If you are a California resident, the California Consumer Privacy Act ("CCPA") requires us to provide you with the following notice ("Notice") which explains:

• the purpose for which we use each category of "personal information" (as defined in the CCPA) we collect; and

• the categories of third parties to which we (a) disclose such personal information for a business purpose, (b) "share" personal information for "cross-context behavioral advertising," and/or (c) "sell" such personal information.

As described in our Privacy Statement, Arity 875 often acts as "service provider" as defined in the CCPA with respect to the services it provides its Business Clients. This means Arity 875 processes personal information provided to us by our Business Clients (i.e., the "businesses") on behalf of that Business Client.

However, in some instances, Arity 875 acts as a "business" as defined in the CCPA and we will process personal information in accordance with our Privacy Statement. The charts below summarize how we collect, use, and disclose personal information in such instances by reference to the statutory categories specified in the CCPA, and describe our practices during the 12 months preceding the effective date of this Privacy Statement. The information we collect varies based on the Services you use and how you interact with us. Please note that this Notice does not apply to personal information that is exempt from the CCPA or personal information that is collected and used through the Insurance Client Services. See our Privacy Statement for a more detailed description of the categories included in the chart.

Please note that we may also disclose personal information to governmental authorities in response to valid, governmental requests in accordance with our Privacy Statement and disclosure policies.

Your Choices Regarding "Sharing" and "Selling"

Under the CCPA, "sharing" is defined as the targeting of advertising to a consumer based on that consumer's personal information obtained from the consumer's activity across distinct online services, and "selling" is defined as the disclosure of personal information to third parties in exchange for monetary or other valuable consideration. As noted in the "Cookies and Online Advertising" of our Privacy Statement, we engage in certain targeted advertising activities for which you have a right to opt out. As part of these activities, we "share" the following categories of personal information with advertisers to provide more relevant and tailored advertising to you:

• Business Client Services & Advertising Services: Identifiers, internet or other electronic network activity information, general geolocation information, and inferences

• Lead Generation Services & Arity Websites: Identifiers, personal characteristics (please note that we don't "share" personal characteristics that are considered "sensitive personal information" under the CCPA), commercial information, Internet or other electronic network activity information, general geolocation information, and inferences

We do not sell personal information in exchange for monetary consideration. However, we may disclose personal information to advertising and analytics partners for purposes of targeted advertising. Under certain state privacy laws, these disclosures may be considered a "sale," "sharing," or use for "targeted advertising."

You have the right to opt out of our sale/sharing of your personal information for purposes of online analytics and advertising by clicking the Your Privacy Choices link in our website footer.

Right to Limit

The CCPA allows you to limit the use or disclosure of your "sensitive personal information" (as defined in the CCPA) if your sensitive personal information is used for certain purposes. We use and disclose sensitive personal information only for purposes permitted by applicable law, including to provide our services and comply with legal obligations. We do not use sensitive personal information to infer characteristics about you or for purposes that would require us to offer a right to limit its use under California law.

Consumer Request Metrics

The following lists the number of access, deletion, correction, and data sale/share opt out requests Arity received, complied with, and denied from residents of California in 2024 and the average number of days it took to complete a request. Please note that these metrics do not include requests made to our Business Clients.

*Number includes all "CCPA Opt Out Tool" global opt out requests received by the DAA's AppChoices tool.

California "Shine the Light" Disclosure

California's "Shine the Light" law gives residents of California, under California Civil Code § 1798.83, the right to opt out of our disclosure of certain categories of "personal information" (as defined in the Shine the Light law) to third parties for their marketing purposes. To exercise this right, please contact us by email at: privacy@arity.com and state clearly that you want to exercise your rights under "Shine the Light."

California "Do Not Track" Notice

Do Not Track ("DNT") is a privacy preference that users can set in certain web browsers. We are committed to providing you with meaningful choices about the information collected on our websites for third-party purposes, and that is why we provide the opt-out mechanisms listed above, and in our Privacy Statement. Some web browsers offer users a "Do Not Track" privacy preference setting in the web browser. We do not currently recognize or respond to browser-initiated Do Not Track signals. Please note that "Do Not Track" is a distinct privacy mechanism from the browser-based "Global Privacy Control," signal which we recognize and process as a valid request to opt out of the sale or sharing of personal information for that browser or device.