1. Introduction

Depending on where you reside, you may have certain rights regarding your personal information. This section describes the rights available under various state privacy laws and how to exercise them.

8.1. California Residents (CCPA)

If you are a California resident, you have the following rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"):

8.1.1. Right to Know

You have the right to request that we disclose:

• The categories of personal information we have collected about you

• The categories of sources from which we collected personal information

• The business or commercial purposes for collecting, selling, or sharing personal information

• The categories of third parties to whom we disclose personal information

• The specific pieces of personal information we have collected about you

8.1.2. Right to Delete

You have the right to request that we delete personal information we have collected from you, subject to certain exceptions.

8.1.3. Right to Correct

You have the right to request that we correct inaccurate personal information we maintain about you.

8.1.4. Right to Opt Out of Sale/Sharing

You have the right to opt out of the "sale" of your personal information and the "sharing" of your personal information for cross-context behavioral advertising purposes.

We sell and share personal information. As described in Section 4, we disclose personal information to our business clients in the form of audience cohorts and to advertising partners for targeted advertising. Under the CCPA and other state laws, these disclosures may constitute "sales" and/or "sharing."

To opt out, you may click the "Do Not Sell or Share My Personal Information" link in the footer of our Website or email us at [email protected] with the subject line "Do Not Sell or Share My Personal Information" and include your name and sufficient information for us to locate your records in our database.

8.1.5. Right to Limit Use of Sensitive Personal Information

We may collect sensitive personal information, as described in Section 2.5, from third-party data sources. We may use sensitive personal information to generate audience segments and ideal customer profiles for our clients' marketing and advertising purposes (for example, consumers meeting a certain demographic). You have the right to limit our use of your sensitive personal information to purposes necessary to provide our Services.

To limit the use of your sensitive personal information, please email us at [email protected] with the subject line "Limit Use of Sensitive Personal Information."

8.1.6. Right to Non-Discrimination

We will not discriminate against you for exercising your CCPA rights. We will not deny you goods or services, charge you different prices, provide a different level of quality, or suggest that you will receive different treatment for exercising your rights.

8.1.7. Financial Incentives

We do not offer financial incentives, price differences, or service differences in exchange for the retention, sale, or sharing of your personal information.

8.1.8. Categories of Personal Information Collected, Sold, and Shared

The following table describes the categories of personal information we have collected, sold, and shared in the preceding 12 months :

Category Collected Sold Shared Sources Purposes

Identifiers (name, address, email, phone, IP address) Yes Yes Yes You; Third-party data providers; Clients Provide Services; Marketing; Analytics

Personal information under Cal. Civ. Code § 1798.80(e) Yes Yes Yes You; Third-party data providers Provide Services; Marketing

Protected classification characteristics Yes Yes No Third-party data providers Provide Services

Commercial information Yes Yes Yes Third-party data providers; Clients Provide Services; Marketing

Internet or network activity Yes Yes Yes Third-party data providers; Automatically collected Provide Services; Analytics; Advertising

Geolocation data Yes Yes Yes Third-party data providers; Automatically collected Provide Services; Advertising

Professional or employment information Yes Yes No Third-party data providers Provide Services

Inferences Yes Yes Yes Derived from other categories Provide Services; Marketing

Sensitive personal information Yes Yes No Third-party data providers Provide Services

8.1.9. Categories of Sensitive Personal Information Collected

The following table describes the categories of sensitive personal information we may have collected in the preceding 12 months:

Category of Sensitive Personal Information Collected Sold Purposes

Social Security, driver's license, state ID, or passport number Yes Yes Provide Services

Account log-in credentials with required security codes No No Provide Services

Financial account, debit card, or credit card number with access credentials No No Provide Services

Precise geolocation No No Provide Services

Racial or ethnic origin Yes Yes Provide Services

Religious or philosophical beliefs Yes Yes Provide Services

Union membership Yes Yes Provide Services

Contents of mail, email, or text messages (where not intended recipient) No No Provide Services

Genetic data Yes No Provide Services

Biometric information for unique identification No No Provide Services

Health information Yes Yes Provide Services

Sex life or sexual orientation information Yes Yes Provide Services

8.1.10. How to Submit a Request

To exercise your rights under the CCPA, you may:

• Click the applicable link in the footer of our Website

• Email: [email protected]

• Phone: 614-636-6789

We will verify your identity before processing your request. To verify your identity, we may ask you to provide information that matches information we have on file, such as your name, email address, postal address, or other identifiers. For individuals whose information is in our data lake (obtained from third-party sources), we may require you to provide a signed declaration under penalty of perjury that you are the individual whose personal information is the subject of the request. The statement need not be notarized.

You may designate an authorized agent to submit a request on your behalf. We may require the authorized agent to provide proof of written authorization and may verify your identity directly.

We will respond to verifiable requests within 45 days. If we need additional time, we will notify you of the extension and the reason for it. We may take up to an additional 45 days to respond, for a maximum total of 90 days.

8.1.11. California Delete Act

Exact Match is registered as a data broker with the California Privacy Protection Agency. Beginning August 1, 2026, California residents may submit deletion requests through the California Delete Act deletion mechanism at https://cppa.ca.gov/. Until that mechanism is available, you may submit deletion requests directly to us at [email protected].

8.2. Virginia Residents (VCDPA)

If you are a Virginia resident, you have the following rights under the Virginia Consumer Data Protection Act ("VCDPA"):

• Right to Access: Confirm whether we are processing your personal data and access such data.

• Right to Correct: Correct inaccuracies in your personal data.

• Right to Delete: Delete personal data you have provided or we have obtained.

• Right to Data Portability: Obtain a copy of your personal data in a portable format.

• Right to Opt Out: Opt out of the processing of your personal data for targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects.

To exercise your rights, please email [email protected]. We will respond within 45 days. If we decline your request, you may appeal by emailing [email protected] with the subject line "VCDPA Appeal." We will respond to your appeal within 60 days. If we deny your appeal, we will provide you with instructions on how to submit a complaint to the Virginia Attorney General.

8.3. Colorado Residents (CPA)

If you are a Colorado resident, you have the following rights under the Colorado Privacy Act ("CPA"):

• Right to Access: Confirm whether we are processing your personal data and access such data.

• Right to Correct: Correct inaccuracies in your personal data.

• Right to Delete: Delete personal data you have provided or we have obtained.

• Right to Data Portability: Obtain a copy of your personal data in a portable format.

• Right to Opt Out: Opt out of the processing of your personal data for targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects.

To exercise your rights, please email [email protected]. We will respond within 45 days. If we decline your request, you may appeal by emailing [email protected] with the subject line "CPA Appeal." We will respond to your appeal within 45 days. If we deny your appeal, we will provide you with instructions on how to submit a complaint to the Colorado Attorney General.

8.4. Connecticut Residents (CTDPA)

If you are a Connecticut resident, you have the following rights under the Connecticut Data Privacy Act ("CTDPA"):

• Right to Access: Confirm whether we are processing your personal data and access such data.

• Right to Correct: Correct inaccuracies in your personal data.

• Right to Delete: Delete personal data you have provided or we have obtained.

• Right to Data Portability: Obtain a copy of your personal data in a portable format.

• Right to Opt Out: Opt out of the processing of your personal data for targeted advertising, sale, or profiling in furtherance of decisions that produce legal or similarly significant effects.

To exercise your rights, please email [email protected]. We will respond within 45 days. If we decline your request, you may appeal by emailing [email protected] with the subject line "CTDPA Appeal." We will respond to your appeal within 60 days. If we deny your appeal, we will provide you with instructions on how to submit a complaint to the Connecticut Attorney General.

8.5. Other State Privacy Laws

Residents of other states with comprehensive privacy laws, including Utah, Texas, Oregon, Montana, Delaware, Iowa, Tennessee, and Indiana, may have similar rights to access, correct, delete, and opt out of certain processing activities. To exercise any rights you may have under applicable state law, please email [email protected]. If we decline your request, you may appeal by emailing [email protected] with the subject line "Privacy Appeal." We will respond to appeals within the timeframe required by applicable law and, if we deny your appeal, provide you with information on how to contact the appropriate state authority.

8.6. Universal Opt-Out Mechanisms

We recognize universal opt-out preference signals, including Global Privacy Control (GPC), as valid requests to opt out of the sale and sharing of personal information. If you enable GPC in your browser, we will process it as an opt-out request for the device and browser from which you access our Website.