PRIVACY RIGHTS ADDENDUM
Last Modified: October 2, 2026
ABOUT THIS ADDENDUM
This EL TORO Privacy Rights Addendum (“Addendum”) is intended to set forth the rights available to consumers (and the methods for exercising such rights) provided under the California Consumer Privacy Act of 2018 as amended by the California Privacy Rights Act of 2020 (“CCPA”); the Colorado Privacy Act (“CPA”); the Connecticut Data Privacy Act (“CTDPA”); the Delaware Personal Data Privacy Act (“DPDPA”); the Indiana Consumer Data Protection Act (“INCDPA”); the Iowa Consumer Data Protection Act (“ICDPA”); the Kentucky Consumer Data Protection Act (“KCDPA”); the Maryland Online Data Privacy Act (“MODPA”); the Minnesota Consumer Data Privacy Act (“MCDPA”); the Montana Consumer Data Privacy Act (“MTCDPA”); the Nebraska Data Privacy Act (“NDPA”); the New Hampshire Data Privacy Act (“NHDPA”); the New Jersey Data Protection Act (“NJDPA”); the Oregon Consumer Privacy Act (“OCPA”); the Rhode Island Data Transparency and Privacy Protection Act (“RIDTPPA”); the Tennessee Information Protection Act (“TIPA”); the Texas Data Privacy and Security Act (“TDPSA”); the Utah Consumer Privacy Act (“UCPA”); and the Virginia Consumer Data Protection Act (“VCDPA”).
This Addendum is intended solely for, and is applicable only to, natural persons who are residents of the State of California (“California Consumers”), State of Colorado (“Colorado Consumers”), State of Connecticut (“Connecticut Consumers”), State of Delaware (“Delaware Consumers”), State of Indiana (“Indiana Consumers”), State of Iowa (“Iowa Consumers”), Commonwealth of Kentucky (“Kentucky Consumers”), State of Maryland (“Maryland Consumers”), State of Minnesota (“Minnesota Consumers”), State of Montana (“Montana Consumers”), State of Nebraska (“Nebraska Consumers”), State of New Hampshire (“New Hampshire Consumers”), State of New Jersey (“New Jersey Consumers”), State of Oregon (“Oregon Consumers”), State of Rhode Island (“Rhode Island Consumers”), State of Tennessee (“Tennessee Consumers”), State of Texas (“Texas Consumers”), State of Utah (“Utah Consumers”), or the Commonwealth of Virginia (“Virginia Consumers”), as defined in their respective privacy laws (together “Consumers”).
For Consumers in an above-listed state, this Addendum supplements the information in EL TORO’s PRIVACY POLICY. If you are not a Consumer in an above-listed state, this Addendum does not apply to you, and you should not rely on it. In addition, EL TORO reserves the right to amend or revise this Addendum at any time, at our sole discretion, and with an associated effective date. Any revised Addendum will be posted on EL TORO’s website(s).
YOUR PRIVACY CHOICES AND RIGHTS
California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia Consumers have one or more of the following rights: the right to make Opt-Out, Limit, Category Access, Access, Confirmation, Correction, Deletion, and Third Party Data Disclosure requests, and the right to appeal our decision. These requests may be made by the Consumer or, where permitted by applicable law, by a minor Consumer’s parent or legal guardian on behalf of the Consumer or by a Consumer’s guardian or conservator on behalf of the Consumer. Additionally, Authorized Agents of the Consumer may make certain requests on behalf of the Consumer, in accordance with and as further set forth in this Addendum.
Please note that we may sometimes act as a “business” or “controller” of data, and other times as a vendor, “service provider,” or “third party” for data (for instance, when we merely process our clients’ data to perform a service and then delete it from our systems). Thus, the rights described in this document only apply to some of the data we hold. In addition, when required by applicable law, we will forward any consumer request to a named client, as feasible.
RIGHT TO OPT OUT OF THE SALE OR SHARE OF YOUR PERSONAL INFORMATION; RIGHT TO OPT OUT OF “TARGETED ADVERTISING”
California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia Consumers may opt out of the “sale” or “share” of their personal information, though we make this option available to all US residents. Consumers in these states may also opt out of the use of their personal information for “targeted advertising.” As with requests to opt out of the sale or share of personal information, we honor requests to opt out of targeted advertising from residents of all US states.
If you would like to opt out:
- Complete the online web form HERE; or
- Contact us at 855-935-8676 (Toll Free).
To complete your request, we maintain the personal information you provide in a “suppression file,” which allows us to prevent data tied to that information from being added to our active advertising database at a later time. This further prevents such information from being shared, sold, or used in targeted advertising activities by our company.
RIGHT TO LIMIT THE USE OF YOUR SENSITIVE PERSONAL INFORMATION
California Consumers have the right to request that we limit our use of their sensitive personal information. If you would like us to limit the use of your sensitive personal information:
- Complete the online web form HERE; or
- Contact us at 855-935-8676 (Toll Free).
To complete your request, we maintain the personal information you provide in a “suppression file,” which allows us to prevent data tied to that information from being added to our active advertising database at a later time. This further prevents such information from being shared, sold, or used in targeted advertising activities by our company.
RIGHT TO REQUEST ACCESS TO THE CATEGORIES OF INFORMATION (“CATEGORY ACCESS REQUEST”)
California Consumers have the right to request that we disclose the following: (1) the categories of personal information we have collected about you; (2) the categories of sources from which the personal information is collected; (3) our business or commercial purpose for collecting, selling, or sharing personal information; and (4) the categories of third parties to which we disclose personal information.
Maryland Consumers have the right to request that we disclose a list of the categories of third parties to which we have disclosed your personal information or a list of the categories of third parties to which we have disclosed any consumer’s personal information if we do not maintain this information in a format specific to you.
Oregon Consumers have the right to request the categories of personal information we are processing or have processed.
We complete these types of requests by providing a report on the categories of information you have requested us to provide. For requests from California Consumers to know categories of personal information, we further provide a report that contains where applicable: (1) the categories of personal information we have collected about you; (2) the categories of sources from which the personal information was collected; (3) the business or commercial purpose for which we collected, sold, or shared the personal information; (4) the categories of third parties to which we disclose personal information; (5) the categories of personal information that we sold or shared about you, and for each category identified, the categories of third parties to which we sold or shared that particular category of personal information; and (6) the categories of personal information we disclosed for a business purpose, and for each category identified, the categories of service providers or contractors to which we disclosed that particular category of personal information.
A Category Access Request is different from an Access Request, which returns specific pieces of personal information held.
To request that we disclose the categories of your personal information that we collect, use, sell, or share, you may:
- Complete the online web form HERE; or
- Contact us at 855-935-8676 (Toll Free).
For security purposes (and as required under applicable law), we will verify your identity by requesting certain information from you. For instance, if you request categories of personal information we have received about you, you may need to confirm that you reside at a particular address or that you are in possession of a particular identifier that confirms to a sufficient degree that you are the person you claim to be.
RIGHT TO REQUEST ACCESS TO YOUR PERSONAL INFORMATION (“ACCESS REQUEST” OR “REQUEST TO KNOW”)
California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia Consumers may request access to specific pieces of personal information we have collected about you. To complete this type of request, we provide an Access Report which will contain the verifiable personal information we hold about you. Where required by applicable law, we will provide this information in a portable and, to the extent technically feasible, readily usable format.
We may withhold some personal information, however, when we are not able to verify to a reasonable degree that the personal information we have is that of the person who submitted the request, and, consequently, the release of the information would pose a risk to individuals or our business. For example, we often are not able to provide such specific pieces of personal information – in particular, precise location coordinates – for this reason. For those sets of information, we are not able to sufficiently verify that the personal information we have pertains to the person who has submitted the request, or whether either the person in possession of a device or the person requesting the information is the actual device owner. A number of people may be temporarily in possession of another person’s phone, such as a partner, friend, or work colleague – whether consensually or not. We seek to avoid (and believe privacy laws require us to avoid) a situation where such a person might obtain potentially detailed and sensitive records pertaining to the phone’s owner.
To request that we disclose the specific pieces of personal information that we have collected from you, you may:
- Complete the online web form HERE; or
- Contact us at 855-935-8676 (Toll Free).
For security purposes (and as required under applicable law), we will verify your identity by requesting certain information from you. For instance, you may need to confirm that you reside at a particular address or that you are in possession of a particular identifier that confirms to a sufficient degree that you are the person you claim to be. Please see above for more information about the limits of such verification and our ability to provide specific pieces of information, and how we thus may respond to such requests.
RIGHT TO CONFIRM WHETHER OR NOT WE ARE PROCESSING YOUR PERSONAL INFORMATION (“RIGHT TO CONFIRM”)
Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia Consumers may also request we confirm whether or not we are processing their personal information. When you exercise this request, you will receive a report on whether or not we are processing your personal information. A Right to Confirm Request is different from an Access Request, which returns specific pieces of personal information held.
To request that we confirm whether or not we are processing your personal information, you may:
- Complete the online web form HERE; or
- Contact us at 855-935-8676 (Toll Free).
For security purposes (and as required under applicable law), we will verify your identity by requesting certain information from you. For instance, you may need to confirm that you reside at a particular address or that you are in possession of a particular identifier that confirms to a sufficient degree that you are the person you claim to be.
RIGHT TO CORRECT YOUR PERSONAL INFORMATION (“CORRECTION REQUEST”)
For California, Colorado, Connecticut, Delaware, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia Consumers: If you believe we have inaccuracies in your personal information, you have the right to request we correct the inaccuracies. Upon receipt of a valid Correction Request, we will take reasonable steps to correct or remove the information you identified as inaccurate, taking into account the nature of the personal information and the purposes of processing.
To request that we correct inaccuracies in your personal information, you may:
- Complete the online web form HERE; or
- Contact us at 855-935-8676 (Toll Free).
For security purposes (and as required under applicable law), we will verify your identity by requesting certain information from you. For instance, you may need to confirm that you reside at a particular address or that you are in possession of a particular identifier that confirms to a sufficient degree that you are the person you claim to be.
RIGHT TO REQUEST DELETION OF YOUR PERSONAL INFORMATION (“DELETION REQUEST”)
As a California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia Consumer, you may request that we delete any personal information that we have about you. Note that this is different from your right to “opt out” of us selling your personal information.
To request that we delete your personal information, you may:
- Complete the online web form HERE; or
- Contact us at 855-935-8676 (Toll Free).
If you seek to exercise your right to keep us from selling your information by placing your information (such as your mobile identifier) on a suppression list, please complete an “opt-out” request, found HERE.
Under the CCPA, CPA, CTDPA, DPDPA, INCDPA, ICDPA, KCDPA, MODPA, MCDPA, MTCDPA, NDPA, NHDPA, NJDPA, OCPA, RIDTPPA, TIPA, TDPSA, UCPA, and VCDPA, we may retain personal information we hold about you, even after receiving a “deletion” request, for certain important purposes, such as: (a) to protect our business, systems, and users from fraudulent activity, (b) to address technical issues that impair existing functionality (such as debugging purposes), (c) as necessary for us, or others, to exercise free speech or other rights, (d) to comply with law enforcement requests pursuant to lawful process or other legal obligations, (e) for scientific or historical research, or (f) for our own internal purposes reasonably related to your relationship with us. Please also note that we need certain types of information so that we can provide our services to you. If you ask us to delete it, you may no longer be able to access or use our services.
Additionally, under the CPA, CTDPA, ICDPA, KCDPA, MCDPA, MTCDPA, NDPA, NHDPA, OCPA, RIDTPPA, TIPA, TDPSA, UCPA, and VCDPA, because we do not collect data directly from you, we may comply with your Deletion Request by processing your request in the same manner as we process an opt-out request.
EMPLOYEE OR JOB APPLICANT REQUEST
California offers certain rights to former, current, and prospective employees related to data we collect for employment purposes. If you are a California Consumer and you would like to make a request to delete, correct, opt out of the sale/sharing or targeted advertising use, access (including the specific pieces and categories of personal information described above), limit our use of your sensitive personal information, or obtain a portable copy of the data that we may store about you as an employee or applicant, please follow the instructions below. Note that the status of your relationship with us may limit our ability to comply with your request. Also note, we may not be able to delete all employee personal information for current or former employees within the past 7 years because we’re required to retain certain information for legal compliance.
To make an Employee or Job Applicant Request, you may:
- Complete the online web form HERE; or
- Contact us at 855-935-8676 (Toll Free).
BUSINESS REPRESENTATIVE REQUEST
California offers certain rights to former, current, and prospective clients and/or vendor business representatives to act on the data that is collected for business contact purposes. If you are a California Consumer and you would like to make a request to delete, correct, opt out of the sale/sharing or targeted advertising use, access (including the specific pieces and categories of personal information described above), limit our use of your sensitive personal information, or obtain a portable copy of the data that we may store about you as a business contact, please follow the instructions below. Please note that the status of your relationship with us may limit our ability to comply with your request. For example, an active platform user may not opt out of system notifications.
To make a Business Representative Request, you may:
- Complete the online web form HERE; or
- Contact us at 855-935-8676 (Toll Free).
RIGHT TO APPEAL
If you receive a notice of refusal to take action on a request, you may submit an appeal to privacy@eltoro.com. EL TORO will review and, if necessary, reach out to you via email to request additional information about your submission. Within 45 days of receipt of the appeal, EL TORO will inform you in writing of the result of the appeal, including a written explanation of the reasons for the decision.
Appeal rights apply to Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, and Virginia Consumers.
RIGHT TO REQUEST A LIST OF SPECIFIC THIRD PARTIES TO WHICH YOUR PERSONAL INFORMATION, OR TO WHICH ANY CONSUMER’S PERSONAL INFORMATION, HAS BEEN DISCLOSED (“THIRD PARTY DATA DISCLOSURE REQUEST”)
Connecticut, Delaware, Minnesota, and Oregon Consumers have the right to request that we disclose a list of the third parties to which we have disclosed (or, for Connecticut Consumers, sold) your personal information or, in certain circumstances, any consumer’s personal information, as described below.
For Connecticut Consumers, we complete this kind of request by providing a report of the third parties to which we have sold your personal information or, if we do not maintain this information in a format specific to you, the third parties to which we have sold any consumer’s personal information (unless an exemption applies under applicable law).
For Oregon Consumers, we complete this kind of request by providing, at our option, a report of the specific third parties to which we have disclosed your personal information or a report of the specific third parties to which we have disclosed any consumer’s personal information (unless an exemption applies under applicable law).
For Delaware Consumers, we complete this kind of request by providing a report of the third parties to which we have disclosed your personal information or, if we cannot compile such a list with reasonable effort, a list of all third parties to which we disclose personal information (unless an exemption applies under applicable law).
For Minnesota Consumers, we complete this kind of request by providing a report of the specific third parties to which we have disclosed your personal information or, if we do not maintain this information in a format specific to you, the specific third parties to which we have disclosed any consumer’s personal information (unless an exemption applies under applicable law).
To make a Third Party Data Disclosure Request, you may:
- Complete the online web form HERE; or
- Contact us at 855-935-8676 (Toll Free).
As required under applicable law, we will verify your identity by requesting certain information from you. For instance, if you make a Third Party Data Disclosure Request, you may need to confirm that you reside at a particular address or that you are in possession of a particular identifier that confirms to a sufficient degree that you are the person you claim to be.
ADDITIONAL INFORMATION
Profiling in furtherance of decisions: We do not process or profile your consumer personal information in furtherance of decisions that produce legal or similarly significant effects, whether automated or otherwise.
Right to nondiscrimination: We do not deny, charge different prices for, or provide a different level of quality of goods or services if you choose to exercise these rights.
Information about persons under 18 years of age: We do not knowingly collect personal information from minors under 18 years of age. If we learn that we have collected personal information from a minor under 18 years of age, we will take reasonable steps to remove that information from our database.
Authorized agents: Under certain US state privacy laws, you may designate an authorized agent to make requests to exercise your privacy rights on your behalf. If you use an authorized agent to submit a request, we may require additional information or documentation to verify your identity (depending on the type of request), to verify the agent’s authority to act on your behalf, and/or to process the request. We may deny a request from an authorized agent when the authorized agent does not submit proper documentation that you have authorized the agent to act on your behalf or the laws applicable to your state of residence do not specifically authorize the submission of the request type by an authorized agent. Authorized agents may submit privacy rights requests via the methods described above, and must provide EL TORO with a written document signed by you that authorizes them to make the request on your behalf.
QUESTIONS OR CONCERNS: If you have any questions about this Addendum, our PRIVACY POLICY, or EL TORO’s services or data practices, please contact us via one of the following methods:
- privacy@eltoro.com
- 855-935-8676 (Toll Free)
- ATTN: Privacy Officer
EL TORO.COM LLC
552 E. Market Street, 4th Floor
Louisville, KY 40202