GAPFUNDED PRIVACY POLICY

What information is subject to this Policy?

Does GapFunded Collect NPI?

Yes. As a company that conducts activities that are financial in nature, GapFunded is a “financial institution”, as that term is defined by the GLBA, and certain of the information it collects from, or about, you qualifies as NPI. If you utilize our financial products and services, we will use and share any information that we collect from, or about, you in accordance with our Gramm-Leach-Bliley Act Privacy Policy, which offers you certain choices with respect to the use and sharing of your personal information.

How does GapFunded collect Personal Information?

GapFunded collects only the Personal Information data that is reasonably necessary and proportionate to our legitimate business purposes. We collect Personal Information:

• Directly from you when you use the Site or Services
• Automatically via cookies and similar technologies (see Cookie Policy)
• From third parties including affiliates, service providers, social media platforms, online databases, and marketing data providers. We also purchase marketing data about our customers from third parties and combine it with the Personal Information or Sensitive Personal Information our customers provide us, to offer advertising and products from our company or one of our subsidiary companies.

Why do we collect your Personal Information?

We collect Personal Information to provide the products and Services you purchase and to provide you with a customized experience. This includes personalization services, interactive communications, as well as display of advertisements for valuable products and services. We may collect and use your Personal Information for any of the following purposes:

• Manage your account and preferences
• Communications with you
• Customer support with the Site or the Services
• Process transactions or perform the Services
• Ensure safety, security, and fraud prevention
• Personalize your experience
• Conduct marketing and send advertisements
• Manage and Improve the Site and our Services
• Meet legal and compliance obligations
• Conduct research on user demographics and behaviors.

Personal Information collected for one purpose may also be used for any of the other purposes listed above.

Who do we share your Personal Information with?

We will share your personal information with third parties only in the ways that are described in this Policy or the Gramm-Leach-Bliley Privacy Policy. We do not sell, rent, trade, or otherwise share your personal information with third parties without first providing you notice and choice. GapFunded may share your Personal Information with the following third parties:

• Service Providers who operate the Site, provide Services, or assist with marketing/research.
• Business Affiliates and Partners who perform certain professional services, such as payment processing, fraud prevention or detection, audits, make referrals to us or provide leads to us.
• Financial Institutions including credit card issuers, lenders, banks, or other parties as necessary to provide the Services.
• Subsidiaries or other entities disclosed to you at the time your information is collected or prior to sharing your Personal Information.
• Other Parties not specifically identified in this Policy but who are necessary to accomplish any of the purposes identified in Section 4 of this Policy.
• Legal Personnel, including our attorneys, law enforcement, courts, and regulatory bodies when legally required or to protect rights.
• Marketing Partners and Sponsors or other entities disclosed to you at the time your information is collected or prior to sharing your Personal Information.
• Ad Servers for advertising, targeted or direct marketing, and lead generation.

How does GapFunded use and share your Personal Information?

In the past twelve (12) months, GapFunded has collected and shared Personal Information for the following purposes and with the following third parties:

What are your rights and choices?

If you live in California, Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have the rights and/or choices described in this section:

• Right to access: The right to access the information collected about you, or shared with third parties. If you live in Utah, Virginia, or Connecticut, you have the right to make a request up to twice in a 12-month period.
• Right to correct: The right to request that incorrect or outdated Personal Information be corrected but not deleted.
• Right to Delete: The right to request deletion of Personal Information under certain conditions.
• Right to opt out of certain processing: The right to restrict processing of certain types of Personal Information, such as sharing of Sensitive Personal Information or profiling.
• Right to portability: The right to request Personal Information be disclosed in a common file format.
• Right to opt-out of sales or sharing: The right to opt out of the sale of Personal Information to third parties.
• Right to limit the use of Sensitive Personal Information: You may have a right to limit our use of sensitive personal information.
• Right against automated decision making: A prohibition against decisions based solely on an automated process without human input. We do not engage in automated decision making.
• Right to appeal: Where a controller declines a request, the right to appeal the decision.
• Private right of action: Some states give you the right to seek civil damages for violations of data privacy laws.
• Right to withdraw consent: The right to withdraw consent at any time.
• Right of Non-Discrimination: You have a right to exercise your rights free of discrimination.

Please Note: These rights do not extend to Personal Information that is exempted from your state’s applicable privacy laws. For information exempted under the GLBA, please see our Gramm-Leach-Bliley Act Privacy Policy.

How do you opt out of data sharing?

Opt Out Request Form: Submit opt out requests through our Data Request Form or by contacting us.

Universal Opt Out Mechanism: We honor Global Privacy Control (GPC) and other opt-out signals as requests to opt out of personal information sales, sharing for targeted advertising, and to limit use of Sensitive Personal Information. Your opt-out applies only to the specific browser/device sending the signal.

How do you make a request to exercise your rights or choices?

How to make a Request: To exercise your rights or to make an inquiry, please contact us using any of the methods listed in the Contact Us section. We may verify your identity before processing requests.

GapFunded’s Response to Requests: We will confirm receipt of your request within 10 business days. In general, we will respond within 45 days. If we need more time, we will let you know.

Authorized Agents: You may designate an authorized agent to exercise your rights on your behalf. We require verification of the agent's authority.

What to do if you disagree with our decision: If we deny your request, you may appeal by contacting us with your name, email, request type, appeal reason, and original request reference.

What is GapFunded’s Cookie Policy?

We use tracking technologies ("Cookies") including cookies, pixels, and tracking scripts to collect, store, and track information about you and your use of the Site or Services.

What is de-identified or aggregate data and how does GapFunded use such data?

"De-identified data" cannot reasonably be linked to a particular person. "Aggregate data" shows high-level trends without linking to individuals.

We may de-identify and aggregate data for business purposes (improving products, security, analytics). We maintain such data in de-identified/aggregate form and do not attempt re-identification except as legally permitted. Third parties receiving such data commit to maintaining it in de-identified form.

How does GapFunded protect your Personal Information?

We maintain reasonable administrative, physical, and technological measures to protect Personal Information. However, no communication method is 100% secure. We cannot guarantee security of transmitted information; you transmit at your own risk.

How does GapFunded protect your financial information?

Any financial information provided to GapFunded (including credit card and payment information) is stored/shared/transmitted in encrypted format complying with PCI standards using SSL (secure socket layer) encryption.

What other steps can you take to protect your account?

If you purchase any products or services with us, you will need to establish an online GapFunded account. Your account is password protected so that you and only you have access to this personal information. You may edit your GapFunded account information by using your user ID and password. Do not divulge your password. We will never ask for your password in unsolicited calls/emails. Sign out and close your browser after use, especially on shared/public computers.

What about children’s privacy?

The Site and Services are not intended for minors under 18. We do not knowingly collect, sell, or share Personal Information of minors under 18 or send direct offers to users under 18. If you believe a child submitted Personal Information without parental consent, contact us.

Does GapFunded use or process Personal Information outside the country where the data was originally collected?

We may send Personal Information to servers outside your country. By using the Site and Services, you consent to transfer and processing in other countries. Data protection laws may differ from your country of residence. We take steps to ensure secure treatment in accordance with our Terms and this Policy.

How does GapFunded retain Personal Information?

Unless you request deletion, we retain Personal Information for the duration of our relationship or as long as necessary to fulfill collection purposes, whichever is longer. We consider amount, nature, sensitivity, risk of harm, processing purposes, and legal requirements when determining retention periods.

What do you need to know about links to third party websites?

The Site may link to other websites operated by unaffiliated entities with their own privacy policies. We are not responsible for their content or privacy practices. Review their privacy policies when linking.

What else should you know about your privacy?

Please keep in mind that whenever you voluntarily disclose Personal Information online, for example on message boards, social media, through email, or in chat areas that information can be collected and used by others. In short, if you post Personal Information online that is accessible to the public, you may receive unsolicited messages from other parties in return. Ultimately, you are solely responsible for maintaining the secrecy of your passwords and/or any account information. Please be careful and responsible whenever you’re online.

How will we inform you of changes to this Policy?

We may modify this Policy at any time. Changes supersede previous policies. Updates will be posted with a revised "Last Updated" date. Check frequently for updates. For material changes, we will notify you by email and/or account notice as required by applicable privacy laws. For changes to how we collect, use, process, or share Personal Information, we'll provide opportunity to consent or opt out as required.

State Specific Disclosures

Contact Us

If you have any questions or concerns about GapFunded, the Site, the Services, this Policy, the Gramm-Leach-Bliley Privacy Policy, or to exercise your rights or choices, please contact us: