Last updated: Oct 22, 2026

Privacy Policy and Statement

Your privacy is important to us. At Whole Co Services Inc. (hereinafter referred to as “Whole Co”), we are committed to protecting your non-public personal information as required by law. This notice is to advise you of how we will handle this information.

What is Personal Data?

In this privacy policy, references to “personal information” or “personal data” are references to information that relates to an identified or identifiable individual. Some examples of personal data are your name, company, e-mail address, address, telephone number, IP address, location data, employment data, and browsing and/or purchasing history.

What is Sensitive Data?

Sensitive personal data is a specific subset of personal data that describes certain types of personal information that is more sensitive. Some examples of sensitive data are your social security or passport number, driver’s license, or other state identification, financial account credentials, geolocation, racial or ethnic origin, citizen or immigration status, religious or philosophical beliefs, or union membership, genetic data, biometrics, or information concerning your mental and physical health or sexual orientation. We will not process sensitive data without obtaining your prior consent.

Types of Information We Collect on this Website

You can visit the website of Whole Co without revealing who you are or providing any personal information about yourself.

There will be times, such as when you request information or a publication, when we will need to obtain personal information from you or about you. However, this information will not be collected without your knowledge.

The information we receive about you is limited to only what is adequate, relevant, and reasonably necessary in relation to the purposes for which the personal data is processed. We will never collect personal information that is not required to conduct business with you nor use any information collected for purposes that are neither reasonably necessary to, nor compatible with our services without obtaining your consent.

The information we receive about you or from you may be used by us to process your inquiry or request, to comply with any law, regulation, or court order, and to help improve our website or the products or services we offer.

When you visit this website, we may collect usage information (including, but not limited to, IP addresses, browser and platform types, domain names, access times, and referral data) to help us understand how our website is navigated and used. This data does not include any personal information about you and is used only to measure and improve the effectiveness of our website.

If you do choose to decline to submit personal information to any of our services, there may be some instances in which we may not be able to provide those services to you.

How We Use Your Information/Use of Collected Personal Information

Whole Co only processes personal information for the purposes described in this Privacy Policy and/or privacy notice for specific services. Such services may include:

• Providing our insurance services to users;
• Auditing, research, and analysis in order to maintain, protect, and improve our services;
• Ensuring the technical functioning of our network; and
• Developing new services.

We may be governed by processor contracts that include clear instructions for processing, the purpose for processing, the type of data being processed, the length of processing, and the rights and obligations of data controllers and processors.

We cannot process data in violation of state and federal laws that prohibit unlawful discrimination or discriminate against a consumer for exercising their rights.

Promotional Messaging or Advertising

Any Promotional Messaging or Advertising material is for general informational purposes only and does not constitute an offer to sell or a solicitation of an offer to buy an insurance product or service.

Ability to Opt-in/Out

You, or someone acting on your behalf, can request to have us stop selling or sharing your personal information, (“Opt-Out”) by contacting us through our Contact Us Section below.

We aim to honor opt-out preference signals in accordance with applicable law. You may opt-out by enabling a legally recognized universal opt-out signal, such as the Global Privacy Control, when visiting our website. When we detect an opt-out signal, we will make reasonable efforts to honor it.

Information Provided by You

When you engage us to provide insurance services, we may ask you for personal information (such as your name, address, social security number, date of birth, phone numbers, credit card information, and email address) which we maintain in encrypted form on secure servers. We may combine the information submitted under various forms and services in order to provide customers with a better experience and to improve the quality of our services.

We may need to use your personal data in order to carry out the following activities:

• To set you up as a new client (including carrying out ‘know your customer’ checks);
• To provide you with an insurance quote;
• To provide our products and services to you;
• To respond to your inquiries;
• To accept payments from you;
• To communicate with you about your policy;
• To renew your policy;
• To obtain reinsurance for your policy;
• To process insurance and reinsurance claims;
• For general insurance administration purposes;
• To comply with our legal and regulatory obligations;
• To model our risks;
• To defend or prosecute legal matters;
• To respond to your inquiries;
• When you sign up for an online account;
• To make our products and services better and to develop new products and services; and
• To send you notices and information regarding our products or services, including notifying you about special promotions or offers, where we are legally permitted to do so.

Information Collected from Other Sources

From time to time, we may receive personal information about you from third party sources but only where we have checked that these third parties either have your consent or are otherwise legally permitted or required to disclose your personal information to us. This Privacy Policy applies to how we handle your information. We do not exercise control over the websites that are displayed in other browser windows opened by links from within our various services. These other sites may place their own cookies or other files on your computer, collect data, or solicit personal information from you.

Disclosure of Personal Information to Third Parties, Vendors, Service Providers, or for Company Communications

We may disclose personal information that we collect, or you provide, as described in this privacy policy under the following circumstances:

• To transfer data to our affiliates from time to time for our legitimate business purposes. Affiliates are defined as group companies, subsidiaries, parent companies, joint ventures, and other corporate entities under common Whole Co ownership;
• To contractors, service providers, and other third parties we use to support our business that are bound by an obligation to keep personal information confidential and use it only for the purposes for which we disclose it to them;
• To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of the Company's assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by the Company about our Website users is among the assets transferred; and
• To fulfill the purpose for which you provide it.

Choices about the Collection and Use of Your Information

This website may use "cookies" to enhance your viewing experience. A cookie is a tiny element of data that is sent to your browser to be stored on your hard drive so that we can recognize you when you return. You may set your browser to notify you when you receive a cookie or refuse cookies from all websites. Please note, if you reject cookies, it is possible that some web pages may not load properly, your access to certain information might be denied, or you might be required to enter information more than once.

Promotional Offers from the Company: If you do not wish to have your e-mail address/contact information used by the Company to promote our own or third parties' products or services, you can opt-out by using one of the methods described above in Ability to Opt-Out.

Targeted Advertising: If you do not want us to use information that we collect or that you provide to us to deliver advertisements according to our advertisers' target-audience preferences, you can opt-out by using one of the methods described above in Ability to Opt-Out.

Data Protection Assessments (“DPA”)

States that require us to conduct data protection assessments include California, Colorado, Connecticut, Delaware, Florida, Indiana, Kentucky, Louisiana, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Vermont, and Virginia.

We must conduct and record data protection assessments for any processing activities that extend high-risks to consumers, including:

• Targeted advertising;
• Selling personal data
• Profiling where there is a reasonably foreseeable risk of harm;
• Processing sensitive data.

Upon completion of an impact assessment, potential threats will be identified and solutions will be introduced to mitigate risks.

Collection of Information from Children

We do not knowingly collect personal information from anyone under the age of 13. If you believe that we are processing personal information pertaining to a child inappropriately, we ask you to contact us using the information provided under the “Contact Us” section.

We do not process personal data of a child without consent from the child’s parent or legal guardian and unless it is in accordance with the Children’s Online Privacy Protection Act of 1998 (COPPA).

For more information about protecting your child's privacy online, visit the Federal Trade Commission website at https://www.ftc.gov.

Other Considerations

When you use some Whole Co products, services, or applications or post on a Whole Co forum, chat room, or social networking service such as Facebook, X (Twitter), or other such social media sites, the personal information and content you share is visible to other users and can be read, collected, or used by them.

State Specific Privacy Laws

Many states and territories have their own privacy regulations which apply to individuals and corporations that live or do business in, frequent, or offer good and services to its residents. The individual laws of these states vary and as such you should familiarize yourself with your individual state laws or seek counsel to assist you.

Addendum 1 which can be found at the end of this notice summarizes each current state privacy regulation.

Confidentiality and Security

We have implemented and maintain administrative, technical, and physical data security practices to protect the confidentiality, integrity and accessibility of your personal data. In addition, we mandate that any third party that we share your data with are subject to a confidentiality duty for that data and provide any required assistance to us in meeting our obligations to provide data breach notices and maintain reasonable security.

We will not add your name to mailing lists unless you specifically request that we do so. We do not share, sell, lease, or rent our mailing or customer lists to third parties. We may use third parties to help us administer e-mail alerts. If personally identifiable information (i.e. name, address, e-mail address, telephone number) is provided to any of these third parties, we will require that they maintain such information in strictest confidence in compliance with this policy. We also assess new technology for protecting customer information on an ongoing basis.

We take the security of your personal information seriously and take appropriate technical and organizational measures against unauthorized or unlawful processing of personal data, and against accidental loss, destruction of, or damage to, personal data. Please contact us immediately if you believe your personal information has been exposed.

Although we take appropriate measures to protect the security of the information communicated through the website, no Internet connected computer system can be made absolutely secure from intrusion. We, therefore, cannot and do not guarantee that information communicated by you to us will be received or that it will not be altered before or after its transmission to us. If you elect to use the website to communicate with us, you do so at your own risk.

Contact Us

Any requests to exercise your rights may be made to us by contacting our toll-free number at: (844) 484-9711, sending an email to: privacy@whole.co, or by visiting our “Contact Us" page.

If we deny your request, you may have the right to appeal. We will provide further instructions on how to contact the Office of the Attorney General.

Authorized Agent

In accordance with applicable state provisions, you may use an authorized agent to make a request on your behalf. If you choose to do so, we may require that; the agent provide proof of your permission to submit the request, you verify your identity, and you provide proof of your confirmation of the agent to submit the request.

Questions and Concerns

If you have any questions or comments regarding this privacy statement, or if you have any concerns as to the validity of information made available within these pages, we recommend you seek verification by contacting us via our ‘Contact Us’ section above.

Please note that we may update and modify this Privacy Statement. It remains your responsibility to access and check these terms and conditions whenever you access the Website as the latest version of these terms and conditions will govern. We do not accept any liability for any errors or omissions.

Addendum 1

Alabama Personal Data Protection Act

The Alabama Personal Data Protection Act, effective May 1, 2027, provides Alabama consumers with rights regarding their personal data including:

• Confirm whether a controller, or a processor or third party acting on a controller’s behalf, is processing personal data and access to such data,
• Correct inaccuracies in personal data;
• Delete personal data;
• Obtain a copy of personal data previously provided to a controller in a portable and, technically feasible way; and
• Opt-out of the processing of personal data for purposes of targeted advertising, the sale of their personal data, or profiling.

We have 45 calendar days to process your request.

California Privacy Rights

The California Consumer Privacy Act provides California consumers with rights regarding their personal data including:

• Right to Know: You can request that a business disclose to you:
• The categories/specific pieces of personal information collected;
• The categories of sources from which the business collected personal information;
• The purpose for which the business uses this information;
• The categories of third parties with whom the business discloses the information; and
• The categories of information that the business sells or discloses to third parties.
• Right to Delete: You have the right to request that we delete personal information about you which we have previously collected and tell our service providers to do the same.
• Right to Opt-Out of Sale of Personal Information: You have the right to request that we stop selling or sharing your personal information (“opt-out”).
  • Right to Correct: You have the right to ask businesses to correct inaccurate information that they have about you.
• Right to Limit Use of Personal Information: You have the right to direct businesses to only use your sensitive personal information for specific purposes, like providing you with the services you requested.

We have 15 business days to process requests to opt-out and limit use and 45 calendar days for other requests.

Colorado Privacy Act

The Colorado Data Privacy Act provides Colorado consumers with rights regarding their personal data including:

• Right of Access: You have the right to confirm whether a controller is processing your personal data and to have the right to access your personal data.
• Right to Correction: You have the right to correct inaccuracies.
• Right to Delete: You have the right to delete personal data concerning the consumer.
• Right to Data Portability: You have the right to obtain your personal data in a portable and, to the extent technically feasible, readily usable format.
• Right to Opt-Out: You have the right to opt out of the processing of your personal data for the purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer.

We have 45 calendar days to complete your request. You have the right to appeal any denial from the business to action your request. If the business denies your appeal, please contact the Colorado Office of the Attorney General to submit a complaint.

Connecticut Data Privacy Act

The Connecticut Data Privacy Act provides Connecticut consumers with rights regarding their personal data including:

• Consumers have the right to confirm whether a controller is processing their personal data and access such personal data.
• Consumers also have the individual right to obtain a list of specific third parties to which their personal data has been sold. We do not sell of any Connecticut resident’s precise geolocation data as it is outright prohibited.
• Consumers have the right to correct inaccuracies in their personal data.
• Consumers have the right to delete personal data including data collected by a controller from third parties; data provided directly by the consumer; and publicly available information that has been compiled.
• Consumers have the right to obtain a portable copy of their personal data to the extent technically feasible.
• Consumers have the right to opt out of: targeted advertising; the sale of personal data; or profiling in connection with automated decisions that produce legal or similarly significant effects concerning the consumer.

We have 45 calendar days to complete your request. Consumers have the right to appeal any denial from the business to complete your request. If the business denies your appeal, please contact the Connecticut Office of the Attorney General to submit a complaint.

Delaware Data Privacy Act

The Delaware Personal Data Privacy Act provides Delaware consumers with rights regarding their personal data including:

• Confirm whether a controller is processing the consumer’s personal data and access such personal data.
• Correct inaccuracies in the consumer’s personal data.
• Delete personal data provided by, or obtained about, the consumer.
• Obtain a copy of the consumer’s personal data processed by the controller, in a portable and, to the extent technically feasible, readily-usable format.
• Obtain a list of the categories of third parties to which the controller has disclosed the consumer’s personal data.
• Opt-out of the processing of the personal data for purposes of the following: targeted advertising, the sale of personal data, profiling in furtherance of solely-automated decisions that produce legal or similarly significant effects concerning the consumer.

We have 45 calendar days to complete your request. Consumers have the right to appeal any denial from the business to complete your request. If the business denies your appeal, please contact the Delaware Office of the Attorney General to submit a complaint.

Florida Digital Bill of Rights

The Florida Digital Bill of Rights provides Florida consumers with rights regarding their personal data including:

• The right to confirm whether a company is processing their personal data.
• The right to access and obtain a portable copy of any data that the controller may hold.
• The right to delete or correct inaccuracies in their personal data.
• The right to opt-out of the selling and/or sharing of personal data for targeted advertising, including removal of personal data from voice or facial recognition technologies.

We have 45 calendar days to complete your request. Consumers have the right to appeal any denial from the business to complete your request. If the business denies your appeal, please contact the Florida Office of the Attorney General to submit a complaint.

Indiana Consumer Data Privacy Act

The Indiana Consumer Data Protection Act provides Indiana consumers with rights regarding their personal data including:

• To confirm whether or not a controller is processing the consumer's personal data and access such data.
• To delete or to correct inaccuracies in personal data previously provided to the controller.
• To obtain a copy or representative summary of personal data in a portable, technically feasible format.
• To opt-out of the processing of personal data for the purposes of targeted advertising, sale of personal data, profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

We have 45 calendar days to complete your request. Consumers have the right to appeal any denial from the business to complete your request. If the business denies your appeal, please contact the Indiana Office of the Attorney General to submit a complaint.

Iowa Consumer Data Privacy Act

The Iowa Consumer Data Protection Act provides Iowa consumers with rights regarding their personal data including:

• The right to confirm processing,
• The right to access personal information,
• The right to delete personal data provided by the consumer,
• The right to obtain a copy of the consumer’s personal data in a portable, technically feasible format, and
• The right to opt out of sale of personal data and targeted advertising.

We have 90 calendar days to complete your request. Consumers have the right to appeal any denial from the business to complete your request. If the business denies your appeal, please contact the Iowa Office of the Attorney General to submit a complaint.

Kentucky Consumer Data Protection Act

The Kentucky Consumer Data Protection Act provides Kentucky consumers with rights regarding their personal data including:

• Right to confirm whether certain businesses collecting personal data (“controllers") are processing their personal data;
• Right to access their collected personal data;
• Right to correct inaccuracies in the consumer's personal data;
• Right to delete personal data provided by, or obtained about, the consumer;
• Right to obtain a portable copy of their personal data to the extent feasible;
• Right to opt-out of the processing of data for purposes of targeted advertising, sale of personal data or profiling.

We have 45 calendar days to complete your request. Consumers have the right to appeal any denial from the business to complete your request. If the business denies your appeal, please contact the Kentucky Office of the Attorney General to submit a complaint.

Louisiana Data Privacy Act

The Louisiana Data Privacy Act, effective January 1, 2027, provides Louisiana consumers with rights regarding their personal data including:

• Confirm whether a controller is processing the consumer's personal data and to access the personal data.
• Correct inaccuracies in the consumer's personal data.
• Delete personal data provided by or obtained about the consumer.
• Obtain a copy of the consumer's personal data that the consumer previously provided to the controller in a portable, technically feasible format.
• Opt-out of the processing of the personal data for purposes of; targeted advertising, the sale of personal data, profiling in furtherance of a decision that produces a legal or similarly significant effect concerning the consumer.

We have 45 calendar days to complete your request. Consumers have the right to appeal any denial from the business to complete your request. If the business denies your appeal, please contact the Louisiana Office of the Attorney General to submit a complaint.

Maryland Online Data Privacy Act

The Maryland Online Data Privacy Act provides Maryland consumers with rights regarding their personal data including:

• Right to confirm and access personal data collected about you.
• Right to opt-out of the sale, targeted advertising, and profiling of your personal data.
• Right to correct inaccurate personal information that businesses have about you.
• Right to know what personal data businesses have and how they use and share it.
• Right to delete personal information businesses have collected from you.
• Right to obtain a portable copy of personal data to the extent feasible.

We have 45 calendar days to complete your request. Consumers have the right to appeal any denial from the business to complete your request. If the business denies your appeal, please contact the Maryland Office of the Attorney General to submit a complaint.

Minnesota Consumer Data Privacy Act

The Minnesota Consumer Data Privacy Act provides Minnesota consumers with rights regarding their personal data including:

• You have a right to request a list of third parties to whom your data was sold.
• You have a right to opt-out, or say “no” to a business selling your data, using your data for profiling, or using targeted advertising with your data.
• You have a right to obtain a copy of the personal and sensitive data a business has about you.
• You have a right to access and correct inaccuracies in the data a business has collected about you.
• You have a right to delete personal data concerning you.
• You have the right to question profiling and automated decisions that affect you.

We have 45 calendar days to complete your request. Consumers have the right to appeal any denial from the business to complete your request. If the business denies your appeal, please contact the Minnesota Office of the Attorney General to submit a complaint.

Montana Consumer Data Privacy Act

The Montana Consumer Data Privacy Act provides Montana consumers with rights regarding their personal data including:

• Confirm whether a business is processing your data.
• Ask the business to provide access to your data or obtain a copy of your personal data.
• Ask the business to correct inaccurate personal data or delete any personal data about you.
• Opt-out of the processing your personal data for purposes of targeted advertising, the sale of personal data, or profiling.

We have 45 calendar days to complete your requests. Consumers have the right to appeal any denial from the business to complete your request. If the business denies your appeal, please contact the Montana Office of the Attorney General to submit a complaint.

Nebraska Data Privacy Act

The Nebraska Data Privacy Act provides Nebraska consumers with rights regarding their personal data including:

• Confirm whether a controller is processing the consumer's personal data.
• Request access to the consumer’s personal data.
• Request a correction of inaccuracies in the consumer's personal data.
• Request deletion of personal data provided by or obtained about the consumer that is being used by the controller.
• Obtain a copy of the consumer's personal data that the consumer previously provided to the controller, if the data is available in a digital format and processed by the controller in completely automated means.
• Request to opt out of the processing of the consumer’s personal data for purposes of targeted advertising of the consumer, sale of the consumer’s personal data, or profiling the consumer based on the consumer data in the controller’s control.

We will respond to requests within 45 calendar days. Consumers have the right to appeal any denial from the business to complete your request. If the business denies your appeal, please contact the Nebraska Office of the Attorney General to submit a complaint.

New Hampshire Expectation of Privacy Act

The New Hampshire Expectation of Privacy Act provides New Hampshire consumers with rights regarding their personal data including:

• Confirm whether or not certain businesses are processing your personal data;
• Obtain access to your personal data being processed by those businesses;
• Correct inaccuracies in your personal data being processed by those businesses;
• Delete personal data provided by, or obtained about, you by those businesses;
• Obtain a copy of your personal data in a portable format; and
• Opt-out of the future processing of personal data for purposes of: targeted advertising the sale of personal data, or certain types of automated profiling.

We have 45 calendar days to complete your request. Consumers have the right to appeal any denial from the business to complete your request. If the business denies your appeal, please contact the New Hampshire Office of the Attorney General to submit a complaint.

New Jersey Data Privacy Act

The New Jersey Data Privacy Act provides New Jersey consumers with rights regarding their personal data including:

• The right to confirm whether businesses are processing your personal data and to access personal data;
• The right to correct inaccuracies or delete your personal data;
• The right to obtain a portable copy of your personal data; and
• The right to opt out of the processing of data for the purposes of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

We have 45 calendar days to complete your request. Consumers have the right to appeal any denial from the business to complete your request. If the business denies your appeal, please contact the New Jersey Office of the Attorney General to submit a complaint.

Oklahoma’s Act Relating to Data Privacy

Oklahoma’s Act Relating to Data Privacy, effective January 1, 2027, provides Oklahoma consumers with rights regarding their personal data including:

• To confirm whether a controller is processing their personal data and access that data.
• To correct inaccuracies in personal data.
• To delete personal data.
• To obtain a copy of personal data previously provided to a controller in a portable and, technically feasible way; and
• Opt-out of the processing of personal data for purposes of targeted advertising, the sale of their personal data, or profiling.

We have 45 calendar days to process your request. Consumers have the right to appeal any denial from the business to complete your request. If the business denies your appeal, please contact the Oklahoma Office of the Attorney General to submit a complaint.

Oregon Consumer Privacy Act

The Oregon Consumer Privacy Act provides Oregon consumers with rights regarding their personal data including:

• Ask businesses to provide a list of specific entities that received your data.
• Opt-out of the processing of your personal data for purposes of targeted advertising, the sale of personal data, or profiling.
• Obtain a copy of your personal data.
• Confirm whether businesses are processing your data.
• Access what information has been collected about you.
• Edit any inaccuracies in your personal data.
• Delete personal and sensitive information businesses have about you.

We will respond to all requests within 45 days. Consumers have the right to appeal any denial from the business to complete your request. If the business denies your appeal, please contact the Oregon Office of the Attorney General to submit a complaint.

Rhode Island Data Transparency and Privacy Protection Act

The Rhode Island Data Transparency and Privacy Protection Act provides Rhode Island consumers with rights regarding their personal data including:

• Confirm whether or not a customer’s personal data is being processed and access to such personal data;
• Correct inaccuracies in the customer’s personal data and delete personal data;
• Obtain a copy of the customer’s personal data in a portable and, technically feasible, readily usable format;
• Opt-out of the processing of the personal data for purposes of targeted advertising, the sale of personal data, or profiling.

Revocation of consent requests will be completed in 15 calendar days and 45 calendar days for other requests. Consumers have the right to appeal any denial from the business to complete your request. If the business denies your appeal, please contact the Rhode Island Office of the Attorney General to submit a complaint.

Tennessee Information Protection Act

The Tennessee Information Protection Act provides Tennessee consumers with rights regarding their personal data including:

• To confirm whether a controller is processing your personal information and to access the personal information.
• To correct inaccuracies in your personal information.
• To delete personal information provided by or obtained about you.
• To obtain a copy of your personal information in a portable, technically feasible format.
• To request that the controller that sold your personal information or disclosed the information for a business purpose, disclose to you
  • The categories of personal information the business sold;
  • The categories of third parties to which your personal information about was sold by category of personal information for each category of third parties to which the personal information was sold; and
  • The categories of personal information that the business disclosed for a business purpose.
• To Opt-out of a controller's selling personal information about you.

We will respond to requests within 45 calendar days. Consumers have the right to appeal any denial from the business to complete your request. If the business denies your appeal, please contact the Tennessee Office of the Attorney General to submit a complaint.

Texas Data Privacy and Security Act

The Texas Data Privacy and Security Act provides Texas consumers with rights regarding their personal data including:

• Right to know whether a company is processing the consumer’s personal data and to obtain the personal data in a readable format;
• Right to correct inaccuracies in the consumer’s personal data;
• Right to delete personal data provided by or obtained about the consumer;
• Right to opt out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of a decision made by the company concerning the consumer that results in the provision or denial by the company of the following: financial and lending services; housing, insurance, or health care services; education enrollment; employment opportunities; criminal justice; or access to basic necessities, such as food and water.

We will address requests within 45 calendar days. Consumers have the right to appeal any denial from the business to complete your request. If the business denies your appeal, please contact the Texas Office of the Attorney General to submit a complaint.

Utah Consumer Privacy Act

The Utah Consumer Privacy Act provides Utah consumers with rights regarding their personal data including:

• Confirm whether businesses as the controller are processing your personal data;
• Access and delete your personal data;
• Right to correct inaccuracies in your personal data;
• Obtain a copy of your personal data previously provided to the business in a portable format; and
• Opt-out of the processing of your personal data for targeted advertising and selling personal data.

We have 45 calendar days to process your request.

Vermont Data Privacy and Online Surveillance Act

The Vermont Data Privacy and Online Surveillance Act, effective January 1, 2028, provides Vermont consumers with rights regarding their personal data including:

• Confirm whether the controller is processing your personal data;
• Access and delete your personal data;
• Correct inaccuracies in your personal data;
• Obtain a copy of your personal data in a portable, technically feasible format;
• Obtain a list of the third parties to which such businesses have sold your personal data.
• Opt-out of the processing of the personal data for purposes of:
• Targeted advertising;
• The sale of personal data;
• Profiling in furtherance of a decision that produces a legal or similarly significant effect concerning you.
• If your personal data was processed for the purposes of profiling in furtherance of any automated decision that produced any legal or similarly significant effect, you may:
  • Question the result of such profiling;
  • Be informed of the reason that such profiling resulted in such decision;
  • Review your personal data that was processed for the purposes of such profiling; and;
  • If the profiling decision concerned housing, considering the nature of the personal data and the purposes for which such personal data were processed, you may correct any incorrect personal data that were processed for the purposes of such profiling and have the profiling decision re-evaluated based on the corrected personal data.

We have 45 calendar days to process your request. Consumers have the right to appeal any denial from the business to complete your request. If the business denies your appeal, please contact the Vermont Office of the Attorney General to submit a complaint.

Virginia Consumer Data Protection Act

The Virginia Consumer Data Protection Act provides Virginia consumers with rights regarding their personal data including:

• Confirm if the controller is actually processing their personal data.
• Correct inaccuracies in the consumer’s personal data that is collected by the controller.
• Access and delete personal data provided by or obtained about the consumer.
• Obtain copies of the personal data collected by the controller in a portable, technically feasible format.
• Opt-out of the processing of personal data for purposes of targeted advertising, the sale of personal data, or further profiling.

We have 45 calendar days to process your request. Consumers have the right to appeal any denial from the business to complete your request. If the business denies your appeal, please contact the Virginia Office of the Attorney General to submit a complaint.