PRIVACY STATEMENT

Additional information for certain jurisdictions. We are committed to respecting the privacy rights of individuals under all privacy laws applicable to us. Some privacy laws require that we provide specific information about individual rights to applicable consumers, which we have set forth at the end of this privacy notice:

California: if you are a California resident, you have certain rights, under California privacy laws, regarding your personal information as set forth in Section 7 below.

EU/EEA: if you are in the European Union / European Economic Area, we provide further details about your rights under the GDPR in Section 10 below.

7. California Privacy Rights
Under California law, specifically the California Consumer Privacy Act ("CCPA"), California residents are required to be provided with certain specific information about the manner in which Prosperity handles their personal information, whether collected online or offline. This section does not address or apply to Prosperity’s handling of publicly available information made lawfully available by state or federal governments or other personal information that is subject to an exemption under the CCPA.

Categories of personal information that we collect. Our collection, use, and disclosure of personal information about a California resident will vary depending upon the circumstances and nature of our interactions or relationship with such resident. The table below sets out generally the categories of personal information (as defined by the CCPA) about California residents that we collect, sell, and disclose to others for a business purpose. We collect these categories of personal information from the sources described and for the purposes also detailed below.

CategoryExamplesCollected

A. Identifiers.A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiersYES

B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code 1798.80(e)).A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some personal information included in this category may overlap with other categories.YES

C. Protected classification characteristics under California or federal law.Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).YES

D. Commercial information.Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.YES

E. Biometric information.Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.NO

F. Internet or other similar network activity.Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.NO

G. Geolocation data.Physical location or movements.NO

H. Sensory data.Audio, electronic, visual, thermal, olfactory, or similar information.NO

I. Professional or employment-related information.Current or past job history or performance evaluations.YES

J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.NO

K. Inferences drawn from other personal information.Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.NO

Personal information does not include:

• Publicly available information from government records.
• De-identified or aggregated consumer information.
• Information excluded from the CCPA's scope, like:
  • Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data;
  • Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.

We obtain the categories of personal information listed above from the following categories of sources:

• Information from you that you actively provide: We collect this information from sources including from online forms, e-mail, and via telephone.
• Information from you that you provide passively from your use of your sites and services: We collect this information from sources including from a web browser, e-mail, app, or smartphone.
• Third Parties (information we collect about you from third party sources): We collect this from sources including marketing partners, lead generators, and website and app vendors.

Use of Personal Information. We may use or disclose the personal information we collect for one or more of the following business purposes:

• To fulfill or meet the services for which the information is provided.
• To provide you with information, products or services that you request from us.
• To provide you with email alerts, event registrations and other notices concerning our products or services, or events or news, that may be of interest to you.
• To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collections.
• To improve our website and present its contents to you.
• For testing, research, analysis and product development.
• As necessary or appropriate to protect the rights, property or safety of us, our clients or others.
• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
• As described to you when collecting your personal information or as otherwise set forth in the CCPA.
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

Sharing Personal Information. We may disclose your personal information to a third party for a business purpose.  When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract.

In the preceding twelve (12) months, we have disclosed the following categories of personal information for a business purpose:

Category A: Identifiers.
Category B: California Customer Records personal information categories.
Category C: Protected classification characteristics under California or federal law.
Category D: Commercial Information
Category I: Professional or employment-related information.

We disclose your personal information for a business purpose to the following categories of third parties:

• Our affiliates.
• Service providers.
• Third parties to whom you or your agents authorize us to disclose your personal information in connection with products or services we provide to you.

Categories of Personal Information Sold. The CCPA defines a “sale” as disclosing or making available to a third-party personal information in exchange for monetary or other valuable consideration. While we do not disclose personal information to third parties in exchange for monetary compensation from such third parties, we do disclose or make available the categories of personal information that we collect to our affiliate and subsidiary companies. We also may make certain categories of personal information available to third parties, in order to receive certain services or benefits from them (such as when we allow third party tags to collect browsing history and other information on our Services to improve and measure our ad campaigns), including:

• Category A. Identifiers. Name, contact information and other identifiers
• Category B. Personal information categories listed in the California Customer Records statute. Customer Records, Profiles and inferences
• Category C. Protected classification characteristics under California or federal law. Customer Records, Profiles and inferences.
• Category D. Commercial Information. Usage data, records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

Rights of California residents. California law grants California residents certain rights and imposes restrictions on particular business practices as set forth below.

• Do-Not-Sell: California residents have the right to opt-out of our sale of their personal information Opt-out rights can be exercised by clicking on the  “Do Not Sell My Personal Information” link here or on the homepage of our website. We do not sell personal information about residents who we know are younger than 16 years old without opt-in consent.
• Initial Notice: We are required to notify California residents, at or before the point of collection of their personal information, the categories of personal information collected and the purposes for which such information is used.
• Request to Delete: California residents have the right to request deletion of their personal information that we have collected about them and to have such personal information deleted, except where an exemption applies. We will respond to verifiable requests received from California residents as required by law.
• Request to Know: California residents have the right to request and, subject to certain exemptions, receive a copy of the specific pieces of personal information that we have collected about them in the prior 12 months and to have this delivered, free of charge, either (a) by mail or (b) electronically in a portable and, to the extent technically feasible, readily useable format that allows the individual to transmit this information to another entity without hindrance. California residents also have the right to request that we provide them certain information about how we have handled their personal information in the prior 12 months, including:
  • categories of personal information collected;
  • categories of sources of personal information;
  • business and/or commercial purposes for collecting and selling their personal information;
  • categories of third parties/with whom we have disclosed or shared their personal information;
  • categories of personal information that we have disclosed or shared with a third party for a business purpose;
  • categories of personal information collected; and
  • categories of third parties to whom the residents’ personal information has been sold and the specific categories of personal information sold to each category of third party.

California residents may make a Request to Know up to twice every 12 months. We will respond to verifiable requests received from California residents as required by law.

• Right to non-discrimination: The CCPA prohibits discrimination against California residents for exercising their rights under the CCPA. Discrimination may exist where a business denies or provides a different level or quality of goods or services, or charges (or suggests that it will charge) different prices, rates, or penalties on residents who exercise their CCPA rights, unless doing so is reasonably related to the value provided to the business by the residents’ data.
• Financial incentives: A business may offer financial incentives for the collection, sale or deletion of California residents’ personal information, where the incentive is not unjust, unreasonable, coercive or usurious, and is made available in compliance with applicable transparency, informed consent, and opt-out requirements. California residents have the right to be notified of any financial incentives offers and their material terms, the right to opt-out of such incentives at any time, and may not be included in such incentives without their prior informed opt-in consent. We do not offer any such incentives at this time.

Submitting Requests. Do-Not-Sell (Opt-out) Requests, Requests to Know, and Requests to Delete may be submitted:

• Do-Not-Sell: By clicking on the “Do Not Sell My Personal Information” (or similar link) at the bottom of this page or the homepage of our website.
• Requests to Know, Requests to Delete: Submitting a request to us at Prosperity Home Mortgage, LLC; 14501 George Carter Way, Suite 300, Chantilly, VA 20151
• All requests: By contacting us at (877) 275-1762 (toll free)

We will respond to verifiable requests received from California residents as required by law. For more information about our privacy practices, contact us as set forth in the “Contact Us” section above.

You may only make a verifiable consumer request to know information twice within a 12-month period. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm that the personal information relates to you. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

Once we receive your verifiable consumer request, we will send you an acknowledgement letter within 10 days which will describe our verification process. We will respond to your request within 45 days, if we are able to verify your identity. Requests for deletion will require a separate confirmation that you want your information deleted.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Please note we are unable to disclose or provide you with your Social Security Number, Driver’s License Number, or other government issued identification number, financial account number, any health insurance or medical identification number, an account password, or security questions and answers.

Rights Under California Shine the Light law. California residents may request from businesses with whom they have an established business relationship (1) a list of categories of personal information , such as name, address, e-mail address, and the type of services provided to the customer, that a business has disclosed to third parties during the immediately preceding calendar year for the third parties' direct marketing purposes and (2) the names and addresses of all such third parties. To request the above information please contact us by writing to us under the “Contact Us” section above. We will respond to such requests within 30 days of receipt.

Changes to Our Privacy Notice. Prosperity reserves the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will post the updated notice on the Website and update the notice’s effective date. Your continued use of our Website or Services following the posting of changes constitutes your acceptance of such changes.

8. Minors
Per applicable federal and state law, you must be at least 18 years of age in order to apply for a mortgage, thus you must be 18 years of age in order to register on Prosperity’s website. If you are a California resident under 18 years of age, you can request that we remove content or information that you have posted to our website or other online services. Note that fulfillment of the request may not ensure complete or comprehensive removal.

9. International Users
Our consumer applications are hosted by servers in the United States. If you are located outside of the United States, your personal information may be transferred to the United States. By submitting your personal information, you consent to its transfer to the United States and to its storage, processing, and use there.

10. European Union Residents and General Data Protection Regulation Information
None of our services are targeted towards, directed to or intended as solicitations to consumers in the European Union and/or the European Economic Area (EEA). In the event that the General Data Protection Regulation “GDPR” (a privacy law applicable to consumers residing in the European Economic Union) is applicable to a specific transaction and/or a specific consumer, any such consumer has the below rights.

(a) Right of access. You have the right to obtain from us confirmation as to whether or not personal information concerning you is being processed, and where that is the case, to request access to the personal information. The accessed information includes – among others - the purposes of the processing, the categories of personal information concerned, and the recipients or categories of recipient to whom the personal information have been or will be disclosed. You have the right to obtain a copy of the personal information undergoing processing. For further copies requested by you, we may charge a reasonable fee based on administrative costs.

(b) Right to rectify and complete personal information. You can request the rectification of inaccurate data and the completion of incomplete data. We will inform relevant third parties to whom we have transferred your data about the rectification and completion if we are legally obliged to do so.

(c) Right to restrict processing. Under certain circumstances, you have the right to restrict the processing of your Personal Information. In such instances, your Personal Information may only be processed by us for limited purposes.

(d) Right to erasure (right to be forgotten). You have the right to obtain from us the erasure of personal information concerning you in limited circumstances where:

• it is no longer needed for the purposes for which it was collected; or
• you have withdrawn your consent (where the data processing was based on consent); or
• following a successful right to object; or
• it has been processed unlawfully; or
• the data has to be erased in order to comply with a legal obligation to which we are subject.

We are not required to comply with your request to erase personal information if the processing of your personal information is necessary for compliance with a legal obligation or to establish, exercise or defend legal claims.

(e) Right to restriction of processing. You have the right to obtain from us restriction of processing your personal information. In this case, the respective data will be marked and only be processed by us for certain purposes. This right can only be exercised where:

• the accuracy of your personal information is contested, to allow us to verify its accuracy; or
• the processing is unlawful, but you do not want the personal information erased; or
• it is no longer needed for the purposes for which it was collected, but you still need it to establish, exercise or defend legal claims; or
• you have exercised the right to object, and verification of overriding grounds is pending.

We can continue to use your personal information following a request for restriction, where: (i) we have your consent; (ii) to establish, exercise or defend legal claims; or (iii) to protect the rights of another natural or legal person.

(f) Right to data portability. You have the right to receive the personal information concerning you, which you have provided to us, in a structured, commonly used and machine-readable format and you have the right to transmit those data to another entity without hindrance from us, but in each case only where the processing is (a) based on your consent or on the performance of a contract with you, and (b) also carried out by automated means.

(g) Right to object. You have the right to object at any time to any processing of your personal information which has our legitimate interests as its legal basis. You may exercise this right without incurring any costs. If you raise an objection, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms. The right to object does not exist, in particular, if the processing of your personal information is necessary to take steps prior to entering into a contract or to perform a contract already concluded.

(h) Right to object to our use of your personal information for direct marketing purposes. You can request that we change the manner in which we contact you for marketing purposes. You can request that we not transfer your personal information to unaffiliated third parties for the purposes of direct marketing or any other purposes.

(i) Right to withdraw consent. If you have given us your consent for the processing of your personal information, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

(j) Right to obtain a copy of safeguards. You can ask to obtain a copy of, or reference to, the safeguards under which your personal information is transferred outside the EU/EEA. We may redact data transfer agreements to protect commercial terms.

(k) Right to lodge a complaint with your local supervisory authority. You have a right to lodge a complaint with your local supervisory authority if you have concerns about how we are processing your personal information. We ask that you please attempt to resolve any issue with us first, although you have a right to contact your supervisory authority at any time.

To make any of these requests, please follow the instructions outlined in Section 6. We may require that you verify your identity to the exercise of any of these rights. Under certain circumstances, and in the event of a data breach involving your Personal Information that is likely to result in a risk to your rights and freedoms, we are required to notify the applicable supervisory authority within 72 hours after becoming aware of such a breach.

If you have been referred to our Company by a third party corporate client or a relocation services company, our Company is acting as a “Data Processor” under the direction of such corporate client or relocation services company, which are deemed “Data Controllers” under GDPR. The Data Controller is responsible for telling our company how your Personal Information should be used or processed in those specific transactions.