Consumer Data Privacy Policy

VGM GROUP, INC.

CONSUMER DATA PRIVACY POLICY

This Consumer Data Privacy Policy applies to VGM Group, Inc. consumers whose data is subject to Data Privacy Laws as defined below. It applies whenever you visit our websites, including www.vgm.com, www.vgmgroup.com, www.vgmhomelink.com, www.vgminsurance.com, or any other website of one of VGM’s divisions or subsidiaries (“Sites”), or use any of our products or services that link to or otherwise reference this policy. The following policy describes what information VGM Group, Inc. (“VGM” or “We” or “Us”) collects that is subject to Data Privacy Laws, your rights under Data Privacy Laws, and how you can enforce your rights under Data Privacy Laws.

Definitions

Consumer: A consumer is a natural person who is a resident of a state with a Data Privacy Law, living in a state with a Data Privacy Law for other than a temporary or transitory purpose, or an individual domiciled in a state with a Data Privacy Law.

Data Privacy Laws: All applicable federal, state, and foreign laws, rules, regulations, and guidance (and any implementing legislation or regulations thereunder as amended) pertaining to consumer data privacy.

Personal Information (“PI”): Information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal Information does not include:

Publicly available information lawfully made available from government records.
Deidentified or aggregated consumer information that cannot be reasonably linked to an individual.
Information excluded from Data Privacy Laws, like:
- Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), the Health Information Technology for Economic and Clinical Health (HITECH) Act, health or medical information covered by applicable state privacy and/or confidential laws or regulations, or clinical trial data; and
- Personal Information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (“FCRA”), and the Gramm-Leach-Bliley Act (“GLBA”) or applicable state financial confidentiality laws and regulations.

Note: If certain types of information are excluded from Data Privacy Laws this policy will not apply to such excluded data.

Sensitive Personal Information (“SPI”): is a subset of PI which includes, but may not be limited to:

Government identification numbers, such as social security numbers, driver’s license numbers, state identification, numbers, or passport numbers;
Account log-in information;
Financial account, credit or debit card numbers, combined with a password, PIN, or other required security or access codes;
Precise geolocation;
Racial or ethnic origin, religious or philosophical beliefs, or union membership;
Content of postal mail, email, or text messages, unless VGM is the intended recipient of those communications;
Biometric data that uniquely identifies an individual;
Information concerning an individual's health, sex life, sexual orientation or gender identity;
Genetic data;
Neural data;
Citizenship or immigration status; and
PI of consumers that VGM has actual knowledge are less than 18 years of age.

Information We Collect

VGM has collected the following categories of PI, including Sensitive PI, from its consumers within the last twelve (12) months:

Category	Examples	Collected?
Identifiers	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, account name, social security number, driver's license number, passport number, mobile device information (e.g., device model, operating system version, device date and time, unique device identifiers, mobile network information, etc.), or other similar identifiers.	YES
B. Personal Information categories listed in Data Privacy Laws	Information that is protected against security breaches such as: name, signature, social security number, physical characteristics or description, address, telephone or mobile device number, passport number, driver's license or other state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some PI included in this category may overlap with other categories and may not be subject to all the rights under Data Privacy Laws.	YES
C. Protected classification characteristics under Data Privacy Laws	Age, race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, and genetic information (including familial genetic information).	YES
D. Commercial information	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. Media information (e.g., advertising engagement in social, digital, and broadcast media, etc.).	YES

Category	Examples	Collected?
E. Biometric information	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.	YES
F. Internet or other similar network activity	Use of a Site, including browsing history, search terms and history, and information on a consumer's interaction with a Site (i.e., pages visited), application, or advertisement.	YES
G. Geolocation data	Physical location or movements.	YES
H. Professional or employment-related information	Current or past job history or performance evaluations.	YES
I. Sensitive PI	As defined above.	YES

We generally do not collect additional categories of PI or use the PI we collected for significantly different or meaningfully unrelated purposes without providing you notice.

Where We Obtain Personal Information

We obtain the categories of PI listed above from the following categories of sources:

Directly from you or your devices. For example, from forms or surveys you complete on one of our Sites or one of our service provider’s Sites.
Indirectly from you. For example, from observing your actions on one of our Sites (i.e., cookies).
Automated sources, such as analytics.
Third-party sources (including social media).
Embedded content from other websites and links to third-party websites.
Other users of our services.
VGM divisions and business units.
Internet service providers and other online sources.
State and federal governmental entities.
Operating systems and platforms.
Business partners (i.e., service providers). For example, insurance companies or providers.
Publicly accessible sources.

Use of Personal Information

We may use or disclose the PI we collect for one or more of the following business purposes:

Fulfilling or meeting the reason you provided the information for a business purpose.
Providing you with information, products, or services that you request from VGM, including responses to your inquiries and to notify winners of any promotions.
Contracting with service providers to perform services on our behalf, including but not limited to maintaining or servicing accounts, providing customer service, processing, or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on our behalf.
Otherwise enabling or affecting, directly or indirectly, a business or commercial transaction.
To improve our Sites.
To monitor and analyze trends, usage, and activities in connection with our Sites.
To personalize our Sites and show you content that’s relevant to you.
Survey, test, research, analyze, and product and service development.
Providing you with email alerts, event registrations and other notices concerning VGM’s services, or news that may be of interest to you.
Sending you SMS text messages or push notifications. Phone Carriers: Your phone number and consent to receive SMS text messages or push notifications will not be shared with third parties or affiliates. See VGM SMS Text Messaging Terms of Service for additional information.
Cell Phone Carriers: Your phone number and SMS consent to receive SMS text messages or push notifications will not be shared with third parties or affiliates.
Facilitating the connection of third-party services or applications, such as social medica.
Marketing purposes, such as developing and providing promotional and advertising materials that may be useful, relevant, valuable, or otherwise of interest to you.
Facilitating transactions and payments.
De-identifying and aggregating information collected through our services and using it for any lawful purpose.
Responding to trust and safety issues that may arise as necessary or appropriate to protect the rights, property, or safety of VGM, our employees, our customers, or others.
For automated decision making, including email segmentation and message personalization.
Carrying out our obligations and enforcing our rights arising from any contracts or other terms entered into between you and VGM, including billing, or as may be required by applicable laws and regulations or requested by any judicial process or governmental agency.
Auditing related to a current interaction with you and concurrent transactions, and auditing compliance with this specification and other standards.
Undertaking activities to verify or maintain the quality or safety of our services, and to improve, upgrade, or enhance our services.
Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.
Debugging to identify and repair errors that impair existing intended functionality.
Short-term, transient use.
To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
For other purposes with your consent for which we provide specific notice at the time the information is collected.
As described to you when collecting your PI or as otherwise set forth in Data Privacy Laws.

Sharing or Sale of Personal Information (PI)

VGM may disclose your PI to a third party for a business purpose. When we disclose PI for a business purpose, we enter into a contract that describes the purpose and requires the recipient to both keep that PI confidential and not use it for any purpose except performing the contract.

In the preceding twelve (12) months, VGM has disclosed the following categories of PI for a business purpose:

Category A: Identifiers

Category B: Customer records

Category C: Protected classification characteristics under applicable laws and regulations

Category D: Commercial information

Category E: Biometric information

Category F: Internet history

Category G: Geolocation data

Category I: Professional or employment-related information

Category L: Sensitive personal information

In the preceding twelve (12) months, VGM has not disclosed PI for commercial purposes that constitutes “selling” or “sharing” under the applicable Data Privacy Laws.

Pursuant to VGM’s Consumer Privacy Policy, we may disclose your information with the following categories of third parties for a business purpose:

Advertising Providers: Advertising technology companies, such as advertising networks.
ISPs: Internet service providers.
Analytics Vendors.
Government: State or federal governmental entities.
OS/Platform Provider: Operating systems and platforms.
Social Media.
Vendors: Service providers.
Integrated Third Parties: Third parties integrated into our services.
Cell Phone Carriers: Your phone number and consent to receive SMS text messages or push notifications will not be shared.
Third Parties as Legally Required: Third parties as required by applicable laws and regulations and similar disclosures.
Third Parties in Merger/Acquisition: Third parties in connection with a merger, sale, or asset transfer.
Third Parties with Consent: Other third parties for whom we have obtained your permission to disclose your PI.

Notice of Right to Opt-Out of the Selling and Sharing of Your Information

You have the right to tell us NOT to sell or share your PI. You have the full and free right to opt-out of our disclosure of your PI to any third parties where the disclosure constitutes "selling" or "sharing" as defined by the CCPA. You may exercise your right to opt-out without fear of discrimination for doing so. To opt-out of our selling or sharing of your information, meaning we will not disclose your information to third parties for any monetary or other valuable consideration, you can do any of the following:

Visit VGM's website at: Consumer Data Privacy Policy | VGM Group or www.vgmgroup.com/privacy-policy. Click on "Your Privacy Choices" at the bottom of the page to be taken to an online submission form and opting out of optional cookies.
You can use a Global Privacy Controls (GPC) signal. VGM will process opt-out preferences from GPC signals, which are in formats commonly used and recognized by businesses, such as an HTTP field header, as requests to opt-out of sale or sharing. The GPC signal opt-out will only apply to the browser you are using on your device; it will not apply to other browsers and/or devices to which GPCs are not activated or to offline sales. We will display your opt-out preference signal in the cookie banner and cookie preference center.
If you are unable to submit an opt-out through any of the above methods, please call our toll-free privacy line at 1-877-474-3227 for assistance and a representative will assist in meeting your needs.

You can have an authorized agent submit a request on your behalf. To submit an opt-out through use of an authorized agent, you must provide that agent with written permission signed by you to submit an opt-out on your behalf, except when using an opt-out preference signal. The authorized agent may call our toll-free privacy line at 1-877-474-3227 to make the opt-out request and for directions for submitting the proof of authorization and the authorized agent's proof of identification to VGM. We maintain the right to deny any request from an authorized agent that does not submit sufficient proof that they have been authorized by you to act on your behalf.

A request to opt-out need not be a verifiable consumer request. However, we may deny a request to opt-out if we have a good faith, reasonable, and documented belief that a request to opt-out is fraudulent. If we deny your request to opt-out, we shall inform you of our decision not to comply and provide an explanation as to why we believe the request is fraudulent.

We do NOT and will not use or disclose your SPI for any purposes that five rise to a right to limit the use or disclosure of your SPI under the California Consumer Privacy Act (CCPA), if it applies and you are a California resident.

Your Privacy Rights and Choices

Depending on your state of residence, certain Data Privacy Laws may provide you with specific rights regarding your PI. This section describes those rights generally provided and explains how to exercise those rights.

Right	To Exercise This Right	Time Frame and Response From VGM	If We Cannot Complete Your Request
Access to specific information and the categories of sources and purposes for collection, use, disclosure, and sale since January 1, 2022, after verification of your identity.	Submit your request and confirm your "verifiable consumer request" via the contact information below.	We will evaluate and respond to your request by a toll-free telephone number, webform, email, or by mail within 45 days. If we require more time, we will inform you of the reason and extension period in writing. Once we confirm your verifiable consumer request, we will provide you access to your specific information and the categories of sources and purposes for collection, use, disclosure, and sales (and direct VGM’s service providers to do the same) of your personal information.	We will explain the reasons we cannot comply with a request in our response.
Deletion of information. You have the right to request that VGM delete your PI, subject to certain exceptions and after verification of your identity.	Submit your request and confirm your "verifiable consumer request" via the contact information below.	We will evaluate and respond to your request by a toll-free telephone number, webform, email, or by mail within 45 days. If we require more time, we will inform you of the reason and extension period in writing. Once we confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your PI from our records, unless an exception applies.	We will explain the reasons we cannot comply with a request in our response. The law does not require us to honor requests to delete where it is necessary in certain circumstances for us or a service provider to maintain Personal Information. These include: Provide a good or service, perform our contract or take action reasonably anticipated in the context of our ongoing relationship with you. Detect and protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities. Debug products to identify and repair errors that impair existing intended functionality. Exercise and/or support free speech provided for by law. Engage in research for which you provided informed consented that complies with applicable laws when deletion will seriously impair the research. Use internally for purposes aligned with your expectations and our relationship. Comply with a legal obligation or make other lawful use compatible with the context in which information was provided.
Opt-out of the "sale" or “sharing” of PI in some circumstances.	Submit your request and confirm your "verifiable consumer request" via the contact information below.	We will evaluate and respond to your request by a toll-free telephone number, webform, email, or by mail within 45 days. If we require more time, we will inform you of the reason and extension period in writing.	We will explain the reasons we cannot comply with a request in our response.
Correction of PI You have the right to have VGM correct errors in the PI it maintains about you.	Submit your request and confirm your "verifiable consumer request" via the contact information below.	We will evaluate and respond to your request by a toll-free telephone number, webform, email, or by mail within 45 days. If we require more time, we will inform you of the reason and extension period in writing. Once we confirm your verifiable consumer request, we will correct (and direct our service providers to correct) your PI in our records, unless an exception applies.	We will explain the reasons we cannot comply with a request in our response.
Limit use and disclosure of SPI in some circumstances	Submit your request and confirm your "verifiable consumer request" via the contact information below.	We will evaluate and respond to your request a toll-free telephone number, webform, email, or by mail within 15 business days. If we require more time, we will inform you of the reason and extension period in writing. Once we confirm your verifiable consumer request, we will limit use and disclosure of your sensitive information (and direct our service providers to do the same).	We will explain the reasons we cannot comply with a request in our response.
Withdraw Consent You have the right to withdraw consent where processing is based on content.	Submit your request and confirm your "verifiable consumer request" via the contact information below.	We will evaluate and respond to your request by a toll-free telephone number, webform, email, or mail within 45 days. If we require more time, we will inform you of the reason and extension period in writing. Once we confirm your verifiable consumer request, we will correct (and direct our service providers to correct) your PI in our records, unless an exception applies.	We will explain the reasons we cannot comply with a request in our response.
Data Portability	Request a copy of PI you previously provided to us in a portable and, where technically feasible, readily useable format.	We will evaluate and respond to your request by a toll-free telephone number, webform, email, or mail within 45 days. If we require more time, we will inform you of the reason and extension period in writing. Once we confirm your verifiable consumer request, we will correct (and direct our service providers to correct) your PI in our records, unless an exception applies.	We will explain the reasons we cannot comply with a request in our response.

"Verifiable Consumer Request”

To exercise your rights to access or delete your PI under applicable Data Privacy Laws, you must submit a “verifiable consumer request.” Only you, or a person authorized by you to act on your behalf, may make a verifiable consumer request related to your PI. You may also make a verifiable consumer request on behalf of your minor child.

A verifiable consumer request must:

Provide sufficient information that allows us to reasonably verify you are the person about whom we collected PI or an authorized representative of such a person.
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

If we cannot verify your identity or authority to make the request, we will not be able to fulfill your request. The information provided for verification will only be used for that purpose.

Authorizing an Agent

Where permitted by applicable law, you may designate an authorized agent to submit a request on your behalf. To authorize an agent to make a request to know or delete on your behalf, please write to the contact address below. To authorize an agent to make an opt-out request on your behalf, please send a written authorization signed by you and the authorized agent to us via the Contact Information section below.

Parents, legal guardians, conservators, and other legally authorized representatives may exercise privacy rights on behalf of individuals as permitted by law.

Processing Fees

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Personal Information Sales Opt-Out and Opt-In Rights

In some circumstances, you may opt out of the sale of your PI.

Generally, we will not sell or share the PI of consumers if we have actual knowledge that the consumer is less than 18 years of age, unless the consumer's parent or guardian has affirmatively authorized the sale or sharing of the consumer's PI. For residents of Washington, we will not sell or share the PI of consumers if we have actual knowledge that the consumer is less than 18 years of age, unless the consumer, in the case of a consumer at least 13 years of age or the consumer’s parent or guardian, in the case of consumers who are less than 13 years of age, has affirmatively authorized the sale or sharing of the consumer’s PI. For residents of Maryland, we will not sell or share the PI of consumers if we have actual knowledge that the consumer is less than 18 years of age.
To exercise the right to opt-out, you (or your authorized representative) may submit a request to us by writing using the Contact Information below or by visiting the Data Request tab.
Once you make an opt-out request, we will wait at least twelve (12) months before asking you to reauthorize the sale of your PI.
However, you may change your mind and opt back into PI sales at any time by visiting our Site and sending us a message. We will only use PI provided in an opt-out request to review and comply with the request.

Appeals Process for Denied Requests

Consumer may submit an appeal for any denied request to the contact information below. We will review and respond to your request within 45 calendar days after receipt.

Retention of Personal Information (PI)

We will retain each category of Personal Information for as long as we continue to have a legal or business need to retain it consistent with the purposes for which the information was collected. Your Personal Information may be stored or maintained in a variety of different records, files, databases, and information systems, some of which are controlled or managed by vendors. As a result, we are unable to predict at the point of collection of your information how long the information will be retained, as it depends on many factors. In deciding how long to retain each category of Personal Information that we collect, we consider many criteria, including, but not limited to: the business purposes for which the Personal Information was collected; relevant federal, state, and local recordkeeping laws; applicable statute of limitations for claims to which the information may be relevant; and legal preservation of evidence obligations.

Because the law prescribes minimum periods for retention of certain records, some records will be retained for at least the duration of the required period plus a certain number of years. Retention is often measured from occurrence of a triggering event but we may also measure the retention period from either (1) the date the record or data was collected, created, or last modified, (2) the date of the particular transaction to which the record or data pertains, or (3) another triggering event that is determined to be reasonable and appropriate based on the nature of the data and the legal/business needs for its continued use.

If the business purposes for collecting the Personal Information, and legal reasons for retaining the Personal Information, have both expired, we will purge the information in a secure manner.

Non-Discrimination

We will not discriminate against you for exercising any of your Data Privacy Law rights. Unless permitted by applicable Data Privacy Laws, we will not:

Deny you goods or services.
Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
Provide you a different level or quality of goods or services.
Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

You also have the right not to receive discriminatory treatment by VGM for the exercise of privacy rights conferred by any applicable Data Privacy Laws, including an employee’s, applicant’s, or independent contractor’s right not to be retaliated against for the exercise of applicable Data Privacy Laws.

We may offer you certain financial incentives such as discounted prices, rates, or quality levels. Any permitted financial incentive we offer will reasonably relate to your PI’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.

Artificial Intelligence (AI)

We may use artificial intelligence or other technology-supported tools to improve our operations and services. We do not use automated decision-making technology to make significant decisions about consumers without meaningful human involvement, as those terms are defined under applicable law. Our use of such technologies is subject to applicable privacy, security, and governance requirements.

Changes to Our Consumer Data Privacy Policy

We reserve the right to amend this privacy policy at our discretion and at any time. When we make changes to this privacy policy, we will post the updated policy on the Sites and update the policy’s effective date. Your continued use of our Sites and/or services following the posting of changes constitutes your acceptance of such changes.

Availability of Our Consumer Data Privacy Policy

You may request a paper copy of this Consumer Data Privacy Policy, free of charge, via the Contact Information section below. Upon request you may also receive a paper or electronic copy of this Consumer Data Privacy in alternative formats or in languages in the ordinary course of business in the states with applicable Data Privacy Laws.

You have the right to receive a copy of this Consumer Data Privacy Policy, free of charge, and to discuss its contents with the VGM Privacy Officer by making a request via the Contact Information below.

Contact Information

You can contact VGM with your questions, comments, consumer rights requests, and other applicable Data Privacy Law inquiries by:

Mail: VGM Group, Inc.

Attn: VGM Privacy Officer

1111 Van Miller Way

Waterloo, IA 50701

Phone: 1-877-474-3227

Email: vgmcorporatecompliance@vgm.com

If you believe your PI was accessed without permission, please contact VGM by any means listed above.

Consumer Data Privacy Policy Last Update

January 1, 2026