Rev. September 2022.

Your California Privacy Rights

CALIFORNIA PRIVACY POLICY

This California Consumer Privacy Act Policy of MPP, Co., Inc., Old United Casualty Company, and Old United Life Insurance Company (collectively, “we,” “us,” or “our”) applies solely to individuals who reside in the State of California (“consumers” or “you”). We adopt this policy to comply with the California Consumer Privacy Act of 2018 (“CCPA”), as amended by the California Privacy Rights Act of 2020 (“CPRA”). Any terms defined in the CCPA have the same meaning when used in this policy. Under the CCPA, California residents have the following rights: (1) the right to know, which is the right to request that we disclose what personal information we collect, use, and may disclose about you; (2) the right to delete, which is the right to request that we delete personal information that is collected or maintained by us, subject to certain exceptions in the CCPA; (3) the right to correct inaccurate personal information that is collected or maintained by us; (4) the right to limit use of your sensitive personal information to those business purposes set forth in the CCPA; and (5) the right to non-discrimination, which is the right to be free from discrimination for exercising any consumer rights under the CCPA.

Your Right to Know About Personal Information Collected, Disclosed, or Sold

You have the right to request that we disclose to you information about the collection and use of your personal information over the last 12 months, including:

• The categories of personal information we have collected about you;
• The categories of sources from which we have collected the personal information;
• The business or commercial purpose for collecting or selling personal information;
• The categories of third parties to whom we share personal information;
• The specific pieces of personal information we have collected about you;
• The categories of personal information we have disclosed about you for a business purpose; and
• The categories of third parties to whom your personal information as disclosed, by categories or categories of personal information disclosed.

We do not sell personal information.

Information We Collect

“Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a
particular consumer or household. Personal information does not include publicly available information or lawfully obtained truthful information that is a matter of public concern.

We may collect the following categories of your personal information:

• Personal identifiers such as a real name, alias, postal address, unique personal identifier, email address, account name, social security number, or other similar identifiers.
• Personal information under Cal. Civ. Code § 1798.80(e) such as a name, signature, social security number, address, telephone number, driver’s license or state identification card number, insurance policy number, bank account number, or any other financial information, medical information, or health insurance information.
• Characteristics of protected classifications under Federal and California law such as gender, disability, age (40 and older), marital status, medical conditions, and military or veteran status.
• Commercial information such as records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
• Biometric information: physiological, biological or behavioral characteristics that can be used, singly or in combination with each other or with other identifying data, to establish individual identity. Biometric information includes, but is not limited to, voice recordings, from which an identifier template, such as a voiceprint, can be extracted.
• Internet or other electronic network activity information such as information regarding interaction with an Internet website, application, or advertisement, and other similar information.
• Geolocation data such as physical location.
• Sensory data such as audio, electronic, visual, or similar information.
• Professional or employment-related information such as job history or other employment information.
• Inferences drawn from other categories of personal information such as to create a profile about a consumer reflecting the consumer’s preferences, characteristics, behavior, attitudes, abilities, and aptitudes.
• Sensitive personal information such as information that reveals consumer’s social security number, driver’s license, state identification card, passport number, account login, financial account, debit card or credit card in combination with any required security or access code, precise geolocation, racial or ethnic origin, religious or philosophical beliefs, union membership, genetic data, mail, email, or text messages contents, processing of biometric data for the purpose of uniquely identifying the 3 consumer, personal information concerning health, information concerning sex life or sexual orientation.

We collect each category of personal information about consumers from the following categories of sources:

• Directly from a consumer or the consumer’s representatives;
• External data sources, such as consumer reporting agencies and other companies that provide data related to a specific consumer, business property;
• Via our website directly or indirectly from information submitted through a web portal or through the use of cookies and other data tracking systems.
• Information from our affiliates;
• Sources used to facilitate the transaction of insurance and the investigation of associated claims including, but not limited to, medical providers, regulators, auditors, attorneys, investigators, adjusters, and other insurance companies.

We collect each category of personal information about consumers for the following business or commercial purposes:

• Operational purposes including to facilitate the transaction of credit life insurance, credit disability insurance, guaranteed auto protection (GAP coverage) and vehicle service contracts, and the investigation of associated claims, or to otherwise fulfill or meet the reason you provided us with your information;
• Maintaining or servicing our accounts, providing customer service, verifying customer information, processing payments, and advertising or marketing our services;
• Auditing related to a current interaction with the consumer and concurrent transactions and compliance with applicable standards;
• Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity;
• Debugging to identify and repair errors that impair existing intended functionality;
• Internal short-term, transient use;
• Undertaking internal research for technological development and demonstration;
• Undertaking activities to verify, maintain, or improve the quality or safety of the products and services we offer as well as our website, databases and other technology assets;
• To confirm eligibility for insurance benefits or payments;
• To respond to law enforcement requests and as required in connection with subpoenas, search warrants or other court orders and governmental regulations;
• For actuarial or research studies;
• In connection with a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of our business or assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding;
• Depending on our relationship, in connection with your provision of products or services to us;
• As otherwise described to you when collecting your personal information or required by law.

We will provide you notice and obtain your explicit consent if we collect additional categories of personal information or use the personal information we previously collected for materially different purposes.

We retain personal information only for as long as is reasonably necessary for the purposes described herein.

Information We Disclose

In the last 12 months, we have disclosed the following categories of personal information about consumers for a business purpose:

• Personal identifiers;
• Personal information under Cal. Civ. Code § 1798.80(e);
• Characteristics of protected classifications under Federal and California law;
• Commercial information;
• Sensory data;
• Sensitive personal information

We share personal information about consumers with the following categories of third parties:

• Entities, including affiliated companies, that facilitate or support our transaction of insurance, administration of vehicle service contracts, and the investigation of associated claims;
• Third Party Administrators, independent adjusters, outside counsel, investigators, and other parties for purposes of investigating and resolving claims;
• Regulatory and other government agencies;
• Consumer reporting agencies or insurance support organizations;
• Entities that have an interest in policies issued by us, such as a certificate holder, additional insureds, group policy owners, or lienholders;
• Entities who perform administrative, business, professional, or employment functions on our behalf;
• To our lawyers, accountants and auditors;
• As otherwise required by law.

We do not currently and do not intend in the future to sell personal information.

Right to Delete

You have the right to request that we delete from our records the personal information we have collected about you, subject to certain exceptions. Once we receive and confirm your request, we
will determine whether an exception applies. If an exception does not apply, we will delete your personal information from our records. We will also direct our service providers to delete your personal information from their records. If an exception applies, we will not delete your personal information from our records and we will notify you in writing of the reason that we are denying your request to delete your information from our records.

Right to Correct Inaccurate Information

You have the right to request that we correct any inaccurate personal information we have collected about you. Once we receive and confirm your request, we will determine if the information is
inaccurate and if so, we will immediately correct it. We may deny the request if we determine the information is more likely accurate than not after considering the totality of the circumstances.

Right to Limit Use and Disclosure of Your Sensitive Personal Information

You have the right to limit the use or disclosure of your sensitive personal information to that necessary for limited business purposes specified under the statute. Permitted uses and disclosures include, but are not limited to, maintenance or service of your account, providing customer service, processing payments, fulfilling orders, and other similar services necessary for the business operations. We do not use or disclose your sensitive personal information except for such limited business purposes as permitted by law. Prior to using or disclosing your sensitive personal information for any additional purposes, we will provide you with notice specifying such additional purposes and informing you of your right to limit use of your sensitive personal information to those purposes specifically allowed by law.

Non-Discrimination

A business may not discriminate against a consumer because the consumer exercised any of the foregoing rights.

Right to Opt-Out of Sale or Sharing of Your Personal Information with Third Parties

Although we do not currently sell your personal information or share it with third parties for cross-contextual behavioral advertising, and do not intend to do so in the future, you have the right to opt-out of any potential sale of your personal information. You also have the right to opt-out of any potential sharing of your personal information with third parties for cross-contextual advertising.

Do Not Track Policy

Do Not Track is a privacy preference that users may set in their web browsers. When a user turns on the Do Not Track signal, the browser sends a message to websites requesting them not to track the user. We do not comply with Do Not Track settings. For information about Do Not Track, please visit www.allaboutdnt.org.

Authorized Agent

You may use an authorized agent to submit to us the requests described in this privacy notice. An authorized agent is a natural person or a business entity that you have authorized to act on your behalf. If you use an authorized agent to submit a request to us, we will require you to (1) provide the authorized agent with signed permission to make requests on your behalf and then verify directly with us your own identity and the fact that you provided the authorized agent permission to submit the request; or (2) provide the authorized agent with a power of attorney pursuant to California Probate Code §§ 4000 to 4665. We may deny a request from an authorized agent that does not submit sufficient proof that they have been authorized by you to act on your behalf.

How to Submit a Request

To exercise any of your rights described in this California Consumer Privacy Act Policy, please submit a request to us by contacting us via one of the following methods:

• Click Here to Submit a Request Online
• Contact Customer Service at (800) 747 – 4400

Our Process to Verify Your Request

We will contact you to collect additional information to verify your identity. Depending on the nature of the request, we will require you to provide either two or three pieces of information. We will seek to associate this information with information already in our systems in order to allow us
to verify that you are the person about whom we collected personal information. We may request additional information if we are unable to verify your identity. We may also require you to submit a signed declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request. This process is intended to help us protect the privacy
and security of the personal information we maintain.

Any information we collect for purposes of verifying your identity in this context will not be used for any other purpose. If we are unable to verify that you are the person about whom we collected personal information, or that you have authority to make the request on that person’s behalf, we will notify you that we will not be able to respond to your request.

We will endeavor to respond to your request within 45 days of the date you submit it. If we require additional time, we will notify you of the extension in writing.

We will not respond to more than two requests from the same consumer in any 12-month period. We will not charge a fee to process or respond to your verifiable consumer request unless it is
excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Information Security

We authorize our employees, agents, outside vendors and others to access personal information only when they have a business reason to do so. We have physical, electronic, and procedural safeguards to protect personal information from unauthorized access.

Contact for More Information

For questions or concerns about our privacy policies or practices, please contact our Customer Service Department at (800) 747-4400 or via email at mppcustomerservice@mpp.com. If you have a disability, you may contact us to access this notice in an alternative format.

Information Not Subject to CCPA

This California Consumer Privacy Policy does not apply to personal information not covered by the CCPA, including but not limited to (1) certain medical information governed by the California
Confidentiality of Medical Information Act or the Health Insurance Portability and Accountability Act of 1996 (HIPAA), as amended, and related regulations; (2) certain information that is furnished to or collected from a consumer reporting agency and used in accordance with the Fair Credit Reporting Act; (3) personal information collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act, and implementing regulations, or the California Financial Information Privacy Act; and (4) information collected, processed, sold, or disclosed pursuant to the Driver’s Privacy Protection Act of 1994.

Changes to Policy

This policy was last reviewed and updated in September 2022. We may change this policy at any time.