This Privacy Policy describes Hippo Education’s (collectively, “Company”, “we”, “us” or “our”) online and offline information practices and informs you about the rights you have regarding your personal information and how you may exercise those rights. • NOTICE AT COLLECTION FOR CALIFORNIA RESIDENTS California residents should also review Appendix A – State Specific Privacy Information & Rights for information about your rights and how to submit a privacy request, including requests that we not sell or share your personal information by visiting Do Not Sell or Share My Info. Categories of Personal Information Collected and Examples (Some types of personal information may overlap with other categories.) Purpose(s) for which the categories of personal information are collected and used A. Identifiers. A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, e-mail address, account name, Social Security number, driver's license number, passport number, or other similar identifiers. • to communicate with you • to determine your eligibility for our services • to identify, authenticate and verify your identity • to provide you with our services and products • to develop and improve our services and products • to provide you with marketing about our services and products • to support our mission, objectives and goals • for physical and IT security purposes • for employee and contractor management purposes • to comply with legal and regulatory requirements • to prevent or investigate illegal or suspicious activity B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment data, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. • to communicate with you • to determine your eligibility for our services • to identify, authenticate and verify your identity • to provide you with our services and products • to develop and improve our services and products • to provide you with marketing about our services and products • to support our mission, objectives and goals • for physical and IT security purposes • for employee and contractor management purposes • to comply with legal and regulatory requirements • to prevent or investigate illegal or suspicious activity C. Protected classification characteristics under California or federal law. Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, gender, veteran or military status, • to determine your eligibility for our services • to provide you with our services and products • to develop and improve our services and products • to provide you with marketing about our services and products • to support our mission, objectives and goals • for employee and contractor management purposes • to comply with legal and regulatory requirements D. Commercial information. Records of products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. • to develop and improve our services and products • to provide you with marketing about our services and products • to support our mission, objectives and goals E. Sensitive Personal Information. Social Security number, driver’s license number or other government-issued identification number, financial account number, any health insurance or medical identification number, Racial or ethnic origin, religious or philosophical beliefs, or union membership, an account password, security questions and answers. • to identify, authenticate and verify your identity • to provide you with our services and products • for physical and IT security purposes • for employee and contractor management purposes • to comply with legal and regulatory requirements • to prevent or investigate illegal or suspicious activity F. Internet or other similar network activity. Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement. • to develop and improve our services and products • to provide you with marketing about our services and products • to support our mission, objectives and goals • for physical and IT security purposes • for employee and contractor management purposes • to comply with legal and regulatory requirements • to prevent or investigate illegal or suspicious activity G. Geolocation data. Physical location or movements. • to determine your eligibility for our services • to identify, authenticate and verify your identity • to provide you with our services and products • to develop and improve our services and products • to provide you with marketing about our services and products • to support our mission, objectives and goals • for physical and IT security purposes • for employee and contractor management purposes • to comply with legal and regulatory requirements • to prevent or investigate illegal or suspicious activity H. Audio or Visual data. Audio, electronic, visual, or similar information. • to communicate with you • to determine your eligibility for our services • to identify, authenticate and verify your identity • to provide you with our services and products • to develop and improve our services and products • to provide you with marketing about our services and products • to support our mission, objectives and goals • for physical and IT security purposes • for employee and contractor management purposes • to comply with legal and regulatory requirements • to prevent or investigate illegal or suspicious activity I. Professional or employment-related information. Current or past job history, employment record(s), and performance evaluations. • to communicate with you • to determine your eligibility for our services • to identify, authenticate and verify your identity • for physical and IT security purposes • for employee and contractor management purposes • to comply with legal and regulatory requirements • to prevent or investigate illegal or suspicious activity K. Inferences drawn from other personal information. Profile reflecting a person's preferences, characteristics, household characteristics. • to develop and improve our services and products • to provide you with marketing about our services and products • to support our mission, objectives and goals 
Data Retention of Personal Information: We may retain your personal information for as long as it is necessary or relevant for the business purposes described in this Privacy Policy, including, for example, to comply with legal obligations, resolve disputes, and enforce our agreements, and for backup, archival, and other internal operations purposes. The criteria we use to determine retention periods include (i) the content of the record or information, (ii) the time required to retain personal information to fulfill business purposes, including providing products and services; (iii) our legal and regulatory requirements and obligations; (iv) whether our contracts have special requirements for data retention; and (v) our legitimate business needs. Selling and Sharing Personal Information. We do not sell personal information. We may share your personal information with our employees, contractors, service providers, business partners, affiliated institutions and entities, regulating agencies and government entities, law enforcement, or as you direct us for the business purposes identified in this Privacy Policy and in Company materials. • SCOPE OF OUR PRIVACY POLICY The Privacy Policy applies to the information, services, and products we offer, and the information we collect on our websites, mobile applications, virtual private networks, learning management systems, and other online services where this Privacy Policy is posted or referenced (collectively, our "Services"). The Privacy Policy applies to all individuals who use or access our Services, including visitors, prospective students, student applicants, current or former students, job applicants, current or former employees, and contractors. By using or accessing our Services, you expressly consent to our use of your information collected for the purposes described in this Privacy Policy. 

Please see Appendix A – State Specific Privacy Information & Rights for information, required disclosures, and privacy rights applicable to residents of specific states. • WE COLLECT INFORMATION FROM AND ABOUT YOU We collect information: • Directly from you when you provide it to us. • Passively as you engage with and use the Services. Information You Provide to Us This may include personal data you provide directly to us when you: • Complete forms on the website or in relation to the use of our Services. This includes information provided at the time of registering to use the Services, placing an order, subscribing to our Services, posting material, requesting further services, and interacting with our Services (including information you may provide as part of any retention or self-assessment features associated with our Services). We may also ask you for information when you report a problem with the Services; • Communicate with us (including via phone call, email, mail, fax, text message, live chat, social media posting, or similar method); • Respond to surveys that we might ask you to complete; • Engage in transactions using our Services; • Input search queries on the website; • Request information about or purchase our Services; • Discuss your interest in and/or your eligibility for our Services with us, including any of our departments. • Provide payment information or apply for other types of financial aid or tuition reimbursement, if applicable. • Create or register for a user account on our Services; • Subscribe to our publications such as newsletters, webinars, specialty communications, social media sites, event notifications, or products updates, • Request marketing be sent to you such as by e-mail, mail, phone, live chat, or text message; • Interact with our social media pages • Participate in educational and learning activities or sign-up for events; • Enter a competition, sweepstakes, or promotion; • Provide information in-person at our events, industry events, other venues, or by phone, fax, online chat, text message, virtual attendance, or e-mail; • Interact with vendors that provide services and products on our behalf. • Provide information to apply for a position on our job/hiring information websites, complete a background check, take an assessment, interview, complete mandatory employment forms, or apply for employee benefits;
 • Engage with us as a service provider, contractor, business, or education partner. You also may provide information to be published or displayed (hereinafter, “posted”) on areas of our Services that may be accessible or viewable by other users of our Services, or may be transmitted to other users of our Services or third parties (collectively, “User Contributions”). Your User Contributions are posted on our Services and transmitted to others at your own risk. Although you may set certain privacy settings for such User Contributions by logging into your account profile, please be aware that no security measures are perfect or impenetrable. Additionally, we cannot control the actions of other users of our Services with whom your User Contributions may be shared. Therefore, we cannot and do not guarantee that your User Contributions will not be viewed by unauthorized persons. We collect job application and human resources information. If you apply for a job or are hired, we may need to collect information required to verify your eligibility from third parties. We collect Audio/Visual Information. When you visit, attend, or work at one of our facilities or attend one of our events, we may capture or collect photographs and record audio and video at the facility (including through the use of CCTV cameras and other technologies to secure our premises). We may record calls and communications from you or to you for quality and training purposes. We may engage or otherwise permit other parties to also collect information through our Services in these ways. Information We Collect Passively Through Automatic Data Collection Technologies We use tracking technologies like browser cookies and web beacons to collect information passively about you. This includes when you use our Services or when you otherwise interact with our Services, advertisements, e-mails, or our in-app notifications that we or our vendors send to you. We may collect information from your devices when your device connects to or is detected by our WiFi services. We may also embed technologies (which may include, for example, web beacons, tags, and pixels) in the e-mails and other communications we or our vendors send to you to help us understand how you interact with those messages, such as whether and when you opened a message or clicked on any content within the message. We may engage or otherwise permit other parties to also collect information through the Services in these ways. We may record your sessions and interactions with our Services, including consents, page and mobile application interaction information, and other electronic communications and content from your use of the Services (such as content entry, mouse movements, screen captures, what areas of the websites you visit and for how long, what search terms or other data you enter, and what products or content or links you view and click on), and methods used to browse away from the page. As you navigate through and interact with our Services, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including: • Details of your visits to the website, including traffic data, location data, logs and other communication data and the resources that you access and use on the website; and • Information about your computer and internet connection, including your IP address, operating system, and browser type. We also may use these technologies to collect information about your online activities over time and across third-party websites or other online services.  • Store information about your preferences, allowing us to customize the Services according to your individual interests. • Prevent and decrease instances of fraudulent activity. • Recognize you when you return to the website. • Identify and solve technical issues with our Services. • Estimate our audience size and usage patterns. The technologies we use for this automatic data collection may include: • Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. You may refuse to accept browser cookies by activating the appropriate setting on your browser. However, if you select this setting you may be unable to access certain parts of the website. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to the website. • Flash Cookies. Certain features of the website may use local stored objects (or Flash cookies) to collect and store information about your preferences and navigation to, from, and on the website. Flash cookies are not managed by the same browser settings as are used for browser cookies. For information about managing your privacy and security settings for Flash cookies, see Choices About How We Use and Disclose Your Information. • Web Beacons. Pages of the website and our e-mails may contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit the Company, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity). Third-Parties and Third-Party Use of Cookies and Other Tracking Technologies Some content or applications, including advertisements, on our Services are served by third-parties, including advertisers, ad networks and servers, content providers, and application providers. These third-parties may use cookies alone or in conjunction with web beacons or other tracking technologies to collect information about you when you use the Services. The information third-parties collect may be associated with your personal information or they may collect information, including personal information, about your online activities over time and across different websites and other online services. They may use this information to provide you with interest-based (behavioral) advertising or other targeted content. • We receive information from vendors we hire to work on our behalf. For example, vendors that host or maintain our websites and send promotional e-mails for us may give us information. Our employment and recruiting vendors also give us information. • We may receive information about you from other sources. This might include our business partners, our education partners, academic institutions, and organizations that administer exams, or manage records related to the Services. It may also include your friends and family who use our referral features. We may also collect information about you from advertising networks, internet service providers, data analytics providers, government entities, operating systems and platforms, and social media sites. • We combine information we obtain from different sources. We may combine information that we collect offline with information we collect online. We may also combine information you submit or that we track across multiple devices. We may also combine information we collect from you with information we get about you from other sources. • WE COLLECT VARIOUS INFORMATION ABOUT YOU The types of personal information we collect about you varies depending on your interactions with our Services and your relationship with us. Not all types of information are collected on all individuals. Generally, we may collect the following categories of personal information: Name, Contact Information, and Other Identifiers: full name, previous name(s), physical postal address, billing address, telephone number(s), unique personal identifier, e-mail address(es), account name, or other similar identifiers. Demographic Information: including race, ethnicity, gender, age, religion, national origin, disability, citizenship status, language(s) spoken, and highest education level completed. Commercial Information: including records of products or services purchased, obtained, or considered; or other purchasing or relevant consuming histories or tendencies. Internet or other Electronic Network Activity Information: including online identifier(s), internet protocol (IP) address, MAC address, the type, make, manufacturer, and identification number of the device(s) you use to access our Services, the browser or mobile operating system you are using, signal strength, date/time stamp, how often you use our app and where you downloaded it, your use of the WiFi, such as which websites you visit, and your recorded interactions with our Services and advertisements. Geolocation data: including geographic location information about a particular individual or device when you access our Services, wireless access point location (which can be associated with a physical location), or keycard entry access activity at our facilities for authorized individuals. Audio, video, and other electronic data: including photos, call recordings, video, or digital CCTV footage at our facilities or events. Employment Information and History: including submitted job applications, resumes, candidate evaluations or interviews, employee file records, work authorization records, payment and salary records, schedules, employee benefits, employee development and training records, reviews and requests. It may also include previous education transcripts, previous employer(s) name and contact information, proof of previous or current employment, background check documentation, and other federal, state or internally required forms, contracts or information for lawful employment, prior occupation(s), job title(s), employer name(s), and professional or employment-related information from prior employment. Customer Records: including paper and electronic customer records containing signature, social security number, date of birth, physical characteristics or description, passport number, alien registration number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, identity verification data and documents, and other financial information. Education Information: including information regarding past and present education, institutions attended, years of attendance, courses of study, transcripts, degree(s)/certificates/certifications obtained, discipline records, financial aid documentation, payment history, applications, required program or other disclosures, professional and employment-related information, and other customer-generated work or materials. Inferences drawn from any of the above categories of Personal Information: inferences used to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. 5. WE USE INFORMATION IN A VARIETY OF WAYS

We use your information to communicate with you and provide our Services. This includes determining your eligibility for our Services, maintaining or servicing your account, providing customer service, processing or fulfilling orders and transactions, verifying your information, processing payments, providing payment processing, providing advertising or marketing services, providing analytic services, collections activity, responding to your questions or inquiries or notifying you if you won a promotion or sweepstakes. We will also use your information to send you information about your account or about our relationship. We may send push notifications to you from our mobile applications, text messaging services, or other similar services that you have opted into. We use your information to provide you with our Services. This includes providing educational services and products and fulfilling your requests. We use your information to understand your interests and develop and improve our services. We may use your information to improve and develop our Services. This may include improving user retention and the user experience. We may also use your information to customize your experience with us. For example, we may use your information to determine your interest in our Services, or to better understand what other products and services may interest you. We use your information for marketing purposes. We may provide you with information about our existing Services, new products, and services, or other ads. We might use your information to serve you with relevant ads. These might be third-party offers or products we think you might find interesting. Our business vendors and education partners may also serve you with advertisements for our Services or other’s services or products. We may use your personal information to send these communications. We use information for security purposes. This may include detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity. It may also include debugging to identify and repair errors that may impair the functionality of our Services, undertaking activities to verify, maintain, improve, upgrade, or enhance the quality or safety of a service, device or system that we own, manufacture, manufacture for, or control. We may also use information to protect our family of companies, students, prospective students, applicants, website visitors, alumni, employees, visitors, and others. It may also include protecting our Services. We use information for verification purposes. This may include using certain pieces of personal information to verify your identity, including to access your account, participate in certain Services, or if you make requests related to this Privacy Policy. We use your information for employee management purposes. This may include applicant and candidate evaluations or interviews. It may also include maintaining your employee file for work authorization, payment and salary records, providing and administering employee benefit programs, and managing and maintaining employee development such as reviews or disciplinary actions. We use your information to support our mission, objectives and goals. We may conduct internal research for technological development and demonstration, conduct and analyze results of surveys, focus groups, interviews, employer feedback and other assessment measures. We use information as otherwise permitted or required by law, our authorized regulators, or as we may notify you. This includes using your information for our legitimate business needs. 6. WE SHARE INFORMATION WITH SERVICE PROVIDERS AND THIRD PARTIES 
We may disclose aggregated information. This includes information about our users, and information that does not identify any individual, without restriction. We share your information within the Perdoceo Education Corporation family of companies. This includes our network of institutions and the Career Education Foundation Scholarship Fund, a nonprofit 501(c)(3) fund dedicated to providing both need-based and merit-based scholarships to qualified students attending affiliated institution(s).
 We share your information with service providers who perform Services on our behalf. For example, this may include payment processors or companies that provide identity verification services. It may also include companies that send communications on our behalf. We may also share your information with others that provide services on our behalf. We share information with our business partners. For example, this may include third parties that provide educational products and services related to our business. It may also include social media sites or a third-party that co-sponsors a promotion. We share information with those who help pay for the Services. We may share your information with authorized individuals, such as family members or employers who help pay your fees. We share information with third parties for marketing purposes. This may include third-parties that serve ads on our behalf. This may also include third-parties in whose products or services we believe you may be interested. These third-parties may also share your information with others. These third parties may use your information for their own marketing purposes or the marketing purposes of others. This may include the delivery of interest-based advertising. Your information may be publicly accessible. Information you submit using our Services, such as in online classrooms, social media, discussion boards or other features can be seen by others who use those features. Online live chat, webinars, classes, events or similar live interactions may be recorded for our use. Individuals who participate in live events or utilize a profile image are consenting to have their video, audio, or image recorded. We will share your information with any successor to all or part of our business. For example, if all or part of our business is sold, we may share your personal information with the new owner. This may include as part of an asset sale, corporate reorganization, or other change of control. We may also share your personal information with others as they conduct diligence. We share information with regulating agencies and government entities. We may share your information with the organizations that analyze our education practices and (if applicable) provide our authorizations to operate. We may also share information with accreditors, regulators, and government agencies. We will share information to comply with the law or to protect ourselves. This includes responding to a court order or lawfully issued subpoena. It could also include sharing information if a government agency or investigatory body requests it. We might share information when we are investigating potential fraud or for disciplinary purposes. We may also share information if you are the winner of a sweepstakes or other promotion with anyone who requests a winner’s list. We will share information you direct us to share. This may include information related to our Services that you may request us to share with third parties. We will share information for other reasons we may describe to you. 7. YOU HAVE CERTAIN CHOICES ABOUT HOW WE USE YOUR INFORMATION
 We strive to provide you with choices regarding the personal information you provide to us. We have created mechanisms to provide you with the following control over your information: • Tracking Technologies and Advertising. You can control certain cookies and tracking tools. We use tracking tools, including cookies, on our websites. Third parties may also use cookies on our websites. Cookies are small files that download when you access certain websites. Your browser may give you the ability to control cookies. How you do so depends on the type of cookie. Certain browsers can be set to reject browser cookies and provide features to manage and delete cookies. You can set your browser to alert you when cookies are being sent. To learn how you can manage your Flash cookie settings, visit the Flash player settings page on Adobe’s website. If you disable or refuse cookies, please note that some parts of this site may then be inaccessible or not function properly.
 • You can control certain tools on your mobile devices. For example, you can turn off the GPS locator or push notifications for apps on your mobile phone. Please contact your device manufacturer for assistance with these tools and other security features they may offer you. • Disclosure of Your Information for Third-Party Advertising. If you do not want us to share your personal information with unaffiliated or non-agent third parties for promotional purposes, you can opt-out by sending us an email with your request to support@hippoeducation.com. • Promotional Offers from the Company. If you do not wish to have your contact information used by the Company to promote our own or third parties’ products or services, you can opt-out by unchecking the relevant notification box located on the User Settings page or by sending us an email stating your request to support@hippoeducation.com. If we have sent you a promotional email, you may send us a return email asking to be omitted from future email distributions. 
 • Telephone Calls. If you would like to be added to our Do Not Call list, please call us and request to be added to our Do Not Call list. You may also contact support@hippoeducation.com for assistance at any time. We will accept your Do Not Call request by any reasonable method of communication such as e-mail, fax, text message, or mail. Please provide the phone number you would like added to the Do Not Call list. ‌ 8. SUBMITTING A REQUEST 
To exercise your access, disclosure, deletion rights, or other applicable rights, you must submit a verifiable consumer request to us. We have outlined the procedure below. a. You may submit your request following the process outlined here: Privacy Data Request. You may also contact us via our toll-free number 1-855-99-HIPPO or at support@hippoeducation.com. b. You will be asked to provide certain personal information that we will review against our records to validate your identity. We require this personal information to prevent identity theft or fraud. In some cases, we may need to contact you for additional information or clarification to comply with your request. We cannot provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. We will only use personal information provided to verify your identity or the requestor’s authority to make the request. c. We will respond to a verifiable consumer request within the period of time required by applicable law. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will explain why we made that decision and provide you with a cost estimate before completing your request. You can review and change your personal information by logging into the website and visiting your account profile page. If you delete your User Contributions from the website, copies of your User Contributions may remain viewable in cached and archived pages or might have been copied or stored by other website users. Proper access and use of information provided on the website, including User Contributions, is governed by our terms of use (http://www.hippoed.com/terms). 9. OUR SERVICES AND CHILDREN Our Services are meant for adults. We do not knowingly collect personally identifiable information from children under 16. If you are a parent or legal guardian and think your child under 16 has provided us with information, please contact us at support@hippoeducation.com. You can also write to us at the address listed at the end of this Privacy Policy. Please mark your inquiries, "COPPA Information Request." 10. WE USE SECURITY MEASURES The Internet is not 100% secure. We cannot promise that our Services or the use of the Services will be completely safe. We encourage you to use caution when using the Internet. We use security measures designed to safeguard personal information under our control. User IDs and passwords are needed to access certain areas of our Services. It is your responsibility to protect your username and password(s). 11. STORAGE OF INFORMATION Information we maintain may be stored in the United States. If you live outside of the United States, you understand and agree that we may transfer your personal information to the United States. The Services are subject to U.S. laws, which may not provide the same level of protection as those in other countries. We may retain your personal information for as long as it is necessary or relevant for the business purposes described in this Privacy Policy and in Company-specific materials, including, for example, to comply with legal obligations, resolve disputes, and enforce our agreements, and for backup, archival, and other internal operations purposes. We also keep personal information as otherwise required by applicable law. 12. WE MAY LINK TO THIRD PARTY SITES Our Services may contain links to other third-party sites, products, and services that are not governed by this Privacy Policy. If you click on a link to a third-party site, you will be taken to a site we do not control. We are not responsible for third-party sites or their privacy practices. We recommend that you carefully read the privacy policies of those sites. 13. HOW TO CONTACT US To ask questions or comment about this Privacy Policy and our privacy practices, contact us at: Phone: 1-855-99-HIPPO
Website: https://www.hippoed.com/contact
Email: support@hippoeducation.com Postal Address: Hippo Education, LLC
 21250 Califa Street Suite 107 Woodland Hills, CA 91367 14. CHANGES TO THIS PRIVACY POLICY From time to time, we may update or revise this Privacy Policy. We will notify you of any material changes to this Privacy Policy as required by law. We will post an updated copy on our Services and other applicable locations. Please check periodically for updates. APPENDIX A – STATE SPECIFIC PRIVACY INFORMATION & RIGHTS This Appendix contains additional information relevant to specific state laws and other applicable regulations regarding data privacy, including the rights that may be available to eligible residents. The relevant rights will be available from the date that the laws and regulations become effective. This Appendix supplements the content provided in our Privacy Policy and should be read in conjunction with our Privacy Policy. CALIFORNIA RESIDENTS: YOUR CALIFORNIA PRIVACY RIGHTS The California Consumer Privacy Act of 2018, as amended, and any implementing regulations (collectively, the “CCPA”) provides consumers residing in California with rights relating to the access, deletion, correction, sharing, and selling of personal information for California residents. We have adopted this information to comply with the CCPA, inform you of your rights under the CCPA and how to submit a request. Any terms defined in the CCPA have the same meaning when used in this notice. The Notice at Collection for California residents can be found in Section 1 of the Privacy Policy. If at any time you have questions about this information, please contact support@hippoeducation.com or call toll-free 1-855-99-HIPPO. Residents of California have the following rights subject to applicable exceptions and limitations set forth in the CCPA: Your Right to Know. You have the right to request that we disclose personal information that we have collected about you. This includes a request for any or all of the following: • The categories of personal information we have collected about you; • The categories of sources from which the personal information is collected; • The categories of personal information that we sold or disclosed for a business purpose about you; • The categories of third parties to whom the personal information was sold or disclosed for a business purpose; and The specific pieces of personal information that we have collected about you on or after January 1, 2022. Your Right to Delete. You have the right to request that we delete any personal information that we have collected from you, subject to certain exceptions. Your Right to Correction. You have the right to request that we correct inaccurate personal information about you. Your Right to Opt-Out of Sale/Sharing. You have the right to request that we not “sell” or “share” your personal information to or with third parties, as defined under the CCPA. As described in the Privacy Policy, cookies and other technologies may be used on our sites to recognize you and receive information about your activity on our websites. This helps customize content and show you more relevant ads. Please note that if you make a request to opt-out of sale or sharing and you would like to opt-out of cookie-based tracking for behavioral advertising purposes, you can manage your cookie preferences on your browser. Additionally, you can opt-out of certain uses of cookies for advertising purposes by visiting www.aboutads.info/choices and https://optout.privacyrights.info.Your selections are specific to the device, website and browser you are using. Your selections are deleted whenever you clear your cookies or browser’s cache. Your Right to Nondiscrimination. You have the right not to receive discriminatory treatment for the exercise of privacy rights conferred by the CCPA. We do not discriminate if you choose to opt-out or exercise your rights under the CCPA. If we offer you a financial incentive permitted under the CCPA and not prohibited by other applicable laws and regulations, we will notify you of the material terms of the incentive or incentive program. Participation is voluntary and you may withdraw at any time by emailing us at support@hippoeducation.com. Additional Information for California Residents: Sensitive Personal Information. Depending on your level of interaction with us, we may collect sensitive personal information, such as Social Security numbers, driver’s license, state identification and passport data, race, ethnicity, medical information, and account information. We do not use or disclose sensitive personal information other than to provide you with our Services, as permitted by California law. For example, sensitive personal information may be used to process admissions and financial aid applications. We do not sell or share sensitive personal information for the purpose of cross-context behavioral advertising. Categories of Personal Information. The categories of personal information collected from and about consumers are listed in Section 4 of the Privacy Policy. Categories of Sources. The categories of sources from which we may obtain your personal information are listed in Section 3 of the Privacy Policy. Use and Disclosure of Your Personal Information. We may use and/or disclose the following categories of personal information we collect about you for one or more business or commercial purposes. Category In the preceding twelve (12) months, we have disclosed the following categories of personal information for a business purpose: A. Identifiers. YES B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)). YES C. Protected classification characteristics under California or federal law. YES D. Commercial information. YES E. Biometric information. NO F. Internet or other similar network activity. YES G. Geolocation data. YES H. Sensory data. YES I. Professional or employment-related information. YES J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)). NO K. Inferences drawn from other personal information. YES L. Sensitive Personal Information YES Categories of Third Parties. We may disclose your personal information for a business purpose to the categories of third parties described in Section 6 of the Privacy Policy, including: • Entities owned in whole or in part by us or our parent company and/or its shareholders. • Government agencies, regulators, accreditors, law enforcement, and other authorities entitled to such personal information pursuant to law or regulation. • Authorized distributors of our organization’s Services. • Service providers fulfilling a business purpose for us, such as: • Professional advisers including, but not limited to, auditors, bankers, insurers, legal counsel, and professional subject matter experts. • Organizations we contract with for affiliation purposes (e.g., Professional Associations). • Organizations we contract with to improve our Services and overall user experience. • Organizations we contract with for employee benefit purposes. • Background check providers for job candidates and/or students. “Sales” and “Sharing” of Personal Information. The following categories of personal information may have been sold or shared with a third-party for advertising purposes: • Personal identifiers, such as name, phone number and e-mail address; • Internet or other electronic network activity information, such as IP address, type of browser, device identifiers, device event information, make and model of the device, and mobile advertising identifiers; and • Information about your use of the Services. Each of the categories of personal information listed above may be sold to or shared with the following categories of third parties: advertising publishers that place advertisements on our behalf, advertising partners, and education partners. Exercising Your California Privacy Rights. To exercise any privacy rights under California law, a California resident may submit their request as follows: • Contact us by sending an e-mail to support@hippoeducation.com or calling us via our toll-free number: 1-855-99-HIPPO. • Current and former employees, job applicants, and contractors should send an e-mail to the HR Service Center. For certain requests, you will be asked to provide certain personal information that we will review against our records to validate your identity and eligibility. We will take reasonable steps to verify your identity prior to responding to your requests. The verification steps may vary depending on the sensitivity of the personal information and whether you have an account with us. California residents may designate an authorized agent to make a request on their behalf. When submitting the request, please ensure the authorized agent is identified as an authorized agent. We may deny certain requests, or fulfill a request only in part, based on our legal rights and obligations. The California "Shine the Light" law of 2003 provides consumers residing in California the right to ask us one time each year if we have disclosed their personal information to third parties for the third parties’ direct marketing purposes. To make a request, please send us an e-mail at support@hippoeducation.com or call toll-free 1-855-99-HIPPO. You may also write to us at the address listed below. Indicate in your e-mail or letter that you are a California resident making a "California Shine the Light" inquiry. COLORADO RESIDENTS: YOUR COLORADO PRIVACY RIGHTS The Colorado Privacy Act (“CPA”) gives residents of Colorado certain rights around the collection, use, and sharing of their personal data. Your Rights. If you are a resident of Colorado, you have the right under the CPA, subject to several exceptions and limitations, to: • Request to know what personal data has been collected about you and to access that information; • Request to correct inaccuracies in your personal data; • Request deletion of your personal data (subject to certain exemptions); • Request a copy of your personal data; • Request to opt-out of the sale (as defined in the CPA) of your personal data; • Request to opt-out of targeted advertising; and • Appeal a denial of any request A Colorado resident may submit their request by contacting us at support@hippoeducation.com or calling us via our toll-free number: 1-855-99-HIPPO. To request to opt-out of “targeted advertising” (as defined in the CPA), you can separately update your cookie preferences on your browser. Additionally, you can opt-out of certain uses of cookies for advertising purposes by visiting www.aboutads.info/choices and https://optout.privacyrights.info. Your selections are specific to the device, website and browser you are using. Your selections are deleted whenever you clear your cookies or browser’s cache. You will be asked to provide certain personal information that we will review against our records to validate your identity and eligibility. We will take reasonable steps to verify your identity prior to responding to your requests. The verification steps will vary depending on the sensitivity of the personal data and whether you have an account with us. We may deny certain requests, or fulfill a request only in part, based on our legal rights and obligations. If you are not satisfied with the outcome of your request, you may submit an appeal by sending an e-mail to support@hippoeducation.com with “Colorado Appeal” in the subject line. Note that for purposes of this section, personal data does not include information about job applicants, employees and other of our personnel; or information about employees and other representatives of third-party entities we may interact with. CONNECTICUT RESIDENTS: YOUR CONNECTICUT PRIVACY RIGHTS The Connecticut Data Privacy Act (“CTDPA”) gives residents of Connecticut certain rights around the collection, use, and sharing of their personal data. Your Rights. If you are a resident of Connecticut, you have the right under the CTDPA, subject to several exceptions and limitations, to: • Request to know what personal data has been collected about you and to access that information; • Request to correct inaccuracies in your personal data; • Request deletion of your personal data (subject to certain exemptions); • Request a copy of your personal data; • Request to opt-out of the sale (as defined in the CTDPA) of your personal data; • Request to opt-out of targeted advertising; and • Appeal a denial of any request A Connecticut resident may submit their request by contacting us at support@hippoeducation.com or calling us via our toll-free number: 1-855-99-HIPPO. To request to opt-out of “targeted advertising” (as defined in the CTDPA), you can separately update your cookie preferences on your browser. Additionally, you can opt-out of certain uses of cookies for advertising purposes by visiting www.aboutads.info/choices and https://optout.privacyrights.info. Your selections are specific to the device, website and browser you are using. Your selections are deleted whenever you clear your cookies or browser’s cache. You will be asked to provide certain personal information that we will review against our records to validate your identity and eligibility. We will take reasonable steps to verify your identity prior to responding to your requests. The verification steps will vary depending on the sensitivity of the personal data and whether you have an account with us. We may deny certain requests, or fulfill a request only in part, based on our legal rights and obligations. If you are not satisfied with the outcome of your request, you may submit an appeal by sending an e-mail to support@hippoeducation.com with “Connecticut Appeal” in the subject line. Note that for purposes of this section, personal data does not include information about job applicants, employees and other of our personnel; or information about employees and other representatives of third-party entities we may interact with. NEVADA RESIDENTS: YOUR NEVADA PRIVACY RIGHTS If you reside in Nevada, you have the right to ask us at any time to review the personal information that we have collected through our website(s) or the Services we provide and to request changes. Subject to the terms of applicable Nevada law, you may also submit a request directing us not to sell certain covered personal information we have collected or will collect about you. To make a request, please send us an e-mail at support@hippoeducation.com or write to us at the address listed below. Indicate in your e-mail or letter that you are a Nevada resident making a "Nevada Internet Privacy" inquiry. VIRGINIA RESIDENTS: YOUR VIRGINIA PRIVACY RIGHTS The Virginia Consumer Data Protection Act (“CDPA”) gives residents of Virginia certain rights around the collection, use, and sharing of their personal data. Your Rights. If you are a resident of Virginia, you have the right under the CDPA, subject to several exceptions and limitations, to: • Request to know what personal data has been collected about you and to access that information; • Request to correct inaccuracies in your personal data; • Request deletion of your personal data (subject to certain exemptions); • Request a copy of your personal data; • Request to opt-out of the sale (as defined in the CDPA) of your personal data; • Request to opt-out of targeted advertising; and • Appeal a denial of any request A Virginia resident may submit their request by contacting us at support@hippoeducation.com or calling us via our toll-free number: 1-855-99-HIPPO. To request to opt-out of “targeted advertising” (as defined in the CDPA), you can separately update your cookie preferences on your browser. Additionally, you can opt-out of certain uses of cookies for advertising purposes by visiting www.aboutads.info/choices and https://optout.privacyrights.info. Your selections are specific to the device, website and browser you are using. Your selections are deleted whenever you clear your cookies or browser’s cache. You will be asked to provide certain personal information that we will review against our records to validate your identity and eligibility. We will take reasonable steps to verify your identity prior to responding to your requests. The verification steps will vary depending on the sensitivity of the personal data and whether you have an account with us. We may deny certain requests, or fulfill a request only in part, based on our legal rights and obligations. If you are not satisfied with the outcome of your request, you may submit an appeal by sending an e-mail to support@hippoeducation.com with “Virginia Appeal” in the subject line. Note that for purposes of this section, personal data does not include information about job applicants, employees and other of our personnel; or information about employees and other representatives of third-party entities we may interact with. Rights Under The General Data Protection Regulation If you are a citizen of the European Union, the General Data Protection Regulation ((EU) 2016/679), the “GDPR”) provides you with the following rights regarding the use and control of your personal information, subject to certain terms and conditions otherwise provided herein: • The right to access. You have the right to request the Company provide you copies of your personal information. We may charge you a small fee for this service. • The right to rectify. You have the right to request that the Company correct any information you believe is inaccurate. You also have the right to request the Company to complete information you believe is incomplete. • The right to erasure. You have the right to request the Company erase your personal information. • The right to restrict processing. You have the right to request that the Company restrict the processing of your personal information. • The right to object to processing. You have the right to object to the Company’s processing of your personal information. • The right to data portability. You have the right to request that the Company transfer the data we collect to another organization, or directly to you. If you make a request pursuant to your rights under the GDPR, we have one month to respond to you. If you would like to exercise any of these rights, please contact us at support@hippoeducation.com. Data Security We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure. All personal and transaction information on the website is encrypted during transmission using Transport Layer Security (TLS) technology. During a transaction, your sensitive payment information (card number, etc.) is securely transmitted to our third-party payment gateway provider and is not stored on our systems. Your remaining order information is securely stored in our systems, and is only physically accessible to those individuals with special access rights. The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain Services, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. We urge you to be careful about giving out information in public areas of the website like message boards. The information you share in public areas may be viewed by any user of the website.