EVOLVE BANK & TRUST PRIVACY POLICY

Legal Rights & Agreement Rules · Context

Evolve Bank & Trust privacy policy, last revised March 29, 2023

The document is the Evolve Bank & Trust Privacy Policy. Its stated last revision date is March 29, 2023; the saved text does not state a separate effective date.

Supporting quotations

Evolve Bank & Trust Privacy Policy

Last Revised on March 29, 2023

Qualifications & exceptions

• The date is the 'Last Revised' date shown in the saved text; no separate effective date is stated.

Not stated here

• Whether a later version exists is not established by this saved copy.

Use & Processing · Context

Policy covers users of Evolve's website, apps, financial products and services

Evolve Bank & Trust describes the policy as covering how it collects, uses and discloses information about users of its website at www.getevolved.com, its applications, financial products and services offered directly or through a third-party partner, and its tools and features (the Services). 'You' means a user of the Services.

Supporting quotations

describes how we collect, use and disclose information about users of our website

financial products and services (through Company directly or via a third party partner)

Qualifications & exceptions

• The listed Services are described collectively; the saved text does not enumerate every product.
• The policy excludes consumer financial-product applicants and customers; the next card states that exclusion.

Not stated here

• The linked GLBA policy and any partner-specific terms are not in this saved source.

Legal Rights & Agreement Rules · Restriction or exception

Consumer financial-product applicants are outside this policy and referred to a GLBA policy

The policy expressly does not apply to information collected about individuals who apply for or obtain financial products or services for personal, family or household purposes. For those customers, Evolve points to a separate Gramm-Leach-Bliley Act Privacy Policy, linked but not included in the saved text.

Supporting quotations

This Privacy Policy does not apply to information we collect about individuals who apply for or obtain financial products and services for personal, family or household purposes.

please refer to our separate Gramm-Leach-Bliley Act Privacy Policy

Qualifications & exceptions

• The exclusion is limited to personal, family or household financial products or services.
• The referenced GLBA policy's terms are not supplied and are not described in this document.

Not stated here

• Contents of the linked GLBA policy.

Cross-references

• qualifies (model-proposed): California section applies only to California residents and includes sensitive personal information — The general policy excludes consumer financial-product applicants and points to a separate GLBA policy. The California section likewise says FCRA- and GLBA-regulated data is exempt from CCPA requirements and rights and points to the same separate policy. Both statements describe the same boundary for those customers; the linked GLBA policy is not in the saved source.

Legal Rights & Agreement Rules · Restriction or exception

Using the Services is stated as agreement to the policy

The policy states that by using the Services, a user agrees to the policy and its terms, and that a user who does not agree should not use or access the Services. The saved text does not describe a separate acceptance step.

Supporting quotations

By using the Services, you agree to this Privacy Policy and its terms.

If you do not agree to this Privacy Policy, please do not use or access any of the Services.

Qualifications & exceptions

• The statement is conditioned on using the Services.
• No signature, checkbox or other acceptance method is described here.

Not stated here

• How agreement is presented in the product interface is not shown in the saved text.

Legal Rights & Agreement Rules · Company practice

Policy may change by updating the Last Revised date, with notice efforts for material-use changes

Evolve may modify the policy and will update the 'Last Revised' date. If it makes material changes to the way it uses collected information, it says it will use commercially reasonable efforts to notify users and take additional steps required by applicable law. Users who do not agree to updates are told not to use or access the Services.

Supporting quotations

We may modify this Privacy Policy, in which case we will update the “Last Revised” date.

If we make material changes to the way we use information we collect, we will use commercially reasonable efforts to notify you and will take additional steps as required by applicable law.

Qualifications & exceptions

• The notice commitment is limited to material changes in how collected information is used and to commercially reasonable efforts.
• Additional steps depend on applicable law.

Not stated here

• The notice channel and timing are not specified.

Data Access & Collection · Company practice

Collection varies by feature and some requested information is optional

Evolve says it may collect categories of information about users from a variety of sources when they use or access the Services. Some features may require information; a user may decline to provide it, but doing so may prevent use of those features.

Supporting quotations

When you use or access the Services, we may collect certain categories of information about you from a variety of sources.

You may decide not to provide this information, but doing so may prevent you from using or accessing these features.

Qualifications & exceptions

• 'May collect' and 'may require' do not state that every category is collected from every user.
• The stated consequence of declining is limited to the features that require the information.

Not stated here

• Which information each feature requires is not listed.

Data Access & Collection · Company practice

Basic contact details collected for the account, requested services, communications and queries

Evolve collects basic contact information such as name, email address, company name and role, mailing address and phone number. It states the purposes as creating and maintaining the account, providing requested products or services, communicating with the user (including about products that may be of interest), and responding to queries.

Supporting quotations

Basic contact information, such as your name, email address, company name and role, mailing address, and phone number.

We collect this information to create and maintain your account, provide you with products or services you have requested, communicate with you (including to tell you about products that may be of interest to you), and respond to your queries.

Qualifications & exceptions

• The examples are introduced by 'such as' and are not exhaustive.
• The communication purpose expressly includes products that may be of interest to the user.

Account & Service Control · Company practice

Account details are collected to create, maintain and secure the account; users must safeguard credentials

Evolve collects account information such as username, password and security questions to create, maintain and secure the account. If a user registers an account, the policy places responsibility on the user to keep credentials safe and says not to share access details.

Supporting quotations

Account information, such as your username, password, and security questions.

We collect this information to create, maintain, and secure your account with us.

If you choose to register an account, you are responsible for keeping your account credentials safe.

Qualifications & exceptions

• The responsibility statement applies if the user chooses to register an account.
• The policy does not describe technical security controls for credentials in this item.

Charges & Financial Obligations · Company practice

Payment details collected to maintain the account, process payments and provide requested services

Evolve collects payment information such as bank account, credit or debit card information and billing address. It states the purposes as maintaining and securing the account, processing payment, and providing requested products or services.

Supporting quotations

Payment information, such as your bank account, credit or debit card information, and billing address.

We collect this information to maintain and secure your account, process your payment, and to provide you with the products or services you have requested.

Qualifications & exceptions

• The examples given are bank account, credit or debit card information and billing address.

Not stated here

• Which payment processors receive this information is not stated in this collection item.

Charges & Financial Obligations · Company practice

Financial and commercial information collected to verify eligibility and provide requested products

Evolve collects financial and commercial information including income, household size and income, expenses, assets, liabilities, credit score and report, business financial information, account information such as balances and payment history, tax-related information, and records of property or products and services purchased, obtained or considered. It states that it uses this information to verify eligibility for, and provide, requested products and services.

Supporting quotations

Financial and commercial information, such as income, household size and income, expenses, assets, liabilities, credit score and report, business financial information, account information (e.g. account balances, payment history, account numbers and other billing information), tax related information, and records of property, products or services purchased, obtained or considered.

We collect this information to verify your eligibility for, and provide you with, products and services you have requested.

Qualifications & exceptions

• The examples are introduced by 'such as' and are not exhaustive.
• The stated purpose is eligibility verification and provision of requested products and services.

Not stated here

• Which sources supply each data element is not stated in this item.

Data Access & Collection · Company practice

Website and app visit information is collected, including webform and tracking data

Evolve collects information relating to a visit to its Site or use of its mobile application, including information submitted through features and webforms and information collected via cookies and tracking technologies. The policy says those technologies are described further below.

Supporting quotations

Information relating to your visit to our Site or use of our mobile application, including information that you submit when interacting with the Site’s and mobile application’s features and webforms and information collected via cookies and tracking technologies (“Tracking Technologies”), as described further below.

Qualifications & exceptions

• 'Site' is used here without a separate definition; the policy earlier names www.getevolved.com.
• The item cross-refers to later tracking details rather than describing them here.

Data Access & Collection · Company practice

Other information users choose to provide, including SSN, license, employment and date of birth

Evolve collects any other information a user chooses to provide, including information provided to use the Services. Its examples include Social Security number, driver's license, work experience, education, business information including TIN, gender and date of birth, as well as information included in communications or used to use the Services.

Supporting quotations

Any other information you choose to provide, such as information provided to us to provide the Services, including your social security number, driver’s license, work experience, education, business information including TIN, gender, date of birth, and any other information that you choose to include in communications with us or to use the Services.

Qualifications & exceptions

• The collection is framed as information the user chooses to provide.
• The examples are not stated as a complete list.

Not stated here

• Which items are mandatory for particular services is not stated.

Data Access & Collection · Company practice

Usage Data collected through tracking technologies for tailoring, offers, analytics and understanding use

Evolve collects information about a user's interaction with the Services ('Usage Data') through Tracking Technologies. It says it uses this data to tailor features, provide offers or promotions, run analytics, and better understand user interactions. The listed Usage Data includes device information, online activity data, and other interaction information such as session recordings, clickstream data and ad impressions.

Supporting quotations

We collect certain information about your interaction with the Services (“Usage Data”) through Tracking Technologies, which we use to tailor features to you, provide you with offers or promotions, run analytics, and better understand user interactions with the Services

Device information, such as unique device identifier, IP address, device type, browser type, operating system, and precise location (if you choose to provide it).

Online activity data, such as date and time stamps and log data.

Other information, regarding your interaction with the Services, such as session recordings, clickstream data, and ad impressions.

Qualifications & exceptions

• Device information includes precise location only if the user chooses to provide it.
• The Usage Data items are introduced by 'such as'.

Data Access & Collection · User right or choice

Precise location is collected only if the user chooses to provide it

Within the device information category, precise location is identified as collected 'if you choose to provide it.' The policy does not describe the permission or setting used for that choice in this item.

Supporting quotations

precise location (if you choose to provide it)

Device information, such as unique device identifier, IP address, device type, browser type, operating system, and precise location (if you choose to provide it).

Qualifications & exceptions

• The choice language is attached to precise location; the other device details are not similarly conditioned in this item.

Not stated here

• Whether the choice is presented through an operating-system permission, an app setting or another mechanism is not stated.

Data Access & Collection · Company practice

Outside sources include credit bureaus, partners, career sites, marketing databases and public records

Evolve may obtain information about a user from outside sources to verify identity and eligibility, provide products and services (including promotions, offers and rewards), personalize the experience, and communicate. The listed sources are third parties such as credit bureaus, other financial institutions, banks and payment networks; partners with whom the user may interact directly and for whom Evolve provides products or services; career websites such as LinkedIn, Monster or Indeed; consumer marketing databases or other data companies; and other public sources and government agencies.

Supporting quotations

We may also obtain information about you from outside sources, which we use to verify your identity and eligibility for the Services, provide you with products and services (including certain promotions, offers and rewards), personalize your experience and otherwise communicate with you

Third parties, who help us supplement the information you have provided (e.g., credit bureaus, other financial institutions and banks and payment networks).

Partners, with whom you may interact directly, and for whom Company provides products or services.

Career websites, such as LinkedIn, Monster, or Indeed.

Consumer marketing databases or other data companies who provide us with information.

Other sources, such as from publicly available sources and government agencies

Qualifications & exceptions

• The source list is introduced by 'including' and is not exhaustive.
• The stated purposes are identity and eligibility verification, providing products and services, personalization and communication.

Not stated here

• Which source supplies which category of information is not stated.

Linking & Identification · Company practice

Outside information may be associated with the account, device or email used to engage Evolve

Information received from outside sources, including public sources and government agencies, is to be treated under this policy. Evolve says it may associate that information with the user's account if registered, the device used to access the Services, or email accounts used to engage Evolve.

Supporting quotations

We may associate this information with your account (if you have a registered account), the device you use to access the Services, or email accounts that you use to engage us.

Other sources, such as from publicly available sources and government agencies

Qualifications & exceptions

• Account association applies only if the user has a registered account.
• The policy does not state a retention period for the association in this item.

Not stated here

• The matching method is not described.

Legal Rights & Agreement Rules · Restriction or exception

Evolve disclaims responsibility for third-party data accuracy and third-party policies

For information received from outside sources, Evolve says it is not responsible or liable for the accuracy of information provided by third parties and is not responsible for any third party's policies or practices. The policy points to 'Section 5 below' for more information.

Supporting quotations

We are not responsible or liable for the accuracy of the information provided to us by third parties and are not responsible for any third party’s policies or practices.

See Section 5 below for more information.

Qualifications & exceptions

• The disclaimer concerns information supplied by third parties and third-party policies, not Evolve's own practices.
• The reference is not numbered in the saved text; a reference record gives the exact citation and target.

Not stated here

• The content of any third-party policy is not supplied.

Use & Processing · Company practice

Additional uses cover service development, legal compliance, enforcement, protection and fraud prevention

In addition to the specific uses described earlier, Evolve may use all collected information to provide, improve and develop the Services and its product offerings; comply with legal or regulatory obligations; enforce agreements; protect or defend the Services and the rights of Evolve, its users or others; combat fraud; or otherwise operate its business.

Supporting quotations

In addition to the specific uses of information described above

we may use all of the above information to provide, improve and develop the Services and our product offerings, to comply with any applicable legal or regulatory obligations, to enforce any applicable agreement, to protect or defend the Services, our rights, the rights of our users, or others, for the purpose of combatting fraud, or to otherwise operate our business.

Qualifications & exceptions

• The uses apply to all of the information described above.
• The list ends with 'otherwise operate our business', a broad residual purpose.

Sharing & Disclosure · Company practice

Company may disclose user information to third parties, including the listed recipient categories

The disclosure section states that Evolve may disclose a user's information with third parties, including the recipient categories listed below. Read with the policy's scope definition, 'your information' means information about users of the Services.

Supporting quotations

HOW THE COMPANY DISCLOSES YOUR INFORMATION We may disclose your information with third parties, including with:

describes how we collect, use and disclose information about users of our website

Qualifications & exceptions

• The list is introduced by 'including with' and is not exhaustive.
• The policy does not state that every recipient receives every category of information.

Not stated here

• The policy does not give a complete named recipient list.

Sharing & Disclosure · Company practice

Vendors and service providers receive information for operational services

Evolve may disclose information to vendors or other service providers that help provide the Services, including for cloud storage, security, customer relationship management, fraud detection and prevention, marketing communications, web analytics, payment networks and payment processors.

Supporting quotations

Vendors or other service providers who help us provide the Services, including for cloud storage, security, customer relationship management, fraud detection and prevention, marketing communications, web analytics, payment networks and payment processors.

Qualifications & exceptions

• The list of functions is introduced by 'including' and is not exhaustive.
• Payment networks and payment processors are named among the service-provider functions.

Not stated here

• No vendor names or contractual limits are stated in this item.

Sharing & Disclosure · Company practice

Partners and other third parties may receive information for products and marketing, including joint marketing

Evolve may disclose information to partners with whom the user may interact directly and for whom Evolve may provide products or services, and to other third parties for marketing purposes, including joint marketing with other financial companies.

Supporting quotations

Partners, with whom you may interact directly and for whom Company may provide products or services.

Other third parties, for marketing purposes, including joint marketing with other financial companies.

Qualifications & exceptions

• The partner category is tied to partners with whom the user may interact directly and for whom Evolve may provide products or services.
• The marketing category expressly includes joint marketing with other financial companies.

Not stated here

• The policy does not name the partners or financial companies.

Cross-references

• contrast (model-proposed): Policy says it does not 'sell' or 'share' personal information as defined by the CCPA — The general disclosure section permits disclosures to other third parties for marketing, including joint marketing with other financial companies, while the later section says Evolve does not 'sell' or 'share' personal information as those terms are defined under the CCPA. The statements use different defined terms; the policy does not reconcile them, and this relation records the contrast without deciding how the definitions apply.

Sharing & Disclosure · Company practice

Credit reporting agencies receive account information as permitted by law

Evolve may disclose information to credit reporting agencies to report account information as permitted by law.

Supporting quotations

Credit reporting agencies, to report account information as permitted by law.

Qualifications & exceptions

• The stated limit is 'as permitted by law'.

Not stated here

• Which account information is reported is not specified here.

Sharing & Disclosure · Company practice

Information may be shared for legal compliance, terms enforcement, safety, corporate-group and advisor purposes

Evolve may also share information to comply with applicable law or obligations, to comply with applicable terms of service, to ensure the safety of the Company or its users, within its corporate group, with professional advisors such as auditors, law firms and accounting firms, or when the user consents, requests or directs the sharing.

Supporting quotations

We may also share your information to comply with applicable law or any obligations thereunder

to comply with applicable terms of service, to ensure the safety of the Company and/or its users, within our corporate group, with professional advisors such as auditors, law firms, and accounting firms, or when you consent, request or direct us to share information.

Qualifications & exceptions

• The purposes are alternatives in one list; the policy does not state that all apply at once.
• Sharing when the user consents, requests or directs is included in the same list.

Not stated here

• The policy does not describe the corporate group's entities here.

Sharing & Disclosure · Company practice

Information may be shared in an asset sale, merger, bankruptcy or other business transaction

The policy lists sharing in connection with an asset sale, merger, bankruptcy or other business transaction among the circumstances in which Evolve may share information.

Supporting quotations

in connection with an asset sale, merger, bankruptcy, or other business transaction

Qualifications & exceptions

• 'Other business transaction' is not defined in the policy.
• The policy does not state what happens to information after such a transaction.

Not stated here

• Whether a successor would be bound by this policy is not stated.

Data Access & Collection · Company practice

Usage Data is collected through Google Analytics, Hotjar and DoubleClick; Hotjar keeps a pseudonymized profile

Evolve says it collects Usage Data through Tracking Technologies including Google Analytics, Hotjar and DoubleClick. For Hotjar, it explains that the tool is used to understand user experience (such as time on pages, links chosen and likes or dislikes) so Evolve can build and maintain the Services with feedback; Hotjar uses cookies and other technologies and stores the information on Evolve's behalf in a pseudonymized user profile.

Supporting quotations

As described above, we collect Usage Data through Tracking Technologies, including Google Analytics, Hotjar, and DoubleClick.

For example, we use Hotjar to better understand our users’ experience

Hotjar uses cookies and other technologies to collect this information and stores this information on our behalf in a pseudonymized user profile.

Qualifications & exceptions

• The tool list is introduced by 'including' and is not stated as exhaustive.
• The Hotjar detail is given as an example ('For example').
• Hotjar stores the information on Evolve's behalf in a pseudonymized profile.

Not stated here

• The policy does not describe retention periods for the Hotjar profile or the other tools.

Data Access & Collection · User right or choice

Users may be able to block or delete cookies, with possible service effects; a Google Analytics opt-out is offered

Most browsers accept cookies automatically, but the policy says users may be able to control how their devices permit Tracking Technologies. A user may block or delete Evolve's cookies from the browser, but doing so may cause some Services to work incorrectly. The policy also links to a Google Analytics opt-out.

Supporting quotations

Most browsers accept cookies automatically, but you may be able to control the way in which your devices permit the use of Tracking Technologies.

If you choose, you may block or delete our cookies from your browser; however, blocking or deleting cookies may cause some of the Services to work incorrectly.

To opt out of tracking by Google Analytics, click here.

Qualifications & exceptions

• Control depends on the browser or device ('may be able to').
• Blocking or deleting cookies may cause some Services to work incorrectly.
• The opt-out link is specific to Google Analytics.

Not stated here

• No central opt-out for all tracking is described.

Use & Processing · Company practice

The website is not designed to respond to Do Not Track signals

The policy says a browser may send a 'Do Not Track' signal, but Evolve's website is not designed to respond to those signals. It refers readers to allaboutdnt.com for more information about the signal.

Supporting quotations

Like many websites, our website is not designed to respond to “Do Not Track” signals received from browsers.

Qualifications & exceptions

• The statement is about the website; the mobile app is not addressed in this item.

Not stated here

• Whether any other tracking control applies across the Services is not stated.

Data Access & Collection · Company practice

Mobile app collects phone contacts and images when the user shares the app

Evolve says that, in addition, it collects phone contacts and images in the mobile app when the user shares the app. The item does not state the purpose or further use of those contacts and images.

Supporting quotations

In addition, we collect phone contacts and images in the mobile app when you share the app.

Qualifications & exceptions

• The collection is limited to the mobile app and to when the user shares the app.

Not stated here

• The purpose, sharing and retention of phone contacts and images are not stated in this item.

Legal Rights & Agreement Rules · Restriction or exception

Third-party links are not endorsed and their privacy practices are outside Evolve's responsibility

Evolve may provide links to third-party websites or platforms. It tells users who follow links to unaffiliated sites to review those sites' policies and terms, says it is not responsible for the privacy, security or information found on those sites, and says inclusion of a link does not by itself imply endorsement. Information provided on public or semi-public venues may be viewable by others without limitation as to its use.

Supporting quotations

If you follow links to sites not affiliated with us, you should review their policies and other terms.

We are not responsible for the privacy, security, or information found on these sites.

Our inclusion of such links does not, by itself, imply any endorsement of the content on such platforms or of their owners or operators.

Qualifications & exceptions

• The disclaimer covers sites not affiliated with Evolve.
• The policy does not describe any review of third-party practices.

Not stated here

• The linked sites' policies are not supplied.

Data Access & Collection · Company practice

Children under 13 are not permitted; Evolve disclaims knowing collection and will try to delete

Children under 13 are not permitted to use the Services, and Evolve says it does not seek or knowingly collect personal information about children under 13. If it becomes aware that it has unknowingly collected such information, it will make commercially reasonable efforts to delete it from its database. A parent or guardian may contact Evolve to request deletion.

Supporting quotations

Children under the age of 13 are not permitted to use the Services, and we do not seek or knowingly collect any personal information about children under 13 years of age.

If we become aware that we have unknowingly collected information about a child under 13 years of age, we will make commercially reasonable efforts to delete such information from our database.

If you are the parent or guardian of a child under 13 years of age who has provided us with their personal information, you may contact us using the below information to request that it be deleted.

Qualifications & exceptions

• The deletion commitment is limited to 'commercially reasonable efforts'.
• The collection statement is limited to knowing collection.
• The parent or guardian request uses the contact information stated later in the policy.

Not stated here

• The policy does not state a separate children's contact channel.

Use & Processing · Company practice

Services are hosted in the United States and use authorizes transfer, storage and processing there

The policy says the Services are hosted and operated in the United States through Evolve and its service providers. By using the Services, a user acknowledges that information about them, whether provided by the user or obtained from a third party, is provided to Evolve and hosted on servers in the United States, and authorizes Evolve to transfer, store and process the information there.

Supporting quotations

The Services are hosted and operated in the United States through Company and our service providers. By using the Services, you acknowledge that any information about you, regardless of whether provided by you or obtained from a third party, is provided to us and hosted on servers in the United States, and you authorize us to transfer, store, and process your information to and in the United States.

Qualifications & exceptions

• The acknowledgment and authorization are tied to using the Services.
• The policy does not name the service providers or server locations beyond the United States.

Not stated here

• Whether any separate transfer mechanism applies is not stated.

Security & Safeguards · Company practice

Evolve says it uses reasonable efforts but cannot guarantee perfect security

Evolve says that despite reasonable efforts to protect information, no security measures are impenetrable and it cannot guarantee 'perfect security.' It also says information sent electronically may not be secure in transit and recommends not using unsecure channels for sensitive or confidential information.

Supporting quotations

Despite our reasonable efforts to protect your information, no security measures are impenetrable, and we cannot guarantee “perfect security.”

We recommend that you do not use unsecure channels to send us sensitive or confidential information.

Qualifications & exceptions

• The statement limits security guarantees; it does not describe specific safeguards.
• The recommendation addresses sending sensitive or confidential information over unsecure channels.

Not stated here

• The policy does not list the security measures used.

Legal Rights & Agreement Rules · Restriction or exception

California section applies only to California residents and includes sensitive personal information

The California residents section applies only to California residents. For that section, 'personal information' includes 'sensitive personal information' as defined under the CCPA. Evolve notes that some data described is exempt from CCPA requirements and rights, such as data regulated by the Fair Credit Reporting Act and the Gramm-Leach-Bliley Act, and points to its separate GLBA privacy policy.

Supporting quotations

This section applies to you only if you are a California resident

references to “personal information” shall include “sensitive personal information,” as these terms are defined under the California Consumer Privacy Act (“CCPA”).

certain of the data we describe below is exempt from the requirements of the CCPA and the rights that you have under the CCPA, such as data regulated by the Fair Credit Reporting Act and the Gramm Leach Bliley Act.

This Privacy Policy does not apply to information we collect about individuals who apply for or obtain financial products and services for personal, family or household purposes.

Qualifications & exceptions

• The section is geographically limited to California residents.
• The exemptions are examples ('such as') and include FCRA- and GLBA-regulated data.
• The separate GLBA policy is linked but not supplied.

Not stated here

• The full set of exempt data is not enumerated.

Cross-references

• qualified by (model-proposed): Consumer financial-product applicants are outside this policy and referred to a GLBA policy — The general policy excludes consumer financial-product applicants and points to a separate GLBA policy. The California section likewise says FCRA- and GLBA-regulated data is exempt from CCPA requirements and rights and points to the same separate policy. Both statements describe the same boundary for those customers; the linked GLBA policy is not in the saved source.

Data Access & Collection · Company practice

California table reports categories collected and disclosed for a business purpose in the preceding 12 months

Under the heading 'Processing of Personal Information,' the policy states that in the preceding 12 months it collected, and where indicated in the table disclosed for a business purpose, the listed categories of personal information and sensitive personal information. Sensitive categories are denoted by an asterisk. The table's columns are 'Category' and 'Categories of Recipients.'

Supporting quotations

Processing of Personal Information

In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *) about residents:

Category

Categories of Recipients

Qualifications & exceptions

• The table's time frame is the preceding 12 months.
• Disclosure is stated as 'where indicated below'; each row's recipient column supplies the indication.
• An asterisk denotes sensitive personal information.

Not stated here

• The policy does not give a specific as-of date for the 12-month period beyond the March 29, 2023 revision date.

Sharing & Disclosure · Company practice

California table: identifiers disclosed to vendors, marketing third parties, credit agencies and partners

The California data table lists 'Identifiers such as name, e-mail address, IP address' as a category collected in the preceding 12 months. For that row, the 'Categories of Recipients' column lists vendors or other service providers, third parties for marketing purposes, credit reporting agencies, and partners for whom Company may provide products or services. The introduction states that disclosure for a business purpose is indicated in the table; the table does not give a separate purpose for each recipient.

Supporting quotations

Identifiers such as name, e-mail address, IP address

In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *) about residents:

Vendors or other service providers

Third parties for marketing purposes

Credit reporting agencies

Partners for whom Company may provide products or services

Qualifications & exceptions

• The row associates the category and recipient categories by table position; the policy does not state a separate purpose for each recipient.
• The table reports the preceding 12 months.

Not stated here

• The table does not name specific recipients within each category.

Sharing & Disclosure · Company practice

California table: Customer Records categories disclosed to vendors, marketers, credit agencies and partners

The California data table lists 'Personal information categories listed in the California Customer Records statute such as name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number' as a category collected in the preceding 12 months. For that row, the 'Categories of Recipients' column lists vendors or other service providers, third parties for marketing purposes, credit reporting agencies, and partners for whom Company may provide products or services. The introduction states that disclosure for a business purpose is indicated in the table; the table does not give a separate purpose for each recipient.

Supporting quotations

Personal information categories listed in the California Customer Records statute such as name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number

In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *) about residents:

Vendors or other service providers

Third Parties for marketing purposes

Credit reporting agencies

Partners for whom Company may provide products or services

Qualifications & exceptions

• The row associates the category and recipient categories by table position; the policy does not state a separate purpose for each recipient.
• The table reports the preceding 12 months.

Not stated here

• The table does not name specific recipients within each category.

Sharing & Disclosure · Company practice

California table: protected classifications disclosed to vendors or other service providers

The California data table lists 'Characteristics of protected classifications under California or federal law such as race, color, national origin or ancestry, sex, age, physical or mental disability, veteran status and citizenship' as a category collected in the preceding 12 months. For that row, the 'Categories of Recipients' column lists vendors or other service providers. The introduction states that disclosure for a business purpose is indicated in the table; the table does not give a separate purpose for each recipient.

Supporting quotations

Characteristics of protected classifications under California or federal law such as race, color, national origin or ancestry, sex, age, physical or mental disability, veteran status and citizenship

In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *) about residents:

Vendors or other service providers

Qualifications & exceptions

• The row associates the category and recipient categories by table position; the policy does not state a separate purpose for each recipient.
• The table reports the preceding 12 months.

Not stated here

• The table does not name specific recipients within each category.

Sharing & Disclosure · Company practice

California table: commercial information disclosed to vendors, marketers and partners

The California data table lists 'Commercial information such as records of products or services purchased' as a category collected in the preceding 12 months. For that row, the 'Categories of Recipients' column lists vendors or other service providers, third parties for marketing purposes, and partners for whom Company may provide products or services. The introduction states that disclosure for a business purpose is indicated in the table; the table does not give a separate purpose for each recipient.

Supporting quotations

Commercial information such as records of products or services purchased

In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *) about residents:

Vendors or other service providers

Third Parties for marketing purposes

Partners for whom Company may provide products or services

Qualifications & exceptions

• The row associates the category and recipient categories by table position; the policy does not state a separate purpose for each recipient.
• The table reports the preceding 12 months.

Not stated here

• The table does not name specific recipients within each category.

Sharing & Disclosure · Company practice

California table: internet or network activity disclosed to vendors or other service providers

The California data table lists 'Internet or other similar network activity such as information regarding your interaction with the website' as a category collected in the preceding 12 months. For that row, the 'Categories of Recipients' column lists vendors or other service providers. The introduction states that disclosure for a business purpose is indicated in the table; the table does not give a separate purpose for each recipient.

Supporting quotations

Internet or other similar network activity such as information regarding your interaction with the website

In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *) about residents:

Vendors or other service providers

Qualifications & exceptions

• The row associates the category and recipient categories by table position; the policy does not state a separate purpose for each recipient.
• The table reports the preceding 12 months.

Not stated here

• The table does not name specific recipients within each category.

Sharing & Disclosure · Company practice

California table: geolocation data disclosed to vendors or other service providers

The California data table lists 'Geolocation data such as IP address' as a category collected in the preceding 12 months. For that row, the 'Categories of Recipients' column lists vendors or other service providers. The introduction states that disclosure for a business purpose is indicated in the table; the table does not give a separate purpose for each recipient.

Supporting quotations

Geolocation data such as IP address

In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *) about residents:

Vendors or other service providers

Qualifications & exceptions

• The row associates the category and recipient categories by table position; the policy does not state a separate purpose for each recipient.
• The table reports the preceding 12 months.

Not stated here

• The table does not name specific recipients within each category.

Sharing & Disclosure · Company practice

California table: audio, visual and similar information disclosed to vendors or other service providers

The California data table lists 'Audio, electronic, visual, thermal, olfactory, or similar information such as photographs, video recordings and voice recordings' as a category collected in the preceding 12 months. For that row, the 'Categories of Recipients' column lists vendors or other service providers. The introduction states that disclosure for a business purpose is indicated in the table; the table does not give a separate purpose for each recipient.

Supporting quotations

Audio, electronic, visual, thermal, olfactory, or similar information such as photographs, video recordings and voice recordings

In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *) about residents:

Vendors or other service providers

Qualifications & exceptions

• The row associates the category and recipient categories by table position; the policy does not state a separate purpose for each recipient.
• The table reports the preceding 12 months.

Not stated here

• The table does not name specific recipients within each category.

Sharing & Disclosure · Company practice

California table: professional or employment information disclosed to vendors, marketers and partners

The California data table lists 'Professional or employment-related information such as title of profession, employer, professional background' as a category collected in the preceding 12 months. For that row, the 'Categories of Recipients' column lists vendors or other service providers, third parties for marketing purposes, and partners for whom Company may provide products or services. The introduction states that disclosure for a business purpose is indicated in the table; the table does not give a separate purpose for each recipient.

Supporting quotations

Professional or employment-related information such as title of profession, employer, professional background

In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *) about residents:

Vendors or other service providers

Third Parties for marketing purposes

Partners for whom Company may provide products or services

Qualifications & exceptions

• The row associates the category and recipient categories by table position; the policy does not state a separate purpose for each recipient.
• The table reports the preceding 12 months.

Not stated here

• The table does not name specific recipients within each category.

Sharing & Disclosure · Company practice

California table: inferences disclosed to vendors and third parties for marketing

The California data table lists 'Inferences drawn from other personal information such as profile reflecting your preferences' as a category collected in the preceding 12 months. For that row, the 'Categories of Recipients' column lists vendors or other service providers and third parties for marketing purposes. The introduction states that disclosure for a business purpose is indicated in the table; the table does not give a separate purpose for each recipient.

Supporting quotations

Inferences drawn from other personal information such as profile reflecting your preferences

In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *) about residents:

Vendors or other service providers

Third parties for marketing purposes

Qualifications & exceptions

• The row associates the category and recipient categories by table position; the policy does not state a separate purpose for each recipient.
• The table reports the preceding 12 months.

Not stated here

• The table does not name specific recipients within each category.

Sharing & Disclosure · Company practice

California table: government identifiers disclosed to credit agencies, vendors and partners

The California data table lists 'Government Identifiers* such as Social Security, driver’s license, state identification card, or passport number' as a category collected in the preceding 12 months and marks it with an asterisk as sensitive personal information. For that row, the 'Categories of Recipients' column lists credit reporting agencies, vendors or other service providers, and partners for whom Company may provide products or services. The introduction states that disclosure for a business purpose is indicated in the table; the table does not give a separate purpose for each recipient.

Supporting quotations

Government Identifiers* such as Social Security, driver’s license, state identification card, or passport number

In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *) about residents:

Credit reporting agencies

Vendors or other service providers

Partners for whom Company may provide products or services

Qualifications & exceptions

• The row associates the category and recipient categories by table position; the policy does not state a separate purpose for each recipient.
• The table reports the preceding 12 months.

Not stated here

• The table does not name specific recipients within each category.

Sharing & Disclosure · Company practice

California table: account access credentials disclosed to vendors or other service providers

The California data table lists 'Account access credentials* such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to your account' as a category collected in the preceding 12 months and marks it with an asterisk as sensitive personal information. For that row, the 'Categories of Recipients' column lists vendors or other service providers. The introduction states that disclosure for a business purpose is indicated in the table; the table does not give a separate purpose for each recipient.

Supporting quotations

Account access credentials* such as account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to your account

In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *) about residents:

Vendors or other service providers

Qualifications & exceptions

• The row associates the category and recipient categories by table position; the policy does not state a separate purpose for each recipient.
• The table reports the preceding 12 months.

Not stated here

• The table does not name specific recipients within each category.

Sharing & Disclosure · Company practice

California table: precise geolocation disclosed to vendors or other service providers

The California data table lists 'Precise geolocation data*' as a category collected in the preceding 12 months and marks it with an asterisk as sensitive personal information. For that row, the 'Categories of Recipients' column lists vendors or other service providers. The introduction states that disclosure for a business purpose is indicated in the table; the table does not give a separate purpose for each recipient.

Supporting quotations

Precise geolocation data*

In the preceding 12 months, we collected and (where indicated below) disclosed for a business purpose the following categories of personal information and sensitive personal information (denoted by *) about residents:

Vendors or other service providers

Qualifications & exceptions

• The row associates the category and recipient categories by table position; the policy does not state a separate purpose for each recipient.
• The table reports the preceding 12 months.

Not stated here

• The table does not name specific recipients within each category.

Use & Processing · Company commitment

Purposes and sources are cross-referenced to Sections 1 and 3; sensitive information is limited to CCPA purposes

The California section says the business or commercial purposes for collection and the categories of sources are described in 'Section 1, Our Collection and Use of Information,' and that further information on disclosure purposes is in 'Section 3, How the Company Discloses Your Information.' It also states that Evolve only uses and discloses sensitive personal information for the purposes specified in the CCPA.

Supporting quotations

The specific business or commercial purposes for which we collect your personal information and the categories of sources from which we collect your personal information are described in the Section 1, Our Collection and Use of Information.

For further information on the purposes for which we disclosed personal information over the preceding 12 months, see Section 3, How the Company Discloses Your Information.

We only use and disclose sensitive personal information for the purposes specified in the CCPA.

Qualifications & exceptions

• The cross-references use section numbers that do not appear in the saved text; the reference records identify the matching headings.
• The sensitive-information limitation is stated for CCPA purposes.

Not stated here

• No additional purpose detail beyond Sections 1 and 3 is supplied in this item.

Retention & Deletion · Company practice

Retention lasts as long as reasonably necessary, with stated criteria

Evolve retains information for as long as is reasonably necessary for the purposes specified in the policy. It says it considers criteria including whether the information is needed to continue providing the Services, resolve a dispute, enforce contractual agreements, prevent harm, promote safety, security and integrity, or protect Evolve, including its rights, property or products.

Supporting quotations

We retain your information for as long as is reasonably necessary for the purposes specified in this Privacy Policy.

When determining the length of time to retain your information, we consider various criteria, including whether we need the information to continue to provide you the Services, resolve a dispute, enforce our contractual agreements, prevent harm, promote safety, security and integrity, or protect ourselves, including our rights, property or products.

Qualifications & exceptions

• The retention standard is 'reasonably necessary'; no fixed period is given.
• The criteria are introduced by 'including' and are not exhaustive.

Not stated here

• No specific retention periods are stated.

Sharing & Disclosure · Company commitment

Policy says it does not 'sell' or 'share' personal information as defined by the CCPA

Under the heading 'Selling and/or Sharing of Personal Information,' Evolve states that it does not 'sell' or 'share' personal information as those terms are defined under the CCPA, and has not done so in the preceding 12 months. It also says it does not have actual knowledge that it sells or shares personal information of residents under 16.

Supporting quotations

Selling and/or Sharing of Personal Information

We do not “sell” or “share” (as those terms are defined under the CCPA) personal information, nor have we done so in the preceding 12 months.

we do not have actual knowledge that we “sell” or “share” personal information of residents under 16 years of age.

Qualifications & exceptions

• The statement uses the CCPA definitions of 'sell' and 'share'.
• The under-16 statement is limited to actual knowledge.
• The statement covers the preceding 12 months as well as current practice.

Not stated here

• The policy does not explain how the CCPA definitions apply to the marketing disclosures described in the general sharing section.

Cross-references

• contrast (model-proposed): Partners and other third parties may receive information for products and marketing, including joint marketing — The general disclosure section permits disclosures to other third parties for marketing, including joint marketing with other financial companies, while the later section says Evolve does not 'sell' or 'share' personal information as those terms are defined under the CCPA. The statements use different defined terms; the policy does not reconcile them, and this relation records the contrast without deciding how the definitions apply.

Legal Rights & Agreement Rules · User right or choice

California residents may have the listed privacy rights, subject to legal limits

The 'Your California Privacy Rights' section says a California resident may have the rights listed below in relation to personal information collected about them. It states that the rights are not absolute and that in some cases Evolve may decline a request as permitted by law.

Supporting quotations

Your California Privacy Rights

As a California resident, you may have the rights listed below in relation to personal information that we have collected about you.

However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law.

This section applies to you only if you are a California resident

references to “personal information” shall include “sensitive personal information,” as these terms are defined under the California Consumer Privacy Act (“CCPA”).

Qualifications & exceptions

• The section applies to California residents.
• 'Personal information' for the section includes sensitive personal information as defined under the CCPA.
• The rights are expressly not absolute; refusal is permitted as allowed by law.

Not stated here

• The policy does not enumerate every refusal ground.

Legal Rights & Agreement Rules · User right or choice

Right to Know covers categories, sources, purposes, recipient categories and specific pieces

The policy states a right to request information about the collection, use and disclosure of personal information: the categories collected and disclosed for a business purpose; the categories of sources; the business or commercial purposes for collection; the categories of third parties to whom information was disclosed for a business purpose; and specific pieces of personal information collected.

Supporting quotations

Right to Know. You have a right to request the following information about our collection, use and disclosure of your personal information:

categories of personal information we have collected, disclosed for a business purpose;

categories of sources from which we collected personal information;

the business or commercial purposes for collecting personal information;

categories of third parties to whom the personal information was disclosed for a business purpose; and

specific pieces of personal information we have collected.

Qualifications & exceptions

• This is a right to request the listed information; the policy does not say the information is provided automatically.
• The rights intro states that requests may be declined as permitted by law.

Not stated here

• The response format and timing are not stated.

Legal Rights & Agreement Rules · User right or choice

Right to Delete covers personal information the company maintains

The policy states a right to request deletion of personal information Evolve maintains about the resident. The rights intro states that the rights are not absolute and requests may be declined as permitted by law.

Supporting quotations

Right to Delete.You have a right to request that we delete personal information we maintain about you.

However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law.

Qualifications & exceptions

• The right is framed as a request, not an automatic deletion.
• The section states that the rights are not absolute.

Not stated here

• The policy does not list exceptions to deletion in this item.

Legal Rights & Agreement Rules · User right or choice

Right to Correct covers inaccurate personal information the company maintains

The policy states a right to request correction of inaccurate personal information Evolve maintains about the resident, subject to the section's statement that the rights are not absolute.

Supporting quotations

Right to Correct.You have a right to request that we correct inaccurate personal information we maintain about you.

However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law.

Qualifications & exceptions

• The right is framed as a request.
• The section states that the rights are not absolute.

Not stated here

• The policy does not describe the correction process or evidence required.

Legal Rights & Agreement Rules · Procedure

No discrimination for exercising rights; identity and authorized-agent verification required

Evolve says it will not discriminate against a resident for exercising the listed rights. It may need information such as email address, government-issued ID or date of birth to verify identity before a substantive response. A resident may designate an authorized agent in writing or by power of attorney; Evolve requires proof of authorization and may also require the resident to verify identity directly.

Supporting quotations

We will not discriminate against you for exercising any of these rights.

We may need to collect information from you to verify your identity, such as your email address, government issued ID or date of birth, before providing a substantive response to the request.

You may designate, in writing or through a power of attorney document, an authorized agent to make requests on your behalf to exercise your rights.

Before accepting such a request from an agent, we will require that the agent provide proof you have authorized them to act on your behalf, and we may need you to verify your identity directly with us.

Qualifications & exceptions

• Verification is described as something Evolve 'may need' before a substantive response.
• Agent requests require proof of authorization and may require direct verification by the resident.

Not stated here

• The policy does not state how much information is required in each case or the response timeline.

Legal Rights & Agreement Rules · User right or choice

California residents may request Shine the Light details about direct-marketing sharing, once a year

The policy says California law permits residents to request certain details about how their personal information, as defined in California Civil Code Section 1798.83, is shared with third parties for the third parties' direct marketing. Evolve may from time to time elect to share personal information for those purposes. Residents may, under certain circumstances, obtain the categories shared and the names and addresses of all third parties that received information for direct marketing in the prior calendar year. Evolve says it is only required to respond to one request per resident each year.

Supporting quotations

California law permits residents to request certain details about how their “personal information” (as defined in California Civil Code Section 1798.83) is shared with third parties for their direct marketing purposes.

We may from time to time elect to share certain personal information about you with third parties for those third parties’ direct marketing purposes.

Residents may, under certain circumstances, obtain the categories of personal information shared and the names and addresses of all third parties that received personal information for their direct marketing purposes during the immediately prior calendar year.

Please note that we are only required to respond to one request per resident each year.

Qualifications & exceptions

• The request right is described as available 'under certain circumstances'.
• The response covers the immediately prior calendar year.
• The policy limits responses to one request per resident each year.

Not stated here

• The policy does not state a separate request channel apart from the general contact information.

Legal Rights & Agreement Rules · Procedure

CCPA rights and privacy questions use the contact form or 866.395.2754

To exercise CCPA rights or ask questions about privacy practices or the policy, Evolve directs users to its contact form or the phone number 866.395.2754.

Supporting quotations

To exercise your CCPA rights or should you have any questions about our privacy practices or this Privacy Policy, please use the following contact formor contact us at 866.395.2754.

Qualifications & exceptions

• The item gives a contact form link and a phone number.
• It does not state response times or a mailing address.

Not stated here

• No separate privacy email or postal address is given.