PRIVACY RIGHTS ADDENDUM
Last Modified: September 18, 2026
ABOUT THIS ADDENDUM
This EL TORO Privacy Rights Addendum (“Addendum”) is intended to set forth rights to consumers (and the methods for exercising such rights) provided under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (“CCPA”); the Colorado Privacy Act (“CPA”); the Connecticut Data Privacy Act (“CTDPA”); the Delaware Personal Data Privacy Act (“DPDPA”); the Indiana Consumer Data Protection Act (“INCDPA”); the Iowa Consumer Data Protection Act (“ICDPA”); the Kentucky Consumer Data Protection Act (“KCDPA”); the Maryland Online Data Privacy Act (“MODPA”); the Minnesota Consumer Data Privacy Act (“MCDPA”); Montana Consumer Data Privacy Act (“MTCDPA”); the Nebraska Data Privacy Act (“NDPA”); the New Hampshire DataPrivacy Act (“NHDPA”); the New Jersey Data Protection Act (“NJDPA”); the Oregon Consumer Privacy Act (“OCPA”); the Rhode Island Data Transparency and Privacy Protection Act (“RIDTPPA”); the Tennessee Information Protection Act (“TIPA”), the Texas Data Privacy and Security Act (“TDPSA”); Utah Consumer Privacy Act (“UCPA”), and the Virginia Consumer Data Protection Act (“VCDPA”).
This Addendum is intended solely for, and is applicable only to, natural persons who are residents of the State of California (“California Consumers”), State of Connecticut (“Connecticut Consumers”), State of Colorado (“Colorado Consumers”), State of Delaware (“Delaware Consumers”), State of Indiana (“Indiana Consumers”), State of Iowa (“Iowa Consumers”), Commonwealth of Kentucky (“Kentucky Consumers”), State of Maryland (“Maryland Consumers”), State of Minnesota (“Minnesota Consumers”), State of Montana (“Montana Consumers”), State of Nebraska (“Nebraska Consumers”), State of New Hampshire (“New Hampshire Consumers”), State of New Jersey (“New Jersey Consumers”), State of Oregon (“Oregon Consumers”), State of Rhode Island (“Rhode Island Consumers”), State of Tennessee (“Tennessee Consumers”), State of Texas (“Texas Consumers”), State of Utah (“Utah Consumers”), or the Commonwealth of Virginia (“Virginia Consumers”), as defined in their respective privacy laws (together “Consumers”).
For Consumers in an above-listed state, this Addendum supplements the information in EL TORO’s Privacy Policy. If you are not a Consumer in an above-listed state, this Addendum does not apply to you, and you should not rely on it. In addition, EL TORO reserves the right to amend or revise this Addendum at any time, at our sole discretion, and with an associated effective date. Any revised Addendum will be posted on EL TORO’s website(s).
YOUR PRIVACY CHOICES AND RIGHTS
California, Connecticut, Colorado, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia Consumers have one or more of the following rights: the right to make Opt-Out, Confirmation, Access, Correction, and Deletion requests, and the right to appeal a decision to businesses. These requests may be made by the Consumer or by the Consumer’s parent, or legal guardian on the Consumer’s behalf. Additionally, opt-out requests and requests to limit the use of sensitive personal information may be made by an authorized agent of the Consumer; provided the authorized agent submits valid proof of authorization and is otherwise statutorily permitted to make such requests. Under the CCPA, such authorized agents may additionally make Confirmation, Access, Correction, and Deletion requests.
Please note that we may sometimes act as a “business” or “controller” of data, and other times as a vendor, “service provider,” or “third party” for data (for instance, when we merely process our clients’ data to perform a service and then delete it from our systems). Thus, the rights described in this document only apply to some of the data we hold. In addition, when required by applicable law, we will forward any consumer request to a named client, as feasible.
RIGHT TO OPT-OUT OF THE SALE OR SHARE OF YOUR PERSONAL INFORMATION; RIGHT TO OPT-OUT OF “TARGETED ADVERTISING”
California, Connecticut, Colorado, Delaware, Indiana, Iowa, Kentucky, Minnesota, Maryland, Montana, Nebraska, New Hampshire, New Jersey, Rhode Island, Oregon, Tennessee, Texas, Utah, and Virginia Consumers may opt out of the “sale” or “share” of their personal information, though we make this option available to all US residents. In some of these states, Consumers may also opt out of the use of their personal information for “profiling” and/or “targeted advertising.”
If you would like to opt-out:
- Complete this Do Not Sell or Share My Personal Information / Opt-Out Request Form; or
- Contact us at 855-935-8676 (Toll Free).
To complete your request, we maintain the personal information you provide in a “suppression file,” which allows us to prevent data tied to that information from being added to our active advertising database at a later time. This further prevents such information from being shared, sold, or used in targeted advertising activities by our company.
RIGHT TO REQUEST ACCESS TO THE CATEGORIES OF INFORMATION (“CATEGORY ACCESS REQUEST”)
California Consumers have the right to request that we disclose the following: (1) The categories of personal information we have collected about you; (2) the categories of sources from which the personal information is collected; (3) our business or commercial purpose for collecting, selling, or sharing personal information; and (4) the categories of third parties to whom we disclose personal information.
Maryland Consumers have the right to request that we disclose a list of the categories of third parties to which we have disclosed your personal data or a list of the categories of third parties to which we have disclosed any consumer’s personal data if we do not maintain this information in a format specific to you.
We complete these types of requests by providing a report on the categories of information you have requested us to provide. For requests from California Consumers to know categories of personal information, we further provide a report that contains where applicable: (1) the categories of personal information we have collected about you; (2) the categories of sources from which the personal information was collected; (3) the business or commercial purpose for which we collected, sold, or shared the personal information; (4) the categories of third parties with whom we disclose personal information; (5) the categories of personal information that we sold or shared about you, and for each category identified, the categories of third parties to whom we sold or shared that particular category of personal information; and (6) the categories of personal information we disclosed for a business purpose, and for each category identified, the categories of service providers or contractors to whom we disclosed that particular category of personal information.
A Category Access Request is different from an Access Request, which returns specific pieces of personal information held.
To request that we disclose the categories of your personal information that we collect, use, sell, or share, you may:
- Complete the online web form here; or
- Contact us at 855-935-8676 (Toll Free).
For security purposes (and as required under applicable law), we will verify your identity by requesting certain information from you. For instance, if you request categories of personal information we have received about you, you may need to confirm that you reside at a particular address or that you are in possession of a particular identifier that confirms to a sufficient degree that you are the person you claim to be.
RIGHT TO REQUEST ACCESS TO YOUR PERSONAL INFORMATION (“ACCESS REQUEST” OR “REQUEST TO KNOW”)
California, Connecticut, Colorado, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia Consumers may request access to specific pieces of personal information we have collected about you. To complete this type of request, we provide an Access Report which will contain the verifiable data we hold about you.
We may withhold some personal information, however, when we are not able to verify to a reasonable degree that the personal information we have is that of the person who submitted the request, and, consequently, the release of the information would pose a risk to individuals or our business. For example, we often are not able to provide such specific pieces of personal information – in particular, precise location coordinates – for this reason. For those sets of information, we are not able to sufficiently verify that the personal information we have pertains to the person who has submitted the request, or whether either the person in possession of a device or the person requesting the information is the actual device owner. A number of people may be temporarily in possession of another person’s phone, such as a partner, friend, or work colleague – whether consensually or not. We seek to avoid (and believe privacy laws require us to avoid) a situation where such a person might obtain potentially detailed and sensitive records pertaining to the phone’s owner. Moreover, because in operating our services we do not collect or connect names to home addresses (which we avoid in order to protect consumer privacy), we do not have other, more conventional ways to verify the identity of an actual device owner.
To request that we disclose the specific pieces of personal information that we have collected from you, you may:
- Complete the online web form, here; or
- Contact us at 855-935-8676 (Toll Free).
For security purposes (and as required under applicable law), we will verify your identity by requesting certain information from you. For instance, you may need to confirm that you reside at a particular address or that you are in possession of a particular identifier that confirms to the sufficient statutory degree that you are the person you claim to be. Please see above for more information about the limits of such verification and our ability to provide specific pieces of information, and how we thus may respond to such requests.
If you are uncomfortable with your device information being used in the ways described above and as set forth in our Privacy Policy, found here, we recommend that you request an “opt-out” of your information, found here and described above. The Network Advertising Initiative (“NAI”), a leading self-regulatory organization, provides additional, comprehensive information about how to opt-out here.
RIGHT TO CONFIRM WHETHER OR NOT WE ARE PROCESSING YOUR PERSONAL DATA (“RIGHT TO CONFIRM”)
Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia Consumers may also request we confirm whether or not we are processing their personal data. When you exercise this request, you will receive a report on whether or not we are processing your personal data. A Right to Confirm Request is different from an Access Request, which returns specific pieces of personal information held.
To request that we confirm whether or not we are processing your personal data, you may:
- Complete the online web form, here; or
- Contact us at 855-935-8676 (Toll Free).
For security purposes (and as required under applicable law), we will verify your identity by requesting certain information from you. For instance, you may need to confirm that you reside at a particular address or that you are in possession of a particular identifier that confirms to the sufficient statutory degree that you are the person you claim to be.
RIGHT TO CORRECT YOUR PERSONAL INFORMATION (“CORRECTION REQUEST”)
For California, Connecticut, Colorado, Delaware, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia Consumers: If you believe we have inaccuracies in your personal data, you have the right to request we correct the inaccuracies. Upon receipt of a valid Correction Request, we will remove or correct the information you identified as inaccurate from our systems.
To request that we correct inaccuracies in your personal data, you may:
- Complete the online web form here; or
- Contact us at 855-935-8676 (Toll Free).
For security purposes (and as required under applicable law), we will verify your identity by requesting certain information from you. For instance, you may need to confirm that you reside at a particular address or that you are in possession of a particular identifier that confirms to the sufficient statutory degree that you are the person you claim to be.
RIGHT TO REQUEST DELETION OF YOUR PERSONAL INFORMATION (“DELETION REQUEST”)
As a California, Connecticut, Colorado, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia Consumer, you may request that we delete any personal information that we have about you. Note that this is different from your right to “opt-out” of us selling your personal information.
To request that we delete your personal data, you may:
- Complete the online web form, here; or
- Contact us at 855-935-8676 (Toll Free).
Therefore, if you seek to exercise your right to keep us from selling your information by placing your information (such as your mobile identifier) on a suppression list, please complete an “opt-out” request, found here. You also may “opt-out” by visiting the opt-out pages offered by the NAI (here) and the Digital Advertising Alliance (DAA) (here).
Under the CCPA, CTDPA, CPA, DPDPA, INCDPA, ICDPA, KCDPA, MODPA, MCDPA, MTCDPA, NDPA, NHDPA, NJDPA, OCPA, RIDTPPA, TIPA, TDPSA, UCPA, and VCDPA, we may retain personal information collected directly from consumers, even after receiving a “deletion” request, for certain important purposes, such as: (a) to protect our business, systems, and users from fraudulent activity, (b) to address technical issues that impair existing functionality (such as de-bugging purposes), (c) as necessary for us, or others, to exercise free speech or other rights, (d) to comply with law enforcement requests pursuant to lawful process or other legal obligations, (e) for scientific or historical research, or (f) for our own internal purposes reasonably related to your relationship with us. Please also note that we need certain types of information so that we can provide our services to you. If you ask us to delete it, you may no longer be able to access or use our services.
Additionally, under the CTDPA, CPA, ICDPA, KCDPA, MCDPA, MTCDPA, NDPA, NHDPA, OCPA, RIDTPPA, TIPA, TDPSA, UCPA, and VCDPA, because we do not collect data directly from you, we may comply with your Deletion Request by processing your request in the same manner as we process an opt-out request.
EMPLOYEE OR JOB APPLICANT REQUEST
California offers certain rights to former, current, and prospective employees related to data we collect for employment purposes. If you are a California Consumer and you would like to make a request to delete, return, correct, opt-out of the sale/sharing or targeted advertising use, access (including the specific pieces and categories of personal information described above), limit our use of your sensitive personal information, or obtain a portable copy of the data of the data that we may store about you as an employee or applicant, please follow the instructions below. Note that the status of your relationship with us may limit our ability to comply with your request. Also note, we may not be able to delete all employee personal information for current or former employees within the past 7 years because we’re required to retain certain information for legal compliance.
To make an Employee or Job Applicant Request, you may:
- Complete the online web form here; or
- Contact us at 855-935-8676 Toll Free.
BUSINESS REPRESENTATIVE REQUEST
California offers certain rights to former, current, and prospective clients and/or vendor business representatives to act on the data that is collected for business contact purposes. If you are a California Consumer and you would like to make a request to delete, return, correct, opt-out of the sale/sharing or targeted advertising use, access (including the specific pieces and categories of personal information described above), limit our use of your sensitive personal information, or obtain a portable copy of the data of the data that we may store about you as a business contact, please follow the instructions below. Please note that the status of your relationship with us may limit our ability to comply with your request. For example, an active platform user may not opt-out of system notifications.
To make a Business Representative Request, you may:
- Complete the online web form here; or
- Contact us at 855-935-8676 Toll Free.
RIGHT TO APPEAL
If you receive a notice of refusal to take action on a request, you may submit an appeal to privacy@eltoro.com. EL TORO will review and, if necessary, reach out to you via email to request additional information about your submission. Within 45 days of receipt of the appeal, EL TORO will inform you in writing of the result of the appeal, including a written explanation of the reasons for the decision.
Appeal rights apply to Connecticut, Colorado, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, and Virginia Consumers.
RIGHT TO REQUEST ACCESS TO A LIST OF SPECIFIC THIRD PARTIES TO WHICH CONSUMER’S PERSONAL DATA OR SPECIFIC THIRD PARTIES TO WHICH ANY PERSONAL DATA HAS BEEN DISCLOSED (“THIRD PARTY DATA DISCLOSURE REQUEST”)
Delaware, Minnesota, and Oregon Consumers have the right to request that we disclose the third parties to which we have disclosed your personal data or third parties to which we disclosed any personal information we collect, use, or sell. We complete this kind of request by providing a report on the third parties we have disclosed personal data about you or, at our discretion, third parties to whom we have disclosed any personal information, unless an exemption exists under applicable law. A Third Party Data Disclosure Request is different from an Access Request, which returns specific pieces of personal information held.
To make a Third Party Data Disclosure Request, you may:
- Complete the online web form here; or
- Contact us at 855-935-8676 (Toll Free).
As required under applicable law, we will verify your identity by requesting certain information from you. For instance, if you make a Third Party Data Disclosure Request, you may need to confirm that you reside at a particular address or that you are in possession of a particular identifier that confirms to a sufficient statutory degree that you are the person you claim to be.
ADDITIONAL INFORMATION
Profiling in Furtherance of Decisions: We do not profile your consumer personal data in furtherance of decisions that produce legal or similar effects concerning a consumer.
Right to nondiscrimination: We do not deny, charge different prices for, or provide a different level of quality of goods or services if you choose to exercise these rights.
Information about persons under 18 years of age: We do not knowingly collect personal information from minors under 18 years of age unless we have received legal consent to do so. If we learn that personal information has been collected, we will take reasonable steps to remove their information from our database (or to obtain legally required consent).
Authorized agents: Under certain United States privacy laws, you may designate an authorized agent to make requests to exercise your privacy rights on your behalf. If you use an authorized agent to submit a request, we may require additional information or documentation to verify your identity, to verify the agent’s authority to act on your behalf, and/or to process the request. This includes providing us with a signed written authorization. Please note, we may deny a request from an authorized agent that does not submit proper documentation that they have been authorized by you to act on your behalf or the laws applicable to your state of residence do not specifically authorize the submission of requests by authorized agents. Authorized agents may submit privacy rights requests via the methods described above.
QUESTIONS OR CONCERNS: If you have any questions about this Addendum, our Privacy Policy, or EL TORO’s services or data practices or services, please contact us at privacy@eltoro.com or by mail at:
ATTN: Privacy Officer
EL TORO
552 E. Market Street, 4th Floor
Louisville, KY 40202