California Employee CCPA Disclosures & Privacy Policy

BELOW IS THE LEGAL INFORMATION WE ARE REQUIRED TO SHARE:

The CALIFORNIA EMPLOYEE CCPA DISCLOSURES AND PRIVACY POLICY by Billfloat, Inc. dba SmartBiz Loans (collectively, “SmartBiz,” “the Company,” “we,” “us,” or “our”) applies to job applicants, employees, owners, directors, officers, and contractors of SmartBiz who are acting in such a capacity (“employment position”) and who reside in the State of California (“consumers” or “you”). We adopt this policy to comply with the CCPA and other California privacy laws. Any terms defined in the CCPA have the same meaning when used in this privacy policy.

1. PERSONAL INFORMATION WE COLLECT

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with an individual consumer (“personal information”).

1.1. Personal information does not include:

• Publicly available information from government records
• De-identified or aggregated information
• Information excluded from the CCPA, like:
  • health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data; and
  • personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.

1.3. How We Use Your Personal Information:

We may use or disclose the personal information we collect for one or more of the following business and commercial purposes:

1. Performing services on behalf of us or by our service provider, including but not limited to:
   • To fulfill or meet the reason for which the information is provided.
   • To provide you with a decision on an employment application.
   • To provide you with employment benefits.
   • To carry out our obligations and enforce our rights arising from any contracts entered into between you and us.
2. Undertaking internal research for technological development and demonstration.
3. Debugging to identify and repair errors that impair existing intended functionality.
4. Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.
5. Auditing related to a current interaction with the you.
6. Short-term, transient use, provided the personal information that is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer’s experience outside the current interaction.
7. Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us.

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

1.4. Who We Share Your Personal Information with for a Business or Commercial Purpose:

We may disclose your personal information to a service provider or third party for a business or commercial purpose. When we disclose personal information for a business or commercial purpose, we enter a contract that describes the purpose and requires the service provider to both keep that personal information confidential and not use it for any purpose except performing the contract. Examples of who we share with include:

• Our service providers.

• Third parties to whom you authorize us to disclose your personal information in connection with your employment position, including but not limited to payroll processors and benefits administrators.

1.6. Sale of Personal Information

We do not and will not sell your personal information. We do not and will not sell the personal information of minors under 16 years of age without affirmative authorization.

2. CHANGES TO OUR PRIVACY POLICY

We reserve the right to amend this privacy policy at our discretion and at any time. When we make changes to this privacy policy, we will notify you by email or through a notice on our website homepage.