Federal Privacy Notices & Privacy Policy

Welcome to Upgrade. Please read the Privacy Policy and the Federal Privacy Notices before using any website or mobile application owned and operated by Upgrade, Inc. (DBAs include Universal
Credit and the names at www.upgrade.com/landing/dba (https://www.upgrade.com/landing/dba)) (“Upgrade”), including www.upgrade.com (https://www.upgrade.com). The Privacy Policy can be found
by scrolling down on this page or by clicking here.

For applicants and borrowers of the Personal Loan (“PL”) product offered by Upgrade’s lending partners through Upgrade (www.upgrade.com/lending-partners (https://www.upgrade.com/lending-
partners)), each of the following Federal Privacy Notices and Privacy Policy apply.

For applicants and borrowers of the Upgrade Card with Personal Credit Line (“PCL”) and applicants and users of the Rewards Checking product, each offered by Cross River Bank through Upgrade, the
following Federal Privacy Notices and Privacy Policy apply except for the Blue Ridge Bank Privacy Notice.

Federal Privacy Notices

Rev. June 2021
Upgrade Federal Privacy Notice
FACTS WHAT DOES UPGRADE, INC. DO WITH YOUR PERSONAL INFORMATION?

Why? Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing.
Federal law also requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand
what we do.

What? The types of personal information we collect and share depend on the product or service you have with us. This information can include:

Social Security Number and Credit History

Account Balances and Transaction History
Payment History and Employment Information
When you are no longer our customer, we continue to share your information as described in this notice.

How? All financial companies need to share customers’ personal information to run their everyday business. In the section below, we list the reasons
financial companies can share their customers’ personal information; the reasons Upgrade chooses to share; and whether you can limit this sharing.

Reasons we can share your personal information Does Company share? Can you limit
this sharing?
For our everyday business purposes— Yes No
such as to process your transactions, maintain your account(s), respond to court
orders and legal investigations, or report to credit bureaus

For our marketing purposes— Yes No

to offer our products and services to you

For joint marketing with other financial companies No We don’t share

COPY
For our affiliates’ everyday business purposes— No We don’t share
information about your transactions and experiences

For our affiliates’ everyday business purposes— No We don’t share

information about your creditworthiness

For nonaffiliates to market to you No We don’t share

Questions? Call 844-319-3909 or go to www.upgrade.com

Who we are

Who is providing this notice Upgrade, Inc.

What we do

How does Upgrade protect To protect your personal information from unauthorized access and use, we use security measures that comply with federal law. These
my personal information? measures include computer safeguards and secured files and buildings.

How does Company collect
my personal information?
We collect your personal information, for example, when you
Open an account or Provide employment information
Apply for a loan or Provide account information
Give us your contact information
We also collect your personal information from others, such as
credit bureaus or other companies.

Why can’t I limit all Federal law gives you the right to limit only
sharing? sharing for affiliates’ everyday business purposes information about your creditworthiness.
affiliates from using your information to market to you
sharing for nonaffiliates to market to you
State laws and individual companies may give you additional rights to limit sharing. See below for more on your rights under state law.
Definitions

Affiliates Companies related by common ownership or control. They can

be financial and nonfinancial companies.
Currently Upgrade has no affiliates.

Nonaffiliates Companies not related by common ownership or control. They can be financial and nonfinancial
companies.
Upgrade does not share with nonaffiliates so they can market to you.

Joint marketing A formal agreement between nonaffiliated financial companies that together market financial products
or services to you.
Upgrade doesn’t jointly market.

Other important information

California: We will not share your information with companies outside of Upgrade except for our everyday business purposes, for marketing our products and services to you
or with your consent.
For Vermont Customers: We will not disclose information about your creditworthiness to our affiliates and will not disclose your personal information, financial information,
credit report, or health information to nonaffiliated third parties to market to you, other than as permitted by Vermont law, unless you authorize us to make those disclosures.
Additional information concerning our privacy policies can be found at www.upgrade.com/privacy or call 844-319-3909
Nevada Residents: Notice provided pursuant to state law. To be placed on our internal Do Not Call List, call 844-319-3909. If you would like more information about
telemarketing practices, you may contact us at Upgrade. Attn: Nevada Marketing Information, 275 Battery Street, 23rd Floor, San Francisco, CA 94111 or email
support@upgrade.com. For more on this Nevada law, contact Bureau of Consumer Protection, Office of the Nevada Attorney General, 555 E. Washington St., Suite 3900, Las
Vegas, NV 89101; Phone number: 1-702-486-3132; e-mail: BCPINFO@ag.state.nv.us.
Texas Residents: Upgrade is licensed and examined under the laws of the State of Texas and by state law is subject to regulatory oversight by the Office of Consumer Credit
Commissioner. Any consumer wishing to file a complaint against Upgrade should contact the Office of Consumer Credit Commissioner through one of the means indicated
below: In Person or U.S. Mail: 2601 North Lamar Boulevard, Austin, Texas 78705-4207. Telephone No.: (800) 538-1579. Fax No.: (512) 936-7610. E-mail:
consumer.complaints@occc.state.tx.us. Website: www.occc.state.tx.us (http://www.occc.state.tx.us).
Telephone Communications: All telephone communications with us or our authorized agents may be monitored or recorded.

COPY
Cross River Bank Privacy Notice Rev. November 2018

FACTS WHAT DOES CROSS RIVER BANK DO WITH YOUR PERSONAL INFORMATION?

Why? Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also
requires us to tell you how we collect, share and protect your personal information. Please read this notice carefully to understand what we do.

What? The types of personal information we collect and share depend on the product or service you have with us. This information can include:
Social Security number and Account balances
Payment history and Transaction History
Account transactions and Wire transfer instructions
When you are no longer our customer, we continue to share your information as described in this notice.

How? All financial companies need to share customers’ personal information to run their everyday business. In the section below, we list the reasons financial
companies can share their customers’ personal information; the reasons Cross River Bank chooses to share; and whether you can limit this sharing.

Reasons we can share your personal information Does Cross Can you limit
River Bank this sharing?
share?
For our everyday business purposes – Yes No
such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit
bureaus

For our marketing purposes – Yes No

to offer our products and services to you

For joint marketing with other financial companies Yes No

For our affiliates' everyday business purposes – No We don't share

information about your transactions and experiences

For our affiliates' everyday business purposes – information about your creditworthiness No We don't share

For nonaffiliates to market to you No We don't share

Questions? Call toll-free 1-877-55CRB55 or go to www.crossriverbank.com

What we do

How does Cross River Bank protect my personal information?
To protect your personal information from unauthorized access and use, we use
security measures that comply with federal law. These measures include computer
safeguards and secured files and buildings.
We also maintain other physical, electronic and procedural safeguards to protect
this information and we limit access to information to those employees for whom

COPY
access is appropriate.

How does Cross River Bank collect my personal information? We collect your personal information, for example, when you
Open an account or Apply for a loan
Make deposits or withdrawals from your account or Provide employment
information
Give us your contact information
We also collect your personal information from others, such as credit bureaus,
affiliates, or other companies.

Why can't I limit all sharing? Federal law gives you the right to limit only
sharing for affiliates' everyday business purposes-information about your
creditworthiness
affiliates from using your information to market to you
sharing for nonaffiliates to market to you
State laws and individual companies may give you additional rights to limit sharing.
See below for more on your rights under state law.

Definitions

Affiliates Companies related by common ownership or control. They can be financial and
nonfinancial companies.
Cross River Bank does not share with our affiliates.

Nonaffiliates Companies not related by common ownership or control. They can be financial and
nonfinancial companies.
Nonaffiliates we share with can include loan finance companies

Joint marketing A formal agreement between nonaffiliated financial companies that together
market financial products or services to you.
Our joint marketing partner(s) include loan finance companies.

Other important information

For Alaska, Illinois, Maryland and North Dakota Customers. We will not share personal information with nonaffiliates either for them to market to you or for joint marketing-
without your authorization.
For California Customers. We will not share personal information with nonaffiliates either for them to market to you or for joint marketing-without your authorization. We will
also limit our sharing of personal information about you with our affiliates to comply with all California privacy laws that apply to us.
For Massachusetts, Mississippi and New Jersey Customers. We will not share personal information from deposit or share relationships with nonaffiliates either for them to
market to you or for joint marketing-without your authorization.
For Vermont Customers. We will not disclose information about your creditworthiness to our affiliates and will not disclose your personal information, financial information,
credit report, or health information to nonaffiliated third parties to market to you, other than as permitted by Vermont law, unless you authorize us to make those disclosures.
Additional information concerning our privacy policies can be found at www.crossriverbank.com or call 1-877-55CRB55.
Blue Ridge Bank Privacy Notice Rev. February 2019

FACTS WHAT DOES BLUE RIDGE BANK, N.A. DO WITH YOUR PERSONAL INFORMATION?

Why? Financial companies choose how they share your personal information. Federal law gives consumers the right to limit some but not all sharing. Federal law also
requires us to tell you how we collect, share, and protect your personal information. Please read this notice carefully to understand what we do.

What? The types of personal information we collect and share depend on the product or service you have with us. This information can include:
Social Security number and employment information
Account balances and transaction history
Credit history and investment experience
When you are no longer our client, we continue to share your information as described in this notice.

How? All financial institutions need to share customer's personal information to run their everyday business. In the section below, we list the reasons financial
companies can share their customer's personal information; the reasons Blue Ridge Bank, N.A. chooses to share; and whether you can limit this sharing.

Reasons we can share your personal information Does Blue Can you limit
Ridge Bank, this sharing?
N.A. share?

For our everyday business purposes – Yes No

such as to process your transactions, maintain your account(s), respond to court orders and legal investigations, or report to credit
bureaus

For our marketing purposes – Yes No

to offer our products and services to you

For joint marketing with other financial companies No We don't share

For our affiliates' everyday business purposes – Yes No

information about your transactions and experiences

For our affiliates' everyday business purposes – Yes Yes

information about your creditworthiness

For our affiliates to market to you Yes Yes

For nonaffiliates to market to you No We don't share

To limit Call 888-331-6521 to speak with a customer service representative

our
sharing

Questions? Call 888-331-6521 or go to www.mybrb.com

COPY
Who we are

Who is providing this notice? Blue Ridge Bank, N.A.

Businesses listed in the other section below provide their own privacy notices.

What we do

How does Blue Ridge Bank, N.A. protect my personal information? To protect your personal information from unauthorized access and use, we use
security measures that comply with federal law. These measures include computer
safeguards and secured files and buildings.

How does Blue Ridge Bank, N.A. collect my personal information?
We collect your personal information, for example, when you
Open an account or apply for a loan
Use your credit or debit card or seed advice about investments
Make deposits or withdrawals from your account
We also collect your personal information from other, such as credit bureaus,
affiliates or other companies.

Why can't I limit all sharing? Federal law gives you the right to limit only
sharing for affiliates’ everyday business purposes—information about your
creditworthiness
affiliates from using your information to market to you
sharing for nonaffiliates to market to you
State laws and individual companies may give you additional rights to limit sharing.

Definitions

Affiliates Companies related by common ownership or control. They can be financial and
nonfinancial companies.
Our affiliates include: Hammond Insurance, Moneywise Payroll Solutions, and
Standard Mortgage Company.

Nonaffiliates Companies not related by common ownership or control. They can be financial or
nonfinancial companies.
Blue Ridge Bank, N.A. does not share with nonaffiliates so they can market to
you.

Joint marketing A formal agreement between nonaffiliated financial companies that together
market financial products or services to you.
Blue Ridge Bank, N.A. does not jointly market.

Other important information

The following entities are not covered by this notice and have separate notices:
Carolina State Bank, a division of Blue Ridge Bank, N.A.
Monarch Mortgage, a division of Blue Ridge Bank, N.A.
Larson Wealth Management and LPL Financial
Primax (credit card company)
To limit our sharing: Call 888-331-6521 to speak to a customer service representative.
Effective date: 01/13/2021

Privacy Policy
Welcome to Upgrade. Please read the Privacy Policy and the Federal Privacy Notices before using any website ("Website") or mobile application ("App") operated by Upgrade, including
www.upgrade.com. Upgrade, Inc. (DBAs include Universal Credit and the names at www.upgrade.com/landing/dba)

Upgrade, Inc. (“Upgrade”) is the owner of the Website and App and the hosting, content, and other functionality of the Website and App is supported by Upgrade and other third parties that provide
software and other services to Upgrade.

This Privacy Policy, together with the Federal Privacy Notice, describe the type of information we collect from you, what we do with the information we collect, how we protect your personal information
we have collected, and how you may update and control the information you provide on our Website or App.

This Privacy Policy applies to all prospective, current and former Upgrade customers. By accessing or using Upgrade’s Website or App, you consent to this Privacy Policy. If you have questions or
complaints regarding our Privacy Policy or practices, please contact us at privacy@upgrade.com. All loans made and bank accounts obtained through use of the Website or App are provided by a bank
partner.

Residents of California
If you are a California resident, the California Consumer Privacy Act of 2018 (the “CCPA”) requires us to provide you with certain notices prior to our collection and use of personal information about
you. You can find these notices below under “For Residents of California.” You should also read the rest of this Privacy Policy, which also applies to all prospective, current and former Upgrade
customers (including residents of California).

Information Upgrade Collects About You

Information Upgrade collects from you online

You can visit our Website without any personal information, in which case our servers collect information about your internet browsing activity on our Website (as described under “Tracking
Technologies”).

If you apply for a product or service on our Website or App, you will be asked to provide some of your personal and/or banking information, and Upgrade will request authorization to obtain your credit
report. To apply for a product or service on our Website or App, the personal information we collect includes but is not limited to (as applicable) your:

Name, address, and phone number

Social Security number

Date of Birth

Employment information

Salary and income

Email address

Bank account number, routing number, and name of your bank

COPY
Login credentials (user ID and password) you plan to use to access our Website or App

Information Upgrade collects from Third Parties about you

Credit Reports. When you visit the Website or App to see what loan terms and interest rate might apply to you, or apply for a loan or bank account, we collect information from credit bureaus and other
partners to determine your creditworthiness. The credit bureau information we collect includes (as applicable) information about your:

Credit score

Open and closed accounts

Credit inquiries

Late payments and collections activity

Public records, including bankruptcy, judgments, tax liens, payment statuses

We may also collect information from credit bureaus after your loan has been funded or your bank account has been opened, in order (as applicable) to provide data to investors that may be
interested in purchasing your loan, to evaluate risks associated with your loan, and also to offer you additional products or services.

We also collect information about you from other sources:

Information received as part of routine card verification (fraud) checks

Joint marketing partners, when they share information with us

Publicly available databases.

Information Upgrade Collects Based on Your Activity on the Upgrade Website or App

Upgrade collects information about your transactions and activity, in addition to other internet browsing data. We collect information about your computer and your visits to the Website or App,
including your IP address, geographical location, browser type, referral source, length of visit, button clicks and page views. If you become a borrower or bank account holder, we collect information
about your payment or transaction history.

Tracking Technologies

If you visit our Website or App, our servers collect information about your internet browsing activity on our Website or App, and other information such as your IP address, browser type and platform,
and information about the link that brought you to our Website or App. This information is used by us and our service providers to better understand a user’s experience on our Website and App and to
improve our Website and App.

Cookies and Web Beacons. Cookies are data files stored by your internet browser on your computer’s hard drive. Upgrade and our marketing partners and service providers use technologies such as
cookies, beacons, tags, and scripts, to analyze trends, administer the Website and App, track users’ movements around the Website and App, and gather demographic information about our user base
as a whole. We may receive reports on this activity on an individual and aggregated basis. Cookies are also used to gather statistical data, such as which pages are frequently visited, what is
downloaded, and the address of sites visited immediately before or after coming to our Website or App.

If you create an account on our Website or App, we use cookies when you sign in to your account to keep track of your personal session, help authenticate your account, and detect fraud. You can
control the use of cookies within your browser. However, if you reject cookies, your ability to use some features or areas of our Website or App may be limited.

Usage Data & Site Activity. Upgrade also uses local storage to store your preferences and other information. Various browsers offer their own tools for managing content persisted in the browser’s
local storage.

Third Party Technologies. We also partner with third parties to manage our advertising on other sites and evaluate our overall Website and App performance. Our third party partners may use
technologies such as cookies or other similar technologies to gather information about your activities on our Website, App, and other sites in order to provide you advertising based upon your browsing
activities and interests or help us track the success of our marketing efforts or overall Website and App performance. If you do not wish to have this information used to provide you with interest-based
advertisements, you may opt-out by clicking here (http://optout.networkadvertising.org/#!/). Please note that this opt-out only applies to interest-based advertisements provided through certain
networks and third-parties. You may continue to receive other generic advertisements or personalized ads from companies not participating in that opt-out program.

Do-Not-Track Signals

We do not respond to “do not track” signals from your browser at this time.

How Upgrade Uses Your Information

Servicing Your Account

If you apply for a loan or bank account using the Upgrade Website or App, we will use your information to facilitate your request and service your loan once it has been funded or your account once it
has been opened.

Upgrade is a service provider to its partner banks, and all loans or bank accounts facilitated through the Upgrade Website or App are provided by a partner bank. The information collected in
connection with a loan or bank account may be used for (as applicable):

Generating your profile

Processing your loan or bank account application on behalf of the partner bank providing the loan or bank account

Enabling automatic payments and fund transfers with other financial institutions

Communicating with you concerning your account and transactions

Addressing any disputes you may raise concerning your account

Implementing collection activities as needed

Data Analysis & Business Operations

Upgrade also uses your information to conduct analyses related to our Services and our Website and App. We use this information to help detect security incidents and prevent fraud, to improve our
Services and credit model, and to develop additional products and services. We also use this information to improve our Website and App’s usability and to evaluate the success of marketing
campaigns and other activities.

Marketing Communications

Upgrade may also use your personal information to select you for certain marketing offers. Upgrade may use your personal information both to select you for an offer and to communicate that offer to
you. If you do not wish to receive these communications, you may call us, or email us at privacy@upgrade.com, and we will remove you from future marketing communications.

Sharing Your Information

Upgrade may use and disclose your personal information that is collected through our Services to run our everyday business and in accordance with applicable law. We do not share, sell, rent or trade
your personal information with any third party other than as described in this Privacy Policy including to our service providers to provide the Services to you or those which you request in connection
with any loan or bank account application or account. We may share your information with law enforcement, government officials, or other third parties as required by law and when we believe that
such disclosure is necessary to protect our rights and/or comply with a judicial proceeding, court order, regulatory request or other legal process. We may also aggregate information and statistics and
use them in our business and provide them to third parties so long as they do not contain any personally identifiable information.

Protecting your Information

Our goal is to protect the personal information you submit to us through this Website and App both in transmission and once received. We and our service providers have implemented technical and
organizational measures designed to protect against loss or unauthorized access, disclosure, alteration or destruction of the information you provide on our Website or App. Despite these efforts, no
security measures, however thorough, are perfect. Accordingly, we do not guarantee the security of the information you provide to us.

Data security is achieved through technical safeguards that include a combination of firewalls, intrusion detection system, malware detection system, and data loss prevention systems. Upgrade also
conducts vulnerability scans of applications and systems regularly.

COPY
Some features of our security program include:

Secure Data Center

Upgrade uses an industry leading infrastructure service provider for its computing infrastructure needs. Upgrade’s cloud infrastructure facility (provided through the service provider) is enabled with
encryption and data protection capabilities for the systems and services we develop and/or deploy within. Upgrade’s infrastructure provider is SOC 1, SOC 2, and SOC 3 compliant.

Physical access to the data center is strictly controlled and we use threat prevention technologies such as network and web application firewalls, VPN, antivirus, intrusion detection systems, web
filtering and antispam technologies.

Security Certificates

Upgrade equips all customer facing services with an Extended Validation (EV) Secure Socket Layer (SSL) certificate to facilitate secure data transmission. Once on our system, personal information can
only be read or written through defined service access points, the use of which is password-protected.

Session Time-Outs

We employ session time-outs to protect your account. You will be logged out of the Website or App automatically after a specified period of inactivity. This time-out feature reduces the risk of others
being able to access your account if you leave your computer unattended.

Passwords

You should always choose a password that is difficult for others to guess and change your password frequently. At a minimum, we require the use of both numbers and letters in your password. We
have also instituted a process by which you can regain access to your account should you forget your password.

You should never share your password with anyone. Your password is not known to any Upgrade employee or third party, and we will never ask for your password by phone or email. If you ever receive
a communication claiming to be from Upgrade that asks for your password, you should immediately report it by contacting us at security@upgrade.com .

Security Awareness Training

We conduct security awareness training for all staff at least annually, and provide additional training on Upgrade privacy and security-related policies and procedures for personnel that have access to
sensitive information. We instruct staff that access must be used only in adherence with the principles set forth in this Policy and applicable laws, and for no other purpose. Personnel who misuse
customer information are subject to disciplinary action.

Additional Steps You Should Take to Ensure the Security of Your Information

Secure your Email Account and User ID. Upgrade sends important communications regarding your account via email. You should therefore take steps to secure and restrict access to your email
account and change your email account password frequently. If your email address changes, you should promptly update your contact information on our Website or App, or contact Customer Service
at 844-319-3909.

You should not include any personally identifying information in your Upgrade User ID. We are not responsible for any personal information that you may choose to reveal in your User ID.

Beware of suspicious emails. You should also be aware of fraudulent emails known as “phishing,” from companies claiming to be Upgrade and requesting your login information or other account
information. Upgrade will never ask for your login information in an email.

Removed Cache Files. When you are finished using our Website, you should log out completely, then close the browser window and clear the browser’s cache files. This step is particularly important if
you use a computer that is accessed by other people, such as in a public library.

Create Strong Passwords. You should use passwords that are at least 10 characters long and contain letters, numbers, and symbols.

Additional Policy Disclosures

We may periodically update or revise this Privacy Policy. The effective date at the top of this page shows when this Privacy Policy was last revised. We will let you know when we update this Privacy
Policy by changing the effective date and/or other appropriate means. Your continued use of our Website or App after we make any changes to this Privacy Policy is deemed to be acceptance of those
changes, so please check this page periodically for updates.

For California Residents

This notice for California residents under the CCPA supplements the information provided in the rest of this Privacy Policy, which also applies to you. Any terms defined in the CCPA have the same
meaning when we use them here.

We collect personal information about prospective, current and former Upgrade customers. In particular, we have collected the following categories of personal information from consumers in the last
twelve (12) months:

CCPA Category Examples

Identifiers Real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name,
social security number, driver’s license number, passport number, current or past job history, or other similar identifiers.

Characteristics of protected Age (40 years or older), marital status, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related
classifications under California or medical conditions), veteran or military status.
federal law

Commercial Information Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories.

Internet or other similar network Information regarding a consumer’s interaction with the Upgrade website, application, or advertisements.
activity

Professional or employment-related Current or past job history.

information

The CCPA does not apply to:

Publicly available information from government records.

De-identified or aggregated consumer information.

Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA) or the Gramm-Leach-Bliley Act (GLBA).

We collect this information from the sources described above under “Information Upgrade Collects About You.”

We use personal information about you for the business and commercial purposes described above under: “How Upgrade Uses Your Information.” Upgrade has not sold any personal information
within the last twelve (12) months. We share personal information with the categories of third parties described in the “Sharing Your Information” section above.

Your Rights and Choices under the CCPA

California residents have certain rights regarding their personal information. If you are a California resident, subject to certain limitations and exceptions, you have the right to:

Request we disclose to you the following information covering the 12 months preceding your request:

the categories of personal information about you that we collected;

the categories of sources from which the personal information was collected;

the purpose for collecting personal information about you;

the categories of third parties to whom we disclosed personal information about you and the categories of personal information that was disclosed (if applicable) and the purpose for

COPY
disclosing the personal information about you; and

the specific pieces of personal information we collected about you;

Request we delete personal information we collected from you; and

Opt out of any sales of personal information that may be occurring (none currently);

Be free from unlawful discrimination for exercising your rights under the CCPA

We will generally respond to your request within 45 days if we are able to verify your identity. We will notify you if our response will take longer than 45 days. Requests for specific pieces of personal
information may require additional information to verify your identity.

In some instances, we may not be able to honor your request. For example, we will not honor your request if we cannot verify your identity or if we cannot verify that you have the authority to make a
request on behalf of another individual. Additionally, we will not honor your request where an exception applies, such as where the disclosure of personal information would adversely affect the rights
and freedoms of another consumer or where the personal information that we maintain about you is not subject to your rights under the CCPA.

We will advise you in our response if we are not able to honor your request. In addition, if you request access to the specific pieces of personal information we have collected about you, we will not
provide social security numbers, driver’s license numbers or government issued identification numbers, financial account numbers, account passwords or security questions and answers, or any other
specific pieces of information if the disclosure presents the possibility of unauthorized access that could result in identity theft or fraud or unreasonable risk to data or systems and network security.

How to Exercise Your Rights under the CCPA

If you are a California resident, you may make a request to exercise your rights under the CCPA by either of the following methods:

Submitting a request via email to ccpa@upgrade.com; or

Calling us toll-free at (877) 418-4547.

Original Document hash: FO6P4shg1UKFZNUewPyjKuYaDaUUVBkRueuzkciIA3Q=

COPY