VII. NOTICE TO CERTAIN RESIDENTS OF DATA SUBJECT RIGHTS

**A. NOTICE TO CALIFORNIA RESIDENTS** To the extent any California data privacy law applies to the collection of your Information, this supplemental section of our Privacy Policy outlines the rights that California residents may have, and how they can exercise those rights. This notice applies solely to California residents. We provide the supplemental selection below to comply with the California Consumer Privacy Act [as amended by the California Privacy Rights Act (referred to collectively hereinafter as CCPA)] and any terms defined in the CCPA have the same meaning when used below. **1. Your Rights under CCPA** - **Right to Know and Access Specific Information.** You have the right to request that we disclose certain information to you about our collection and use of your Information over the past twelve (12) months. Once we receive and confirm a verifiable consumer request from you, we will disclose to you, to the extent permitted by law: > - The categories of Information we collected about you, and whether we sell or share your Information to third parties. > - The specific pieces of Information we hold about you. > - The categories of personal Information sold within the last 12 (twelve) months. > - The categories of sources from which Information about you is collected. > - Our business or commercial purpose for collecting, selling, or sharing your Information. > - The categories of third parties with whom your Information is sold, shared, or disclosed for a business purpose. You have the right to request that the Information described above be provided to you in a portable and readily useable format, to the extent technically feasible (“data portability”). - **Deletion Request Rights.** You have the right to request that we delete the Information that we collected from you, subject to certain exceptions. To the extent that we can delete your Information, once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your Information, unless an exception applies. - **Right to Correct Inaccurate Information.** To the extent that we may maintain inaccurate personal Information, you have the right to request that we correct such inaccurate personal Information taking into account the nature of the personal Information and the purposes of the processing of the personal Information. Once we receive and verify your verifiable consumer request, we will use commercially reasonable efforts to correct your personal Information. - **Sale and Sharing of Personal Information and the Right to Opt Out.** You have the right to opt out of the processing of your Information for the following purposes: > - Sale of your Information. > - Sharing of your Information for cross-context behavioral advertising. The use of online tracking technologies may be considered a “sale” or “sharing” under California law. To the extent that these online tracking technologies are deemed to be a “sale” or “sharing” under California law, you may opt out of these online tracking technologies by submitting a request via this link or by broadcasting an opt-out preference signal, such as the Global Privacy Control (GPC). - **Right to Limit Use and Disclosure of Sensitive Personal Information.** You have the right to request that we limit the ways we use and disclose your sensitive personal Information (as defined by CCPA) to uses which are necessary for us to perform the Services, or deliver the goods reasonably expected by you, or and as authorized by law. - **Right to Non-Discrimination.** You have a right to not be discriminated against in the Services or quality of Services you receive from us for exercising your rights. We may not, and will not, treat you differently because of your data subject request activity. As a result of your data subject request activity, we may not and will not deny goods or Services to you, charge different rates for goods or Services, provide a different level quality of goods or Services, or suggest that we would treat you differently because of your data subject request activity. - **Right to Disclosure of Direct Marketers.** You have a right to the categories and names/addresses of third parties that have received personal Information for their direct marketing purposes upon simple request, and free of charge. You may make an authenticated consumer request exercising your Right to Know and Access Specific Information including Right to Know what Personal Information is being Sold or Shared or under the CCPA twice within a twelve (12) month period. To exercise the rights described above, see the [Exercising your data subject rights](#exercising) section below. **2. Authorized Agent** You may use an authorized agent to submit verifiable consumer requests on your behalf provided that the authorized agent is a natural person or a business entity that you have authorized to act on your behalf. If you use an authorized agent, we will require: (1) proof of written permission for the authorized agent to make requests on your behalf, and identity verification from you; or (2) proof of power of attorney pursuant to California Probate Code sections 4000 to 4665. We may deny a request from an authorized agent that does not submit proper verification proof. **3. Notice of Financial Incentive** As an incentive for providing us with your Information, you may receive a financial benefit in the form of an email coupon, discount, or other similar reward that will be sent to you. This discount may constitute a financial incentive under the California Consumer Privacy Act (“Financial Incentive”). The categories of personal Information required for us to provide the Financial Incentives include personal identifiers such as full name and contact Information including email address as well as personal and demographic Information you choose to provide. To offer these discounts, we may track your personal Information, such as purchase history and other demographic data. You have the right to withdraw from the Financial Incentive at any time by submitting a request to privacy@rich.com. Please note that if you request deletion of part or all your personal Information, that could affect your ability to qualify for the discount. **4. Additional Information** To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request. **B. NOTICE TO VIRGINIA RESIDENTS** To the extent any Virginia data privacy law applies to the collection of your Information, this supplemental section of our Privacy Policy outlines the individual rights guaranteed to Virginia residents and how to exercise those rights and applies solely to Virginia residents. We provide the supplemental selection below to comply with the Virginia Consumer Data Protection Act (“VCDPA”) and any terms defined in the VCDPA have the same meaning when used below. **1. Your Rights under VCDPA** Subject to certain exceptions you may be entitled to the following rights: - **Right to Access & Data Portability.** You have the right to request that we disclose certain information to you about our collection and use of your Information at any time. Once we receive and confirm an authenticated consumer request from you, we will, subject to certain exceptions: > - Disclose whether we are processing your Information. > - Provide you with access to your Information. Where the processing is carried out by automated means, and subject to certain exceptions, you have the right to request and obtain a copy of your Information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the Information to another data controller without hindrance. - **Right to Correct Inaccurate Information.** To the extent that we may maintain inaccurate Information, you have the right to request that we correct such inaccurate Information taking into account the nature of the personal Information and the purposes of the processing of the personal Information. Once we receive and verify your authenticated consumer request, we will use commercially reasonable efforts to correct your Information. - **Right to Delete.** You have the right to request that we delete certain of your Information provided by or obtained about you. To the extent that we can delete your Information, once we receive and confirm your authenticated consumer request, we will delete (and direct our service providers to delete) your Information, subject to certain exceptions. - **Sale of Personal Information, Targeted Advertising, Profiling, and the Right to Opt Out.** You have the right to opt out of the processing of your Information for the following purposes: > - Targeted advertising. > - Sale of your Information. > - Profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. - **Right to Appeal.** You have the right to appeal our denial of any request you make under this section. To exercise your right to appeal, please submit an appeal request via the information in the [How to Contact Us](#howto) section below. Within sixty (60) days of receipt of your appeal, we will inform you in writing of any action taken or not taken in response to your appeal, including a written explanation of the reasons for the decisions. If we deny your appeal, you may contact the Virginia Office of the Attorney General by: Contacting Online: https://www.oag.state.va.us/consumer-protection/index.php/file-a-complaint. Calling: > - If calling from Virginia, call the Consumer Protection Hotline at 1-800-552-9963. > - If calling from the Richmond area or from outside Virginia, call the Consumer Protection Hotline at 1-804-786-2042. - **Right to Non-Discrimination.** You have a right to not be discriminated against in the Services or quality of Services you receive from us for exercising your rights. We will not discriminate against you for exercising any of your rights in this section including denying goods or Services, charging different prices or rates for goods or Services, or providing a different level of quality of goods and Services. However, we may offer a different price, rate, level, quality, or selection of goods or Services, including offering goods or Services for no fee, if you have exercised your right to opt out or the offer is related to your voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program. You may make an authenticated consumer request under the VCDPA twice within a twelve (12) month period. To exercise the rights described above, see the [Exercising Your Rights](#exercising) section below. - **Additional Information** To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request. **C. NOTICE TO COLORADO RESIDENTS** To the extent any Colorado data privacy law applies to the collection of your Information, this supplemental section of our Privacy Policy outlines the individual rights guaranteed to Colorado residents and how to exercise those rights and applies solely to Colorado residents. We provide the supplemental selection below to comply with the Colorado Privacy Act (“CPA”) and any terms defined in the CPA have the same meaning when used below. **1. Your Rights under CPA** Subject to certain exceptions you may be entitled to the following rights: - **Right to Access & Data Portability.** You have the right to request that we disclose certain information to you about our collection and use of your Information at any time. Once we receive and confirm an authenticated consumer request from you, we will, subject to certain exceptions: > - Disclose whether we are processing your Information. > - Provide you with access to your Information where we process it. Where exercising your right to access, you have the right to request and obtain a copy of your Information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the Information to another data controller without hindrance (“data portability”). - **Right to Correct Inaccurate Information.** To the extent that we may maintain inaccurate personal Information, you have the right to request that we correct such inaccurate personal Information taking into account the nature of the personal Information and the purposes of the processing of the personal Information. Once we receive and verify your authenticated consumer request, we will use commercially reasonable efforts to correct your personal Information. - **Right to Delete.** You have the right to request that we delete certain of your Information provided by or obtained about you. To the extent that we can delete your Information, once we receive and confirm your authenticated consumer request, we will delete your Information, subject to certain exceptions. - **Sale of Personal Information, Targeted Advertising, Profiling, and the Right to Opt Out.** You have the right to opt out of the processing of your Information for the following purposes: > - Targeted advertising. > - Sale of your Information. > - Profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. - **Right to Appeal.** You have the right to appeal our denial of any request you make under this section. To exercise your right to appeal, please submit an appeal request via the information in the [How to Contact Us](#howto) section below. Within forty-five (45) days of receipt of your appeal, we will inform you in writing of any action taken or not taken in response to your appeal, including a written explanation of the reasons for the decisions. If you have concerns regarding the results of your appeal, you may contact the Colorado Office of the Attorney General by: > - Contacting Online:https://complaints.coag.gov/s/contact-us > - Calling: (720) 508-6000 You may make an authenticated consumer request free of charge under the CPA once within a twelve (12) month period. We reserve the right to charge a reasonable fee for a second or subsequent request within the same twelve (12) month period. To exercise the rights described above, see the [Exercising Your Rights](#exercising) section below. - **2. Authorized Agent** You may use an authorized agent to submit verifiable consumer requests on your behalf. An authorized agent is a natural person or a business entity that you have authorized to act on your behalf. If you use an authorized agent, we will require: (1) proof of written permission for the authorized agent to make requests on your behalf, and identity verification from you; or (2) proof of power of attorney sent to privacy@rich.com. We may deny a request from an authorized agent that does not submit proper verification proof. - **3. Notice of Financial Incentive** As an incentive for providing us with your Information, you may receive a financial benefit in the form of an email coupon, discount code, or other similar reward that will be sent to you. This discount may constitute a financial incentive under the Consumer Privacy Act (“Financial Incentive”). The categories of personal Information required for us to provide the Financial Incentives include personal identifiers such as full name and contact information including email address as well as personal and demographic information you choose to provide. To offer these discounts, we may track your personal Information, such as purchase history and other demographic data. You have the right to withdraw from the Financial Incentive at any time by submitting a request to privacy@rich.com. Please note that if you request deletion of part or all your personal Information, that could affect your ability to qualify for the discount. - **4. Additional Information** To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request. **D. NOTICE TO CONNECTICUT RESIDENTS** To the extent any Connecticut data privacy law applies to the collection of your Information, this supplemental section of our Privacy Policy outlines the individual rights guaranteed to Connecticut residents and how to exercise those rights and applies solely to Connecticut residents. We provide the supplemental selection below to comply with the Connecticut Act Concerning Personal Data Privacy and Online Monitoring (“CTDPA”) and any terms defined in the CTDPA have the same meaning when used below. **1. Your Rights under CTDPA** Subject to certain exceptions you may be entitled to the following rights: - **Right to Access & Data Portability.** You have the right to request that we disclose certain information to you about our collection and use of your Information at any time. Once we receive and confirm an authenticated consumer request from you, we will, subject to certain exceptions: > - Disclose whether we are processing your Information. > - Provide you with access to your Information where we process it. Where the processing is carried out by automated means, and subject to certain exceptions, you have the right to request and obtain a copy of your Information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the Information to another data controller without hindrance. - **Right to Correct Inaccurate Information.** To the extent that we may maintain inaccurate personal Information, you have the right to request that we correct such inaccurate personal Information taking into account the nature of the personal Information and the purposes of the processing of the personal Information. Once we receive and verify your authenticated consumer request, we will use commercially reasonable efforts to correct your personal Information. - **Right to Delete.** You have the right to request that we delete certain of your Information provided by or obtained about you. To the extent that we can delete your Information, once we receive and confirm your authenticated consumer request, we will delete (and direct our service providers to delete) your Information, subject to certain exceptions. - **Sale of Personal Information, Targeted Advertising, Profiling, and the Right to Opt Out.** You have the right to opt out of the processing of your Information for the following purposes: > - Targeted advertising. > - Sale of your Information. > - Profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. - **Right to Non-Discrimination.** You have a right to not be discriminated against in the Services or quality of Services you receive from us for exercising your rights. We will not discriminate against you for exercising any of your rights in this section including denying goods or Services, charging different prices or rates for goods or Services, or providing a different level of quality of goods and Services. However, we may offer a different price, rate, level, quality, or selection of goods or Services, including offering goods or services for no fee, if you have exercised your right to opt out or the offer is related to your voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program. - **Right to an Appeal.** You have the right to appeal our denial of any request you make under this Section. To exercise your right to appeal, please submit appeals request to us by either: > - Emailing us at privacy@rich.com > - Calling us at 1-877-352-0077 Within sixty (60) days of receipt of your appeal, we will inform you in writing of any action taken or not taken in response to your appeal, including a written explanation of the reasons for the decisions. If we deny your appeal, you may contact the Connecticut Office of the Attorney General by: > - Contacting Online:https://www.dir.ct.gov/ag/complaint/ > - Calling: The Consumer Assistance Unit at 860-808-5420 You may make an authenticated consumer request under the CTDPA once within a twelve (12) month period. To exercise the rights described above, see the [Exercising Your Rights](#exercising) section below. If we cannot authenticate your request, we may request more information or may be unable to fulfill your request. **2. Authorized Agent** You may use an authorized agent to submit verifiable consumer requests on your behalf. An authorized agent is a natural person or a business entity that you have authorized to act on your behalf. If you use an authorized agent, we will require: (1) proof of written permission for the authorized agent to make requests on your behalf, including through technology means, and identity verification from you; or (2) proof of power of attorney. We may deny a request from an authorized agent that does not submit proper verification proof. **3. Additional Information** To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request. **E. NOTICE TO UTAH RESIDENTS** To the extent any Utah data privacy law applies to the collection of your Information, this supplemental section of our Privacy Policy outlines the individual rights guaranteed to Utah residents and how to exercise those rights and applies solely to Utah residents. We provide the supplemental selection below to comply with the Utah Consumer Privacy Act (“UCPA”) and any terms defined in the UCPA have the same meaning when used below. **1. Your Rights under UCPA** Subject to certain exceptions you may be entitled to the following rights: - **Right to Access & Data Portability.** You may have the right to request that we disclose certain information to you about our collection and use of your Information at any time. Once we receive and confirm an authenticated consumer request from you, we will, subject to certain exceptions: > - Disclose whether we are processing your Information > - Provide you with access to your Information where we process it Where the processing is carried out by automated means, and subject to certain exceptions, you have the right to request and obtain a copy of your Information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the Information to another data controller without hindrance (“data portability”). - **Right to Delete.** You have the right to request that we delete certain of your Information provided by or obtained about you. To the extent that we can delete your Information, once we receive and confirm your authenticated consumer request, we will delete (and direct our service providers to delete) your Information, subject to certain exceptions. - **Right to Non-Discrimination.** We will not discriminate against you for exercising any of your rights in this section including denying goods or Services, charging different prices or rates for goods or Services, or providing a different level of quality of goods and services. - **Sale of your Personal Information, Targeted Advertising, and Right to Opt Out.** You have the right to opt out of the processing of your Information for the following purposes: > - Targeted advertising > - Sale of your Information You may make an authenticated consumer request free of charge under the UCPA once within a twelve (12) month period. We reserve the right to charge a reasonable fee for a second or subsequent request within the same twelve (12) month period. To exercise the rights described above, see the [Exercising Your Rights](#exercising) section below. **2. Additional Information** To the extent permitted by applicable law, we reserve the right to charge a reasonable fee for any subsequent requests within the same twelve (12) month period. **F. NOTICE TO INDIVIDUALS IN THE EUROPEAN ECONOMIC AREA AND THE UK** This section applies only to individuals coming to our Services from within the European Union (EU), the European Economic Area (EEA), and the UK, and only if we collect through the Services any Information from you that is considered “Personal Data,” as defined in the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018. Personal Data includes any information relating to an identified or identifiable natural person, who could be identified either directly or indirectly by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one (1) or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person (which may include some or all your Information as defined in this Privacy Policy). **1. Identity and contact details of controller and EU representative** **2. Your data protection rights** **3. Lawful basis for processing your information** **4. Consent to transfer** **5. Retention** **1. Identity and Contact Details of Controller and EU Representative** Unless otherwise stated, we are the Data Controller for the Information we process. **Contact Details:** > - **Email:** privacy@rich.com > - **Call us:** +44 03300605174 > - **Write us:** Rich Andover Realty Limited Unit 5 Pioneer Road Andover Business Park Andover, GB SP11 8EZ **2. Your Data Protection Rights** To the extent the GDPR and Data Protection Act 2018 apply, and we hold your Information in our capacity as a Data Controller as defined under those laws, you may request that we: • Restrict the way that we process and share your Information; • Transfer your Information to a third party; • Provide you with access to your Information; • Remove your Information if no longer necessary for the purposes collected; • Update your Information so it is correct and not out of date; and/or • Object to our processing of your Information. You may also revoke your consent for processing of your Information. If you wish to object to the use and processing of your Information or withdraw consent to this Privacy Policy, you can contact us in the following ways: **Contact Details:** - **Email:** privacy@rich.com - **Call us:** +44 03300605174 - **Write us:** > - Rich Andover Realty Limited > - Unit 5 Pioneer Road > - Andover Business Park > - Andover, GB SP11 8EZ The requests above will be considered and responded to in the time-period stated by applicable law. Note, certain Information may be exempt from such requests. We may require additional Information from you to confirm your identity in responding to such requests. You have the right to lodge a complaint with the supervisory authorities applicable to you and your situation, although we invite you to contact us with any concern as we would be happy to try and resolve it directly. Please contact us at: **Contact Details:** - **Email:** privacy@rich.com - **Call us:** +44 04400605174 - **Write us:** > - Rich Andover Realty Limited > - Unit 5 Pioneer Road > - Andover Business Park > - Andover, GB SP11 8EZ **3. Basis for Processing Your Information** The lawful basis for our processing of your Personal Data will depend on the purposes of the processing. For most Personal Data processing activities covered by this Privacy Policy, the lawful basis is that the processing is necessary for our legitimate business interests. Where we process Personal Data in relation to a contract, or a potential contract, with you, the lawful basis is that the processing is necessary for the performance of our contract with you or to take steps at your request prior to entering into a contract. If we are required to share Personal Data with law enforcement agencies or other governmental bodies, we do so on the basis that we are under a legal obligation to do so. We will also use consent as the legal basis where we deem appropriate or to the extent required by applicable law, for example, before we collect precise location data from your mobile device. Depending on what Personal Data we collect from you and how we collect it, we may also rely on various grounds for processing your Personal Data, including the following reasons: **Processing on the basis of legitimate business interests.** When we process Personal Data on the basis that the processing is necessary for our legitimate business interests, such interests include: (i) providing, improving, and promoting our Services; (ii) communicating with current and potential customers, other business partners, and their individual points of contact; (iii) managing our relationships with our customers and other business partners, and their individual points of contact; (iv) other business development purposes; (v) sharing information within the Company, as well as with service providers and other third parties; and (vi) maintaining the safety and security of our products, Services, and employees, including fraud protection. **Processing on the basis of performance of a contract.** Examples of situations in which we process Personal Data as necessary for performance of a contract include e-commerce transactions in which you purchase a service from us. **Processing on the basis of consent.** Examples of processing activities for which we may use consent as its legal basis include: (i) collecting and processing precise location information from your mobile device; (ii) sending promotional emails when consent is required under applicable law; and (iii) processing Personal Data on Company Services through cookies and similar technologies when consent is required by applicable law. **Processing because we are under a legal obligation to do so.** Examples of situations in which we must processes Personal Data to comply with our legal obligations include: (i) providing your Personal Data to law enforcement agencies and other governmental bodies when required by applicable laws; (ii) retaining business records required to be retained by applicable laws; and (iii) complying with court orders or other legal process. If the processing of your Information is based on your consent, the GDPR and Data Protection Act 2018 also allow users the right to access, revoke, or modify your consent at any time. Please see the [How to Contact Us](#howto) section, below, to review or modify your consents. **4. Consent to Transfer** We are operated in the United States, and we may use service providers based in the United States to operate our business and our relationship with you. Please be aware that Information, including your Personal Data, that we collect will be transferred to, stored, and processed in the United States, a jurisdiction in which the privacy laws may not be as comprehensive as those in the country where you reside and/or are a citizen. We maintain measures to address the transfer of your Personal Data between our group companies and between us and our third-party providers in accordance with applicable data protection laws and regulations. **5. Retention** We will retain your Information for as long as needed for the purposes described in this Privacy Policy. More specifically, the time we maintain your Information depends on the following factors: - **Whether we need the Information to provide the Services.** We will maintain any data needed to provide you with the Services, such as contact information and payment or transaction information, for as long as needed for us to provide you with the Services, respond to your questions and requests, and/or administer your account (if applicable). - **Whether we need the Information to comply with our legal obligations.** We may have legal obligations to maintain your Information where a legal or regulatory body may ask for it in the future, for example in response to a data subject request or complaint. This information may include contact information and location information. - **Whether we need the Information for a legitimate business interest.** We may store Information like contact information, cookies, and location information in order to perform analytics, troubleshoot errors, or improve our Services. In any event, we delete the Information when it is no longer needed for our legitimate interest. Regardless of our reason for retaining your Information, we delete all Information in accordance with our routine record keeping policies.