Guardcard Data Subject Request Form # Guardcard Data Subject Request Form

Polis Grove Inc. (“Guardcard,” “we,” “us,” or “our”) values your privacy rights. As required under applicable law, including the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (collectively “CCPA”), the Virginia Consumer Data Protection Act of 2021 (“VCDPA”), the Colorado Consumer Protection Act (“CPA”), the Connecticut Data Privacy Act (“CTDPA”), and the Utah Consumer Privacy Act ("UCPA") (collectively “Data Protection Laws”), individual consumers are permitted to make certain requests and exercise certain rights regarding their Personal Data or Personal Information (as defined under the applicable Data Protection Laws) depending on their jurisdiction.

To submit a request to exercise individual rights under the Data Protection Laws, please complete this form and send it to: support@guardcard.co.

Upon receipt of your completed request, we will process it and respond within the timelines required under applicable Data Protection Laws. If additional information is necessary, we will contact you using the contact information you provided in this form. Information provided in connection with this request will be processed only for the purpose of processing and responding to your request and will be deleted immediately thereafter. For more information, please review our Privacy Policy.

1. Contact Information:

Full Name:
Email Address:
If applicable, US State:

2. What is Your Relationship with Us?

• ☐ Merchant
• ☐ End-User
• ☐ Prospect/Website Visitor
• ☐ Vendor
• ☐ Other: **__**

3. Your Request:

Below are the rights and requests you may submit depending on your residence. Please check the applicable right you are requesting to execute.

A. California:

Note: Under the CCPA, your rights only apply to Personal Information collected 12 months prior to the request, and you are not entitled to submit more than 2 requests in a 12-month period.
Please check the applicable right you are requesting to execute:

• ☐ Right to Know or Access
• ☐ Right to Deletion
• ☐ Right to Data Portability
• ☐ Right to Non-Discrimination
• ☐ Right to Rectification
• ☐ Right to Limit the Use and Disclosure of Sensitive Personal Information
• ☐ Right to Opt-Out of Sale
• ☐ Right to Opt-Out of Share for Cross-Contextual Behavioral Advertising
• ☐ Opt-Out of the Use of Automated Decision Making

CCPA Opt-Out Rights:

You can execute certain opt-out rights without filling the form:

• Through Device-Level Choices: Limit the collection of certain information through your device settings if you do not want to receive interest-based advertisements.
• Use Global Privacy Control (“GPC”) signals.

Opting out of interest-based advertising does not mean that you will not receive any advertising. You may still receive ads that may be less relevant to your interests.

Authorized Agency:
An authorized agency can submit the request on your behalf, as detailed in the CCPA Notice available here.

We will aim to complete CCPA verifiable consumer requests as soon as reasonably practicable within the 45-day timeframe mandated by the CCPA. If additional time is needed, we will inform you in writing of the reason and extension period. Our ability to uphold these rights may depend on our obligations to process Personal Information for security, safety, fraud prevention, regulatory compliance, or service delivery. We will inform you of specific details if we cannot fulfill your request.

B. Virginia:

• ☐ Right to Confirm if the Data is Being Processed and to Access That Personal Data
• ☐ Right to Deletion
• ☐ Right to Data Portability
• ☐ Right to Correct Inaccuracies
• ☐ Right to Opt-Out of the Processing of Personal Data for Targeted Advertising, Sale of Personal Data, or Profiling in Furtherance of Decisions that Produce Legal or Similarly Significant Effects Concerning the Consumer
• ☐ Other

Opt-out rights can be executed without filling this form as detailed under "California".

We will complete all VCDPA authenticated consumer requests as soon as reasonably practicable within the 45-day timeframe mandated by the VCDPA. If we need additional information to authenticate your request, we may request it. If we refuse to take action on a request, you may appeal our decision within a reasonable time by contacting us. We will respond within 60 days of receipt of your appeal. If the appeal is denied, you may submit a complaint to the Virginia Attorney General at https://www.oag.state.va.us/consumercomplaintform.

C. Colorado:

• ☐ Right of Access
• ☐ Right to Correction
• ☐ Right to Deletion of Personal Data
• ☐ Right to Data Portability – to obtain a portable copy of the data
• ☐ Right to Opt-Out of the Processing of Personal Data for Targeted Advertising, Sale of Personal Data, or Profiling used for decisions that produce legal or similarly significant effects on a consumer
• ☐ Other

Opt-out rights can be executed without filling this form as detailed under "California".

We will complete CPA consumer requests as soon as reasonably practicable within the 45-day timeframe mandated by the CPA. We reserve the right to extend the response time by an additional 45 days if necessary. If we refuse to act on your request, you may appeal within a reasonable period. We will respond within 60 days of receipt of your appeal. You may contact the Colorado Attorney General if you have concerns about the appeal at https://coag.gov/filecomplaint/.

D. Connecticut:

• ☐ Right to Confirm if the Data is Being Processed
• ☐ Right to Correction
• ☐ Right to Deletion of Personal Data
• ☐ Right to Data Portability – to obtain a portable copy of the data
• ☐ Right to Opt-Out of the Processing of Personal Data for Targeted Advertising, Sale of Personal Data, or Profiling used for decisions that produce legal or similarly significant effects on a consumer
• ☐ Other

Where consent is required and subsequently revoked, we will cease processing the applicable data as soon as practicable, but not later than fifteen days after receipt of your request.

Opt-Out Right and Authorized Agency:
Opt-out rights can be executed without filling this form as detailed under "California". For Connecticut's consumers, universal opt-out mechanisms will be recognized starting January 1, 2025.

We will respond to your requests within 45 days. This period may be extended by an additional 45 days if necessary. If we decline your request, we will inform you within 45 days and provide a justification. Appeals must be addressed within 60 days. If denied, you may submit a complaint to the Connecticut Attorney General at https://www.dir.ct.gov/ag/complaint/ or (860) 808-5318.

E. Utah (Effective January 2024):

• ☐ Right to Confirm if the Data is Being Processed
• ☐ Right to Access
• ☐ Right to Deletion of Personal Data
• ☐ Right to Data Portability – to obtain a portable copy of the data
• ☐ Right to Opt-Out of the Processing of Personal Data for Targeted Advertising or Sale of Personal Data
• ☐ Other

Opt-out rights can be executed without filling this form as detailed under "California".

We will respond to your UCPA requests within 45 days. This period may be extended by an additional 45 days if necessary. If we decline your request, we will inform you within 45 days and provide a justification.

F. Notice:

Deletion rights under US data protection regulations are not absolute. We may deny your deletion request, in full or in part, if retaining the information is necessary for us or our service providers for reasons including but not limited to:

• Completing the transaction for which the data was collected or providing a service you requested.
• Detecting security incidents or protecting against malicious activity.
• Debugging products to identify and repair errors.
• Complying with legal obligations.
• Engaging in public or scientific research that adheres to ethical and privacy laws.
• Making internal uses aligned with consumer expectations based on our relationship.
• Any other lawful uses compatible with the context in which the data was provided.

We will delete or de-identify personal information not subject to one of these exceptions and will direct our processors to take similar action.

4. Validation

To process your request, we need enough information to verify your identity. We cannot respond if we cannot verify your identity or authority to make the request.

Please describe your request with sufficient detail:
Thank you for filling in the form. Please send it to: support@guardcard.co. We will process your request within the time frame under the applicable Data Protection Law. We reserve the right to extend the period if the request is complex or numerous or if we require additional information