GRANITE BAY FINANCIAL ONLINE PRIVACY POLICY

Last Updated: August 11, 2025.

Your privacy is important to Granite Bay Financial (“Granite Bay”). This Online Privacy Policy (“Privacy Policy”) explains how Granite Bay may collect, use, store, and share information from or about you, and explains how information collected from or about you may be, used, including for advertising purposes, and/or how your information shared with third parties through our  site www. granitebayfinancial.com, or through our affiliates that link to our policy or reference this policy, or any of  Granite Bay’s online site pages and marketing services, including the websites, social media sites or pages, mobile application (if available), as well as any interactions you may have while viewing content provided through one of our advertising campaigns whether done on your computer or mobile device (collectively the “Sites”).

Granite Bay is not a lender nor is it a provider of loans. Any information you provide on this site, including any loan application, will be provided to third party lenders and providers. As such, you understand that this Privacy Policy only applies to Granite Bay’s collection, retention, use, and sharing of the information you provide Granite Bay. You understand that Granite Bay will be sharing the information with third party lenders which may have their own privacy policies and information security policies. Granite Bay is not responsible for any misuse, misapplication, unauthorized release of any information that is shared with third party lenders. You specifically acknowledge that by providing your information on our Site, and/or completing an application by phone or online, we are authorized to share the information you provide with the third party lenders, and that from the moment the information is shared, any aspect of information security shall be governed also by the third party lender with whom you are matched. Please review carefully this privacy policy to understand how it applies to you. If you do not want your information to be shared with third party lenders, do not complete an application or provide your information online.

Agreement to this Policy: This Privacy Policy is incorporated by reference into, and is subject to the terms of, Granite Bay’s Terms and Conditions, and too, is subject to your obligation to arbitrate claims brought pursuant to this Privacy Policy, or relating to the breach of this Privacy Policy in any way whatsoever, in accordance with your agreement to arbitrate your claims with Granite Bay as provided in Section 11 titled Dispute Resolution by Binding Arbitration. By using, interacting with, entering information, or viewing information on the Sites, you expressly acknowledge and consent to this Privacy Policy in its entirety, including providing your consent to our use of, and disclosure of, information collected from, or about, you in the manner described herein. You agree that Granite Bay will rely on your use, requests, and interaction with our Sites as your express consent to the terms of this Privacy Notice. YOU AGREE THAT YOU HAVE READ, UNDRESTOOD, AND AGREE TO BE BOUND BY THE TERMS AND CONDITIONS AND THIS PRIVACY POLICY, AND YOUR OBLIGATION TO ARBITRATE CLAIMS UNDER OUR ARBITRATION AGREEMENT.

As you review this Online Privacy Policy, here are a few general principles to keep in mind:

• Our online services are intended for a U.S. residents consumers only, and we are not marketing, offering, or collecting information from non-U.S. resident consumers. See Notice to Users Outside of the United States in this Policy for further information.
• Our online services are not intended for children under 18. See Children Online Privacy Protection Act (“COPPA”) Disclosure in this Policy for further information.
• Should you sign up for our personal loan matching service, in addition to this Privacy Policy, you understand that Personally Identifiable Information (“PII”) and/or Personal Financial Information (“PFI”), may be collected, processed, used, shared, and stored, as part of our services, and that in addition to this Policy, you may be subject to additional contractual terms in your service agreement with Granite Bay.
• If you are a California resident, you may have rights under the California Consumer Privacy Act. Please click here to learn more.
• If you are a Florida resident, you may have certain rights under the Florida Digital Bill of Rights. See our Florida Privacy Rights section below.

1. INFORMATION GRANITE BAY MAY COLLECT:

Granite Bay may collect certain categories of information, including Personally Identifiable Information (“PII”), Personal Financial Information (“PFI”) and other sensitive personal information that may be shared with Granite Bay in accordance with the law including information in the following categories:

1. General Identifying Information: General Identifying Information may include, but not limited to, you full name, postal address, e-mail address, telephone number, account ID, profile photo, other data made publicly available about you, provided by you, or made available by linking your social media or other similar identifiers.
2. Demographic Information and Important Dates: Demographic Information and Important Dates may include, but not limited to, you gender, language preferences, nationality, and/or date of birth.
3. Financial Information: Financial Information may include, but not limited to, your credit, debit, or other payment data, bank account information, personal financial statements, or other financial personal information about you or your household.
4. Credit Information: Credit Information may include, but not limited to, your credit score, credit accounts status, and other creditworthiness information about you or your household.
5. Internet or Other Electronic Information: Internet or other Electronic Information may include, but not limited to, your web history, search history, interactions with a website, email, applications, or advertisements, IP address, IP Host location, enabled cookies, or any other information that may be automatically obtained from you while making use of the Sites.
6. Geolocation information: Geolocation information may include, but not limited to, your real-time location or GPS coordinates data provided by your computer or mobile device or web browser, data derived from your IP address, general location based on nearby Wi-Fi networks or cell towers, location history records, geotags in content uploaded to the Site, or other user location information entered by you.
7. Categories that may be considered Sensitive Personal information: Such information may include Government Identifiers (including social security numbers, driver license, or other government issued identifiers), certain Financial Information (such information that maybe protected by Federal Financial regulations such as the GLBA), Credit Information (such as a Credit Report), or other sensitive information as defined by applicable law.
8. Inferences drawn from the above information about your predicted characteristics.

2. HOW DOES GRANITE BAY COLLECT YOUR INFORMATION:

Granite Bay may collect PII and/or PFI from each of the above categories in the following ways:

1. Directly from You. Granite Bay may collect certain PII and/or PFI from the categories in section I above directly from you. You may be asked to provide certain information in forms on our Site, or may provide such information when you contact Granite Bay to inquire about our personal loan matching services.
2. Indirectly from You. Certain interactions with the Sites may, through the use of cookies, pixels, or other tracking tools or software, collect information about you, your location, your IP, or other categories in section I of this Policy.
3. From Marketing and Analytical Partners. Granite Bay may utilize and/or partner with various marketing and/or analytical partners such as Google Analytics, Meta, or other third-party online marketing and analytics services that analyze the Sites or partner to market the Sites or our services.
4. From Third-Party Vendors, Affiliates, and Partners. Granite Bay may obtain certain PII and PFI about you from third parties providing credit reporting data, accounts history data, service data, or other lead generation data.
5. From Public Records. Certain information about you may be available from various public sources and public government records. Granite Bay may obtain information about you with respect to the categories in Section I to this Policy, which may be available to the public through various public databases, online searches, or public record requests.

3. HOW DOES GRANITE BAY USE YOUR PERSONAL INFORMATION:

Granite Bay may use any collected PII and/or PFI from you, or about you, in the following ways and for the following purposes:

1. to respond to your inquiries on the Sites and fulfill requests made by you.
2. to refer and match you with a lender for purposes of obtaining a personal loan from the lender;
3. to provide you with important information regarding the Sites, products or services for which you may apply or in which you are enrolled, changes to terms, conditions, and policies and/or other administrative information.
4. to deliver marketing communications that Granite Bay believes may be of interest to you, including, personalized ads or offers tailored to you, including ads on other websites, or from affiliated or unaffiliated third parties.
5. to personalize your experience on the Sites.
6. to refer you to various complementary service providers that may offer you various additional services independently of our Sites.
7. to allow you to apply for various products or services and evaluate your eligibility for such products or services.
8. to verify your identity and/or location (or the identity or location of your representative or agent) in order to allow access to services you may enroll in, conduct online transactions, confirm forms submitted are authentic, and to maintain measures aimed at preventing fraud against Granite Bay and you, as well as protecting the security of your Personal information.
9. to allow you to participate in surveys and other forms of market research, sweepstakes, contests and similar promotions, and to administer these activities (if any). These activities may have additional rules of participation, which may also contain additional policies about how PII or PFI is collected, used, stored, and/or shared.
10. to allow us to verify your identity or other information collected from or through our social media pages or campaigns and other interaction with online forms generated on our behalf. We may combine and use PII and/or PFI you provide in this Site with the information collected from our social media pages or from your interaction with online forms generated on our behalf.
11. to allow you to enter and participate in our live chat, forums, and/or other types of bulletin boards that we may have on the Sites from time to time (if any).
12. for legitimate business purposes, including data and marketing analysis, audits, developing and improving products and services, enhancing the Sites, identifying usage trends and determining the effectiveness of promotional campaigns.
13. for internal and external risk control, fraud detection, and prevention.
14. to comply with applicable laws and regulations, and other legal process (including in any lawsuit by you or on your behalf), and government and law enforcement requirements.
15. to allow you to utilize features within our Sites by granting us access to information from your device, such as contact lists or geolocation, when you request certain services.
16. to manage your Sites preferences.
17. to respond to your requests, applications, and process your transactions.
18. For any other purposes that Granite Bay may specifically disclose at the time you provide or we collect your information.

Granite Bay may also use data that Granite Bay collects on an aggregate or anonymous basis (such that it does not identify any individual customers) for various business purposes. As an example, we may use information collected from cookies or pixels for various analytical purposes, or for market research. “Cookies” are small amounts of data a website can send to a visitor’s web browser.  “Pixels” are small codes imbedded in websites that trigger certain actions. Cookies and Pixels may also enable us or our service providers and other companies we work with to relate your use of our online services over time to customize your experience.  Most web browsers allow you to adjust your browser settings to decline or delete cookies, but doing so may degrade your experience with our online services. In general, we may use or use these different types of cookies and pixels:

1. Strictly Necessary Cookies and Pixels: These cookies are necessary to enable the basic features of the Sites, these may include a variety of cookies and pixels from the below categories.
2. Functional Cookies: These cookies allow our Site to remember your preferences and choices on the site, as well as allow for certain functions on the site to properly operate. We also use functional cookies to facilitate navigation, to display content more effectively, and/or to personalize your experience.
3. Advertising Cookies and Pixels: Advertising cookies and pixels allow us to select which advertisements or offers are most likely to appeal to you. We also use them to track responses to online advertisements and marketing, including those who reach our site through social media platforms or from our marketing partners. We may use them to better understand your interests so we can present you with relevant messages and offers. These cookies and pixels may also allow us to share certain information with social media platforms that you may be using.
4. Analytics Cookies and Pixels: Analytics cookies and pixels help us improve our Sites and Apps by collecting and reporting information on how you use it. Some pixels belong to our third party analytics vendors and are therefore share information with third parties.
5. Compliance cookies, pixels, or tools: These cookies and pixels are used to ensure compliance with various applicable laws and regulations. For instance, we may use certain tools for functionality like screen recording to capture user actions for TCPA compliance and acceptance certificates. These compliance cookies, pixels, or tools are essential and will be applicable regardless of your cookies and pixels choice.

Furthermore, there are certain choices you can make to control certain cookies and pixels. Note that certain cookies, pixels, and tools cannot be disabled regardless of how you choose to proceed with your Cookie Choices. That said, there are several ways to manage cookies:

1. Browser settings:You can opt out of cookies on your browser. Every browser is different, please check the instructions provided by your browser. Note should you choose to opt out of cookies on your browser or disable cookies, such action may impact your use of the Sites.
2. Cookies Preferences: Currently you can only ACCEPT ALL COOKIES / ACCEPT ESSENTIAL COOKIES on the Sites. However, please note that currently essential cookies cannot be rejected, and only non-essential cookies will be rejected. Compliance tools and cookies, as well as functional cookies are always considered essential cookies. In addition, certain marketing and analytics cookies, pixels, or tools may be deemed essential and therefore cannot be removed.
3. Google Analytics:We may collect data through Google Analytics which use cookies and technologies to collect and analyze data about the use of online services. These services also collect data regarding the use of other websites, apps, and online resources. You can learn about Google’s practices by going to google.com/policies/privacy/partners/. You may choose to opt out from Google Analytics by downloading the Google Analytics opt out browser add-on, available at https://tools.google.com/dlpage/gaoptout.

 

Bear in mind that because cookies are stored by your browser, if you use different browsers on your computer, or multiple computers and devices that have browsers and you do not wish to have cookies collect information, you will need to opt out from each browser on each of the computers and devices that you use. 

4. HOW DOES GRANITE BAY STORE AND SECURE YOUR PERSONAL INFORMATION:

1. Data Security. Granite Bay takes commercially reasonable precautions to protect your personal information and only provide access to the information on a need-to-know basis. Being that Granite Bay does not provide loans, and simply refers you to third party loan provider. As such you acknowledge and agree that the information you provide to Granite Bay will be shared with third party loan providers. To prevent the unauthorized access, disclosure, dissemination, misuse, loss, alteration or destruction of your personal information, Granite Bay has employed commercially reasonable physical, electronic, and managerial measures to protect your data and Granite Bay periodically reviews these policies and procedures in effort to prevent such acts. However, despite our best efforts, no security policy, procedures or practices can adequately protect against all types of threats or data losses and no type of data transmission method is impenetrable to interception. While we follow generally accepted industry standards to protect the PFI and PII submitted to us (both during your submission and after we receive it), please be advised that no method of transmission over the Internet, or method of electronic storage, is 100% secure. Therefore, while we strive to use commercially acceptable means to protect your Personal information and PII, we cannot guarantee its absolute security. In the event of a breach, we have policies for immediate measures to inform our management and legal team and take immediate action to minimize the impact of the breach. We are committed to ensure compliance with any rights you may have to know in the event of a breach of your information that is on our servers. We are not responsible for third party partners and loan provider’s data security, and you acknowledge that you are to proceed against any third party provider directly for any such data breach of their systems. You understand that we may utilize a third-party Customer Relationship Manager (CRM) provider and software. In such case, you understand that while we take all precautions and contractually require our CRM to meet certain industry standards, we cannot control any CRM data breach which is controlled by the third-party.

 

2. Data Retention. Granite Bay retains Personal information for as long as needed or permitted considering the purpose(s) for which it was collected. The criteria used to determine our retention periods include: (i) The length of time we have an ongoing relationship with you and as necessary to provide requested services to you; (ii) Whether there is a legal or regulatory obligation to which we are subject (for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them); (iii) Whether retention is advisable considering our legal position (such as, for statutes of limitations, litigation, or regulatory investigations); and (iv) compliance with regulations and applicable laws. You acknowledge that due to these criteria, should you be in a state that has deletion rights, we may reject certain request to delete your data, if we are required by law or regulation to maintain the information, and deletion of such personal information will run foul with our compliance with said regulations.

5. STATE SPECIFIC DISCLOSURES:

This section provides state specific disclosures which apply solely to consumers who reside in the states referenced herein. If you are a resident of one of these states, you have certain rights with respect to personal information collected and the processing of your personal information which are subject to the applicable state privacy laws.

1. Privacy Notice to California Consumers. Granite Bay is dedicated to compliance with California consumer regulation, Granite Bay provided a dedicated page to California consumers rights under the California Consumer Privacy Act. To review your rights under the California Consumer Privacy Act, please click here.
2. Privacy Notice to Florida Consumers. Florida, like California, enacted a consumer privacy protection law titled “Florida Digital Bill of Rights”. Under the Florida Digital Bill of Rights, a Florida resident is, pursuant to the authenticated consumer request, to exercise the following rights:
   1. To confirm whether Granite Bay is processing consumer’s personal data (such as PII and PFI) and to access the personal data.
   2. To correct inaccuracies in the consumer’s personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer’s personal data.
   3. To delete any or all personal data provided by or obtained about the consumer. The consumer understands and agrees that while the consumer has a right to get its personal data, Granite Bay may be required to maintain certain personal data as part of its compliance obligations, and therefore may not be able to delete all of the personal data of the consumer if such data is required to be maintained by Granite Bay for legal or regulatory compliance obligations.
   4. To obtain a copy of the consumer’s personal data, in a portable, and, to the extent technically feasible, readily useable format if the data is available in a digital format.
   5. To opt out of the processing of the consumer’s personal data for purposes of: (i) targeted advertising; (ii) the sale of personal data; or (iii) profiling in furtherance of a decision that produces a legal or similar significant effect concerning the consumer.
   6. To opt out of the collection of sensitive data, including precise geolocation data, or the processing of sensitive data.
   7. To opt out of the collection of personal data collected through the operation of voice recognition or facial recognition features. Consumer understands and agrees that Granite Bay may record calls as part of its operations for purposes of better servicing clients, obtaining certain authorizations from the consumer, confirming receipt of services, and other legitimate business reasons. Such recordings may be maintained by Granite Bay to comply with regulation and internal legal and business purposes.
   8. Consumers can make the request that Granite Bay comply with any of the above data privacy requests through the submission of Granite Bay’s via email at privacy@granitebayfinancial.com, and/or Data Request Form, which is located on our site, and is accessible by the link here. Any request made by phone, must be followed in writing. Granite Bay shall have up to 45 days to respond to a request, and should the matter be complex, the consumer can inform the consumer that Granite Bay requires up to an additional 15-day extension to the request. Consumer is entitled to response no later than 60 days from the date the validated request is made.
   9. Consumers may appeal a decision by emailing Granite Bay’s email at privacy@granitebayfinancial.com. Consumers understand that Granite Bay shall have 60 days after receipt of the appeal, including a written explanation of the reason or reasons for the decision.

3. Notice to Nevada Residents. We are providing you this Notice pursuant to state law. You may be placed on our internal Do Not Call List by following the directions set forth above. Nevada law requires that we also provide you with the following contact information: Bureau of Consumer Protection, Office of the Nevada Attorney General, 555 E. Washington St., Suite 3900, Las Vegas, NV 89101; Phone number: 702-486-3132; e-mail: BCPINFO@ag.state.nv.us.

4. Privacy Notice to Utah Residents. As a Utah resident, you have the following rights regarding your personal information:
   1. Access. You have a right, twice in a 12-month period, to request that we disclose to you the personal information that we collected about you, and any additional information about our collection, use, disclosure, or sale of such personal information, which is also contained in this privacy policy.
   2. Obtaining a portable copy of your personal data. To obtain a copy of your personal data that you previously provided to us in a portable format, please submit an “Access” request as described above. While these requests are distinct, we have not identified any technically feasible and readily usable format that would allow you to transmit this data to another controller. Therefore, we will provide you a copy of your personal data so that we honor your request as best is technically feasible.
   3. Deletion. You have the right to request that we delete your personal information under certain circumstances, subject to a number of exceptions, subject to a number of exceptions provided under Utah law. To request the deletion of personal information, please submit a Data Request on our Site. You understand that we have no control over how the lender collects and maintains your information, and you are to reach out to the lender directly to delete your information.
   4. Opt-Out of Targeted Advertising. You have a right to opt-out of targeted advertising and the sale of personal data. To request the opt out of targeted advertising, please submit a Data Request Form on our Site. You understand that we are not responsible for any targeted advertising by any lender to whom you are referred.
   5. Authentication/Verification. To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your request (except for a request to opt-out of sales or sharing). We may require you to provide any of the following information: your name, date of birth, your phone number, your Social Security number, the email and physical addresses. If you request that we provide you with specific pieces of personal information, we may require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request, or authorized personnel of the consumer making the request. You understand that we may decline to process your request where: (i) we are unable to authenticate that you are the person to whom the data relates; (ii) the request is unreasonable or excessive; (iii) or where otherwise permitted by applicable law.
   6. Declining Requests. You understand that we may decline requests where granting the request would be prohibited by law, could adversely affect the privacy or rights of another person, would reveal a trade secret or other confidential information, would interfere with a legal or business obligation that requires retention or use of the data, or because the data at issue is not covered under the law you are asserting. Also, where permitted by law if you send us a request to exercise your rights or the choices in this section, we may charge a fee or decline requests in certain cases.
   7. Non-Discrimination. You have the right to not be discriminated against for exercising any of your privacy rights.
5. Privacy Notice to Virginia Residents. As a Virginia resident, you have the following rights regarding your personal information:
1. Access. You have a right, twice in a 12-month period, to request that we disclose to you the personal information that we collected about you, and any additional information about our collection, use, disclosure, or sale of such personal information, which is also contained in this privacy policy.
2. Correction. You have the right to request that we correct inaccurate personal information under certain circumstances, subject to a few exceptions provided under Virginia law. To request the correction of personal information, please submit a Data Request on our Site. You understand that we have no control over how the lender collects and maintains your information, and you are to reach out to the lender directly to correct your information.
3. Deletion. You have the right to request that we delete your personal information under certain circumstances, subject to a few exceptions, subject to a number of exceptions provided under Virginia law. To request the deletion of personal information, please submit a Data Request on our Site. You understand that we have no control over how the lender collects and maintains your information, and you are to reach out to the lender directly to delete your information.
4. Opt-Out of Targeted Advertising. You have a right to opt-out of targeted advertising and the sale of personal data. To request the opt out of targeted advertising, please submit a Data Request Form on our Site. You understand that we are not responsible for any targeted advertising by any lender to whom you are referred
5. Obtaining a portable copy of your personal data. To obtain a copy of your personal data that you previously provided to us in a portable format, please submit an “Access” request as described above. While these requests are distinct, we have not identified any technically feasible and readily usable format that would allow you to transmit this data to another controller. Therefore, we will provide you a copy of your personal data so that we honor your request as best is technically feasible.
6. Appeal. You have the right to appeal our decision to refuse to act on a Virginia data privacy law request within a reasonable period after you receive our decision. To appeal our decision, you should send your objection to our denial via email to ______________________ and to allow us to review your data subject request. Within 60 days, we will provide you with a written explanation of the justification for declining to act on your request. If you disagree with our explanation you have the right to file a complaint with the Virginia Attorney General.
7. Authentication/Verification. To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your request (except for a request to opt-out of sales or sharing). We may require you to provide any of the following information: your name, date of birth, your phone number, your Social Security number, the email and physical addresses. If you request that we provide you with specific pieces of personal information, we may require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request, or authorized personnel of the consumer making the request. You understand that Company may decline to process your request where: (i) Company is unable to authenticate that you are the person to whom the data relates; (ii) the request is unreasonable or excessive; (iii) or where otherwise permitted by applicable law.
8. Declining Requests. You understand that we may decline requests where granting the request would be prohibited by law, could adversely affect the privacy or rights of another person, would reveal a trade secret or other confidential information, would interfere with a legal or business obligation that requires retention or use of the data, or because the data at issue is not covered under the law you are asserting. Also, where permitted by law if you send us a request to exercise your rights or the choices in this section, we may charge a fee or decline requests in certain cases.
9. Non-Discrimination. You have the right to not be discriminated against for exercising any of your privacy rights.

6. Privacy Notice to Indiana Residents. You have the right to get notified in the event of a data breach of the information we collect for you under Indiana Law. In the event of a data breach encompassing your information we will inform you using one of the following methods: (i) Mail; (ii) Telephone; (iii) Facsimile (fax); or (iv) Electronic Mail if we have your email in our database. You understand that we are only responsible to inform you of data breaches caused to our servers and have no control over any information retained by the lender with whom we may connect you.
7. Privacy Notice to Iowa Residents. As an Iowa resident you have the right to submit to us an authenticated request regarding your personal data:
   1. Access. You have a right, twice in a 12-month period, to request for free that we disclose to you the personal information that we collected about you, and any additional information about our collection, use, disclosure, or sale of such personal information, which is also contained in this privacy policy.
   2. Obtaining a portable copy of your personal data. To obtain a copy of your personal data that you previously provided to us in a portable format, please submit an “Access” request as described above. While these requests are distinct, we have not identified any technically feasible and readily usable format that would allow you to transmit this data to another controller. Therefore, we will provide you a copy of your personal data so that we honor your request as best is technically feasible.
   3. Deletion. You have the right to request that we delete your personal information under certain circumstances, subject to a number of exceptions, subject to a number of exceptions provided under Iowa law. To request the deletion of personal information, please submit a Data Request on our Site. You understand that we have no control over how the lender collects and maintains your information, and you are to reach out to the lender directly to delete your information.
   4. Opt-Out of Sale of Personal Data. You have a right to opt-out of the sale of personal data. To request the opt out of sale of your personal, please submit a Data Request Form on our Site. You understand that we are not responsible for any targeted advertising or further sale of your data by any lender to whom you are referred. You further understand and agree that the transferring of your information to lender pursuant to your application on our Site shall not constitute the sale of data.
   5. Request, Response, and Procedure. When submitting your request, please provide the necessary information to authenticate your identity. Only authenticated requests will be processed. You understand that we have an initial period of 90 days to respond to the request, with one additional extension period of 45 when reasonably necessary upon considering the complexity of the request.
   6. Appeal. You have the right to appeal our decision to refuse to act on a personal data privacy request within a reasonable period after you receive our decision. To appeal our decision, you should send your objection to our denial via email to ______________________ and to allow us to review your data subject request. Within 60 days, we will provide you with a written explanation of the justification for declining to act on your request. If you disagree with our explanation you have the right to file a complaint with the Iowa Attorney General.

8. Privacy Notice to Montana Residents. As a Montana resident you have the right to submit to us an authenticated request regarding your personal data:
   1. Access. You have a right, twice in a 12-month period, to request for free that we disclose to you the personal information that we collected about you, and any additional information about our collection, use, disclosure, or sale of such personal information, which is also contained in this privacy policy. You understand that we may deny the request for access if such confirmation of processing personal data and access request would require us to reveal trade secrets.
   2. Correction. You have the right to request that we correct inaccurate personal information under certain circumstances, subject to a few exceptions provided under Montana law. To request the correction of personal information, please submit a Data Request on our Site. You understand that we have no control over how the lender collects and maintains your information, and you are to reach out to the lender directly to correct your information.
   3. Obtaining a portable copy of your personal data. To obtain a copy of your personal data that you previously provided to us in a portable format, please submit an “Access” request as described above. While these requests are distinct, we have not identified any technically feasible and readily usable format that would allow you to transmit this data to another controller. Therefore, we will provide you a copy of your personal data so that we honor your request as best is technically feasible.
   4. Deletion. You have the right to request that we delete your personal information under certain circumstances, subject to a number of exceptions, subject to a number of exceptions provided under Montana law. To request the deletion of personal information, please submit a Data Request on our Site. You understand that we have no control over how the lender collects and maintains your information, and you are to reach out to the lender directly to delete your information.
   5. Opt-Out Rights. You have a right to opt-out from the following: (i) targeted advertising; (ii) the sale of personal data; or (iii) profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning you. To request the opt out of sale of your personal, please submit a Data Request Form on our Site. You understand that we are not responsible for any targeted advertising or further sale of your data by any lender to whom you are referred. You further understand and agree that the transferring of your information to lender pursuant to your application on our Site shall not constitute the sale of data.
   6. Request, Response, and Procedure. When submitting your request, please provide the necessary information to authenticate your identity. Only authenticated requests will be processed. You understand that we have an initial period of 45 days to respond to the request, with one additional extension period of 45 when reasonably necessary upon considering the complexity of the request. In the event we decline to process your request we will inform you in the initial 45 period and provide you with instructions on how to appeal the decision.
   7. Appeal. You have the right to appeal our decision to refuse to act on a personal data privacy request within a reasonable period after you receive our decision. To appeal our decision, you should send your objection to our denial via email to ______________________ and to allow us to review your data subject request. Within 60 days, we will provide you with a written explanation of the justification for declining to act on your request. If you disagree with our explanation you have the right to file a complaint with the Montana Attorney General.

9. Privacy Notice to Nebraska Residents. As a Nebraska resident you have the following data privacy rights regarding your personal data:
   1. Access. You have a right, twice in a 12-month period, to request for free that we disclose to you the personal information that we collected about you, and any additional information about our collection, use, disclosure, or sale of such personal information, which is also contained in this privacy policy.
   2. Correction. You have the right to request that we correct inaccurate personal information under certain circumstances, subject to a few exceptions provided under Nebraska law. To request the correction of personal information, please submit a Data Request on our Site. You understand that we have no control over how the lender collects and maintains your information, and you are to reach out to the lender directly to correct your information.
   3. Obtaining a portable copy of your personal data. To obtain a copy of your personal data that you previously provided to us in a portable format, please submit an “Access” request as described above. While these requests are distinct, we have not identified any technically feasible and readily usable format that would allow you to transmit this data to another controller. Therefore, we will provide you a copy of your personal data so that we honor your request as best is technically feasible.
   4. Deletion. You have the right to request that we delete your personal information under certain circumstances, subject to a number of exceptions, subject to a number of exceptions provided under Nebraska law. To request the deletion of personal information, please submit a Data Request on our Site. You understand that we have no control over how the lender collects and maintains your information, and you are to reach out to the lender directly to delete your information.
   5. Opt-Out Rights. You have a right to opt-out from the following: (i) targeted advertising; (ii) the sale of personal data; or (iii) profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning you. To request the opt out of sale of your personal, please submit a Data Request Form on our Site. You understand that we are not responsible for any opt out requests between you and any lender to whom you are referred. You further understand and agree that the transferring of your information to lender pursuant to your application on our Site shall not constitute the sale of data.
   6. Request, Response, and Procedure. When submitting your request, please provide the necessary information to authenticate your identity. Only authenticated requests will be processed. You understand that we have an initial period of 45 days to respond to the request, with one additional extension period of 45 when reasonably necessary upon considering the complexity of the request. In the event we decline to process your request we will inform you in the initial 45 period and provide you with instructions on how to appeal the decision.
   7. Appeal. You have the right to appeal our decision to refuse to act on a personal data privacy request within a reasonable period after you receive our decision. To appeal our decision, you should send your objection to our denial via email to ______________________ and to allow us to review your data subject request. Within 60 days, we will provide you with a written explanation of the justification for declining to act on your request. If you disagree with our explanation you have the right to file a complaint with the Nebraska Attorney General.

10. Privacy Notice to New Jersey Residents. As a New Jersey resident you have the data privacy rights regarding your personal data, and can submit to us a verified data request to:
    1. Access. You have a right, twice in a 12-month period, to request for free that we disclose to you the personal information that we collected about you, and any additional information about our collection, use, disclosure, or sale of such personal information, which is also contained in this privacy policy. You understand that we may deny the request for access if such confirmation of processing personal data and access request would require us to reveal trade secrets.
    2. Correction. You have the right to request that we correct inaccurate personal information under certain circumstances, subject to a few exceptions provided under New Jersey law. To request the correction of personal information, please submit a Data Request on our Site. You understand that we have no control over how the lender collects and maintains your information, and you are to reach out to the lender directly to correct your information.
    3. Obtaining a portable copy of your personal data. To obtain a copy of your personal data that you previously provided to us in a portable format, please submit an “Access” request as described above. While these requests are distinct, we have not identified any technically feasible and readily usable format that would allow you to transmit this data to another controller. Therefore, we will provide you a copy of your personal data so that we honor your request as best is technically feasible.
    4. Deletion. You have the right to request that we delete your personal information under certain circumstances, subject to a number of exceptions, subject to a number of exceptions provided under New Jersey law. To request the deletion of personal information, please submit a Data Request on our Site. You understand that we have no control over how the lender collects and maintains your information, and you are to reach out to the lender directly to delete your information.
    5. Opt-Out Rights. You have a right to opt-out from the following: (i) targeted advertising; (ii) the sale of personal data; or (iii) profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning you. To request the opt out of sale of your personal, please submit a Data Request Form on our Site. You understand that we are not responsible for any targeted advertising or further sale of your data by any lender to whom you are referred. You further understand and agree that the transferring of your information to lender pursuant to your application on our Site shall not constitute the sale of data.
    6. Designation of Authorized Agent. You may designate another person to serve as your authorized agent to opt out of the processing and sale of your personal data, and other opt out requests. In the event you choose another person to serve as your authorized agent, you understand that we may require a written acknowledgment from you, as well as written documentation of your authorized agent establishing that he can act on your behalf. If your authorized agent takes an action contrary to your requests, you acknowledge that we are not responsible and will follow the authorized agent’s request, until and unless you provide us with written notice that we are not to follow your designated agent.
    7. Request, Response, and Procedure. When submitting your request, please provide the necessary information to authenticate your identity. Only authenticated requests will be processed. You understand that we have an initial period of 45 days to respond to the request, with one additional extension period of 45 when reasonably necessary upon considering the complexity of the request. In the event we decline to process your request we will inform you in the initial 45 period and provide you with instructions on how to appeal the decision.
    8. Appeal. You have the right to appeal our decision to refuse to act on a personal data privacy request within a reasonable period after you receive our decision. To appeal our decision, you should send your objection to our denial via email to ______________________ and to allow us to review your data subject request. Within 60 days, we will provide you with a written explanation of the justification for declining to act on your request. If you disagree with our explanation, you have the right to file a complaint with the New Jersey Division of Consumer Affairs.

 

11. Privacy Notice to Tennessee Residents. As a Tennessee resident you have the following data privacy rights regarding your personal data:
    1. Access. You have a right, twice in a 12-month period, to request for free that we disclose to you the personal information that we collected about you, and any additional information about our collection, use, disclosure, or sale of such personal information, which is also contained in this privacy policy.
    2. Correction. You have the right to request that we correct inaccurate personal information under certain circumstances, subject to a few exceptions provided under Tennessee law. To request the correction of personal information, please submit a Data Request on our Site. You understand that we have no control over how the lender collects and maintains your information, and you are to reach out to the lender directly to correct your information.
    3. Obtaining a portable copy of your personal data. To obtain a copy of your personal data that you previously provided to us in a portable format, please submit an “Access” request as described above. While these requests are distinct, we have not identified any technically feasible and readily usable format that would allow you to transmit this data to another controller. Therefore, we will provide you a copy of your personal data so that we honor your request as best is technically feasible.
    4. Deletion. You have the right to request that we delete your personal information under certain circumstances, subject to a number of exceptions, subject to a number of exceptions provided under Tennessee law. To request the deletion of personal information, please submit a Data Request on our Site. You understand that we have no control over how the lender collects and maintains your information, and you are to reach out to the lender directly to delete your information.
    5. Opt-Out Rights. You have a right to opt-out from the sale of your personal data. To request the opt out of sale of your personal, please submit a Data Request Form on our Site. You understand that we are not responsible for any opt out requests between you and any lender to whom you are referred. You further understand and agree that the transferring of your information to lender pursuant to your application on our Site shall not constitute the sale of data.
    6. Request, Response, and Procedure. When submitting your request, please provide the necessary information to authenticate your identity. Only authenticated requests will be processed. You understand that we have an initial period of 45 days to respond to the request, with one additional extension period of 45 when reasonably necessary upon considering the complexity of the request. In the event we decline to process your request we will inform you in the initial 45 period and provide you with instructions on how to appeal the decision.
    7. Appeal. You have the right to appeal our decision to refuse to act on a personal data privacy request within a reasonable period after you receive our decision. To appeal our decision, you should send your objection to our denial via email to ______________________ and to allow us to review your data subject request. Within 60 days, we will provide you with a written explanation of the justification for declining to act on your request. If you disagree with our explanation, you have the right to file a complaint with Tennessee Attorney General.

 

12. Privacy Notice to Texas Residents. As a Texas resident you have the following data privacy rights regarding your personal data:
    1. Access. You have a right, twice in a 12-month period, to request for free that we disclose to you the personal information that we collected about you, and any additional information about our collection, use, disclosure, or sale of such personal information, which is also contained in this privacy policy.
    2. Correction. You have the right to request that we correct inaccurate personal information under certain circumstances, subject to a few exceptions provided under Texas law. To request the correction of personal information, please submit a Data Request on our Site. You understand that we have no control over how the lender collects and maintains your information, and you are to reach out to the lender directly to correct your information.
    3. Obtaining a portable copy of your personal data. To obtain a copy of your personal data that you previously provided to us in a portable format, please submit an “Access” request as described above. While these requests are distinct, we have not identified any technically feasible and readily usable format that would allow you to transmit this data to another controller. Therefore, we will provide you a copy of your personal data so that we honor your request as best is technically feasible.
    4. Deletion. You have the right to request that we delete your personal information under certain circumstances, subject to a number of exceptions, subject to a number of exceptions provided under Texas law. To request the deletion of personal information, please submit a Data Request on our Site. You understand that we have no control over how the lender collects and maintains your information, and you are to reach out to the lender directly to delete your information.
    5. Opt-Out Rights. You have a right to opt-out from the following: (i) targeted advertising; (ii) the sale of personal data; or (iii) profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning you. To request the opt out of sale of your personal, please submit a Data Request Form on our Site. You understand that we are not responsible for any opt out requests between you and any lender to whom you are referred. You further understand and agree that the transferring of your information to lender pursuant to your application on our Site shall not constitute the sale of data.
    6. Request, Response, and Procedure. When submitting your request, please provide the necessary information to authenticate your identity. Only authenticated requests will be processed. You understand that we have an initial period of 45 days to respond to the request, with one additional extension period of 45 when reasonably necessary upon considering the complexity of the request. In the event we decline to process your request we will inform you in the initial 45 period and provide you with instructions on how to appeal the decision.
    7. Appeal. You have the right to appeal our decision to refuse to act on a personal data privacy request within a reasonable period after you receive our decision. To appeal our decision, you should send your objection to our denial via email to ______________________ and to allow us to review your data subject request. Within 60 days, we will provide you with a written explanation of the justification for declining to act on your request. If you disagree with our explanation, you have the right to file a complaint with Texas Attorney General.

 

13. Notice to Users Outside of the United States. This Online Privacy Policy is intended to cover collection of information on our Sites from residents of the United States only. If you are visiting our Site from outside the United States, please be aware that your information may be transferred to, stored and processed in the United States where cloud or servers are located, and our central database is operated. The data protection and laws of the United States and other countries might not be as comprehensive as those in your country. We do not sell, offer, or otherwise provide services to individuals outside of the United States, and you understand that non-U.S. residents are unable to receive services from Granite Bay.

 

6. MISCELLANEOUS PROVISIONS.
7. Protecting Children’s Privacy Online (Children’s Online Privacy Protection Act (COPPA)) Disclosure. The Sites are not directed to individuals under the age of eighteen (18), and we request that these individuals do not provide Personally Identifiable Information (PII) or Personal Financial Information (“PFI”) through the Site. We do not knowingly collect information from children, teenagers, or minors under 18 years of age without parental consent. If you are a User under the age of 18, please do not send any PII or PFI to us if we have not obtained prior consent from your parent or guardian. If we learn we have collected PII and/or PFI from a User under the age of 18 without parental consent, or if we learn a User under the age of 18 has provided us with PII beyond what we request from him or her, we will delete that information as quickly as possible. If you believe that a User under the age of 18 may have provided Granite Bay with PII and/or PFI in violation of this Privacy Policy, please contact us at our e-mail or physical mailing address listed in the “Contact Us” section below and we will take all reasonable efforts to remove the information. For more information about the Children’s Online Privacy Protection Act (COPPA), please visit the Federal Trade Commission website at https://www.ftc.gov/business-guidance/privacy-security/childrens-privacy.

 

2. English Language Govern this Privacy Notice. You acknowledge and agree that the text of this Privacy Notice, including all linked pages or other page Sites, have been written, and are offered, in both English and Spanish. Each version is authentic. In the event of any dispute regarding this Privacy Policy, however, the English version shall be given priority of interpretation and shall therefore be controlling. Additionally, all notifications shall be provided by one party hereunder to the other party in the English language. You may request a copy of this Privacy Notice in Spanish for your records.

 

3. Making Sure Information is Accurate. You understand and agree that Granite Bay presumes that the PII or PFI you provided is, indeed, accurate. Granite Bay will not be responsible for verifying that your Information. It is your responsibility to ensure the information provided is accurate and up to date. If you have previously submitted information which is incomplete, inaccurate or not current, please email or write us at the appropriate address, or complete a data request form, with updated information which you would like us to use in our communication with you.

 

4. Business Transitions. You understand and agree that if Granite Bay goes through a business transition, such as a merger, acquisition by another company, or sale of all or a portion of its assets, your Personal information, PII, PFI, and additionally collected information will likely be among the assets transferred.

 

5. Linking to Third-Party Websites. Granite Bay may provide links to websites that are owned or operated by other companies (“third-party websites”).  When you use a link online to visit a third-party website, you will be subject to that website’s privacy and security practices, which may differ from ours. You should familiarize yourself with the privacy policy, terms of use and security practices of the linked third-party website before providing any information on that website.

 

6. Opt-Out Policy for Newsletter and/or Email Subscriptions. You may opt-out or unsubscribe from a newsletter or other email list at any time by following the instructions at the end of the newsletters or emails which you receive. Please allow five to ten (5-10) business days for changes to take effect. Please be advised that all opt-out requests will be honored by the 10^th business day. You understand and agree that during that period and while your request is pending you may still receive newsletters and emails. Client service-related communications are an integral part of the services you receive from us, and you may continue to receive such service-related emails unless you cancel your account, even if you opt out of the newsletters or email list. If you have provided more than one email address to us, you may continue to be contacted unless you request to unsubscribe each email address you have provided. You may also opt-out of receiving our newsletter or marketing emails by contacting us at privacy@granitebayfinancial.com,or by replying to an existing email with your request to be removed from the mailing list.

 

7. Changes to this Online Privacy Policy. We may change this Online Privacy Policy from time to time.  When we do, we will let you know by appropriate means such as by posting the revised policy on this page with a new “Last Updated” date.  Any changes to this Online Privacy Policy will become effective when posted unless indicated otherwise. We recommend you review this Online Privacy Policy each time you visit Granite Bay’s website to review for such changes, as your continued use of the website constitutes your express acceptance of, and agreement to, the revised Online Privacy Policy.

 

8. Contact Us. If you have any questions or concerns related to this Online Privacy Policy, please contact us by email to info@granitebayfinancial.com. You may also contact us by mail at 1207 Delaware Ave., #2678m Wilmington, DE 19806, or by phone at 1-877-264-8624.

YOU MAY DOWNLOAD A PDF VERSION OF THIS PRIVACY POLICY BY CLICKING HERE, WHICH WE ENCOURAGE YOU TO SAVE IN YOUR RECORDS, AND CEHCK FOR UPDATE FROM TIME TO TIME.