PRIVACY STATEMENT-CALIFORNIA

PRIVACY NOTICE FOR CALIFORNIA RESIDENTS
Effective Date: December 24, 2025

This Privacy Notice for California Residents supplements the information contained in the Privacy Policy of Convenient Payments, LLC dba IntelliPay and its subsidiaries (collectively, "we," "us," or "our") and applies solely to visitors, users, and others who reside in the State of California ("consumers" or "you"). We adopt this notice to comply with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (together, the "CCPA"), and the regulations issued by the California Attorney General and the California Privacy Protection Agency. Any terms defined in the CCPA have the same meaning when used in this notice.

If there is any conflict between this California notice and our main Privacy Policy, this notice controls for California residents to the extent of the conflict.

We use certain third-party advertising and analytics cookies and similar technologies that may constitute "sharing" personal information for cross-context behavioral advertising under the CCPA. However, we do not "sell" personal information for monetary consideration. We only use sensitive personal information ("SPI") as necessary to provide our services and comply with law; we do not use SPI to infer characteristics about you or for profiling, marketing, or advertising.

1. Information We Collect

We collect information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household ("personal information"). We have collected the following categories of personal information from consumers within the last twelve (12) months:

Sensitive Personal Information

Under the CCPA, sensitive personal information ("SPI") includes: Social Security, driver's license, state ID, or passport numbers; account log-in credentials combined with required security codes; financial account, debit, or credit card numbers with security codes; precise geolocation; racial or ethnic origin; religious or philosophical beliefs; union membership; contents of mail, email, or text messages (unless we are the intended recipient); genetic data; biometric information for identification purposes; health information; and information concerning sex life or sexual orientation.

We may collect the following SPI:

• Government identifiers (e.g., Social Security number, driver's license, state ID, passport) for underwriting, identity verification, sanctions screening, and fraud prevention.
• Full payment card and bank account details and related security data for transaction processing, settlement, refunds, and chargeback handling.

We only use and disclose SPI as reasonably necessary and proportionate to: provide requested services; prevent, detect, and investigate security incidents and fraud; verify or maintain the quality and safety of our services; and comply with laws, regulations, and card-network rules. We do not use SPI to infer characteristics about you or for advertising, marketing, or profiling. Accordingly, we do not offer a separate "Limit the Use of My Sensitive Personal Information" control beyond these necessary uses.

What Is Not Personal Information

Personal information does not include:

• Publicly available information from government records.
• De-identified or aggregated consumer information.
• Information excluded from the CCPA's scope, such as health or medical information covered by HIPAA or CMIA, and personal information covered by GLBA, FCRA, or DPPA.

2. Sources of Personal Information

We obtain the categories of personal information described above from the following sources:

• Directly from you, our clients, or their agents: For example, from applications, onboarding forms, or documents our clients provide to us related to the services for which they engage us.
• Indirectly from you: For example, from observing your actions on our websites or within our applications using logs, cookies, and similar technologies.
• Third parties: For example, identity verification providers, credit bureaus, fraud-prevention tools, card networks, issuing banks, and other service providers that support our payment processing activities.

3. Use of Personal Information

We may use or disclose the personal information we collect for one or more of the following business or commercial purposes:

• To fulfill or meet the reason you provided the information (for example, to process a transaction, onboard a merchant, or respond to a support request).
• To provide, operate, maintain, support, personalize, and develop our websites, products, and services.
• To create, maintain, customize, and secure your account with us.
• To process your requests, purchases, transactions, and payments and to detect, prevent, and mitigate fraud, security incidents, or other malicious or illegal activities.
• To provide you with support and respond to inquiries, including to investigate and address concerns and to monitor and improve our responses.
• To personalize your website experience and deliver content, product, and service offerings, including certain marketing communications and online advertising (subject to your choices and applicable law).
• To help maintain the safety, security, and integrity of our websites, products and services, databases and other technology assets, and our business.
• For testing, research, analysis, and product development, including to develop and improve our websites, products, and services.
• To comply with laws, regulations, card-brand rules, and other legal obligations, and to respond to law enforcement requests, court orders, subpoenas, or similar legal processes.
• To enforce our terms and conditions, protect our operations, or protect our rights, privacy, safety, or property, and/or that of you or others.
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets.

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

4. Disclosure of Personal Information

We may disclose your personal information to the following categories of third parties for a business purpose:

• Service providers: Companies that perform services on our behalf, such as payment processors, data hosting providers, customer support platforms, identity verification services, fraud prevention services, and analytics providers.
• Business partners: Card networks, issuing and acquiring banks, and other financial institutions necessary to process transactions.
• Affiliates and subsidiaries: Entities under common ownership or control with us.
• Professional advisors: Attorneys, accountants, auditors, and consultants.
• Government and law enforcement: As required by law, regulation, court order, or legal process.
• Parties to business transactions: In connection with a merger, acquisition, asset sale, or similar corporate transaction.

Sharing for Cross-Context Behavioral Advertising

We use certain third-party advertising and analytics cookies and similar technologies (such as pixels and tags) that may constitute "sharing" of personal information for cross-context behavioral advertising under the CCPA. The categories of personal information we may share in this manner include: identifiers (such as IP address, device ID, and cookie identifiers) and internet or network activity information. We share this information with advertising networks and analytics providers.

No Sale of Personal Information

We do not sell personal information for monetary or other valuable consideration as defined under the CCPA.

5. Retention of Personal Information

We retain personal information for as long as reasonably necessary to:

• Provide our services and fulfill the purposes for which the information was collected;
• Maintain business records for analysis, financial reporting, and audit purposes;
• Comply with legal, regulatory, and card-network record-keeping requirements;
• Resolve disputes and enforce our agreements; and
• Protect against fraud, chargebacks, and legal claims.

Retention periods vary depending on the type of information and the purpose for which it was collected. For example, transaction records are typically retained for at least seven (7) years to comply with applicable laws and card-brand rules. When personal information is no longer needed for any of these purposes, we securely delete or anonymize it.

6. Your California Privacy Rights

If you are a California resident, you have the following rights under the CCPA:

Right to Know

You have the right to request that we disclose to you:

• The categories of personal information we have collected about you;
• The categories of sources from which the personal information was collected;
• Our business or commercial purpose for collecting or sharing personal information;
• The categories of third parties with whom we share personal information; and
• The specific pieces of personal information we have collected about you.

Right to Delete

You have the right to request that we delete personal information we have collected from you, subject to certain exceptions. We may deny your deletion request if retaining the information is necessary for us or our service providers to:

• Complete the transaction for which we collected the personal information;
• Provide a good or service you requested, or perform a contract with you;
• Detect security incidents, protect against malicious or fraudulent activity, or prosecute those responsible;
• Debug products to identify and repair errors;
• Exercise free speech or another legal right;
• Comply with the California Electronic Communications Privacy Act;
• Engage in research in the public interest (with your consent);
• Enable solely internal uses reasonably aligned with your expectations;
• Comply with a legal obligation; or
• Make other lawful internal uses compatible with the context in which you provided the information.

Right to Correct

You have the right to request that we correct inaccurate personal information we maintain about you, taking into account the nature and purposes of the processing.

Right to Opt-Out of Sharing

You have the right to opt out of the "sharing" of your personal information for cross-context behavioral advertising. To exercise this right, you may:

• Click the "Do Not Sell or Share My Personal Information" link on our website;
• Enable a recognized opt-out preference signal (such as the Global Privacy Control) in your browser; or
• Submit a request using the contact methods below.

Because we do not sell personal information, there is no separate "Do Not Sell" opt-out.

Right to Limit Use of Sensitive Personal Information

We only use sensitive personal information for purposes permitted under the CCPA (providing services, preventing fraud, ensuring security, and complying with legal requirements). We do not use SPI for profiling, marketing, or advertising. Therefore, we do not offer a separate "Limit the Use of My Sensitive Personal Information" mechanism.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you goods or services;
• Charge you different prices or rates for goods or services;
• Provide you a different level or quality of goods or services; or
• Suggest that you may receive a different price or rate or different level or quality of goods or services.

7. How to Exercise Your Rights

To exercise any of the rights described above, please submit a verifiable consumer request to us by:

• Online form: www.intellipay.com/privacy-request
• Email: privacy@intellipay.com
• Toll-free phone: 1-855-872-6632
• Mail: Convenient Payments, LLC dba IntelliPay, Attn: Privacy Team, 12884 S Frontrunner Blvd., Suite 220, Draper, UT 84020

Only you, or a person you have authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

You may make a verifiable consumer request for access or data portability no more than twice within a 12-month period.

Verification Process

We must verify your identity before fulfilling your request. To verify your identity, we may ask you to:

• Provide information that matches the personal information we already have on file (such as name, email address, phone number, or account details); and/or
• Provide additional documentation or information to confirm your identity.

We will match the information you provide against information we maintain. If we cannot verify your identity to a reasonable degree of certainty, we will notify you and explain why we cannot fulfill your request.

For requests to access specific pieces of personal information or to delete sensitive information, we apply a higher standard of verification and may request additional documentation.

Authorized Agents

You may designate an authorized agent to make a request on your behalf. To do so, you must:

• Provide the authorized agent with written permission signed by you; and
• Verify your own identity directly with us.

Alternatively, you may provide your authorized agent with a power of attorney pursuant to California Probate Code sections 4000–4465.

We may deny a request from an authorized agent if the agent does not submit proof of authorization or if we cannot verify the agent's authority.

Response Timing

We will confirm receipt of your request within 10 business days and provide information about how we will process the request. We will respond to a verifiable consumer request within 45 calendar days of its receipt. If we require additional time (up to an additional 45 days), we will inform you of the reason and extension period in writing.

8. Do Not Sell or Share My Personal Information

As described above, we do not "sell" personal information for monetary consideration. However, our use of certain cookies and similar technologies for cross-context behavioral advertising may constitute "sharing" under the CCPA.

To opt out of sharing:

• Click the "Do Not Sell or Share My Personal Information" link in our website footer;
• Enable a recognized opt-out preference signal (such as the Global Privacy Control) in your browser—we honor such signals as valid opt-out requests; or
• Contact us using the methods in Section 7 above.

When you opt out, we will stop sharing your personal information with third parties for cross-context behavioral advertising purposes. Note that opting out does not prevent all advertising; you may still see non-personalized ads.

9. Financial Incentives

We do not currently offer financial incentives, price differences, or service differences in exchange for the retention, sale, or sharing of personal information.

If we offer any such programs in the future, we will provide you with a separate notice describing the material terms, how to opt in, and how to withdraw at any time.

10. California "Shine the Light" Disclosure

Under California Civil Code Section 1798.83 ("Shine the Light" law), California residents may request information regarding the disclosure of their personal information to third parties for direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes without your consent. If you have questions about this practice, please contact us using the information below.

11. Changes to This Notice

We reserve the right to amend this Privacy Notice for California Residents at our discretion and at any time. When we make material changes, we will post the updated notice on our website and update the "Effective Date" at the top of this page. Your continued use of our services after any changes indicates your acceptance of the updated notice.

12. Contact Us

If you have any questions or comments about this notice, the ways in which we collect and use your personal information, your choices and rights regarding such use, or if you wish to exercise your rights under California law, please contact us:

Convenient Payments, LLC dba IntelliPay
Attn: Privacy Team
12884 S Frontrunner Blvd., Suite 220
Draper, UT 84020

Email: privacy@intellipay.com
Phone: 1-855-872-6632
Online: www.intellipay.com/privacy-request

This Privacy Notice for California Residents was last updated on December 24, 2025.