California Privacy Policy

This California Privacy Policy (the "Policy") is provided by Finicity Corporation, a wholly owned subsidiary of Mastercard International Inc. ("Finicity," "we," and/or "us").

This Policy supplements the information and disclosures contained in our General Privacy Policy, and applies to Personal Information of individuals residing in California that is subject to the California Consumer Privacy Act of 2018 (California Civil Code §§ 1798.100 to 1798.199) and its implementing regulations, as amended or superseded from time to time ("CCPA") that we collect or is provided to us through our websites, including https://www.finicity.com, (the "Site") and through our other online services, websites, applications, and related services that link to this Privacy Policy (collectively with the Site, the "Services").

For the purposes of this Policy, "Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California consumer or household.

Personal Information does not include information that is:

• Lawfully made available from government records;
• Anonymized, deidentified or aggregated; or
• Otherwise excluded from the scope of the CCPA.

YOUR PERSONAL INFORMATION

The information below provides the categories of Personal Information we have collected, disclosed for a business purpose, or used for business or commercial purposes in the preceding twelve months since this Policy was last updated, as well as the categories of sources from which that information was collected, and the categories of third parties with whom we shared Personal Information.

Categories of Personal Information We Collect

We may collect certain categories of Personal Information to facilitate the provision of our products and services.

Such categories of Personal Information may include:

• Personal identifiers, which may include: names; addresses; phone numbers; dates of birth; emails; account numbers; passwords; IP addresses; Personal Identification Numbers (PINS), social security numbers, and geotechnical information;
• Commercial Information, which may include: bank statements, bank transactions, records of personal property; products or services purchased, obtained, or considered; purchase history; consumer habits or tendencies; banking account numbers; credit/debit card numbers; bank routing numbers; W-2s and other tax related documentation, and credit scores;
• Professional employment information, which may include: current work status; payroll provider username and passwords; paystubs, and multi-factor authentication; and
• Audio data, which may include: audio recordings.

How We Obtain Personal Information

We may obtain Personal Information from a variety of sources. Such sources may include:

• Directly from you;
• Public records;
• Lenders;
• Payroll providers;
• Payment processors;
• Web and data analytics;
• Cloud storage providers;
• SaaS providers; and
• Third-party partners.

We collect, use, and disclose your Personal Information in accordance with the specific business and commercial purposes below, including:

• To provide, maintain, improve, and enhance our Services;
• To verify your identity, which is required to give you access to our Services;
• To verify your accounts and establish the requested Service with the service provider(s) of your choice, including financial institutions, brokerage houses, and credit card companies;
• If you subscribe to a Service requiring payment, to process the initial payment and all subsequent payments;
• To help us improve and personalize the content and functionality of our Services;
• To help us understand your usage of the Services to improve the Services;
• To communicate with you regarding customer service matters, questions and other various comments you may send to us;
• To inform you about products, services, offers, and events we offer or sponsor, and to provide news and other information we believe may interest you;
• To communicate various technical and administrative messages regarding the Services, including notices of technology updates;
• To generate aggregated data containing only de-identified, non-personal information that we may use for our business purposes;
• To offer you the option to participate in contests or surveys regarding the Services;
• Auditing related to a current interaction with the consumer and concurrent transactions;
• Debugging to identify and repair errors that impair existing intended functionality;
• Undertaking internal research for technological development and demonstration;
• To maintain legal and regulatory compliance;
• To enforce compliance with our Terms and Conditions and Policies; and
• For any other purpose disclosed to you at the time we collect or receive the information, or otherwise with your consent.

Third Parties That We Share Personal Information With

We may share your Personal Information with the following categories of third parties:

• Web analytics providers;
• Cloud storage providers;
• Reporting agencies;
• SaaS providers;
• Service providers;
• Approved partners with whom you have enrolled for services; and
• Subsidiaries and affiliates, including other entities within the Mastercard group.

SALE OF PERSONAL INFORMATION

We do not sell Personal Information under the CCPA.

YOUR RIGHTS

Right to Know and Access

You may submit a verifiable request for information regarding the: (i) categories of Personal Information collected, sold, or disclosed by us; (ii) purposes for which categories of Personal Information are collected or sold by us; (iii) categories of sources from which we collect Personal Information; (iv) categories of third parties with whom we disclosed or sold Personal Information; and (v) specific pieces of Personal Information we have collected about you during the past twelve months.

Right to Delete

The CCPA provides consumers the ability to delete Personal Information that we have collected from you, in response to a verifiable consumer request, subject to certain exceptions. To submit a request to delete your Personal Information, please visit our Data Privacy Consumer Rights Portal.

Please be aware that exercising your right to delete may affect any of your subscribed services.

Verification

Requests for access to or deletion of Personal Information are subject to our ability to reasonably verify your identity in light of the Personal Information requested and pursuant to relevant CCPA requirements, limitations, and regulations. To verify your access or deletion, please visit our Data Privacy Consumer Rights Portal to initiate the verification process.

Right to Equal Service and Price

You have the right not to receive discriminatory treatment for the exercise of your CCPA privacy rights, subject to certain limitations.

AUTHORIZED AGENTS

To authorize an agent to make a request to know or delete on your behalf, please provide us the following information by mail at the address provided below: (i) the applicable consumer’s name; (ii) the applicable consumer’s signature; (iii) the agent’s name; (iv) the agent’s signature; and (v) the desired expiration date of the agent authorization. We may request additional information to verify an agent is authorized to act on your behalf.

EXERCISING YOUR CALIFORNIA PRIVACY RIGHTS

To exercise any of your rights listed above, please login to Data Privacy Consumer Rights Portal. For more information regarding your CCPA rights or to exercise your CCPA rights, you also can contact privacy@finicity.com.

You may also contact us by mail. If you do so, please provide your full name, address, and phone number, along with a detailed request. Please note, that if we are unable to validate your identity, we may not be able to comply with your request.

Finicity Corporation
Data Privacy Department
434 West Ascension Way, Suite 200
Salt Lake City, UT 84123
(801) 984-4200

FAIR CREDIT REPORTING ACT

Your rights under the CCPA do not apply to any Personal Information that has been provided to us in our capacity as a "consumer reporting agency" for a permissible purpose related to consumer lending or credit decisioning under the Fair Credit Reporting Act ("FCRA") and will not be included under a CCPA request. Instead, you have the right to access any consumer report information collected pursuant to the FCRA at the Finicity Reports portal.