Qualpay, Inc. California Privacy Notice

INFORMATION FOR CALIFORNIA RESIDENTS

We collect Personal Data from Consumers and comply with the California Privacy Rights Act ("CPRA"). In addition to our general Privacy Notice available at https://www.qualpay.com/privacy, this California Privacy Notice applies to California residents ("Consumers," "you," or "your").

For the purposes of this California Privacy Notice, "Personal Data" means information that is linked or reasonably linkable to a particular individual or household. However, the following categories of information are not Personal Data:

This Privacy Notice provides the following information to California Consumers:

CATEGORIES OF NON-SENSITIVE PERSONAL DATA

The table below outlines the non-sensitive categories of Personal Data Qualpay, Inc collects about Consumers and whether and how they are disclosed to third parties.

We collect Non-Sensitive Personal Data from the following sources:

CATEGORY OF PERSONAL DATA: IDENTIFIERS

Examples
Identifiers may contain the following: Real name, alias, postal address, Internet Protocol address, email address, account name, social security number, driver's license number, passport number, birthdate, or other similar identifiers.

Purpose(s)
To comply with laws, regulations, and system rules, as well as better understand businesses and their owners and operators who are applying for merchant accounts and assess their risk profile, improve services, and provide targeted advertising.

Identifiers may also be collected from owners and employees of business partners to further the intent of the business relationship.

Targeted Advertising
We do not engage in targeted advertising or share Personal Information for targeted advertising purposes.

Sale
We do not sell Personal Information to anyone.

Sharing
This data may be shared with Processors.

Retention Period
7 years after the merchant account is closed; 3 years after a business relationship is terminated for non-merchants.

CATEGORY OF PERSONAL DATA: PERSONAL CHARACTERISTICS

Examples
Personal Characteristics may contain the following: Name, social security number, address, telephone number, passport number, driver's license number, employment history, education history, financial information, bank account number, or other similar characteristics.

Purpose(s)
To comply with laws, regulations, and system rules, as well as better understand businesses and their owners and operators who are applying for merchant accounts and assess their risk profile.

Targeted Advertising
We do not engage in targeted advertising or share Personal Information for targeted advertising purposes.

Sale
We do not sell Personal Information to anyone.

Sharing
This data may be shared with Processors.

Retention Period
7 years after the merchant account is closed.

CATEGORY OF PERSONAL DATA: COMMERCIAL INFORMATION

Examples
Commercial Information may contain the following: Records of personal property or other purchasing or consuming histories or tendencies contained in a credit report.

Purpose(s)
To comply with laws, regulations, and system rules, as well as better understand businesses and their owners and operators who are applying for merchant accounts and assess their risk profile.

Targeted Advertising
We do not engage in targeted advertising or share Personal Information for targeted advertising purposes.

Sale
We do not sell Personal Information to anyone.

Sharing
This data may be shared with Processors.

CATEGORY OF PERSONAL DATA: INTERNET/ELECTRONIC ACTIVITY

Examples
Internet/Electronic Activity may contain the following: Internet/Electronic Activity: Name, device ID, cookies.

Purpose(s)
To comply with laws, and regulations, and best practices for the use of electronic documents and signatures.

Cookies are tracked to enable our systems to recognize your browser and capture as well as remember certain information. We also use cookies to compile aggregate data about site traffic and site interactions in order to offer better site experiences and tools in the future. We may also use trusted Third-Party services that track this information on our behalf. We also send a "session cookie" to your computer when you sign up for and log in to your account. This type of cookie helps us to recognize you if you visit multiple pages on our site during the same session so that we don't need to ask users for a password on each page.

Targeted Advertising
We do not engage in targeted advertising or share Personal Information for targeted advertising purposes.

Sale
We do not sell Personal Information to anyone.

Sharing
This data may be shared with Processors.

Retention Period
7 years after the merchant account is closed.

CATEGORY OF PERSONAL DATA: IMPRECISE GEOLOCATIONAL

Examples
Imprecise Geolocational may contain the following: Internet Protocol Address.

Purpose(s)
As a personal identifier for electronically signed agreements.

Targeted Advertising
We do not engage in targeted advertising or share Personal Information for targeted advertising purposes.

Sale
We do not sell Personal Information to anyone.

Sharing
This data may be shared with Processors.

Retention Period
7 years after the merchant account is closed.

CATEGORY OF PERSONAL DATA: PROFESSIONAL INFORMATION

Examples
Professional Information may contain the following: Employment and business ownership history.

Purpose(s)
To comply with laws, regulations, and system rules, as well as better understand businesses and their owners and operators who are applying for merchant accounts and assess their risk profile.

Targeted Advertising
We do not engage in targeted advertising or share Personal Information for targeted advertising purposes.

Sale
We do not sell Personal Information to anyone.

Sharing
This data may be shared with Processors.

Retention Period
7 years after the merchant account is closed.

CATEGORY OF PERSONAL DATA: EDUCATIONAL INFORMATION

Examples
Educational Information may contain the following: College or degree information.

Purpose(s)
To comply with laws, regulations, and system rules, as well as better understand businesses and their owners and operators who are applying for merchant accounts and assess their risk profile.

Targeted Advertising
We do not engage in targeted advertising or share Personal Information for targeted advertising purposes.

Sale
We do not sell Personal Information to anyone.

Sharing
This data may be shared with Processors.

Retention Period
7 years after the merchant account is closed.

CATEGORIES OF SENSITIVE PERSONAL DATA

The table below outlines the categories of Sensitive Personal Data Qualpay, Inc collects about Consumers and whether they are shared with third parties. Qualpay, Inc obtains affirmative consent from Consumers to process the Sensitive Personal Data, in compliance with applicable law.

We collect Sensitive Personal Data from the following sources:

CATEGORY OF PERSONAL DATA: GOVERNMENT ID DATA

Examples
Government ID Data may contain the following: Government ID Data may contain the following information: Driver's License, Passport, Social Security Number, or State issued ID.

Purpose(s)
Complying with legal and regulatory obligations, and to follow best practices for identity verification for owners and operators of businesses seeking merchant services.

Targeted Advertising
We do not engage in targeted advertising or share Personal Information for targeted advertising purposes.

Sale
We do not sell Personal Information to anyone.

Sharing
This data may be shared with Processors.

Retention Period
7 years after the termination of an account or contract.

CATEGORY OF PERSONAL DATA: SENSITIVE CATEGORY DATA

Examples
Sensitive Category Data may contain the following: Sensitive Category Data may contain the following information: Social Security number, Driver's License number, Passport number, state identification card, financial account information, and credit history.

Purpose(s)
Complying with legal and regulatory obligations, and to follow best practices for identity verification for owners and operators applying for merchant services for their business.

Targeted Advertising
We do not engage in targeted advertising or share Personal Information for targeted advertising purposes.

Sale
We do not sell Personal Information to anyone.

Sharing
This data may be shared with Processors.

Retention Period
7 years after the termination of a merchant account.

CATEGORY OF PERSONAL DATA: FINANCIAL DATA

Examples
Financial Data may contain the following: Financial Data may include a consumer's financial account information or credit history.

Purpose(s)
Complying with legal and regulatory obligations, and to follow best practices for underwriting for merchant services.

Targeted Advertising
We do not engage in targeted advertising or share Personal Information for targeted advertising purposes.

Sale
We do not sell Personal Information to anyone.

Sharing
This data may be shared with Processors.

Retention Period
7 years after the termination of a merchant account.

USE OF PERSONAL DATA

We use Personal Data for the purposes described in our general Privacy Notice (see https://www.qualpay.com/privacy). Personal Data may also be used or disclosed as otherwise permitted or required by applicable law.

DISCLOSING PERSONAL DATA

We share Personal Data with the following categories of third parties:

See the tables above for more details about how different categories of Personal Data are shared.

We do not sell Personal Data to anyone.

EXERCISING YOUR PERSONAL DATA RIGHTS

California Consumers have the following rights under the CPRA:

If you are a California Consumer, you can submit a request to exercise your personal data rights under the CPRA by sending an email to support@qualpay.com with the subject line "Privacy Rights Request". To protect your privacy, we may need to authenticate your identity before we respond to your rights request. We will use commercially reasonable efforts to verify your identity for this purpose. Any information you provide to authenticate your identity will only be used to process your rights request. Please be aware that we do not accept or process rights requests through other means (e.g., via fax or social media).

After submitting your request online, you will receive a follow-up email, which may include a link you must click on in order to verify your identity. If you do not click on that link, we may be unable to complete your request due to lack of verification. It is important that you provide a valid email address in order for us to be able to process your request.

We will respond to your rights request within 45 days, though in certain cases we may inform you that we will need up to another 45 days to act on your request. If we suspect fraudulent or malicious activity on or from your account, we will delay taking action on your request until we can appropriately verify your identity and the request as authentic. Also note that each of the rights are subject to certain exceptions.

We reserve the right to decline to process, or charge a reasonable fee for, requests from a Consumer that are manifestly unfounded, excessive, or repetitive.

LIMITING THE USE OF SENSITIVE PERSONAL DATA

The CPRA provides a right to limit some uses of Sensitive Personal Data. In particular, you may direct companies not to use Sensitive Personal Data except as necessary to provide goods or services you have requested.

You may submit a request to limit the use of your sensitive Personal Data by submitting a rights request as described above.

AUTHORIZED AGENT REQUESTS

The CPRA allows you to designate an authorized agent to make a rights request on your behalf. Your authorized agent may submit such a request by following the same method described above. We may require verification of your authorized agent in addition to the information for verification above for Consumers and households.

CONTACTING US

If you have any questions or concerns regarding this California Privacy Notice, contact us at privacy@qualpay.com.