California Privacy Policy

This California Privacy Policy contains disclosures required by the California Consumer Privacy Act (“CCPA”) and applies only to “personal information” that is subject to that law. Most of our data collection, use, and sharing practices are governed by our Gramm-Leach-Bliley Privacy Policy. However, if you are a California resident, the CCPA may apply to our Services as they relate to business products featured on our site (for example, business credit cards and small business loans). This California Privacy Policy should be read in conjunction with the Onboard Money Privacy Policy and Onboard Money Terms of Use, which are incorporated herein by reference.

Personal Information We Collect, Disclose for a Business Purpose, and Sell
We collect categories of personal information about California consumers identified in the chart below and use and disclose this information to third parties for business or commercial purposes. As is common among online businesses, we allow certain third parties—including unaffiliated business partners, advertising networks, analytics providers, and other advertising providers—to directly collect information about your online activities on the Site and across browsers and devices using cookies, web beacons, mobile advertising identifiers, and other technologies. These third parties may use this information to display advertisements tailored to your interests and preferences, conduct ad measurement and site analytics, detect and prevent fraud, or perform their own business purposes. The collection of this information by some third parties may constitute a “sale” of personal information as defined under the CCPA. For more information, review the “Third-Party Web Beacons and Third-Party Buttons” section of the Onboard Money Privacy Policy, or see the “Your Rights Regarding Personal Information” section below to learn how to opt out of personal information sharing that constitutes a sale.

Categories of Personal Information

Categories of Information	Categories of Sources	Business or Commercial Purposes	Disclosed to Categories of Third Parties
Personal and online identifiers	All categories listed below	All purposes listed below	All categories listed below
Sensitive Personal Information	All categories listed below	All purposes listed below	All categories listed below
Characteristics of protected classifications	All categories listed below	All purposes listed below	All categories listed below
Commercial or transaction information	All categories listed below	All purposes listed below	All categories listed below
Internet or electronic network activity	All categories listed below	All purposes listed below	All categories listed below
Geolocation information	All categories listed below	All purposes listed below	All categories listed below
Professional or employment-related data	All categories listed below	All purposes listed below	All categories listed below
Education information	All categories listed below	All purposes listed below	All categories listed below
Inferences about predicted preferences	All categories listed below	All purposes listed below	All categories listed below
Other linked personal information	All categories listed below	All purposes listed below	All categories listed below

1. Categories of Sources

We collect personal information directly from you. At your direction, we may also receive credit reports or scores from consumer reporting agencies such as TransUnion or Equifax, or third-party services that allow information sharing through application program interfaces (APIs), such as Facebook Connect or Twitter API. You may enable us to collect personal information from financial accounts you maintain with third-party financial institutions. Additionally, we may collect personal information using automated tools (e.g., cookies) as described elsewhere in this policy.

1. Why We Collect, Use, and Share California Information

We use and disclose personal information for business and commercial purposes as outlined in this Privacy Policy.

• Commercial purposes include marketing, advertising, authentication, fraud prevention, fulfillment services, and fulfilling customer requests.
• Business purposes, as defined by the CCPA, include: audits; legal compliance; detecting fraud and security incidents; debugging systems; processing orders and payments; internal operations; and improving our Services.

We disclose this personal information to service providers, lending partners, referral partners, credit reporting agencies, advertising networks, data analytics providers, and social networks. Third parties may collect data through cookies for behavioral advertising or ad campaign measurement.

1. Your Rights Regarding Personal Information

California residents have the following rights regarding their personal information:

1. Right to know the categories and specific pieces of personal information collected, shared, or sold.
2. Right to delete personal information collected.
3. Right to opt-out of sales or sharing of personal information.
4. Right to correct inaccurate personal information.
5. Right to limit the use of sensitive personal information.
6. Right to data portability.
7. Right not to be discriminated against for exercising your rights.

1. Retention of Personal Information

We retain personal information as long as necessary to comply with legal obligations, fulfill customer requests, and operate our business effectively. If you request deletion, certain information may still be retained to comply with laws, defend legal claims, or prevent fraud.

1. How to Exercise Your California Consumer Rights

To exercise your rights to request, know, or delete:

• Visit our Privacy Preferences page.
• Email us at privacy@onboardmoney.com with the subject “CCPA Request” and include the right you’re exercising.
• Submit a request via our support center at support@onboardmoney.com.

To opt out of the sale or sharing of personal information:

1. Use the cookie banner management tool on our websites.
2. Visit privacyrights.info to opt out of third-party sales.
3. Adjust ad personalization settings through Google (visit myaccount.google.com/data-and-personalization).

1. Verification Process and Authorized Agents
   We may need additional information to verify your identity when processing requests. Authorized agents must provide written authorization and verify their identity.

1. Minors’ Right to Opt-In
   We do not knowingly sell personal information of individuals under 16 years old.

1. Small Business Loan Information
   If you provide personal information to request small business loans from our partners, this disclosure is not considered a “sale” under the CCPA.