Applied Underwriters, Inc.® Privacy Notice — California

Applied Underwriters, Inc.®, its affiliates, subsidiaries and partners (collectively "Applied") or ("we", "us" and "our")provide insurance and payroll processing to various insureds, including individuals and companies. In this notice, we explain how we gather, use, share, and protect your data. We are providing this notice in accordance with the California Consumer Privacy Act of 2018 as amended (the "CCPA") and any terms defined in the CCPA have the same meaning where used in this California Privacy Policy, and applies to you if you are a California resident and you receive services from us including insurance, or visit our website.

Definitions Specific to this Policy

The CCPA includes definitions for terms specific to this California Privacy Policy that do not apply to our general Privacy Policy including the following terms:

"Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal Information does not include publicly available information obtained from government records; deidentified or aggregated consumer information that cannot be reconstructed to identify you; any information covered under the Gramm-Leach-Bliley Act or the California Financial Information Privacy Act, activities covered by the Fair Credit Reporting Act, or protected health information as defined under the Health Insurance Portability and Accountability Act.

"Sale" or "sell" means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.

"Service Provider" means a sole proprietorship, partnership, limited liability company, corporation, association, or other legal entity that is organized or operated for the profit or financial benefit of its shareholders or other owners, that processes information on behalf of a business and to which the business discloses a consumer’s Personal Information for a business purpose pursuant to a written contract.

"Third Party" means a person or entity who is not a business that collects Personal Information from consumers, as defined in the CCPA, and to whom the business discloses a consumer’s Personal Information for a business purpose pursuant to a written contract.

What Personal Data Do We Collect?

The types of personal data we gather and share depends on your relationship with us. For example, we may gather different data if you are a claimant reporting an injury than if you want a quote for insurance. The data we gather can include your Social Security Number, income, and medical information related to your injury. It may also include data gathered as we provide services to you, when you apply for such services, or resulting from other contacts with you. It may also include:

• Identifiers, including a real name, alias, address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security Number, tax identification number, driver’s license number, or other similar identifiers.

• Personal data, such as your name, signature, Social Security Number, physical characteristics or description, address, telephone number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, financial data, medical data, or health insurance data.

• Protected classification characteristics described in California Civil Code § 1798.80(e), including age, race, color, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, or veteran or military status.

• Commercial data, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories and tendencies.

• Professional or employment related data, including current or past job history (for employment purposes).

• Risk data, including data about your driving and/or accident history; this may include data from consumer reporting agencies, such as your motor vehicle records, and loss history data, health data, or criminal convictions.

• Claims data, including data about your previous and current claims, which may include data regarding your health, criminal convictions, third party reports, or other personal data.

• Payroll data, including rates of pay, wages paid, subject or taxable wages, taxes withheld, payroll deductions and payroll classification.

We may have collected Personal Information in any of the above categories in the past twelve (12) months. The categories and examples provided above are those defined in the CCPA but does not mean that all examples of that category of Personal Information were in fact collected but reflects our good faith belief to the best of our knowledge that some of that information may have been collected about consumers.

Information Collection

You have the right to request certain information regarding the Personal Information we have collected about you in the preceding 12 months. You may make such a request up to twice in a 12-month span. Please note that there are circumstances in which we may not be able to comply with your request pursuant to the CCPA, including when we cannot verify your request or when there is a conflict with our own obligations to comply with other legal or regulatory requirements. We will notify you following the submission of your request if this is the case.

How do you gather my data?

We gather your personal data directly from you. For example, you provide us with data when you ask about or buy insurance or file a claim; pay your statement; visit our websites, call us, or visit our offices.

We also gather your personal data from other people. For example your insurance agent or broker; your employer, association, or business (if you are insured through them); our affiliates or other insurance companies about your transactions with them; consumer reporting agencies, Motor Vehicle Departments and inspection services, to gather your credit history, driving record, claims history, payroll history or value and condition of your property; other public directories and sources; third parties, including other insurers, brokers and insurance support organizations who you have communicated with about your policy or claim, anti-fraud databases, sanctions lists, court judgments and other databases, government agencies, or in the event of a claim, third parties including other parties to the claim, witnesses, experts, loss adjusters, and claim handlers and other third parties to provide your data.

How Do We Use Your Personal Data?

Applied uses your data to provide you our products and services and as otherwise provided in this Notice. We may use your data and the data of our former insureds for our business purposes. Our business purposes include:

Business Purpose:

Market, sell and provide insurance.

• Calculating your premium

• Determining your eligibility for a quote

• Confirming your identity and servicing your policy

Data Categories:

• Identifiers

• Personal data

• Protected classification characteristics

• Commercial data

• Professional or employment related data

• Risk data

• Claims data

• Payroll data

Manage your claim. This includes, for example:

• Conducting claims investigations

• Conducting medical examinations

• Conducting inspections and appraisals

• Providing roadside assistance

• Providing rental car replacement or repairs

Data Categories:

• Identifiers

• Personal data

• Protected classification characteristics

• Commercial data

• Professional or employment related data

• Risk data

• Claims data

• Payroll data

Day-to-Day Business and Insurance Operations. This includes, for example:

• Creating, maintaining, customizing and securing accounts

• Supporting day-to-day business, insurance and payroll related functions

• Doing research for technology development

• Marketing and creating products and services

• Conducting audits related to a current contact with a consumer or other transactions

• As described at or before the point of gathering personal data or with your authorization

Data Categories:

• Identifiers

• Personal data

• Protected classification characteristics

• Commercial data

• Professional or employment related data

• Risk data

• Claims data

• Payroll data

Regulatory and Legal Requirements. This includes, for example:

• Monitoring controls and access rights management

• Evaluating or conducting a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Applied’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal data held by Applied is among the assets transferred

• Exercising and defending Applied’s legal rights and positions

• Meeting Applied’s contractual obligations

• Responding to law enforcement requests and as required by applicable law, court order, or governmental regulations

• As otherwise permitted or required by law

Data Categories:

• Identifiers

• Personal data

• Protected classification characteristics

• Commercial data

• Professional or employment related data

• Risk data

• Claims data

• Payroll data

Improve Your Customer Experience and Our Products. This includes, for example:

• Improving your customer experience and our products and services

• Providing, supporting, personalizing and developing our website, products and services

• Creating and offering new products and services

Data Categories:

• Identifiers

• Personal data

• Protected classification characteristics

• Commercial data

• Professional or employment related data

• Risk data

• Claims data

• Payroll data

Analytics to identify, understand and manage our risks and products. This includes, for example:

• Conducting analytics to better identify, understand and manage risk and our products

Data Categories:

• Identifiers

• Personal data

• Protected classification characteristics

• Commercial data

• Professional or employment related data

• Risk data

• Claims data

• Payroll data

Customer service and technical support. This includes, for example:

• Answering questions and providing notifications

• Providing customer and technical support

Data Categories:

• Identifiers

• Personal data

• Protected classification characteristics

• Commercial data

• Professional or employment related data

• Risk data

• Claims data

• Payroll data

Do We Share Your Personal Data?

Applied does not sell your personal data as defined by California law.

Applied may share personal data with affiliated and non-affiliated third parties, including:

• Applied affiliates;

• Service Providers (such as auto repair facilities, towing companies, property inspectors, and independent adjusters);

• Insurance support organizations;

• Brokers and agents;

• Public entities (e.g. regulatory, quasi-regulatory, tax or other authorities, law enforcement agencies, courts, arbitrational bodies, and fraud prevention agencies);

• Consumer reporting agencies;

• Advisors including law firms, accountants, auditors, and tax advisors;

• Insurers, re-insurers, policy holders, and claimants;

• Group policyholders (for reporting claims data or an audit);

• Service providers and affiliates for actuarial or research studies; and

• As permitted or required by law

Financial Incentives and Non-Discrimination

We will not discriminate against you if you exercise any of the rights provided by the CCPA set forth in this California Privacy Policy. Please note that a legitimate denial of a request for information, deletion, or to opt-out is not discriminatory, nor is charging a fee for excessive or repetitive consumer requests as permitted by the CCPA.

Deletion of Your Personal Information

You have the right to request that we delete certain Personal Information that we have collected. Please note that there are circumstances in which we may not be able to comply with your request pursuant to the CCPA, including when we cannot verify your request and/or when there is a conflict with our own obligations to comply with other legal or regulatory requirements. We will notify you following submission of your request if this is the case.

Right to Opt-Out

Applied does not sell your personal data as defined by California law, so there is no reason to request that we not sell your "Personal Information".

What Rights Do I Have to Learn More About My Personal Data?

You may have rights under California laws to learn more about our privacy practices. For example, you may have the right to request a copy of certain information about you to review its completeness and accuracy. You must make this request in writing by contacting us as indicated below.

Authorized Agents

You may designate an authorized agent to exercise your rights under the CCPA on your behalf.

Pursuant to the CCPA:

• Only a business entity or natural person registered with the California Secretary of State may act as an authorized agent.

• You must provide the authorized agent written permission to exercise your rights under the CCPA on your behalf.

• We may deny a request from an authorized agent on your behalf if the authorized agent does not submit proof that he, she, or it has been authorized by you to act on your behalf if we request such proof, as permitted by the CCPA.

• Even if you use an authorized agent to exercise your rights under the CCPA on your behalf, pursuant to the CCPA we may still require that you verify your own identity directly to us. This provision does not apply if you have provided with a power of attorney under California Probate Code sections 4000 to 4465.

Additional California Privacy Rights

California Civil Code Section § 1798.83 permits users of our web site that are California residents to request certain information regarding our disclosure of personal information to other parties for their direct marketing purposes. To make such a request, please send an email to privacy@auw.com with the subject "Privacy Request".

Changes to Our California Privacy Policy

We reserve the right to amend this California Privacy Policy at our discretion and at any time. When we make changes to this California Privacy Policy, we will post an updated notice on our website with the effective date.

How to submit a California Rights Request

If you are a California resident, you may make one of the following requests, in writing, by contacting us (see How to Contact Us below):

• Right to Know

• Right to Request Deletion of your Personal Information

• Right to Opt-Out of Sale of Personal Information

• Right to Non-Discrimination

Please include the following information in your request to us:

• Name

• Address

• Email address

• Details on the type of request you are making

• Your relationship to us

In order to protect your information, we will confirm your identity before responding to any request. We will ask you at least one question, and you must reply by email with the correct answer for each question based on your previous interaction with us. If we still cannot verify your identity as is required by the CCPA, we will let you know and may ask additional questions. Otherwise, we will acknowledge your request and contact you later with our full response.

How to Contact Us:

You can submit requests in writing or seek additional information by contacting us using the information below:

Call: (877) 234-4420

Email: privacy@auw.com

Mail: Applied Underwriters, Inc. 10805 Old Mill Road Omaha, Nebraska 68154 Attn: General Counsel

Effective Date: January 1, 2020