CCPA - i360

CALIFORNIA CONSUMER PRIVACY NOTICE

Effective date: January 1, 2020

Last updated: October 12, 2020

This California Consumer Privacy Notice (“Notice”) supplements i360’s (“i360”) Privacy Policy and applies solely to the personal information collected online and offline of California consumers(excluding i360 employees, applicants, contractors and otherpersonnel).

This Notice is intended to address the relevant notice requirements of the California Consumer Privacy Act of 2018, Cal. Civ. Code § 1798.100 et seq. and its implementing regulations (the “CCPA”), and certain terms used herein have the meaning given to them in the CCPA. Nothing in this Notice is intended to contradict or limit the applicability of the information provided in our Privacy Policy.

1. Notice of Collection and Use of Personal Information

i360 collects information from government and other sources. In doing so, we may collect the following categories of personal information about you:

• Identifiers: identifiers such as a real name, alias, postal address, unique personal identifier (such as a device identifier), cookies, beacons, pixel tags, mobile ad identifiers and similar technology, telephone number, and other forms of persistent or probabilistic identifiers), online identifier, internet protocol address, email address, account name, and other similar identifiers

• Additional Data Subject to Cal. Civ. Code § 1798.80:physical characteristics or description, education, income level and other financial information, and medical-relatedinformation

• Protected Classifications: characteristics of protected classifications under California or federal law, such as race, color, national origin, religion, age, sex, gender, marital status, medical-related information, ancestry, and military and veteran status

• Commercial Information: commercial information, including records of personal property, products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies

• Online Activity: Internet and other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding your interaction with websites, applications, or advertisements

• Geolocation Data

• Sensory Information: audio, electronic, and similar information when you call i360 and leave a voicemail

• Employment Information: professional or employment-related information

• Inferences: inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, predispositions, behavior, or attitudes

We may use your personal information for the purposes described in our Privacy Policy. In addition, we may use such categories of personal information for certain business purposes specified under the CCPA, including as described below:

• Performing services: Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing advertising or marketing services, providing analytics services, or providing similar services

• Auditing: Auditing related to a current interaction with you and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance

• Short Term Use: Short-term, transient use, including, but not limited to, the contextual customization of ads shown as part of the same interaction

• Security Purposes: Detecting security incidents; protecting against malicious, deceptive, fraudulent, or illegal activity; and prosecuting those responsible for that activity

• Debugging: Debugging to identify and repair errors that impair existing intended functionality

• Internal R&D: Undertaking internal research for technological development and demonstration

• Safety: Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us

2. Our Prior Collection, Use and Disclosure of Personal Information

We may have collected and used your personal information, as described in section 1 above, during the 12-month period prior to the effective date of this California Consumer Privacy Notice. For the personal information collected during that timeframe, wedescribe below: (a) the categories of sources from which we may have obtained the personal information, and (b) information regarding our sharing of personal information with third parties.

a. Sources of Personal Information

We may have personal information about you from various sources,including as described below.

• Directly from you, such as when you connect with us via social media, send us questions, requests or comments, elect to receive business alerts, newsletters and other communications,or when you provide information about an incident or allegation

• From your devices, such as when you visit our website or use our mobile application

• Our affiliates

• Social networking services

• Online advertising companies

• Consumer data vendors and other data suppliers with whom we have contractual agreements

• Public databases

• i360/System Generated Data

b. Sharing of Personal Information

We may have shared your personal information with certain categories of third parties, including as described in our Privacy Policy and below, including for the business purposes described above.

Categories of Third Parties	Categories of Personal Information
Our affiliates	• Identifiers • Additional Data Subject to §1798.80 • Protected Classifications • Commercial Information • Online Activity • Geolocation Data • Employment Information • Inferences
Third-party vendors who provide services on our behalf	• Identifiers • Additional Data Subject to §1798.80 • Protected Classifications • Commercial Information • Online Activity • Geolocation Data • Employment Information • Inferences
Corporate business partners (such as parties involved in a transfer of our assets, attorneys and consultants)	• Identifiers • Additional Data Subject to §1798.80 • Protected Classifications • Commercial Information • Online Activity • Geolocation Data • Employment Information • Inferences
Marketing partners (including network advertising companies, publishers, and business partners)	• Identifiers • Additional Data Subject to §1798.80 • Protected Classifications • Commercial Information • Online Activity • Geolocation Data • Employment Information • Inferences
Data analytics providers	• Identifiers • Additional Data Subject to §1798.80 • Protected Classifications • Commercial Information • Online Activity • Geolocation Data • Employment Information • Inferences
Law enforcement agencies, courts, regulators, and government authorities as described in our Privacy Policy	• Identifiers • Additional Data subject to §1798.80 • Protected Classifications • Commercial Information • Online Activity • Geolocation Data • Employment Information • Inferences
Social networking services	• Identifiers • Additional Data subject to §1798.80 • Protected Classifications • Commercial Information • Online Activity • Geolocation Data • Employment Information • Inferences
Consumer data vendors	• Identifiers • Additional Data subject to §1798.80 • Protected Classifications • Commercial Information • Online Activity • Geolocation Data • Employment Information • Inferences
Political committees, non-profit advocacy groups, and similar organizations	• Identifiers • Additional Data subject to §1798.80 • Protected Classifications • Commercial Information • Online Activity • Geolocation Data • Employment Information • Inferences

In connection with certain of our products and services, we may sell certain personal information we obtain about you for monetary consideration. You have the right to opt out of such sale of your information, as detailed below.

During the 12-month period prior to the effective date of this California Consumer Privacy Notice, we may have sold the following categories of personal information: Identifiers, Additional Data subject to §1798.80, Protected Classifications, Commercial Information, Online Activity, Geolocation Data, Employment Information, and Inferences.

We do not have actual knowledge that we collect or sell the personal information of minors under 18 years of age.

3. California Consumer Privacy Rights

You have certain choices regarding our use and disclosure of your personal information, subject to relevant exceptions under applicable law, as described below.

Access: You may have the right to request, twice in a 12-month period, that we disclose to you the personal information we have collected, used, disclosed, and sold about you during the past 12 months.

Deletion: You have the right to request that we delete certainpersonal information we have collected from you.

Opt-Out of Sale: You have the right to opt-out of the sale of your personal information.

Shine the Light Request: If you are a California resident and have provided us with your personal information, you may ask us to refrain from sharing your personal information with third parties, including our affiliates if they are separate legal entities, for direct marketing purposes.

How to Submit a Request: To submit an access or deletion request,or to opt-out of the sale of your personal information, click here to submit your request via the i360 California Consumer Privacy Act California resident request system or call our CCPA information line at 1–844–611-2737. To submit a CCPA request as an authorized agent on behalf of a consumer, click here to submit the consumer’s request via the i360 California Consumer Privacy Act California resident request system or call our CCPA information line at 1–844–611-2737. After submitting the consumer’s request, we will collect proof of your status as an authorized agent through the i360 California Consumer Privacy Act California resident request system. To submit a Shine the Light request, please contact us at [email protected] and include the phrase “Shine the Light request” in the subject line.

Verifying Requests: To help protect your privacy and maintain security, we will take steps directly or through a third-party identity verification vendor to verify your identity before granting you access to your personal information or complying with your request.If you request access to or deletion of your personal information, we may require you to provide certain information to help us identify you. In addition, if you ask us to provide you with specific pieces of personal information, we will require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request.

Additional Information: If you choose to exercise any of your rights under the CCPA, you have the right to not receive discriminatory treatment by us related to products or services we offer you. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request. This Notice is available in alternative formats upon request by emailing[email protected] or contacting our CCPA information line at 1–844–611-2737.