Aliya Privacy Policy

Overview

Aliya is committed to ensuring the privacy and security of all Information, including Personal Information, that we collect, use, share, and otherwise process as part of our business. We also believe in transparency, and we are committed to informing you about how we treat the data we collect and process in accordance with applicable law. We have established this Policy to inform you about the privacy practices that we apply to Information and inform you about your rights and choices in this regard. All the Information described in this Policy is collectively referred to as “Information.” We may use the Information we collect about you, including Personal Information, as described below to draw inferences about you, including about your characteristics and creditworthiness.

What is Personal Information? “Personal Information” means Information that can be used to identify you, directly or indirectly, alone or together with other information processed by Aliya. This may include things such as your full name, contact information, email address, phone number, device IDs, certain cookie and network identifiers, and other categories described below. We may create de-identified or anonymous information from Personal Information by excluding and removing information components (such as your name, email address, or linkable tracking ID) that makes the information personally identifiable to you, through obfuscation, or through other means (“Aggregated Information”). Our use of Aggregated Information or Information that is publicly available and has not been combined with non-public Personal Information, is not considered Personal Information. Information collected and processed through the Services pursuant to this Policy includes Personal Information.

What processing activities are covered by this Policy? This Policy applies to the processing of Information when you use or visit the Site and any features, subdomains, content, functionality, services, media, forms, applications, or solutions offered on or through the Site, and our Services. This Policy also applies to Information that we receive from business partners and other third parties and is processed by us. By accessing and using the Services, or by otherwise signaling your agreement when the option is presented to you, you consent to the collection, use and disclosure of information as described in this Policy. This Policy only governs the Services and it does not govern any other website or service operated by third parties that do not specifically refer to this Policy. Any materials submitted through the Services and your use of the Services are also subject to Our Terms of Use at [Link].

“Processing” means any operation or set of operations performed upon Information or sets thereof, whether or not by automatic means, such as collection, recording, organization, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction and the verb “to process” shall be construed accordingly.

I. Information We Collect About You

We may collect the following types of Information: (A) information you provide to us, (B) information we automatically collect, (C) information we receive from third parties, and (D) information we collect through cookies and other tracking technologies. All of the Information listed in subsections (A) through (C) below is detailed in the following subsections and we may use such Information as described below to draw inferences about you, including about your characteristics and creditworthiness.

A. Information You Provide to Us

In using our Services, you may provide us with Information, including, without limitation:

• Your name, address, phone number, email, date of birth, Social Security number, and documents or other media that verify your identity.
• Financial information such as your credit history, credit scores, and other information.
• Information about your loan account and your payment history.
• Bank information such as the name of your bank, account numbers, bank account credentials, and transaction information.
• Information you provide directly when you register on the Site, fill out forms, request a loan offer, apply for a loan, opt into Aliya Services and Aliya Partner services, or choose automatic employment or bank account verification.
• Communications with us, including records and copies of correspondence when you contact us, subscribe to alerts, or report a problem. We may keep records and copies of your correspondence if you contact us.

Is entry of Information required? The entry of Information is required to access certain portions of the Services. You may choose not to provide us with any Information and may still access certain portions of the Services but will not be able to access any portions of the Services that require your Information.

In addition, where we need to process your Information either to comply with law, to perform the terms of a contract we have with you, or to provide Services and you fail to provide that data when requested, we may not be able to provide Services or perform the contract we have or are trying to enter into with you (for example, to provide you with the functionalities of the Services). In this case, we may have to stop you from using our Services, cease providing Services, and terminate the contract you have with us. We will notify you if this is the case at that time.

B. Information We May Automatically Collect

We also collect information about you from your visit to our Online Services including:

1. IP address. This is the number associated with the service through which you access the Internet, like your Internet service provider (ISP) or your company.
2. Date and time. We capture the date and time of your visit or use of our Online Services.
3. Domain server. We identify the domain server from which you are using our Online Services.
4. Device and technology information. This includes the type of computer, web browsers, search engine used, operating system, or platform you use.

This information is primarily needed to maintain the security and operation of our Services, and for our internal analytics and reporting purposes.

C. Cookies and Other Tracking Technologies

We collect Information directly and through the use of third parties by using technologies such as cookies, pixels, web beacons, and other tracking tools. Third-party service providers, advertisers, and partners may also view, edit, or set their own cookies or place web beacons to collect similar or identical information. The use of these technologies by such third parties is subject to their own privacy policies and is not covered by this Policy, except as required by law. We may tie this information to Personal Information about you that we collect from other sources or that you provide to us.

Cookies (or browser cookies). A cookie is a small file placed on the hard drive of your computer. Most web browsers automatically accept cookies. You may refuse to accept browser cookies by activating the appropriate setting on your browser; however, if you select this setting, you may be unable to access certain parts of our Services. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you direct your browser to our Services.

First and Third-Party Cookies. Our Services may use first party cookies, third party cookies, and other similar technologies. First party cookies are set by us. Third party cookies are set by third parties when you access some content or applications, including advertisements, on our Services. These third parties include advertisers, ad networks and servers, content providers, application providers, and social media sites. Unless you set your browser to refuse cookies as described herein, these third parties may use cookies (alone or in conjunction with web beacons or other tracking technologies) to collect information about you when you access the Services. The information they collect may be associated with your Information or they may collect Information, including Personal Information, about your online activities over time and across different websites and other online services. They may use this Information to provide you with interest-based (behavioral) advertising and other targeted content. We do not control these third parties’ tracking technologies or how they may be used. If you have any questions about advertisement or other targeted content, you should content the responsible provider directly. Below is a list of the different types of cookies that we use on our Services.

We may use the following types of cookies and tracking technologies:

Other Similar Technologies. In addition to cookies, we may use automatic data collection technologies, such as Internet tags, web beacons (clear gifs, pixel tags, and single-pixel gifs), and navigational data collection (log files, server logs, etc.) to collect data as users navigate through and interact with the Services, including relating to your viewing of any video content. For example, web beacons are tiny graphics with unique identifiers that are used to understand browsing activity. In addition, UTM codes are strings that can appear in a URL when you move from one web page or website to another. The string can represent information about browsing, such as which advertisement, page, or publisher sent the user to the receiving website. By viewing any video content on the Site, you consent to the collection of data related to your accessing of such content, including any automatically collected data.

Analytics. We may use analytics tools, such as Google Analytics, to help provide us with information about traffic to our website and use of our website, which Google may share with other services and websites that use the collected data to contextualize and personalize the ads of its own advertising network. We may use analytics tools to collect information about your use of the Services and enable us to improve the way they work and operate, information regarding what the most frequently visited pages on the Site are, help us record and debug any issues you may have with the Services, and show us how effective our advertising is. These analytics cookies do not allow us to see the usage of a single user but does allow us to see overall patterns of usage on the Services. We do not examine this information for individually identifying information, but we do use this information to understand the traffic on our Services.

Google Analytics. We use Google Analytics to collect and process statistical data about the number of people using the Services and to better understand how they find and use the Services. The data collected includes data related to your device/browser, your IP address, and on-site activities to measure and report statistics about user interactions. The information stored is reduced to a random identifier. Any data collected is used in accordance with this Policy and Google’s privacy policy. You may learn more about Google Analytics by visiting https://www.google.com/policies/privacy/partners/ and https://support.google.com/analytics/answer/6004245. You can learn more about Google’s restrictions on data use by visiting the Google Privacy Policy at: https://www.google.com/policies/privacy. To opt-out of Google Analytics, visit https://tools.google.com/dlpage/gaoptout and install the opt-out browser add-on feature. For more details, visit the “Google Analytics opt-out browser add-on” page located at https://support.google.com/analytics/answer/181881?hl=en.

Advertising Cookies and Similar Technologies. Advertising cookies and other similar technologies used by us are used to display targeting promotions or advertisements based on your use of the Services and interests and to manage our use of advertising resources. These technologies collect information about your activities on this and other sites to provide you with interest-based advertising. You can learn more about interest-based advertisements and your opt-out rights and options from members of the Network Advertising Initiative (“NAI”) on its website (www.networkadvertising.org) and from members of the Digital Advertising Alliance (“DAA”) on its website (www.aboutads.info). We do not control third parties’ collection or use of your information to serve interest-based advertising. However, these third parties may provide you with ways to choose not to have your information collected or used in this way. You can also opt out of receiving targeted ads from members of the NAI on its website.

Opting out of interest-based advertising does not mean that you will no longer see any advertisements. You will still see advertisements, but they will be general and untailored to your specific interests and activities. In general, opt-outs must be performed on each device and browser that you wish to have opted out. If your browser is configured to reject cookies when you visit these opt-out webpages, or you subsequently erase your cookies, use a different device or web browser, or use a non-browser-based method of access (e.g., a mobile app), your NAI or DAA browser-based opt-out may not, or may no longer, be effective. Aliya supports the advertising industry’s Self-Regulatory Principles for Online Behavioral Advertising. We expect that ad networks we directly engage to serve you interest-based advertising will do so as well, though we cannot guarantee their compliance. We are not responsible for effectiveness of, or compliance with, any third party’s opt-out options or programs, or the accuracy of their statements regarding their programs.

Choices About Cookies and Similar Technologies. You may choose not to allow certain cookies by setting your browser to refuse all or some browser cookies or to alert you when cookies are being set. For more information on how to modify your browser settings to block or filter cookies, visit http://www.aboutcookies.org/. You may learn more about internet advertising practices and related consumer resources at http://www.aboutads.info/consumers/, http://www.networkadvertising.org/choices, and http://youronlinechoices.eu/. These settings may affect your enjoyment of the Services’ functionality. Adjusting the cookie settings may not fully delete all of the cookies that have already been created. To delete them, you should review your web browser settings after you have changed your cookie settings. In addition to the above, the links below provide additional information about how to disable cookies or manage the cookie settings:

Google Chrome: https://support.google.com/chrome/answer/95647?hl=en

Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences

Microsoft Edge: https://support.microsoft.com/en-us/windows/manage-cookies-in-microsoft-edge-view-allow-block-delete-and-use-168dab11-0753-043d-7c16-ede5947fc64d

Safari: https://help.apple.com/safari/mac/8.0/en.lproj/sfri11471.html

Online Tracking Signals. We do not currently recognize browser settings or signals of tracking preferences, which may include “Do Not Track” instructions. “Do Not Track” is a web browser setting that seeks to disable the tracking of individual users’ browsing activities. We adhere to the standards set out in this Policy and do not currently respond to “Do Not Track” signals on the Services or on third-party websites or online services where we may collect information.

Visual Materials and Consent to Collect, Use, And Disclose Viewing History. The Services may display live or prerecorded videos or similar audio-visual materials (“Videos”). We are not in the business of delivering audiovisual materials. Rather, the display and use of Videos on the Services is incidental to our business and merely a peripheral part of our marketing strategy. The provision of Videos on our Services is not an admission by us, and it shall not otherwise be interpreted, in any form or manner, to mean that we are a “video tape service provider” for purposes of the Video Privacy Protection Act (codified as amended at 18 U.S. Code § 2710) (“VPPA”) or that we are otherwise subject to the VPPA.

We may collect personal information with respect to your viewing, streaming, or otherwise accessing such Videos and we may disclose such personal information regarding your video-viewing history on the Services to third parties through the use of cookies, pixels, or other tracking technologies, to facilitate or assist with our marketing and advertising campaigns. By viewing, streaming, or otherwise accessing Videos on the Services, you hereby acknowledge, agree, and consent to our collection, use, and disclosure of such personal information regarding your video-viewing history on the Services.

We may use tracking technologies provided by YouTube as part of our services and/or embed YouTube Videos on the Services. These tracking technologies enable us to understand and improve our marketing efforts, track the performance of any Video content we have, and provide you with a more personalized experience. With respect to YouTube Videos embedded on our Services, no data about you will be transferred to YouTube if you do not play the Videos. YouTube may collect information relating to your visit to our Services, including the referring IP address, device, and pages you accessed on our Services. Additional information on the purpose and scope of data collection and processing by YouTube can be found in YouTube’s/Google’s Privacy Policy. By viewing any videos embedded on our Services or as part of the products and services that we offer, you consent to the disclosure of information to YouTube through its tracking technologies

By viewing, streaming, or otherwise accessing Videos on the Services, you hereby acknowledge, agree, and consent to our collection, use, and disclosure of such personal information regarding your video-viewing history on the Services.

Web Scraping. You are strictly prohibited from using any automated system, software, or other methods, including but not limited to scripts, bots, crawlers, scrapers, or other data mining tools, to access, acquire, copy, monitor, or collect any data, content, or other information from the Services without prior written consent from us. This prohibition extends to the use of any technology designed to bypass or circumvent measures we employ to restrict access to certain content or areas of the Services.

Accuracy and Updating Your Information. Our goal is to keep your Information accurate, current, and complete. If any of the Information you have provided to us changes, please update it in your user/account profile, or let us know via the “Contact Us” details at the end of this Policy. For instance, if your email address changes, you may wish to let us know so that we can communicate with you. If you become aware of inaccurate Information about you, you may want to update your Information. We are not responsible for any losses arising from any inaccurate, inauthentic, deficient or incomplete Information that you provide to us.

D. Information We May Receive from Third Parties

We may collect additional Information about you from others such as our Aliya Partners, affiliates, other companies, third-party websites, and sources providing publicly available information (e.g., from the U.S. Postal Service) to help us provide services to you, help prevent fraud, and for marketing, advertising, and analytic purposes. For example, we may collect Information about you from third-party service providers including Information we request on your behalf from credit reporting agencies, payroll providers and third parties who facilitate access to payroll provider data, Information we receive from other third-party data partners who supplement and/or verify Information we collect from you, and Information we obtain from public record sources or websites.

We may also collect Information about you from third-party Aliya Partners that you engage with who may pass certain Information about you and your use of their service to us. This Information could include any Information that you have permitted the third party to share with us, including personal Information necessary for the Aliya Partner to use Aliya’s credit analytics or employment verification services. The Information we collect is covered by this Policy, and the Information the third parties collect is subject to the third-party’s privacy practices. We encourage you to be aware when you leave our sites or applications and to read the privacy policies of other sites that may collect your Information.

E. Aggregated Data

We may also collect, use and share “Aggregated Data” such as statistical or demographic data for any purpose. Aggregated Data may be derived from your Information, but once in aggregated form it will not constitute Personal Information for the purposes of applicable law as this data does not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your Personal Information so that it can directly or indirectly identify you, we treat the combined data as Personal Information which will be used in accordance with this Privacy Policy.

F. Special Categories of Personal Information

We do not collect any additional “Special Categories of Personal Information” or “Sensitive Personal Information” about you, including, details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, and information about your health. Nor do we collect any additional information about criminal convictions and offenses.

II. How We Use Your Information

A. Use and Purpose of Processing Your Information

We use and process your Information for purposes including, but not limited to:

• Providing you and other customers with access to the products and services offered by Aliya or Aliya Partners.
• Improving our insights so we can provide you with offer recommendations and insights that are most relevant to you.
• Providing notices and other information to you about, or in connection with, these products and services.
• Responding to user inquiries and offering support.
• Detecting security incidents; protecting against malicious, deceptive, fraudulent, or illegal activity; fulfilling legal requirements; and enforcing our agreements.
• Debugging to identify and repair errors that impair existing intended functionality.
• Providing, maintaining, developing, and improving the Aliya Services, your experience, and protecting Aliya and its users.
• Improving your experience accessing the products and services offered by Aliya or Aliya Partners by recognizing you as a customer and remembering information you previously provided so that you will not have to re-enter it.
• Marketing and advertising purposes, including sending you promotional material or special offers on our behalf or on behalf of our marketing partners and/or their respective affiliates, subsidiaries, and other third parties, provided that you have not already opted out of receiving such communications.
• Managing relationships with third-party service providers, vendors, suppliers, parents, affiliates, subsidiaries, and business partners.
• Maintaining, improving, customizing, or administering our Services, performing business analyses, or other internal purposes to improve the quality of our business and the Services, resolve technical problems, improve security, or develop other products and services.
• Carrying out our obligations and enforcing our rights arising from any contracts entered into between you and us, including for billing and collection.
• Complying with our Terms of Use and other purposes disclosed to you at the time we collect your Information.

B. Sharing Your Information

We may share your information in the following contexts, but we will not share your Personal Information if such sharing is prohibited by applicable privacy and data protection law. If we are acting as a data processor or service provider, disclosures in the following contexts will be limited in accordance with the instructions from the data controller or business.

Where permitted by applicable law, we may share the information described above in the following contexts:

• Third-Party Service Providers: We may share your Information with third-party service providers, vendors, contractors, or agents that perform certain business functions or services on our behalf (such as processing your transactions, managing our databases, maintaining your account, performing analyses and credit risk assessments, providing customer service, providing marketing or technology product development, or sending communications for us). These companies are authorized to use your Information only as necessary to provide these services to us.
• Aliya Partners: We may share your Information with Aliya Partners that you request loan offers from or who decline to pre-approve you for a loan when you request a loan offer, and we may also share your Information with nonaffiliated financial institutions that we partner with to market or provide the Aliya Services or to fulfill your requests.
• Subsidiaries and Affiliates: We may share your non-medical Information with our subsidiaries and affiliates. “Affiliates” means any entity controlled by, controlling, or under common control with us. Our affiliates will use and distribute your Information in accordance with the terms of this Policy. If you do not want us to share your Information with our subsidiaries and affiliates, please contact us via the Contact Us section.
• Credit Reporting Agencies: We may share your Information with credit reporting agencies to report account information, at your direction, and otherwise as permitted by law.
• Business Transfers: Your non-medical Information may be transferred, sold, or otherwise conveyed (“Conveyed”) to a third party where we (i) merge with or are acquired by another business entity; (ii) sell all or substantially all of our assets; (iii) are adjudicated bankrupt; or (iv) are liquidated or otherwise reorganize. You consent to any and all such Conveyances of your non-medical Information.
• Online Communications: If you choose to share comments, post a review, participate in a survey, provide a testimonial, or provide other non-medical information, you consent and agree that we may make it available generally to the public, and it will not be returned to you unless we receive such a request in writing from you and determine, in our sole discretion, to honor such request.
• Legal Necessity: We may disclose Information in response to subpoenas, warrants, court orders or other legal process, or to comply with relevant laws. We may also share Information in order to establish or exercise our legal rights or claims; to defend against a legal claim; and to investigate, prevent, or take action regarding possible illegal activities, suspected fraud, safety of person or property, or a violation of our contracts.
• Professional Advisors: We may share your information with our and our affiliates’ insurers and professional advisors, including attorneys and accountants, that need access to your information to provide operational or other support services on our behalf.
• Other Third Parties: We may share information about you to third parties that may offer you products, services or promotions.
• Deidentified or Aggregated Data: We may disclose aggregated information or de-identified information that does not identify any specific individual, such as groupings of demographic data or customer preferences.
• With Your Consent: Except as provided in this Policy, we will not sell, rent, or license the Information we have collected to any other third party without your consent and shall share your Information consistent with this Policy with your consent.

III. Selling or Renting of Personal Information

OTHER THAN AS DESCRIBED HEREIN, ALIYA WILL NOT SELL OR RENT ANY OF YOUR PERSONAL INFORMATION TO THIRD PARTIES AND ONLY SHARES YOUR PERSONAL INFORMATION WITH THE THIRD PARTIES DESCRIBED ABOVE.

IV. Information Security

We use commercially reasonable safeguards to provide our Services. We have put security measures in place designed to protect the Information that you share with us from being accidentally lost, used, altered, disclosed, or accessed in an unauthorized manner. We have implemented reasonable security measures designed to detect fraudulent identity-verification activity and the unauthorized access to or deletion of Information. From time to time, we review our security procedures to consider appropriate new technologies and methods. While our security measures seek to protect the Information in our possession, no data transmitted over the Internet or stored or maintained by us or our third-party service providers can be guaranteed to be 100% secure. Therefore, although we believe the measures implemented by us reduce the likelihood of security problems to a level appropriate to the type of data involved, we do not promise or guarantee, and you should not expect, that your Information or private communications will always remain private or secure. We do not guarantee that your Information will not be misused by third parties, nor that privacy settings or security features cannot be circumvented, and we are not responsible for the circumvention of any privacy settings or security features. You agree that we will not have any liability for misuse, access, acquisition, deletion, or disclosure of your Information.

You are responsible for maintaining the confidentiality of your username and password and for all activities that occur under your username and password. If you believe that your Information has been accessed or acquired by an unauthorized person, or if you believe there is any other breach of security, promptly contact us so that necessary measures can be taken.

If a data breach compromises your personal information, we will notify you and any applicable regulator when we are required to do so by applicable law.

V. Data Retention

We keep your Information only for as long as is necessary for the purposes set out in this Policy unless a longer retention period is required or permitted by law. When we have no ongoing business need to process your Information, we will delete it or securely store it and isolate it from any further processing until deletion is possible.

VI. Your Rights and Choices Regarding Personal Information

Depending on where you live in the United States, you may have certain rights relating to your Personal Information, which may include those described below. We will respond to requests from individuals in accordance with applicable law; however, we reserve the right to deny any requests where appropriate and permitted by applicable law.

You may use the “Contact Us” details at the end of this Policy to exercise your rights and choices under this Policy. If you would like to manage, change, limit, or delete your Personal Information, or if you no longer want to receive any email contact from us in the future, such requests may be submitted via the “Contact Us” details at the end of this Policy. We honor such requests when we are required to do so under applicable law.

Email Opt-Out. We may send you emails about our services and other updates. If you no longer wish to receive communications from us via email, you may opt-out by clicking the “unsubscribe” link at the bottom of our emails or by contacting us at via the “Contact Us” details at the end of this Policy and providing your name and email address so that we may identify you in the opt-out process. Once we receive your instruction, we will promptly take corrective action. Please note that registered users cannot opt out of receiving transactional e-mails related to their account. Third party advertisers that maintain their own mailing lists may send communications that advertise our products or services; and you may need to contact those parties directly in order to stop receiving their e-mail communications.

Accuracy and Updating Your Information. Our goal is to keep your Information accurate, current, and complete. If any of the Information you have provided to us changes, please let us know via the “Contact Us” details at the end of this Policy. For instance, if your email address changes, you may wish to let us know so that we can communicate with you. If you become aware of inaccurate Personal Information about you, you may want to update your Information. If you have created a user account, you may access, review, and make changes to your registration by following the instructions on the Services; however, your e-mail address cannot be changed from that used in your initial registration. We are not responsible for any losses arising from any inaccurate, inauthentic, deficient or incomplete Information that you provide to us.

Right to Confirmation and Access. If required by law, upon request, we will confirm whether we process your Personal Information and grant reasonable access to the Personal Information that we hold about you.

Right to Data Portability. If required by law, upon request, we will deliver a copy of your Personal Information in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance.

Right to Know. If required by law, upon request, we will provide information regarding: (1) the specific pieces of Personal Information we have collected about you; (2) the categories of Personal Information we have collected about you; (3) the categories of sources from which the Personal Information is collected; (4) the categories of Personal Information about you that we have sold or shared and the categories of third parties to whom the Personal Information was sold or shared; (5) the categories of Personal Information about you that we disclosed for a business purpose and the categories of third parties to whom the Personal Information was disclosed for a business purpose; (6) the business or commercial purpose for collecting, disclosing, selling, or sharing Personal Information; and (7) the categories of third parties to whom we disclose Personal Information. Our response will cover the 12-month period preceding our receipt of a verifiable request unless a longer period is requested by you.

Right to Correct. If required by law, upon request, we will correct inaccuracies in your Personal Information, accounting for the nature of the personal information and the purposes for which we process the Personal Information. We will use commercially reasonable efforts to correct the inaccurate Personal Information as directed by you.

Right to Delete. You may have a legal right to request that we delete your Personal Information when it is no longer necessary for the purposes for which it was collected, or when, among other things, your Personal Information has been unlawfully processed. All deletion requests should be sent to the address noted in the Contact Us section of this Policy.

Right to Opt-Out. You may have a legal right to request that we stop selling, and for residents of California (discussed below), sharing, your Personal Information to third parties and to refrain from doing so in the future. You may also have the right to opt out of targeted advertising and profiling based on your Personal Information.

Right to Appeal. You may have a legal right to appeal our denial to act on your consumer rights under the applicable state privacy laws within a reasonable time. We will respond within designated period for responding to U.S. data subject requests and may exercise the right to extend this response period (to the extent authorized by applicable state privacy laws).

Right to Withdraw Consent. If you have provided your consent to the collection, processing, sale, and transfer of your Personal Information, you have the right to fully or partially withdraw your consent. To withdraw your consent, please notify us using the information in the Contact Us section of this Policy, and you may follow opt-out links on any marketing communications sent to you.

Once we have received notice that you have withdrawn your consent, in whole or in part, we will no longer process your Personal Information for the purpose(s) to which you originally consented and have since withdrawn unless there are compelling legitimate grounds for further processing that override your interests, rights and freedoms or for the establishment, exercise or defense of legal claims.

Withdrawal of consent to receive marketing communications will not affect the processing of Information for the provision of our services.

How to Exercise Your Rights: To request that you access, correct, or delete your Information, contact us at:

• Email: Privacy@aliya.com
• Mail: AFT Analytics, Inc., 200 Vesey Street, 24th Floor, New York, NY 10281
• Phone: 1.888.479.2739

Requests will be considered and responded to in the time period stated by applicable law. Note, certain Information may be exempt from such requests. We may require additional information from you to confirm your identity. You have the right to lodge a complaint with supervisory authorities applicable to you and your situation, although we invite you to contact us with any concern as we would be happy to try and resolve it directly.

VII. Notice to California Residents

To the extent any California data privacy law applies, this supplemental section outlines how California residents may receive their personal Information and exercise their rights. For purposes of the California Consumer Privacy Act (“CCPA”) and California Privacy Rights Act (“CPRA”), in collecting the Information described above, we collect the categories of Personal Information listed below from natural persons residing in the state of California (“consumers”). We may provide a separate notice at collection if we collect additional information or intend to use information for additional purposes.

Note: For CCPA/CPRA categories, please refer to Section I above for the detailed information we collect. Each category listed may be used as set forth in Section II(A), shared as set forth in Section II(B), and may be sold or shared to third-party advertising, analytics, and similar marketing business partners under certain circumstances as defined under CCPA and CPRA.

Data Practices During the Last 12 Months

Personal Information Collected: As described in this Policy, we have collected the categories of Personal Information listed below during the preceding 12 months:

• Identifiers
• Categories of personal information described in the California Customer Records statute
• Internet or other electronic network activity information
• Geolocation data
• Audio, electronic, visual, thermal, olfactory, or similar information
• Commercial Information
• Professional or employment-related information

Categories of Sources: We have collected the Personal Information identified in this Policy from you directly when you provide it to us, automatically as you navigate through the Services, which may include, but not be limited to, usage details, IP addresses, and information collected through cookies and other tracking technologies, and from our business partners and other third-parties, as applicable. See Section 1, above, for additional information.

Business and Commercial Purposes for Collecting: We have collected the categories of Personal Information listed above for the purposes identified in Section II(A), above.

Personal Information Sold or Shared: As described herein, we may have sold or shared the information identified above to third parties and affiliates for their own marketing purposes, including targeted advertising. Third-party advertising, analytics, and similar marketing business partners may have had access to this data and this may be considered a “sale” or “share” under the CCPA and CPRA under certain circumstances.

Sensitive Personal Information Collected: We do not collect Sensitive Personal Information for any purpose.

Sensitive Personal Information Disclosed, Sold, or Shared: We do not currently and have not disclosed, sold or shared categories of Sensitive Personal Information during the preceding 12 months.

Personal Information Disclosed for a Business Purpose. We have disclosed for a business purpose the categories of Personal Information listed below during the preceding 12 months:

• Identifiers
• Categories of personal information described in the California Customer Records statute
• Internet or other electronic network activity information
• Geolocation data
• Audio, electronic, visual, thermal, olfactory, or similar information
• Commercial Information
• Professional or employment-related information

We have disclosed each category of Personal Information as described in Section II(B) above, including to the following categories of third parties: (1) corporate parents, subsidiaries, and affiliates; (2) advisors (accountants, attorneys); (3) contractors and service providers (data analytics, data storage, mailing, marketing, website and platform administration, technical support); and (4) operating systems and platforms.

Personal Information Retention. We will retain and use the foregoing categories of personal information for an appropriate period of time as is necessary to fulfill the purposes for which the information was collected, to comply with our business requirements and legal obligations, to provide our services, resolve disputes, enforce our agreements, and other purposes to the extent provided in this California Privacy Notice. We take reasonable steps to delete personal information when (1) we have a legal obligation to do so; (2) we no longer have a purpose or obligation for retaining the information; or (3) if you ask us to delete the information unless there is an applicable exception to deleting the information under CPRA.

We are required to maintain records of consumer requests submitted under the CPRA, which may include personal information, and how we responded to such requests for at least twenty-four (24) months. Such information related to consumer requests is retained only for recordkeeping purposes.

Children: Aliya does not knowingly collect or maintain Personal Information on any minors under the age of 16. We do not knowingly sell or share Personal Information of minors under 16 years old, however, to the extent we knowingly “sell” or “share” as those terms are defined under the CCPA and the CPRA, respectively, the Personal Information of minors under 16 years old who are California residents, we either obtain prior affirmative authorization from such minor to the opt-in to the sale of the minor’s Personal Information or obtain affirmative authorization from the minor’s parent or guardian. A minor, or parent/guardian, who has opted in to the sale of the minor’s Personal information has the right to opt-out at any time. To exercise your right to opt-out see the Right to Opt-Out section below. See also the Submitting a Request and Right to Delete sections with regard to Personal Information of any minors under the age of 16.

Right to Opt-Out/Do Not Sell or Share My Personal Information or Sensitive Personal Information: Under the CCPA and CPRA, you have the right to direct us to stop selling and sharing your Personal Information to third parties and to refrain from doing so in the future. For purposes of the CCPA and the CPRA, we may sell or share the Personal Information identified above to third parties for the purpose of targeted advertising.

To the extent we sell or share your Personal Information, as those terms are defined in the CCPA and CPRA, respectively, you have the right to opt-out of the sale or sharing of your Personal Information at any time. You may submit a request to opt-out using the information in the Contact Us Section, below.

Financial Incentives: We do not offer financial incentives or any price or service difference in exchange for the retention or sale of your Personal Information.

Consumer Requests

1. Right to Know and Access to Specific Information

California residents may have the right to request that we disclose certain information to you about our collection and use of your Personal Information over the past twelve (12) months. Upon receipt of a verifiable consumer request, we will disclose:

• The categories of Personal Information we collected about you.
• The categories of sources for your Personal Information.
• Our business or commercial purpose for collecting your Personal Information.
• The categories of third parties with whom we share your Personal Information.
• If we disclosed your Personal Information for a business purpose, the Personal Information categories that each category of recipient obtained.

You may have the right to request that the Personal Information described above be provided to you in a portable and readily usable format.

2. Deletion Request Rights

You may have the right to request that we delete certain Personal Information that we collected from you, subject to certain exceptions.

We may deny your deletion request if retaining the Personal Information is necessary for us or our service providers to:

• Complete the transaction for which we collected your Information, provide a good or service that you requested, or take actions reasonably anticipated within the context of our ongoing business relationship with you.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible.
• Debug products to identify and repair errors.
• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et seq.).
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the Information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
• Enable solely internal uses reasonably aligned with consumer expectations based on your relationship with us.
• Comply with a legal obligation, as described in Section II(B) above.
• Make other internal and lawful uses of that Information that are compatible with the context in which you provided it.

3. Right to Correct

You may have a right to request the correction of certain inaccurate Personal Information collected or maintained by us. Upon receipt of a verifiable request to correct inaccurate Personal Information, we will use commercially reasonable efforts to correct the inaccurate Personal Information as directed by you, pursuant to applicable law.

Right to Limit Use and Disclosure of Sensitive Personal Information

As a California consumer, in certain circumstances, you have a right to request that use and disclosure of Sensitive Personal Information be limited to that use which is necessary to perform the services or provide the goods reasonably expected by a similarly situated consumer and as authorized in accordance with applicable law. We do not collect Sensitive Personal Information and, therefore, we include this disclosure for informational purposes only.

Exercising Your Right to Know, Right to Deletion, and Right to Correct

How to Exercise Your Rights. To exercise the rights described above, submit a verifiable consumer request by emailing Privacy@aliya.com or calling 1.888.479.2739. Only you or an authorized agent may make a verifiable consumer request related to your Information, and you may make such a request on behalf of your minor child. You may only make a verifiable consumer request for access or data portability twice within a twelve (12) month period.

The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Authorized Agent. You may use an authorized agent to submit verifiable consumer requests on your behalf. If you use an authorized agent, we will require: (1) proof of written permission for the authorized agent to make requests on your behalf and identity verification from you, or (2) proof of power of attorney pursuant to California Probate Code sections 4000 to 4665. We may deny a request from an authorized agent that does not submit proper verification proof.

Non-Discrimination.

We may not, and will not, treat you differently because of your Data Subject Request activity. As a result of your Data Subject Request activity, we may not and will not deny goods or services to you, charge different rates for goods or services, provide a different level or quality of goods or services, or suggest any of the preceding will occur. However, we can and may charge you a different rate, or provide a different level of quality, if the difference is reasonably related to the value provided by your Information.

F. Verifying Requests

To help protect your privacy and maintain security, if you request access to or deletion of your Information, we will take steps and may require you to provide certain information to verify your identity. In addition, if you ask us to provide you with specific pieces of Information, we may require you to sign a declaration under penalty of perjury that you are the consumer whose Information is the subject of the request. If you designate an authorized agent to make a request on your behalf, we may require you to provide the authorized agent with written permission to do so and to verify your own identity directly with us as described above.

G. Shine the Light Requests

California Civil Code Section 1798.83 permits you to opt out of the disclosure of your Information by us to third parties for the third parties’ direct marketing purposes. To make an opt-out request of such disclosures, email Privacy@aliya.com.

H. Additional Information

To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request. This statement is available in alternative formats upon request by contacting Privacy@aliya.com or calling 1.888.479.2739.

VIII. Notice to Residents of Nevada

We do not presently sell any personal information we collect to third parties. If we do so in the future, we will update this Policy and provide Nevada residents with the opportunity to opt out of the sale of their personal information.

IX. Children’s Online Privacy Protection Act

The Children’s Online Privacy Protection Act (“COPPA”), as well as other data privacy regulations, restrict the collection, use, or disclosure of personal information from and about children on the Internet. Our Services are not directed to children aged 13 or younger, nor is information knowingly collected from children under the age of 13. No one under the age of 13 may access, browse, or use the Services or provide any information to or on the Services. If you are under 13, please do not use or provide any information on the Services (including, for example, your name, telephone number, email address, or username). If we learn that we have collected or received personal information from a child under the age of 13 without a parent’s or legal guardian’s consent, we will take steps to stop collecting that information and delete it. If you believe we might have any information from or about a child under the age of 13, please contact us via the “Contact Us” details provided at the end of this Policy.

X. Third Party Sites and Services

This Policy only applies to the Services, and it does not apply to any third-party websites or applications.

The Services may contain links to, or media and other content from, third-party websites. These links are to external websites and third parties that have their own privacy policies. If you follow any links that direct you away from the Services, including links to social media sites or to other websites, this Policy will not apply to your activity on the other sites you visit. Because of the dynamic media capabilities of the Services, it may not be clear to you which links are to the Services and which are to external, third party websites. If you click on an embedded third-party link, you will be redirected away from the Services to the external third-party website. You can check the URL to confirm that you have left the Services.

We cannot not (i) guarantee the adequacy of the privacy and security practices employed by or the content and media provided by any third parties or their websites, (ii) control the privacy policies or the privacy practices of any third parties regarding their independent collection or use or your personal information, or (iii) endorse any third party information, products, services or websites that may be reached through embedded links on the Services.

Any Information provided by you or automatically collected from you by a third party will be governed by that party’s privacy policy and terms of use. If you are unsure whether a website is controlled, affiliated, or managed by us, you should review the privacy policy and practices applicable to each linked website.

XI. Changes to This Privacy Policy

We reserve the right to change, modify, or amend this Policy at any time to reflect changes in our products and service offerings, accommodate new technologies, regulatory requirements, or other purposes. If we modify our Policy, we will update the Effective Date and such changes will be effective upon posting. If you provide us an email address, we will provide any updated Policy to you and include an option to opt out of future emails. It is your obligation to check our current Policy for changes.

XII. Contact Us