California Consumer Privacy Act

Introduction

This Privacy Policy for California Residents (the "Policy") supplements American Portfolio Mortgage Corporation's main Privacy Policy and applies solely to all visitors, users, and other California residents ("consumers" or "you"). We adopt this notice to comply with the California Consumer Privacy Act of 2018 ("CCPA"). Any terms defined in the CCPA have the same meaning when used in this Policy.

In this Policy, "we," "us," "our," and "APMC" refer to American Portfolio Mortgage Corporation. "Website" refers to goapmc.com.

Information We Collect

Our Website may collect information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, household, or device ("personal information"). Personal information does not include:

• Publicly available information from government records.
• Deidentified or aggregated consumer information.
• Information excluded from the CCPA's scope, such as health or medical information covered by HIPAA and the California Confidentiality of Medical Information Act (CMIA); clinical trial data; or other qualifying research data.
• Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA), the California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.

Categories of Personal Information Collected

Our Website may have collected the following categories of personal information from consumers within the last twelve (12) months:

Sources of Personal Information

We obtain personal information from the following sources:

• Direct collection — information you provide via forms, surveys, and correspondence.
• Indirect observation — your actions and activities on the Website.
• Third-party partners — social media sites, ad networks, and analytics providers.

Use of Personal Information

We may use or disclose personal information for the following business purposes:

• Fulfill requests you provide.
• Provide, support, personalize, and develop our Website, products, and services.
• Create, maintain, customize, and secure your account.
• Process your requests, purchases, transactions, and payments, and prevent fraud.
• Provide support and respond to inquiries; investigate concerns; monitor and improve our responses.
• Personalize your Website experience and deliver relevant content and targeted offers via the Website, third-party sites, email, or text (with consent where required).
• Maintain safety, security, and integrity of the Website, products, services, databases, and technology assets.
• Conduct testing, research, analysis, and product development.
• Respond to law enforcement and legal requirements.
• Respond to audits and regulatory examinations.
• Evaluate mergers, divestitures, restructuring, reorganizations, dissolutions, or asset transfers.

We will not collect additional categories of personal information or use the information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

Sharing Personal Information

We may disclose personal information to third parties under written contracts that require recipients to keep the information confidential and use it only for performance of the contract.

Disclosures by Category (preceding 12 months)

Categories A–D, F, G, I, and J may be disclosed to:

• Service providers
• Partners
• Internet cookie data recipients (e.g., Google Analytics)
• Internet service providers
• Data analytics providers
• Government entities
• Operating systems and platforms

Categories E, H, and K: No disclosures.

Sale of Personal Information

We do not sell personal information, and in the preceding twelve (12) months, we have not sold personal information.

Your Rights and Choices

Right to Know and Data Portability

You have the right to request disclosure of our personal-information collection and use over the past twelve (12) months. Upon verification of your identity, we will disclose:

• The categories of personal information we collected about you.
• The categories of sources for the personal information.
• Our business or commercial purposes for collecting or selling that personal information.
• The categories of third parties with whom we shared that information.
• If we sold or disclosed your personal information for a business purpose: separate lists identifying the categories of personal information involved and the categories of recipients.
• The specific pieces of personal information we collected about you (data portability).

Right to Delete

You have the right to request that we delete personal information we collected from you, subject to certain exceptions. We may retain information when necessary to:

• Complete the transaction, provide a requested good or service, or perform our contract.
• Detect security incidents; protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible.
• Debug products and services to identify and repair errors that impair existing intended functionality.
• Exercise free speech or ensure another consumer's right to exercise free speech, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et seq.).
• Engage in public-interest scientific, historical, or statistical research with appropriate ethics and privacy safeguards, when deletion may seriously impair the research, and you have provided informed consent.
• Enable solely internal uses that are reasonably aligned with consumer expectations based on the relationship with us.
• Comply with a legal obligation.
• Make other internal and lawful uses of the information that are compatible with the context in which you provided it.

We will delete or de-identify any non-excepted information and direct our service providers to do the same.

Exercising Your Rights to Know or Delete

How to Submit a Request

To exercise your rights, you (or your authorized agent) may submit a request by:

• Calling: 888-878-3684
• Emailing: info@goapmc.com

Authorization and Frequency

Only you, or a person legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. Authorized agents must provide a signed power of attorney and verify their own identity. You may submit a verifiable "right to know" request twice within a 12-month period.

Request Requirements

The request must:

• Provide sufficient information to reasonably verify your identity, using any combination of the following:
  • Current California-issued driver's license or ID
  • Full name
  • Telephone number
  • Address
  • Email address
  • Date of birth
  • Last four digits of your Social Security number
  • Other verification information as circumstances require
• Describe the request with enough detail for us to properly understand, evaluate, and respond.

We cannot respond to your request without verifying your identity (or your agent's authority) and confirming the information relates to you. You do not need to create an account to submit a request. Personal information you provide in connection with a request is used solely to verify the request.

Response Timing and Format

We will confirm receipt of your request within ten (10) business days. We will respond substantively within forty-five (45) days of receipt, extendable to ninety (90) days total with written notice and explanation of the reason.

Responses will be delivered to your account (if you have one with us) or by mail or electronic means at your option. Responses cover the twelve (12) months preceding receipt and explain reasons for any inability to comply. Data-portability responses are provided in a readily usable format that enables transmission without hindrance.

We do not charge a fee to respond unless requests are excessive, repetitive, or manifestly unfounded. If we determine a charge is appropriate, we will provide a cost estimate before completing the request.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. We will not:

• Deny you goods or services.
• Charge you different prices or rates, including through discounts, benefits, or penalties.
• Provide a different level or quality of goods or services.
• Suggest that you may receive a different price, rate, or quality of goods or services.

Other California Privacy Rights

APMC does not share personal information, as defined in California's "Shine the Light" law, with non-affiliated third parties for their own direct-marketing purposes.

Changes to This Privacy Policy

We reserve the right to amend this Policy at our discretion and at any time. When we make changes, we will post them on the Website and update the effective date. Your continued use of the Website following the posting of changes constitutes your acceptance of them.