Arbol United States Privacy Policy

1. Types of Information Collected and How We Collect Them.Personal Information You Provide:

We collect the following personal information you provide when you use our services, like when you sign up for an account, request a transaction, enroll in a promotion or program, to otherwise engage or communicate with us:

1. Identity Data includes your full name, date of birth, gender, social security numbers, and other data on government-issued identification documents.
2. Contact Data includes your email address, mailing address, and telephone numbers.
3. Profile Data includes your username and password, purchases or orders made by you, your knowledge assessment results, and your interests, preferences, feedback, and survey responses.
4. Additional Information includes information that you submit via focus groups, contests/sweepstakes, job applications, customer support, to other similar means. We may also collect any communications between Arbol and you (including recording calls made to orby Arbol) and any other information you provide to Arbol.

Personal Information Collected Automatically:

As is true of many digital platforms, we collect certain personal information automatically when you visit our online services, including:

1. Location Data. To help us protect against fraud, provide our services to you, and improve our services, we collect location data, including current and historical information concerning a user’s geographic location data, including current and historical information concerning a user’s geographic location, GPS location, transaction location, and IP addresses that they use in conjunction with our services. We collect your precise location data with your permission, and use that information, for example, to help protect against fraud by detecting and declining debit card transactions that may occur far away from your device’s location. We collect information about your location through GPS, Wi-Fi, wireless network triangulation, or other methods in order to obtain your location. We may also approximate your location by your IP Address. We also use the Google Maps API to gather information about your location. Google uses various technologies to determine your location, including IP address, GPS, and other sensors that may, for example, provide Google with information on nearby devices, Wi-Fi access points, and cell towers(see Google’s Privacy Policy to learn more).
2. Usage and Device Data Collected Automatically Through Tracking Technologies. To provide a personalized and enhanced user experience, we, and our third-party partners, automatically collect certain types of usage information when you visit or use ourServices, read our emails, or otherwise engage with us. We typically collect this information through a variety of tracking technologies, including cookies, Flash objects, web beacons, embedded scripts, location identifying technologies, file information, and similar technology (collectively, “Tracking Technologies”). For example, we collect information about your device and its software, such as your IP address, browser type,Internet service provider, platform type, device type, operating system, data and timestamp, unique ID (that allows us to uniquely identify your browsers, mobile device, or your account), and other similar information. We use Tracking Technologies to help ensure that you have a high-quality experience on our Services. We also use TrackingTechnologies to aid in the targeted advertising of our services on other platforms. From your device manufacturer, we also may collect the names of other third-party applications that you have downloaded on your device.

If you prefer, you can change your cookie settings. Some browsers have options that allow the user to control whether the browser will accept cookies, reject cookies, or notify the user each time a cookie is sent. You may elect to reject cookies by adjusting your settings but doing so will limit the range of features available to you on our Services and other websites. Be sure to read any information provided by our browser developer to understand the limitations of these settings, as they may differ from browser to browser and may not apply to all technologies. You may also set your email options to prevent the automatic downloading of images that may contain technologies that would allow us to know whether you have accessed our email, used ourServices, or performed certain functions with it.

Our Services are also occasionally use “local shared objects” (also known as “Flash cookies”).Like browser cookies, Flash cookies may be used for coordinating content delivery, website functionality, maintaining preferences, advertising, or analytics. Unlike browser cookies, “Flash cookies” are not stored in the browser.

3. Disclosures of Personal Information:

Arbol is committed to maintaining your trust, and we want you to understand when and with whom we may share the personal information we collect. We may share your personal information in the instances below. For further information on your choices regarding your personal information, see the “Control Over Your Information” section below. We do not sell or rent your personal information to third parties, aside from substantial corporate transactions(described below).

• a. Authorized third-party vendors and service providers. We share personal data with certain authorized and vetted contractors, subcontractors, third-party vendors, and service providers who help us run and protect our business. This includes sending emails, conducting business analytics, marketing, and data processing. For example, we may share personal data with service providers that identify and serve targeted advertisements or provide mailing services, contest fulfillment, web hosting, or analytic services.
• b. Arbol affiliates. We share personal data with other companies owned or controlled by Arbol Inc. These companies will use your personal information in the same way that we do under the United States Privacy Policy.
• c. Substantial corporate transactions. We may share personal data in connection with a substantial corporate transaction, such as the sale of a website, a merger, consolidation, reorganization, financing, change or control or acquisition of all or a portion of our business by another company or third party, asset sale, initial public offering, or in the unlikely event of bankruptcy or similar proceeding.
• d. Legal purposes. We disclose personal data to respond to subpoenas, court orders, legal process, law-enforcement requests, legal claims, or government inquiries and to protect and defend the rights, interests, safety, and security of Arbol, our affiliates, users or the public.
• e. With your consent. We share personal data for any other purposes disclosed to you with your consent. We may also share information with others in an aggregated or otherwise anonymized form that does not reasonably identify you directly as an individual.

4. Third-Party Links:

Some of the Services may contain links to content maintained that we do not control. We are not responsible for the privacy parties of these third parties or the content on the third-party services, and the information practices of these third parties are not covered by this Policy. Please note that these third-party services have their own privacy policies, and we strongly recommend that you read their privacy policies as terms and conditions of use to understand how they collect, use, and share your information.

5. Third-Party Tracking and Online Advertising:

We use Google Analytics to recognize you and link your devices when you use our Services on your browser or mobile device, log on to your accounts on our Services, or otherwise engage with us. We share a unique identifier, like a user ID or hashed email address, with Google to facilitate the Services. Google Analytics allows us to better understand how our users interact with our Services and to tailor our advertisements and content to you. For information on howGoogle Analytics collects and processes data, as well as how you can control information sent toGoogle, see “How Google uses data when you use our partners’ sites of apps” linked here: http://www.google.com/policies/privacy/partners/. You can learn about Google Analytics’ currently available opt-outs, including the Google Analytics Browser Ad-On, here: https://tools.google.com/dlpage/gaoptout/. We may use certain forms of display advertising and other advanced features through Google Analytics, such as Remarketing with Google Analytics, Google Display Network Impression Reporting. These features let us to use first-party cookies(such as the Google Analytics cookie) and third-party cookies (such as the DoubleClick advertising cookie) or other third-party cookies together to inform, optimize, and opt-out of certain Google advertising products by visiting the Google Ads Preference Manager, currently available at https://google.com/ads/preferences, or by visiting NAI’s online resources at http://www.networkadvertising.org/choices.

6. Control Over Your Information:

Account profile. You may update certain of your account profile information by logging into your account.

Access to your device data. You may control the mobile app’s access to your device information in your device’s settings. For instance, you can withdraw permission for the app to access your contact list or photo gallery.

How to control your communications preferences. You can stop receiving promotional emails from us by clicking on the provided “unsubscribe” link. You may not opt out of service-related or other non-promotional communications (e.g., account verification, transactional communications, changes/updates to features of the Services, and technical and security notices).

7. Notice to California Residents:

This section provides additional details about the personal information we collect aboutCalifornia residents and the rights afforded to them under the California Consumer Privacy Act(“CCPA”). Please note that the CCPA does not apply to what is referred to as nonpublic information collected by financial institutions (like Arbol), as that information is subject instead to other financial privacy laws. As a result, the CCPA does not apply to most of the information that Arbol collects.

Subject to certain limitations and exceptions, the CCPA provides California residents the right to request more details about categories and specific elements of personal information we collect, to delete their personal information, to opt out of any “sales” that may be occurring, and to not be discriminated against for exercising these rights. We do not sell information about you to third parties.

We collect the following categories of personal information subject to the CCPA: identifiers(such as email address and IP address), approximate geolocation information, and internet or other electronic network activity information (such as browsing history and related usage data).

California residents may make a consumer rights request for access to certain personal information subject to the CCPA, not otherwise exempted as nonpublic information collected by financial institutions, by sending an email to insuranceprivacy@arbolmarket.com. We may verify the request by asking you to provide information that matches information we have on file about you. You can also designate an authorized agent to exercise these rights on your behalf, but we will require proof that the person is authorized to act on your behalf and may also still ask you to verify your identity with us directly.

8. Transfer of Personal Information:

Our Services are currently designed for use only in certain select markets. If you are using ourServices from another jurisdiction, your information collected through our Services may be stored and processed in the United States or any other country in which Arbol or its affiliates maintain facilities or conduct business activities. If you are located in other regions with laws governing data collection and use that may differ from U.S. law, please not that we may transfer information, including personal information, to a country and jurisdiction that does not have the same data-protection laws as your jurisdiction.