Consent: We will never use or process your personal data without first obtaining your consent. To obtain your consent, we will always request your clear affirmative approval prior to processing your personal data. Consent may be requested in the form of a written statement, including by electronic means, or any other unambiguous affirmative actions.

Consumer Rights: You have rights as it relates to your personal data. We will respond to all requests within 45 days of receipt. If a request cannot be honored for any reason, legal or otherwise, we will notify you in writing and provide details of how you can dispute our decision(s).

Disclosure: We may at times be required to disclose your personal data to a third party to assist in processing your request. Any disclosure to a third party will be strictly under a written contract authorizing them to use the personal data only to perform services on our behalf.

In addition, all third parties will adhere to all data security obligations and regularly (no less than annually) conduct data protection assessments and immediately notify us of any findings.

If you would like to exercise any such rights or have any questions related to this regulation, please send a request via our ‘Contact Us’ page.

NEW HAMPSHIRE ACT

What is Personal Data? Personal data includes all data revealing racial or ethnic origin, religious beliefs, mental or physical health condition, sexual orientation, or citizenship status. In addition, sensitive data includes genetic or biometric data, personal data of a known child, and precise geolocation data.

Consent: We will always obtain your explicit consent prior to collecting and using any of your personal data.

Consumer Data Rights: As a Consumer, you have the right to:

• Confirm whether we are processing your personal data;

• Correct inaccuracies;

• Delete personal data;

• Know the purposes for processing your personal data;

• Know how your data is shared with third parties and the categories of third parties receiving it;

• Obtain a portable and readily usable copy of personal data; and

• Opt out of any and all processing.

We will respond and take the requested action within 45 days of receipt of the request. If we cannot honor your request for any reason, written notice with an explanation will be provided.

Privacy by Design: We limit the collection of personal data to what is adequate, relevant, and reasonably necessary for the disclosed purposes. We will never collect additional categories of personal information not required to conduct business with you, nor use collected information for compatible/unrelated purposes without obtaining your consent.

Security: We have implemented and maintain administrative, technical, and physical data security practices to protect your data. In addition, we mandate that any third party with whom we share your data is subject to a confidentiality duty and provides required assistance in meeting data breach notice obligations.

Opt-out Preference Signals: As the owner of the personal information, you have the right to opt-out of any processing of personal data for any purpose. Please be aware that we may not be able to provide you with all services if you choose to opt-out or request data deletion.

If you would like to exercise any such rights or have any questions related to this regulation, please send a request via our ‘Contact Us’ page.

NEW JERSEY DATA PRIVACY ACT

What is Personal Data? Personal data includes all data revealing racial or ethnic origin, religious beliefs, mental or physical health condition, sex life, sexual orientation, citizenship, or immigration status. In addition, sensitive data includes genetic or biometric data, personal data of a known child, and precise geolocation data.

Opt-In for Personal Data Processing: We will never use or process your personal data without first obtaining your consent. We will always request your clear affirmative approval prior to processing. Consent may be requested in the form of a written statement, electronic means, or other unambiguous affirmative actions.

Consumer Data Rights & Opt-Out Preference: You may opt-out of providing and allowing us to use your Personal data at any time via our ‘Contact Us’ page.

Disclosure: Any disclosure to a third party to assist in processing your request will be strictly under a written contract authorizing them to perform services solely on our behalf.

Privacy by Design: We limit the collection of personal data to what is adequate, relevant, and reasonably necessary. We will not collect unnecessary data or use it for unapproved purposes without consent.

Security: We maintain administrative, technical, and physical security practices to safeguard accessibility and confidentiality. Third parties are bound by confidentiality obligations and must assist us as Controllers with breach notices and security standards.

If you would like to exercise any such rights or have any questions related to this regulation, please send a request via our ‘Contact Us’ page.

OREGON CONSUMER PRIVACY ACT

What rights does the Oregon Consumer Privacy Act (OCPA) grant consumers? The OCPA grants Oregon residents acting in an individual context ("consumers") certain access and control rights concerning their personal data.

We will respond to all authenticated requests within 45 days. If we refuse to grant your request, we will explain the reasons in writing. You have the right to appeal our decision in writing within 60 days from the date of denial.

What are our obligations under the OCPA? We limit the collection of personal data to what is adequate, relevant, reasonably necessary, and proportionate. We maintain administrative, technical, and physical data security practices to protect your data. We will notify you if we sell your personal data to third parties or engage in targeted advertising, and you have the right to opt out at any time.

Disputes Concerning Consumer Data Privacy: If you are not satisfied with our response or actions, a formal complaint may be filed with the Oregon Attorney General.

Questions or Concerns? If you would like to exercise any such rights or have any questions related to this regulation, please send a request via our ‘Contact Us’ page.

TEXAS DATA PRIVACY AND SECURITY ACT

The Texas Data Privacy and Security Act (TDPSA) regulates the collection, use, processing, and treatment of consumers’ personal data and provides residents the following rights:

• Confirm whether we are processing personal data and be provided access to it.

• Correct inaccuracies or delete your personal data at any time.

• Obtain a copy of your personal data in a portable and readily usable format.

• Opt-out of processing personal data for targeted advertising, data sales, or profiling.

We will address all data subject or opt-out requests within 45 days of receipt.

Texas Data Privacy Law Requirements: The TDPSA outlines duties for controllers to limit collection and establish security practices. As data controllers, we cannot:

• Collect personal data for undisclosed reasons without consent.

• Process data in violation of anti-discrimination laws or discriminate against a consumer for exercising their rights.

• Process sensitive data without consent, or process sensitive data of a child unless done in accordance with the Children’s Online Privacy Protection Act (COPPA).

Questions or Concerns? If you would like to exercise any such rights or have any questions related to this regulation, please send a request via our ‘Contact Us’ page.

UTAH CONSUMER PRIVACY ACT

The Utah Consumer Privacy Act (UCPA) is applicable to:

• Any controller or processor who conducts business in Utah or produces products/services targeted to Utah residents.

• Any consumer who is a Utah resident or is provided goods/services by a business operating in Utah.

The UCPA provides consumers the right to:

• Confirm whether we are processing your personal data;

• Access and delete your personal data;

• Obtain a copy of your personal data in a portable, readily usable format to transmit to another controller without impediment; and

• Opt-out of the processing of your personal data for any and all purposes.

If you would like to exercise any such rights or have any questions related to this regulation, please send a request via our ‘Contact Us’ page.

VIRGINIA CONSUMER DATA PROTECTION ACT

The Virginia Consumer Data Protection Act (VCDPA) provides consumers with certain rights related to their personal data, including:

• The right to know, access, and confirm personal data;

• The right to delete or correct inaccuracies in personal data;

• The right to data portability (easy, portable access to all pieces of personal data held);

• The right to opt-out of the processing of personal data for any and all purposes; and

• The right to not be discriminated against for exercising any of these rights.

If you would like to exercise any such rights or have any questi