State Privacy Notice

Last Modified: December 18, 2023

This State Privacy Notice supplements wemlo LLC’s Privacy Notice and applies solely to individuals who reside in the States of California, Colorado, Connecticut, Utah, and Virginia (“consumers” or “you”) and access our websites or use our mobile applications (collectively, the “Online Services”), contact us, or otherwise interact with us (collectively, the “Services”).

The California Consumer Privacy Act of 2018 (“CCPA”), the Colorado Privacy Act, the Connecticut Act Concerning Personal Data Privacy and Online Monitoring, the Utah Consumer Privacy Act, and the Virginia Consumer Data Protection Act, as each comes into force and as each may be amended (collectively, the “U.S. State Privacy Laws”), provide consumers with certain rights with respect to their personal information. Pursuant to the U.S. State Privacy Laws, this U.S. State Privacy Notice includes specific disclosures for consumers regarding the information handling and privacy practices of wemlo, LLC and its subsidiaries and affiliates (collectively, “wemlo,” “us,” “our,” or “we”). This U.S. State Privacy Notice also describes the rights available to consumers in relation to their personal information and how they can exercise those rights.

We have made this U.S. State Privacy Notice easy to navigate by providing quick access to information you may care about and easy to understand by using plain English. We strongly urge you to read this U.S. State Privacy Notice from beginning to end to gain a better understanding of our information handling and privacy practices and how you can exercise your privacy rights.

Unless otherwise expressly stated, all terms used in this State Privacy Notice have the same meanings ascribed to them in our Privacy Notice.

Collection of personal information

We may collect a variety of information from and about you in connection with our delivery of the Services. The “Personal information we collect” section of our Privacy Notice describes the categories of personal information we collect and the sources of the information.

Use of personal information

As described in more detail in the “How we use personal information” section of our Privacy Notice, we collect personal information to provide and manage the Services and as otherwise necessary or appropriate in connection with the fulfillment of other legitimate business purposes.

Sharing of personal information

As described in more detail in the “How we share personal information” section of our Privacy Notice, we share personal information with certain categories of third parties to provide and manage the Services and as otherwise necessary or appropriate in connection with the fulfillment of other legitimate business purposes.

Your privacy rights

Pursuant to the U.S. State Privacy Laws, you may be entitled to exercise the following rights in relation to your personal information, subject to certain legal limitations and exceptions:

Right to Know/Access.
You may have the right to know whether we are processing your personal information and to obtain certain details about your personal Information, such as:

• The categories of personal information we have collected about you;

• The categories of sources for the personal information we have collected about you;

• Our business or commercial purpose for collecting or disclosing your personal information;

• The categories of third parties to whom we disclosed your personal information;

• The specific pieces of personal information we have collected about you;

• And if we disclosed your personal information to third parties, two separate lists disclosing:
  (1) the categories of personal information and the categories of third parties to whom we disclosed such information for a business purpose; and
  (2) the categories of personal information and the categories of third parties to whom we “sold” or “shared” (as these terms defined in the U.S. State Privacy Laws) such information.

Right to Data Portability.
You may have the right to obtain a copy of your personal information in a portable, and to the extent technically feasible, readily usable format that allows you to easily transmit the data to another party.

Right to Correction.
You may have the right to request correction of any inaccuracies in the personal information that we maintain about you.

Right to Delete.
You may have the right to request that we delete the personal information that we maintain about you, subject to certain exceptions.

Right to Opt-Out of Sales or Sharing of Personal Information.
You may have the right to direct us not to “sell” your personal information or “share” your personal information with third parties for “cross-context behavioral advertising” (as these terms are defined in the U.S. State Privacy Laws) at any time.

Right to Opt-Out of Other Processing.
You may have the right to direct us not to process your personal information for “targeted advertising” (as defined in the U.S. State Privacy Laws) or certain forms of profiling at any time.

Right to Non-Discrimination.
We will not discriminate against you if you decide to exercise your rights under the U.S. State Privacy Laws.

Exercising your privacy rights

If you are interested in exercising any of the rights described above, you can submit a request to us by either:

• Calling us at 866.523.3876; or

• Or, email us at privacy@wemlo.io

If you are interested in exercising your right to opt out of the “sale” or “sharing” of your personal information, you can also submit your request to us by clicking the “Do Not Sell or Share My Personal Information” link in the footer of our website and following the instructions.

Upon receipt of your request, we will endeavor to honor it based on the information that we collect and maintain.

Depending on the nature of your request, you will need to do the following in order for us to honor it:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we have collected personal information. This may require the matching of up to three pieces of personal information provided with your request with information we maintain in order to verify that it is you making the request. Where applicable, we will use the requested information for verification purposes only.

• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

Please note that we may decline certain requests if we cannot verify your identity and confirm the personal information we maintain relates to you.
If you have any questions about your rights or the form, please email us at privacy@wemlo.io.
Please note that you may only make a request to know/access or data portability twice within a 12-month period.
Exercising your rights does not require you to create an account with us.

Authorized agents.

You may authorize someone to submit a privacy rights request on your behalf (an “authorized agent”) using the submission methods outlined above. An authorized agent will need to demonstrate that you have authorized them to act on your behalf, unless you have provided the agent with power of attorney pursuant to applicable probate law. Depending on the evidence provided, we may also contact you to verify your identity directly with us or request confirmation from you that the agent is authorized to submit the request on your behalf.

Appealing privacy rights decisions

Depending on your state of residency, you may have the right to appeal a decision we have made in connection with your privacy rights request. All appeals should be submitted via email to privacy@wemlo.io with the word “APPEAL” clearly indicated in the subject line. If you are unsatisfied with the way that we have handled your appeal, you may have the right to complain to your state’s Attorney General.

Changes to this U.S. State Privacy Notice

We reserve the right to amend this U.S. State Privacy Notice at our discretion and at any time. The “Last Modified” date at the top of this page indicates when this U.S. State Privacy Notice was last revised. Any changes to this U.S. State Privacy Notice will become effective when we post a revised version of it on this page unless otherwise specified. We encourage you to visit this page frequently to stay informed of any changes to this U.S. State Privacy Notice.

California-specific disclosures

The following additional disclosures apply only to residents of the State of California.

Personal information collection and disclosure
The CCPA requires that we disclose what personal information we collect by reference to specific categories of personal information. To address this obligation, this section, beginning with the list below, details which categories of personal information we have collected from and about California consumers in the last twelve (12) months, the sources of each category of information, and the categories of third parties to whom we have disclosed each category of information for a business purpose. Please note that list below specifies, by category, the types of information described in the “Personal information we collect” section of our Privacy Notice, as required by the CCPA.

• Identifiers, including names, addresses, email addresses, Social Security numbers, online identifiers, IP addresses, account names, and other similar identifiers.

• Customer Records, including name, address, telephone number, education, employment, or financial information.

• Protected classification characteristics, including age, national origin, citizenship, marital status, physical or mental disability, sex (including pregnancy or childbirth and related medical conditions), veteran or military status.

• Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

• Internet or other similar network activity, including browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.

• Professional or employment-related information, including current or past job history.

• Inferences drawn from other personal information.

• Sensitive personal information, including log-in information for accounts in combination with passwords allowing access to accounts.

We may collect this personal information from the following categories of sources: (i) directly from consumers, for example, when consumers contact us or provide information requested to perform mortgage loan processing; (ii) indirectly from business partners or affiliates, or from consumers by observing their actions on our Online Services; and (iii) third parties, such as MLS services, Facebook, Google, and consumer identity and access management companies. We disclose all of these categories of personal information for a business purpose to service providers, or other third parties as detailed in the “How we share personal information” section of our Privacy Notice.

Sale and sharing of personal information
We may “sell” or “share” (as these terms are defined in the CCPA) and have “sold” and “shared” in the past twelve (12) months, the following categories of personal information to the following categories of recipients: (i) identifiers, usage data, customer records, commercial information and profiles with our affiliates; and (ii) identifiers, usage data and commercial information to ad networks, social media platforms and data analytics providers (e.g., in order to improve and measure our ad and marketing campaigns).
We do not “sell” or “share” the personal information of individuals we know to be under 16 years of age, unless we receive affirmative authorization from either an individual who is between 13 and 16 years of age or the parent or guardian of an individual less than 13 years of age.

Use and disclosure of sensitive personal information
We collect certain “sensitive personal information” (as defined in the CCPA). However, we do not use or disclose such information for any purpose outside of the limited permissible purposes set forth in the regulations implementing the CCPA. Such purposes include providing the Services and verifying, maintaining the quality of, and improving the Services.

Retention of personal information
As described in more detail in the “Information retention” section of our Privacy Notice, we will only retain your Personal Information as long as we need it to fulfill the purpose(s) for which it was collected, including providing the Services to you, maintaining your Account with us (where applicable), complying with our legal obligations, or protecting our interests or those of others.

“Shine the Light” notice
In addition to the rights described above, California’s “Shine the Light” law (Civil Code Section § 1798.83) permits California residents that have an established business relationship with us to request certain information regarding our disclosure of certain types of personal information to third parties for their direct marketing purposes during the immediately preceding calendar year.

To make such a request, please email privacy@wemlo.io. This request may be made no more than once per calendar year. We will respond to your request in accordance with applicable law. We reserve the right to not respond to requests submitted other than via the method described in this section.