The California Consumer Privacy Act of 2018 (''CCPA''), amended by the California Privacy Rights Act of 2020, provides you with specific rights regarding your Personal Information. This section describes the rights that California consumers have and explains how to exercise those rights. For the purposes of this section, ''Personal Information'' does not include: (i) information that is lawfully made available from federal, state or local government records; (ii) de-identified or aggregated data; or (iii) information excluded from the scope of the CCPA. To be clear, these rights are granted only to the extent that you are a California consumer. The rights in this section are not intended to grant you additional rights, but only your rights under the CCPA to the extent that we are considered a CCPA business with respect to the applicable Personal Information.

In order to provide our Services to our clients, we may process Service Data that we receive from or on behalf of our clients. If you are a California resident, you may have certain CCPA rights pertaining to such information. Under the CCPA, when we act as a ''service provider'' (not as a ''business'' or a ''third party'') over such information, we only process your information through our Services as necessary to provide our services to our clients, at our clients' direction. If you wish to exercise any of your rights under CCPA regarding such information, please contact the relevant business that collected the information from you, who controls and determines how your information is processed.

Information We Collect; How We Collect It; How We Use It

California consumers may access, delete, and control certain uses of their information as set forth in Rights to Your Information, below.

In the past 12 months, we have collected some or all of the categories of Personal Information described in the table below. The table below further describes the business or commercial purpose(s) for which the Personal Information was collected and the entities to whom such information has been disclosed within the last 12 months.

The Personal Information described in the table above is collected directly from you, or from the sources set forth in the How We Collect Your Personal Information section of the Privacy Statement. In addition to the parties described above, we may disclose your Personal Information to other third parties as set forth in the How We Disclose Your Personal Information section of the Privacy Statement.

Please note that BNK Invest does not ''sell'' any of your personal information in exchange for money. However, the term ''sell'' has a broader meaning under the CCPA than would ordinarily be understood in a non-legal context. In the past 12 months, we have sold or shared the following categories of Personal Information with third parties:

• Identifiers
• Customer records information

• Characteristics of protected classifications
• Internet or other similar network activity information
• Geolocation data
• Professional or employment-related information
• Inferences

Disclosures of Personal Information to Service Providers and Third Parties

Company may disclose your Personal Information to a third party for a business purpose, or sell or share your Personal Information, subject to your right to opt out (see Personal Information Sales Opt-Out and Opt-In Rights, below). The information above under Information We Collect; How We Collect It; How We Use It describes the third parties with which we may disclose your Personal Information.

Rights to Your Information

1. Right to Know

As a California consumer, you have the right to request that we disclose certain information to you about our collection, use, disclosure or sale of your Personal Information over the past 12 months. Once we receive and confirm your verifiable consumer request (see Exercising Your Rights, below), and subject to certain limitations that we describe below, we will disclose such information. You have the right to request any or all of the following:

• The categories of Personal Information we collected about you.
• The categories of sources from which the Personal Information is collected.

• Our business or commercial purpose for collecting or selling that Personal Information.
• The categories of third parties with whom we share that Personal Information.
• The specific pieces of Personal Information we collected about you (see Data Portability Rights below).

2. Right to Delete

You have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (see Exercising Your Rights, below), we will delete (and direct our service providers to delete) your Personal Information from our records, unless an exception applies. However, we may retain Personal Information that has been de-identified or aggregated. Furthermore, we may deny your deletion request if retaining the information is necessary for us or our service provider(s) in order to perform certain actions set forth under CCPA, such as detecting security incidents and protecting against fraudulent or illegal activity.

3. Right to Data Portability

You have the right to request a copy of Personal Information we have collected and maintained about you in the past 12 months. The CCPA allows you to request your information from us up to twice during a 12-month period.  We will provide our response in a readily usable (and usually electronic) format.

4. Right to Correct

You have the right to request the correction of any Personal Information we maintain about you.

5. Right to Opt Out of Selling or Sharing Your Personal Information

You have the right to opt out of the sale or sharing of your Personal Information, along with the right to opt in to the sale of such information. We do not sell or share the Personal Information of consumers we actually know are less than 16 years of age, unless we receive affirmative authorization (the ''right to opt-in'') from either the consumer who is less than 16 (but greater than 13) years of age, or the parent or guardian of a consumer less than 13 years of age. To our knowledge, we do not sell or share the Personal Information of minors under 16 years of age.

To exercise the right to opt out, you (or your authorized representative) may submit a request to the following email: info@bnkinvest.com. Alternatively, you may submit an opt-out request by contacting us at (516) 605-2277.

You may change your mind and opt back into Personal Information sales at any time by contacting us at info@bnkinvest.com.

6. Right to Limit the Use of Your Sensitive Personal Information

You have the right to limit the use or disclosure of your sensitive personal information (''SPI'') if we are using your SPI beyond what is reasonable and proportionate to provide the requested goods or services. You can make a request for us to limit the use or disclosure of your SPI by emailing info@bnkinvest.com with the following subject: ''Limit the Use of My Sensitive Personal Information.''

Right to Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights, including but not limited to, by:

• Denying you goods or services.
• Charging you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Providing you a different level or quality of goods or services.

• Suggesting that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

8. Exercising Your Rights

To exercise the rights described above, please contact us by using the following methods:

• Calling us at (516) 605-2277; or
• Email us at info@bnkinvest.com with the subject line: California Resident CCPA Request to submit a request.

After submitting a request, we will take steps to verify your identity in order for us to properly respond and confirm that it is not a fraudulent request. In order to verify your identity, we will ask, at a minimum, that you provide your name, email address, and mailing address so that we can match this information with the information existing in our systems. When providing us this information, you represent and affirm that all information provided is true and accurate.

BNK Invest will send you a verification email to verify that you have access to the email address you have provided. Then, as required by the CCPA, BNK Invest will use this information to verify your identify to a reasonable or reasonably high degree of certainty, depending on the request. If we are able to match at least two pieces of personal information to the personal information that we may retain of you, we will honor your Right to Know (Categories) request. If we are able to match at least three pieces of personal information to the personal information that we may retain of you, we will honor your Right to Delete, Right to Correct, and/or Right to Know (Data Portability / Specific Pieces of Personal Information) requests. If we are unable to verify your identity, we will let you know that we are unable to fulfill your request.

Only you, or an agent legally authorized to act on your behalf, may make a verifiable request related to your Personal Information. If you are making a request as the authorized agent of a California consumer, we will ask you also submit reliable proof that you have been authorized in writing by the consumer to act on such consumer's behalf.

We will make every effort to respond to your request within 45 days from when you contacted us. If you have a complex request, the CCPA allows us up to 90 days to respond. We will still contact you within 45 days from when you contacted us to let you know we need more time to respond.

Notice of Financial Incentive

We may at times offer our customers programs that provide certain perks associated with us, such as rewards and exclusive offers. We may also provide other programs, such as sweepstakes, contests, or other similar promotional campaigns (collectively, the ''Programs''). When you sign up for one of these Programs, we typically ask you to provide your name and contact information (such as email address and/or telephone number). Because our Programs involve the collection of Personal Information, they may be considered a ''financial incentive'' program under California law. The value of your personal information to us is related to the value of the free or discounted products or services, or other benefits that you obtain or that are provided as part of the applicable Program, minus the expense related to offering those products, services, and benefits to Program participants. Unless specifically stated otherwise in connection with a potential ''financial incentive,'' the value of the benefit BNK Invest may offer to you exceeds the value of the personal information you provide as a participant.

You may withdraw from participating in a Program at any time by contacting us using the designated method set forth in the applicable Program rules. Please read the terms and conditions of each Program to view full details, including how to join. You may also withdraw from or opt into the Program by contacting us at the email address provided in connection with the Program. If none is provided, you may contact us as set forth above in the Contacting Us section.

CALIFORNIA ''SHINE THE LIGHT''

Under California Civil Code Section 1798.83 (''Shine the Light''), California residents have the right to request in writing from businesses with whom they have an established business relationship: (a) a list of the categories of personal information, as defined under Shine the Light, such as name, email address, and mailing address, and the type of services provided to the customer that a business has disclosed to third parties (including affiliates that are separate legal entities) during the immediately preceding calendar year for the third parties' direct marketing purposes; and (b) the names and addresses of all such third parties. To request the above information, please contact us at (516) 605-2277. If you do not want your personal information shared with any third party who may use such information for direct marketing purposes, then you may opt out of such disclosures by contacting us at (516) 605-2277.

VIRGINIA PRIVACY RIGHTS

The Virginia Consumer Data Protection Act (''CDPA'') provides Virginia consumers with specific rights regarding their personal information. This section describes your rights under the CDPA and explains how you may exercise these rights.

The categories of personal information we process, our purposes for processing your personal information, the categories of personal information that we share with third parties, and the categories of third parties with whom we share it are detailed above in our Privacy Statement.

Certain rights that you may have concerning your personal information are set forth in our Privacy Statement. The CDPA provides you with the following additional rights:

• Right to know. You have the right to know whether we process your personal information.

• Right to data portability. You have the right to access and obtain a copy of your personal information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another business without hindrance, where the processing is carried out by automated means. You may request such personal information up to twice annually, subject to certain exceptions.
• Right to delete. You have the right to delete personal information that you have provided by or that we have obtained about you. Please note that we may deny such request if the requested deletion falls under an exception to this right set forth in the CDPA. Additionally, if you request deletion of your personal information and we have obtained such information from a third-party source, we may retain such data by keeping a record of the deletion request and the minimum data necessary to ensure that your personal information remains deleted from our records and that such retained data is not used for any other purpose, or we may opt you out of the processing of such personal information for any purpose except for those allowed under the CDPA.
• Right to opt out of selling or sharing. You have the right to opt out of the processing of the personal information for purposes of: (i) targeted advertising; (ii) the sale of personal information; or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. As of the latest date of the Privacy Statement:
• We DO process personal information for the purposes of targeted advertising;
• We DO NOT sell your personal information in exchange for monetary consideration;
• We DO NOT engage in profiling decision based on your personal information that produce legal or similarly significant effects concerning you.
• If you wish to opt out of the processing of your personal information for the purposes of targeted advertising please email us at info@bnkinvest.com.

• Right to correct. You have the right to correct inaccuracies in the personal information we collect from you, taking into account the nature of the personal information and the purposes for which we process it.
• Right to nondiscrimination. You have the right not to receive discriminatory treatment by us for the exercise of your Virginia privacy rights. Unless permitted by the CDPA, we will not:
• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

How to Contact Us About Your Virginia Privacy Rights

To exercise any of your Virginia privacy rights, or if you have any questions about your privacy rights, you may contact us by:

• Calling us at (516) 605-2277; or
• Emailing us at info@bnkinvest.com with the subject line: Virginia CDPA Request to submit a request.

Verification of Your Identity. After submitting a request, we will take steps to verify your identity in order for us to properly respond and/or confirm that it is not a fraudulent request. In order to verify your identity, we will request, at a minimum, that you provide your name, email address, phone number, address, and relationship to us, so that we can seek to match this information with the information existing in our systems. When providing us this information, you represent and affirm that all information provided is true and accurate. If we are unable to verify using reasonably commercial efforts that the consumer submitting the request is the same individual about whom we have collected personal information, then we are not required to comply with the request; we may contact you for more information reasonably necessary to authenticate the request, but ultimately we may not be able to meet your request.

Only you may make a verifiable request related to your personal information. If you are making a request as the parent or legal guardian of a known child regarding the processing of that child's personal information, we may ask you to submit reliable proof of your identity.

Our Response Time to Your Request

We will make every effort to respond to your request within forty-five (45) days from when you contacted us. If you have a complex request, the CDPA allows us up to ninety (90) days to respond. We will still contact you within forty-five (45) days from when you contacted us to let you know we need more time to respond and the reason for the extension.

Your Right to Appeal

If we decline to take action regarding a request that you have submitted, we will inform you of our reason for declining to take action and provide instructions for how to appeal the decision. In the event that we do not respond to a request that you make pursuant to one of the privacy rights set forth in this section, you have the right to appeal our refusal to take action within a reasonable period of time after you receive our decision. Within 60 days of our receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If the appeal is denied, we will also provide you with an online mechanism, if available, or other method through which you may contact the Attorney General to submit a complaint.