California Privacy Notice

CALIFORNIA PRIVACY POLICY Flagship Credit Acceptance LLC (“Flagship”) is providing this California Privacy Policy (“Policy”) pursuant to the California Consumer Privacy Act, the California Privacy Rights Act, and the regulations implementing those laws (collectively, the “CCPA”). This Policy applies to California residents, i.e., individuals who (1) currently reside in California permanently or (2) reside in California but who are currently outside the state for a temporary or transitory purpose. California residents include, but are not limited to, customers or former customers of Flagship; credit applicants of Flagship; employees or former employees of Flagship; job applicants of Flagship; independent contractors of Flagship. The purpose of this Policy is to (1) provide California residents with a comprehensive description of Flagship’s online and offline practices regarding the collection, use, disclosure, sale and sharing of personal information and (2) inform California residents about their rights regarding their personal information and to provide them the information necessary to exercise those rights. CERTAIN TERMS DEFINED BY THE CCPA Personal Information Broadly, “personal information” means information that:

identifies, relates to, or describes;
is reasonably capable of being associated with; or
could be reasonably linked, directly or indirectly, with a California resident or her/his household.

Sensitive personal information “Sensitive personal information” means:

personal information that reveals:
- a resident’s social security, driver’s license, state identification card, or passport number.
- a resident’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.
- a resident’s precise geolocation.
- a resident’s racial or ethnic origin, religious or philosophical beliefs, or union membership.
- the contents of a resident’s mail, email, and text messages unless the business is the intended recipient of the communication.
- a resident’s genetic data.
the processing of biometric information for the purpose of uniquely identifying a resident.
personal information collected and analyzed concerning a resident’s health.
personal information collected and analyzed concerning a resident’s sex life or sexual orientation.

The terms “sell, selling, sale and sold,” and “share, shared, and sharing” have the meanings given to them in the CCPA. See California Civil Code section 1798.140. PRIVACY RIGHTS The CCPA gives California residents certain rights concerning their personal information. These rights are described below. The Right to Know What Personal Information Is Being Collected California residents have the right to request that we disclose

the categories of personal information that we have collected about them;
the categories of sources from which the personal information is collected;
the business or commercial purpose for collecting, selling, or sharing the personal information;
the categories of third parties to whom we disclose personal information; and
the specific pieces of personal information that we have collected about them over the past 12 months.

Upon our receipt of a verifiable request from a California resident to disclose this information, we will disclose this information pursuant to the CCPA. The Right to Correct Inaccurate Personal Information California residents have the right to request that we correct inaccurate personal information that we have about them. Upon our receipt of a verifiable request from a California resident to correct inaccurate personal information, we will use commercially reasonable efforts to correct the inaccurate personal information as directed by the resident pursuant to the CCPA. The Right to Know What Personal Information Is Sold or Shared and to Whom California residents have the right to request that we disclose

the categories of personal information that we collected about them;
the categories of personal information that we sold or shared about them and the categories of third parties to whom the personal information was sold or shared;
the categories of personal information that we disclosed about them for a business purpose; and
the categories of persons to whom the personal information was disclosed for a business purpose over the past 12 months.

Upon our receipt of a verifiable request from a California resident that we disclose this information, we will disclose this information pursuant to the CCPA. The Right to Opt Out of the Sale or Sharing of Personal Information For businesses that sell or share personal information with third parties, the CCPA gives California residents the right to opt out of the sale or sharing of their personal information. Flagship does not sell or share personal information with third parties and we have not done so in the past 12 months. Because Flagship does not sell or share personal information with third parties, Flagship does not provide a mechanism for California residents to opt-out of the sale or sharing of their personal information. The Right to Limit Use and Disclosure of Sensitive Personal Information For businesses that collect sensitive personal information, the CCPA gives California residents the right to limit the use of their sensitive personal information to the purposes outlined in the CCPA. Because Flagship does not use or disclose residents’ sensitive personal information for purposes other than as outlined in the CCPA, Flagship does not provide a mechanism for California residents to limit the use of their sensitive personal information. The Right to Non-Discrimination for Having Exercised CCPA Rights The CCPA prohibits businesses from discriminating against California residents for having exercised any of their CCPA rights. This includes the rights of an employee, job applicant, and independent contractor not to be retaliated against for having exercised their CCPA rights. Flagship will not discriminate against California residents for having exercised any of their CCPA rights. The Right to Delete Personal Information California residents have the right to request that we delete personal information that we have about them. However, we are not required to comply with every request to delete personal information (see California Civil Code section 1798.105(d)). Upon our receipt of a verifiable request from a California resident to delete personal information, and unless (1) an exception applies or (2) it proves impossible or involves a disproportionate effort, we will delete the personal information and will notify any service providers and third parties with whom we have shared the personal information to delete the personal information as well. INFORMATION COLLECTION The categories of personal information that we collect and have collected in the past 12 months include the following:

identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers;
signature, physical characteristics or description, telephone number, passport number, state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information;
as permitted by law, characteristics of protected classifications under California or federal law, such as race, gender, national origin, age, etc.;
commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies;
audio, electronic, visual, or similar information;
professional or employment-related information;
education information; and
sensitive personal information.

The categories of sensitive personal information that we collect and have collected in the past 12 months include the following:

a resident’s social security, driver’s license, state identification card, or passport number; and
a resident’s race.

The categories of sources from which personal information have been collected in the past 12 months include the following:

the resident (including through job applications to Flagship and credit applications);
the resident’s co-applicant(s), family member(s), reference(s), or person(s) authorized on their account;
the resident’s employer;
automobile dealerships;
third-party service providers or vendors;
internet service providers;
lead generators/lead aggregators; and
consumer reporting agencies.

INFORMATION PURPOSES We may use the personal information to:

process your transaction(s);
maintain your account(s);
respond to your inquiries, requests, communications, etc.;
locate you (not geolocation);
locate the collateral securing a loan;
offer our products and services to you;
communicate with you, including with regard to updates, changes, or additions to our practices or policies;
enhance and/or improve your on-line experience with us;
maintain and manage the employer/employee relationship (applicable to Flagship employees); and
facilitate legal processes.

We may use the sensitive personal information to:

process your transaction(s);
maintain your account(s);
respond to your inquiries, requests, communications, etc.;
locate you;
locate the collateral securing a loan;
maintain and manage the employer/employee relationship (applicable to Flagship employees); and
facilitate legal processes.

Our goal is to collect only that information about you that is needed for the purposes listed above. We collect, and have collected in the past 12 months, this information through the application process, the servicing of your account, our customer service center, our website(s), public records, consumer reporting agencies, affiliates, business partners, and service providers. We collect, and have collected in the past 12 months, this information for the following business purposes:

auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards;
helping to ensure security and integrity (but only to the extent that the use of the personal information is reasonably necessary and proportionate for these purposes);
debugging to identify and repair errors that impair existing intended functionality;
short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of your current interaction with us (provided that the personal information is not disclosed to a third party and is not used to build a profile about you or otherwise alter your experience outside the current interaction with us);
performing services on our behalf, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, or providing similar services on our behalf;
providing advertising and marketing services, except for cross-context behavioral advertising, to you (provided that, for the purpose of advertising and marketing, a service provider or contractor will not combine the personal information of opted-out consumers that the service provider or contractor receives from, or on behalf of, us with personal information that the service provider or contractor receives from, or on behalf of, another person or persons or collects from its own interaction with consumers);
undertaking internal research for technological development and demonstration; and
undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us.

INFORMATION RETENTION Flagship is licensed under the California Financing Law, which generally requires that licensees keep information regarding a loan for at least three years after making the final entry on the loan. Flagship is also subject to numerous state and federal consumer protection and employment laws that have their own record retention requirements. It is Flagship’s intention to retain personal information and sensitive personal information of California residents in accordance with applicable state and federal laws. INFORMATION DISCLOSURE We do not disclose residents’ sensitive personal information for purposes other than as outlined in the CCPA. We may disclose the personal information with authorized third parties:

to perform services for us or functions on our behalf;
to effect, administer, or enforce a transaction that you request or authorize;
to service or process a financial product or service that you request or authorize;
to maintain or service your account with us;
in connection with a proposed or actual securitization, secondary market sale, or similar transaction related to a transaction of yours;
with your consent or at your direction;
to protect the confidentiality or security of our records;
to protect against or prevent actual or potential fraud, unauthorized transactions, claims, or other liability;
for required institutional risk control or for resolving your disputes or inquiries;
to the extent specifically permitted or required under applicable law;
in connection with a proposed or actual sale, merger, transfer, or exchange of all or a portion of our business;
to comply with Federal, state, or local laws, rules and other applicable legal requirements;
to comply with a properly authorized civil, criminal, or regulatory investigation, or subpoena or summons by Federal, state, or local authorities;
maintain and manage the employer/employee relationship (applicable to Flagship employees); and
to respond to judicial process or government agencies with jurisdiction over us for examination, compliance, enforcement or other purposes, as authorized by law.

The categories of third parties to whom we have disclosed personal information in the past 12 months include the following:

investors;
third party debt collectors;
payment processors;
repossession vendors;
automobile dealerships;
government agencies with jurisdiction over us for examination, compliance, enforcement or other purposes, as authorized by law;
attorneys, accountants and auditors; and
consumer reporting agencies.

The categories of personal information that we have disclosed for a business purpose in the past 12 months include the following:

real name, alias, postal address, unique personal identifier, online identifier, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers;
signature, telephone number, passport number, state identification card number, insurance policy number, employment, employment history, medical information, or health insurance information;
as permitted by law, characteristics of protected classifications under California or federal law, such as race, gender, national origin, age, etc.;
commercial information, including records of personal property, products or services purchased, obtained, or considered;
audio, electronic, visual, or similar information;
professional or employment-related information; and
sensitive personal information.

The categories of third parties to whom we have disclosed personal information in the past 12 months for a business purpose include the following:

investors;
third party debt collectors;
payment processors;
repossession vendors;
government agencies with jurisdiction over us for examination, compliance, enforcement or other purposes, as authorized by law;
attorneys, accountants and auditors;
medical, dental, and vision benefit providers (Flagship employees only);
insurance providers;
human resources vendors and service providers (Flagship employees only);
employment verification vendors and service providers; and
vendors providing background checks (Flagship employees, job applicants and independent contractors only).

We disclose, and have disclosed in the past 12 months, this information for the following business purposes:

helping to ensure security and integrity (but only to the extent that the use of the personal information is reasonably necessary and proportionate for these purposes);
debugging to identify and repair errors that impair existing intended functionality;
performing services on our behalf, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, or providing similar services on our behalf;
providing advertising and marketing services, except for cross-context behavioral advertising, to you;
administering benefits for employees or independent contractors, if applicable;
undertaking internal research for technological development and demonstration; and
undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us.

STATEMENT REGARDING MINORS Our website is not intended for use by minors, we do not knowingly solicit information from minors, and we do not knowingly market to minors. Flagship does not sell or share personal information with third parties, and Flagship will not sell or share the personal information of a California resident who we know is less than 16 years of age unless (1) the resident (in the case of a resident who is at least 13 years of age but less than 16 years of age) or (2) the resident’s parent or guardian (in the case of a resident who is less than 13 years of age) has affirmatively authorized us to sell or share that resident’s personal information. EXERCISING YOUR RIGHTS

Your CCPA Rights	How To Exercise Them	What to Expect
The Right to Know What Personal Information Is Being Collected The Right to Correct Inaccurate Personal Information The Right to Know What Personal Information Is Sold or Shared and to Whom The Right to Delete Personal Information	Call Flagship toll free at 800-900-5150 or submit a request online at https://www.flagshipcredit.com/contact-us.	We will validate that you (1) currently reside in California permanently or (2) reside in California but are currently outside the state for a temporary or transitory purpose. If you are a California resident who is a Flagship (1) (I) customer or former customer or (ii) credit applicant or (2) (i) employee or former employee or (ii) job applicant, we will verify your identity using two or three pieces of personal information, depending upon the type of request you are making. For example, if your request pertains to Category Information (e.g., information about the categories of personal information we collect, the categories of sources from whom we collect, the categories of third parties to whom we disclose), we will ask you for two pieces of personal information in order to verify your identity. If your request pertains to for Specific Information (e.g., the specific information we have collected about you), we will ask you for three pieces of personal information in order to verify your identity. If you are not a Flagship customer, former customer, California-based employee or job applicant, we may need additional personal information from you to verify your identity and determine if we have collected information about you. No later than 10 business days after we receive your request, we will confirm that we received it and let you know how we will process it.
The Right to Opt Out of the Sale or Sharing of Personal Information	No action required. Because Flagship does not sell or share personal information with third parties, Flagship does not provide a mechanism for opting out.	You should expect that Flagship will not sell or share your personal information with third parties.
The Right to Limit Use and Disclosure of Sensitive Personal Information	No action required. Because Flagship does not use or disclose sensitive personal information for purposes other than as outlined in the CCPA, Flagship does not provide a mechanism for limiting its use or disclosure.	You should expect that Flagship will not use or disclose your sensitive personal information other than as outlined in the CCPA.
The Right to Non-Discrimination for Having Exercised CCPA Rights	No action required. Flagship will not discriminate against California residents for having exercised any of their CCPA rights.	You should expect that Flagship will not discriminate against you for having exercised your CCPA rights.

Your authorized agent may make CCPA requests on your behalf. An authorized agent may, for example, be your agent under a power of attorney (POA); a person acting as your conservator; a natural person you authorized in writing to act on your behalf; a business entity that is registered with the California Secretary of State and that you authorized in writing to act on your behalf; etc. However, for your protection, we will first require documentation (for example, the POA, a copy of the signed, written permission you gave to your authorized agent, etc.) showing that the person is authorized to act on your behalf. Additionally, regardless of the type of request, we will ask your authorized agent for three pieces of information verifying their identity. Once the authorized agent has verified their identity and provided the required documentation, they may make a CCPA request on your behalf in the same manner as you are able. For questions or concerns regarding this California Privacy Policy or Flagship’s practices related to same, call Flagship toll free at (800) 900-5150 or submit a request online at https://www.flagshipcredit.com/contact-us. This California Privacy Policy was last updated July 1, 2023.

Have Questions?