State Privacy Rights

1. Categories and Sources of Personal Information We Collect

The following table describes those categories and sources of information that we may collect from you and that we have collected from consumers during the past 12 months. References to categories of data in the rest of the Policy will also map to the categories in this table.

*We collect biometric information, professional/employment information, and education information for employees and job applicants only.

Categories of Sensitive Personal Information:

*We collect these categories of sensitive personal information for employees and job applicants only.

2. Sources of Personal Information

New Day obtains the categories of information listed above as described in our Privacy Policy and from the following categories of sources:

Information You Provide to Us

We may receive information directly from you when you interact with our websites, purchase products, interact with us or otherwise provide us with your information. We may also provide additional notices when collecting information from you about our collection, use and disclosure of that information. These notices may supplement or clarify our privacy practices with respect to that information and may provide you with additional choices about how we use that information.

Information Collected from Third Parties

We may collect your information from third party business partners such as social media sites, ad networks and analytics providers.

We may also collect information from others that refer you to our services.

Information Collected Automatically

When you use our Sites, our servers automatically record information. This information may include your IP address, browser type or the domain from which you are visiting, the webpages you visit, the search terms you use and any advertisements you interact with.

Cookies

We use third-party cookies that help us analyze how you use this website, store your preferences, and provide the content and advertisements that are relevant to you. A “cookie” is a small data file stored on your web browser or on your mobile device that allows us to recognize your computer or mobile device when you visit the Sites by associating identification numbers with other user information you have provided us. Some cookies will remain on the hard drive of your computer or mobile device for the duration of your browser or user session, while others will remain until deleted by you. You may also be able to configure your computer or mobile device to limit the collection of these “cookies,” but that limitation may also limit our ability to provide all the services or functionality of the Sites. For more information about cookies including how to set your internet browser to reject cookies please go to https://allaboutcookies.org/.

Pixel Tags

We may use pixel tags (also called web beacons or clear gifs) on our Sites. They can help us analyze what our customers like to do on our Sites and the effectiveness of our features and advertising. They can also help us customize your browsing experience. We may use information collected through pixel tags or tracked links in combination with your personal information. We may also combine personal information you provide to us with other personal information (such as purchase history and demographic information). If we work with other companies to help us track, collect and analyze this information, they will be prohibited from using this information for any other purpose.

Information Received from Service Providers

We may receive personal information about you from service providers that perform services on our behalf. Our service providers collect or process personal information as necessary to carry out services for us and at our direction.

Children’s Privacy and Age-Related Information Collection Policies

We do not knowingly collect or allow the collection of personal information with our Websites or Services from Users under the age of 16. If we have actual knowledge that we have collected personal information from someone under the age of 16 we will delete that personal information. If you believe that we have collected information from a child under the age of 16, please contact us at Privacy@newdayusa.com and/or toll free at (888) 990-7859.

3. Internet-Based Advertisements

Some of the advertisements presented on our Websites and Apps are provided by third-parties based on the activity of your browser or app. The information, which may contain personal information, may be provided to us by you or it may be derived by our advertising service providers from your browser’s activity over time and across non-related websites or apps. Such tracking can be accomplished with targeting cookies and/or pixels/web beacons. More information on interest-based advertising is available at the following Network Advertising Initiative link: https://thenai.org/about-online-advertising/. Note that stopping the collection of data used to present advertising to you that may be of more interest than a non-targeted advertisement will not prevent advertising.

4. Links to Non-New Day Websites

Our Sites may contain links to other websites. The fact that we link to a website is not an endorsement, authorization or representation of our affiliation with that third party. We do not exercise control over third party websites. These other websites may place their own cookies or other files on your computer or mobile device, collect data or solicit information from you. Other sites follow different rules regarding the use or disclosure of the information you submit to them. We are not responsible for the content, privacy and security practices, and policies of third party sites or services to which links or access are provided through our Sites. We encourage you to read the privacy policies or statements of the other websites you visit.

5. How We Use Your Information

We may use or disclose the information we collect about you as described in our Privacy Policy. We may also use or disclose your Personal Information for one or more business purposes:

• To fulfill or meet the reason you provided the information. For example, if you share your name and contact information to ask a question about our products or services, we will use that information to respond to your inquiry. If you provide your information to purchase a product or service, we will use that information to process your payment and facilitate delivery. We may also save your information to facilitate new product orders or process refunds. If you submit a review of our products or your experience with New Day, we may post that submission on our Sites, without identifying you by your full name or address.
• To provide, support, personalize and develop our Sites, products and services.
• To create, maintain, customize and secure your account with us.
• To process your requests, purchases, transactions and payments and prevent transactional fraud.
• To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
• To personalize your experience on our Sites and to deliver content and product and service offerings relevant to your interests, including targeted offers and ads through our Sites, third party sites and via email or text message (with your consent, where required by law).
• To help maintain the safety, security and integrity of our Sites, products and services, databases and other technology assets and our business.
• For testing, research, analysis and product development, including to develop and improve our Sites, products and services.
• To respond to law enforcement requests and as required by applicable law, court order or governmental regulations.
• As described to you when collecting your Personal Information or as otherwise set forth in applicable law ..
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of New Day’s assets, whether as a going concern or as part of bankruptcy, liquidation or similar proceeding, in which Personal Information held by New Day about users of our Sites and our customers is among the assets transferred.

New Day will not collect additional categories of Personal Information or use the Personal Information we collected for materially different, unrelated or incompatible purposes without providing you notice.

6. How We Share Your Information

New Day may disclose your information to service providers and third parties. When we disclose information for a business purpose, we enter into a contract with that service provider that contains processing instructions and obligations to apply to applicable law.

• Service Providers. We engage certain trusted service providers, which may include affiliates or subsidiaries, to perform functions and provide services to us, including hosting and maintenance, error monitoring, debugging, performance monitoring, billing, customer relationship, database storage and management and direct marketing campaigns. We may share your Personal Information with these service providers, but only to the extent necessary to perform these functions and provide such services. We also require these third parties to maintain the privacy and security of the Personal Information they process on our behalf.

We may also share your information with the following categories of third parties:

• Law Enforcement Agencies. We cooperate with government and law enforcement officials or private parties to enforce and comply with the law. To the extent permitted under applicable law, we may disclose any information about you to government or law enforcement officials or private parties as we believe is necessary or appropriate to investigate, respond to, and defend against claims, for legal process (including subpoenas), to protect the property and rights of New Day or a third party, to protect New Day against liability, for the safety of the public or any person, to prevent or stop any illegal, unethical, fraudulent, abusive or legally actionable activity, to protect the security or integrity of our Sites and Services and any equipment used to make the Sites and Services available, or to comply with the law.
• Other Third Parties:
  • Analytics Providers

We share your information with thirdparty analytics providers to help us understand how consumers interact with our websites, online services, and digital content. These third parties use the information to perform analytics, reporting, and measurement activities, such as evaluating website performance, understanding usage patterns, and improving our online offerings.

• Advertising and Marketing Partners

We share your information with thirdparty advertising and marketing partners to promote our products and services, measure the effectiveness of advertising campaigns, and support interestbased or targeted advertising.

7. Use and Disclosure of Sensitive Personal Information

New Day may use and or disclose sensitive personal information as required by law when entering into a financial transaction with you, including to meet federal reporting requirements.

New Day may use and/or disclose your sensitive personal information for purposes of processing an application for employment at New Day. This information is not shared or sold to any third parties and will only be used in the context it was provided for. However, this information may have to be disclosed to government entities to obtain a license.

8. Personal Information Sold or Shared

New Day shares personal information with third parties for cross-context behavioral advertising. New Day has no actual knowledge that it sells or shares the personal information of consumers under 16 years of age.

9. Data Retention

We retain personal data for as long as needed or permitted in light of the purpose(s) for which it was obtained and consistent with applicable law. The criteria used to determine our retention periods include:

• The length of time we have an ongoing relationship with you and provide the Services to you (for example, for as long as you keep using the Services);
• Whether there is a legal obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); or
• Whether retention is advisable in light of our legal position (such as in regard to applicable statutes of limitations, litigation, or regulatory investigations).

10. Use of Profiling and Automated Decision-Making Technology

Use of Profiling and Automated Decision-Making Technology ("ADMT")

We may use automated tools, models, analytics, and other technologies to process personal information in connection with providing financial products and services. These technologies may assist with evaluating information provided in connection with a loan application and supporting underwriting and eligibility determinations.

The use of these technologies may involve the automated processing of personal information and, in some circumstances, profiling. Profiling generally refers to the automated processing of personal information to evaluate, analyze, or predict characteristics or outcomes relating to an individual.

Depending on your state of residence and applicable law, you may have certain rights regarding profiling or automated decision-making technology. Any such rights are subject to applicable legal requirements, exceptions, exemptions, and limitations. Additional information regarding available rights is provided below under "Your Rights and Choices."

11. Your Rights and Choices

Applicable state privacy laws provide residents with certain rights regarding their personal information. This section describes those rights and explains how eligible consumers may exercise them.

Access to Specific Information and Data Portability Rights

You have the right to request that New Day disclose certain information to you about our collection and use of personal information. Once we receive and confirm your verifiable consumer request (see How to Exercise Your Rights), we will disclose to you, based on what you request:

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• Our business and/or commercial purposes for collecting or selling that personal information.
• The categories of third parties with whom we shared that personal information.
• The specific pieces of personal information we collected about you (also known as a data portability request).
• If we sold or disclosed your personal information for a business purpose, two separate lists disclosing: (1) sales, identifying the Personal Information categories that each category of recipient purchased; and (2) disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.

Deletion Request Rights

You have the right to request that New Day delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (see How to Exercise Your Rights), we will delete (and direct our service providers to delete) your Personal Information from our records, unless an exception applies.

Correction Request Rights

You have the right to request that New Day correct inaccurate information we maintain about you. Once we receive and confirm your verifiable consumer request (see How to Exercise Your Rights), we will review the information requested to be corrected and consider the totality of circumstances relating to the contested information.

If you submit documentation supporting your claim for the information you are contesting, we will review the document(s) provided. We may also require you to provide documentation if it is necessary to rebut our own documentation that the personal information is accurate.

Any documentation supplied in connection with a request to correct will only be used for purposes of correcting your information and for record keeping obligations (24 months from the date of request closure). Documentation that was collected on you that was not already maintained by us will not be repurposed.

Right to Know What Personal Information is Sold or Shared and to Whom

You have the right, if New Day sells, shares your information, to request that New Day disclose to you the following:

1. The categories of personal information that New Day collected from you.
   1. The categories of personal information that New Day sold or shared about you and the categories of personal information for each category of third parties to whom the personal information was sold or shared.
      1. The categories of personal information that New Day disclosed about you for a business purpose and the categories of persons to whom it was disclosed for a business purpose.

Right to Opt Out of Sale or Sharing of Personal Information

You have the right to direct New Day, if we sell or share your personal information to third parties, not to sell or share your personal information.

We have no actual knowledge that we sell or share the personal information of consumers under 16 years of age.

Right of No Retaliation Following Opt Out or Exercise of Other Rights

New Day may not discriminate against you if you exercise any of your rights as described above

Rights Related to Profiling and Automated Decision-Making Technology

Residents of certain states may have rights relating to profiling or automated decision-making technology used in furtherance of decisions that produce legal or similarly significant effects concerning them. Such rights may include the right to request information regarding our use of automated decision-making technology and, where required by applicable law, the right to opt out of certain uses of automated decision-making technology or to appeal certain decisions.

Any such rights are subject to applicable legal requirements, exceptions, exemptions, and limitations. Consumers may submit requests using the methods described in the "How to Exercise Your Rights" section.

How to Exercise Your Rights

To exercise the access, data portability, deletion, and correction rights described above, please submit a verifiable consumer request to us by either:

• Calling us at 888-990-7859;
• Emailing us at Privacy@Newdayusa.com; or
• Visiting https://www.newdayusa.com/privacy/data-rights and completing the form.

Only you, or an agent you authorize to act on your behalf, may make a verifiable consumer request related to your Personal Information.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative of that person.
• Describe your request with sufficient detail that allows us to properly understand, evaluate and respond to it.

We cannot respond to your request to exercise your access, data portability and/or deletion rights if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you.

Making a verifiable consumer request does not require you to create an account with us. However, we do consider requests made through your password-protected account sufficiently verified when the request relates to Personal Information associated with that specific account.

We will only use Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

Response Timing and Format

We attempt to respond to a verifiable consumer request within 45 days after we receive it. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing within 45 days after we receive your initial request.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period prior to the date we receive the verifiable consumer request. The response we provide will also provide the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Appeal Process

You have the right to appeal if we refuse to take action on your privacy rights request. You must submit your appeal within a reasonable period of time after receiving our decision. To begin the appeal process, please follow the instructions under "How to Exercise Your Rights" and submit a new request.

NewDay will respond to your appeal within 45 days of receiving it, providing a written update on the action taken or reasons for not taking action. If we require more time (up to 90 days) we will inform you of the reason and extension period in writing within 45 days after we receive your appeal request. If your appeal is denied, we will also inform you of how to contact the Attorney General of Connecticut (if you are a Connecticut resident), the Attorney General of Minnesota (if you are a Minnesota resident), the Attorney General of Montana (if you are a Montana resident), or the Attorney General of Oregon (if you are an Oregon resident) to file a complaint.\

Opt Out Preference Signal

If your browser supports an opt-out preference signal, you may opt out of the sharing or sale of your personal information by properly configuring the opt-out preference signal. If you subsequently delete cookies, change your browser settings, or use a different browser, you will need to turn the opt-out signal on again.

After you opt out of the “sharing” of your personal information, we will no longer “share” your personal information to third parties (except in an aggregated or de-identified manner so it is no longer personal information), but we will continue to share your personal information with our service providers, which process it on our behalf.

Non-Discrimination

We will not discriminate/retaliate against you for exercising any of your rights. Unless permitted by state law, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted that can result in different prices, rates or quality levels. Any permitted financial incentive we offer will reasonably relate to your Personal Information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.

12. California Shine The Light Law And Do Not Track

If you are a California resident and have an established business relationship with us, you may request that we not disclose your personal information to third parties for the third parties’ own direct marketing purpose (as defined in California Civil Code section 1798.83).

Note that we do not currently respond to web browser “do not track” signals. Although a protocol for the “do not track” signal was adopted, the standard for how to respond to the signal was not adopted.

13. Transfer Of Corporate Assets

If New Day is acquired by or merged with a third-party entity, New Day reserves the right to transfer or assign the personal information you provided to us as part of such merger, acquisition, sale, or other change of control to the new entity. In the event of bankruptcy, insolvency, reorganization, receivership, or assignment for the benefit of creditors, or the application of laws or equitable principles affecting creditor’s rights generally, we may not be able to control how your personal information is processed. If such a situation arises, New Day would request that all applicable privacy laws and protection standards at least as stringent as New Day’s be applied to your personal information originally in our possession. In the event of a transfer of corporate assets, the information regarding the transfer will be posted on our Websites.

14. Changes to this Supplemental Privacy Policy

New Day reserves the right to amend this Supplemental Privacy Policy at our discretion at any time. When we make changes to this Supplemental Privacy Policy, we will post the Supplemental Privacy Policy on the Sites and update the Supplemental Privacy Policy’s effective date. Your continued use of the Sites following the posting of changes constitutes your acceptance of such changes.

We welcome your questions, comments and concerns about privacy. Please email us at Privacy@Newdayusa.com with your feedback pertaining to privacy. You also may write to us at:

New Day Financial, LLC
360 South Rosemary Avenue, Suite 1900
West Palm Beach, FL 33401

Last Updated: [______], 2026