The Data Group Privacy Policy

Effective Date: November 6, 2026

1. WHO WE ARE AND SCOPE OF THIS POLICY

This Privacy Policy explains how The Data Group (“Company”, “we”, “us”, or “our”) collects, uses, discloses, sells, and otherwise processes personal information, and the rights you may have with respect to that information. We understand the importance of safeguarding your data and are dedicated to maintaining transparency about how we handle it. We are committed to protecting your personal information and your right to privacy.

Contact: Compliance@thedatagroup.com | Website: https://thedatagroup.com/

This privacy policy applies to all information collected through our website and/or any related services, sales, marketing or events (the “Services”), including cases where clients provide us with data files for processing by third-party data partners or where we obtain third-party data for client-requested list rentals. We act in two capacities. When a client provides us with its own data file for enrichment or appending, we process that file on the client’s behalf as a service provider or processor. When we obtain personal information from third-party data partners and make it available to clients through list rental, data append, or similar services, we act as a business (or controller), and we are a “data broker” under California law and the laws of other states because we sell or license personal information about consumers with whom we do not have a direct relationship. This Policy also applies to personal information we collect from visitors to our website and from individuals who contact us.

Data Broker Notices

California: The Data Group is a data broker registered with the California Privacy Protection Agency (“CalPrivacy”) under the Delete Act (Cal. Civ. Code § 1798.99.80 et seq.). California residents may request that all registered data brokers, including The Data Group, delete their personal information in a single request through CalPrivacy’s Delete Request and Opt-out Platform (“DROP”), available at https://privacy.ca.gov. You may also contact us directly as described in Sections 15 and 18.
Texas: The entity maintaining this website is a data broker under Texas law. To conduct business in Texas, a data broker must register with the Texas Secretary of State (Texas SOS). Information about data broker registrants is available on the Texas SOS website. Texas residents may exercise their rights under the Texas Data Privacy and Security Act as described in Sections 13 and 22.6.

This Privacy Policy applies to individuals who interact with our website, services, and products and is intended to provide the disclosures required by, and describe the rights available under, the following laws, to the extent each applies to us:

CCPA/CPRA — California Consumer Privacy Act / California Privacy Rights Act
FDBR — Florida Digital Bill of Rights
CPA — Colorado Privacy Act
VCDPA — Virginia Consumer Data Protection Act
UCPA — Utah Consumer Privacy Act
CTDPA — Connecticut Data Privacy Act
TDPSA — Texas Data Privacy and Security Act
NJDPA — New Jersey Data Privacy Act
NDPA — Nebraska Data Privacy Act
MCDPA — Montana Consumer Data Privacy Act
ICDPA — Iowa Consumer Data Protection Act
INCDPA — Indiana Consumer Data Protection Act
OCPA — Oregon Consumer Privacy Act
DPDPA — Delaware Personal Data Privacy Act
TIPA — Tennessee Information Protection Act
NHDPA — New Hampshire Data Privacy Act
KCDPA — Kentucky Consumer Data Protection Act
RIDTPPA — Rhode Island Data Transparency and Privacy Protection Act
MODPA — Maryland Online Data Privacy Act
MNCDPA — Minnesota Consumer Data Privacy Act
California Delete Act (Cal. Civ. Code § 1798.99.80 et seq.) and California “Shine the Light” law (Cal. Civ. Code § 1798.83)
State data broker registration laws, including Texas (Tex. Bus. & Com. Code ch. 509), Vermont (9 V.S.A. § 2446), and Oregon (ORS 646A.593)

2. WHAT INFORMATION DO WE COLLECT?

Sources of Personal Information: We collect personal information from the following categories of sources: (a) our clients, who provide data files for processing; (b) third-party data partners, including data compilers, list owners and managers, and public record sources, from which we obtain data for list rental and data append services; (c) individuals who visit our website or contact us; and (d) automatically, through cookies and similar technologies.
Client Data Provided for Processing: Includes names, addresses, phone numbers, and other personal information as directed by clients. We act solely as a data processor in this context and do not independently determine the purpose or means of processing.
Third-Party Data for List Rentals: Personal data sourced solely to fulfill client requests for list rental services. Such data is obtained through vetted third-party data partners and is not retained beyond the scope of service fulfillment, except for suppression records we keep to honor opt-out and deletion requests.

Information Automatically Collected

When you visit our website, we may automatically collect certain technical information, including but not limited to: IP address, browser type and characteristics, device data and identifiers, cookie identifiers, and approximate geolocation derived from IP address.

Categories of Personal Information Collected, Sold, Shared, and Disclosed in the Preceding 12 Months

In the preceding 12 months, we have collected the following categories of personal information (as defined in the CCPA). For each category, we indicate whether we sold it, shared it for cross-context behavioral advertising, or disclosed it to service providers or contractors for a business purpose:

Identifiers (e.g., name, postal address, email address, telephone number, IP address, cookie and device identifiers). Sources: clients, data partners, website visitors. Sold to: clients. Shared with: advertising partners (website identifiers only). Disclosed for a business purpose to: hosting, IT, data processing, and data hygiene vendors.
Personal information described in Cal. Civ. Code § 1798.80(e) (e.g., name, address, telephone number). Sources: clients, data partners. Sold to: clients. Disclosed for a business purpose to: data processing vendors.
Characteristics of protected classifications (e.g., age range, gender). Sources: data partners. Sold to: clients.
Commercial information (e.g., purchase or interest indicators). Sources: data partners. Sold to: clients.
Professional or employment-related information (e.g., job title, employer, industry). Sources: data partners. Sold to: clients.
Internet or other electronic network activity (website browsing and interaction data). Source: website visitors. Shared with: advertising partners. Disclosed for a business purpose to: analytics and hosting providers.
Geolocation data (approximate location derived from IP address only). Source: website visitors. Disclosed for a business purpose to: analytics providers.
Inferences (e.g., modeled interests or propensities). Sources: data partners. Sold to: clients.

We use and disclose these categories of personal information for the business and commercial purposes described in Sections 3, 4, and 5. We do not have actual knowledge that we sell or share the personal information of consumers under 16 years of age. We do not collect, use, or sell personal data for the purpose of training large language models.

Client Data Source Attestation and Transparency

As part of our commitment to responsible data stewardship, we require that clients who provide personal data to us for processing attest that such data has been collected from lawful sources with appropriate notice to, and where required consent from, the individuals whose information is included. We do not knowingly process personal data that clients have obtained in violation of applicable law, regulation, or privacy policy. If you believe that personal data about you has been submitted to us in a manner inconsistent with the original collection notice or consent, please contact us at Compliance@thedatagroup.com so that we may investigate and take appropriate corrective action.

3. HOW WE USE AND PROCESS CLIENT DATA

We process client-provided data strictly according to client instructions and for no other purpose. The primary activities through which we process client data include:

Data Enrichment and Appending: Client-provided files are processed to append or update data elements as specified by the client. All files are securely deleted following completion of the processing engagement.
List Rental Services: We obtain personal information from third-party data partners and rent, license, or otherwise provide it to clients to fulfill client-requested list rental orders, including for clients’ own marketing purposes. This is a “sale” of personal information under the CCPA and similar state laws. Clients are contractually required to use the data only for the specified purpose and to comply with applicable law. Except for suppression records, no data is retained beyond the fulfillment of the specific rental order.

Data Processing Limitations

No collection of personal data beyond what is necessary to fulfill client orders
All data partner relationships governed by binding compliance agreements
Data security and confidentiality maintained throughout all processing activities

We are committed to processing client data solely for the purpose intended by the client and in strict conformance with applicable law.

Prohibition on Re-Identification of De-Identified Data

We do not attempt to re-identify any individual whose personal information has been anonymized, pseudonymized, or de-identified. We do not combine de-identified data with information from other sources in a manner that would enable the identification of a natural person. We contractually require our data partners and permitted subcontractors to observe the same prohibition. In the event that re-identification occurs inadvertently within our systems or through a partner, we will take immediate steps to contain the incident, notify affected parties as required by applicable law, and mitigate any harm to affected individuals.

Prohibition on Secondary Use of Client Data

We do not use client data for any purpose beyond the specific services requested by the client. We do not repurpose, resell, or otherwise exploit client-provided data for independent business development, marketing to third parties, profiling, or any other commercial vertical not contemplated by the original client engagement. Any client request to expand the use of previously submitted data to a materially different purpose will require a new written engagement and, where required by applicable law, appropriate notice to or consent from affected data subjects.

4. HOW DO WE USE YOUR INFORMATION?

We use the information we collect or receive for the following purposes:

Marketing communications, including updates, offers, and promotional materials. You may opt out of marketing emails at any time by using the unsubscribe link in the email or by contacting us.
Administrative notices regarding services, accounts, and policy changes
Responding to testimonials, feedback, and service inquiries
Delivering targeted advertising relevant to user interests
Protecting our Services, rights, and the interests of our users
Legal compliance and regulatory obligations
Service delivery, fulfillment, and operational support
User and client support functions

5. WILL YOUR INFORMATION BE SHARED WITH ANYONE?

We only share information in the following circumstances, consistent with applicable law and the legal bases identified below:

Consent: With your explicit consent or at your direction
Legal Compliance: Where required by applicable law, court order, or governmental authority
Service Provision: With vendors, consultants, and third-party service providers who assist in delivering our Services, subject to binding confidentiality and data protection obligations
Rights Protection: To protect the rights, property, or safety of The Data Group, our clients, or others
Legal Obligations: To fulfill legally mandated disclosure requirements
Business Transfers: In connection with a merger, acquisition, sale of assets, or similar corporate transaction, where the acquiring entity agrees to be bound by the terms of this Privacy Policy
Third-Party Advertisers: For the delivery of interest-based advertising, consistent with applicable law and user opt-out rights
Clients (Sale of Personal Information): We sell, rent, or license personal information obtained from our data partners to clients for list rental and data append purposes, subject to contractual use restrictions.

As described above and in Section 3, we sell personal information to clients, including for their own marketing purposes, and we share website identifiers and browsing data with advertising partners for cross-context behavioral advertising (“sharing” under the CCPA). You may opt out of the sale and sharing of your personal information as described in Sections 15 and 18. We do not otherwise sell, rent, or trade personal information.

6. DATA RETENTION AND DELETION POLICY

We retain personal information only as long as necessary to fulfill the purposes for which it was collected, subject to legal, regulatory, and contractual obligations. Our specific retention practices are as follows:

Client-Provided Data: Deleted within thirty (30) days of service completion, unless the client and applicable law require a different retention period.
List Rental Data: Not retained after successful delivery to the client.
Transaction and Communication Records: Retained for the period required by applicable law or as reasonably necessary to support dispute resolution and legal proceedings.
Anonymized Data: Securely stored until permanent deletion is operationally feasible; such data cannot be used to re-identify individuals.
Suppression Records: We retain the minimum information necessary to honor opt-out and deletion requests (including requests received through DROP) for as long as needed to ensure the individual is not re-added to our datasets or included in future sales, as permitted by law.
Website and Analytics Data: Retained for up to 13 months from collection.

Secure deletion protocols, including physical destruction or cryptographic erasure where appropriate, are applied to all personal information at the expiration of its applicable retention period. Clients may contact us to discuss specific retention requirements applicable to their engagements.

Backup System Retention Cap

Notwithstanding any other provision of this policy, personal data that has reached the end of its applicable retention period will not be retained in backup or archival systems for more than thirty (30) days following that expiration date, unless retention is required by applicable law or a valid court or regulatory order. We will ensure that backup copies of expired data are purged on a rolling basis consistent with this cap.

Written Deletion Confirmation

Upon written request by a client or, where required by applicable law, by an individual data subject, we will provide written confirmation that specific personal data has been deleted from our active systems and, following the thirty (30)-day backup cap described above, from our backup systems. Requests for deletion confirmation may be submitted to Compliance@thedatagroup.com.

7. DATA PARTNER SELECTION AND SECURITY

We conduct thorough due diligence in the selection of all data partners and require execution of legally binding data processing or data partner agreements as a condition of any engagement. Our requirements for data partners include:

Implementation of industry-standard encryption for data in transit and at rest
Robust access controls limiting data access to authorized personnel only
Documented incident response and breach notification plans
Demonstrated compliance with applicable data privacy laws and standards

We are committed to the continuous improvement of our security practices and to ongoing review and re-vetting of data partner relationships to ensure sustained compliance.

8. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

We may use cookies and similar tracking technologies (such as web beacons and pixel tags) to access or store information about your interactions with our website. Certain information may be collected automatically when you use our Services. For a detailed description of the types of tracking technologies we use and your choices regarding their use, please review our Cookie Policy, available on our website at https://thedatagroup.com/. You may also set your browser to refuse all or some browser cookies or to alert you when cookies are being sent. Where our use of cookies or similar technologies constitutes a “sale” or “sharing” of personal information (for example, for cross-context behavioral advertising), you may opt out by using the “Do Not Sell or Share My Personal Information” link on our website or by enabling the Global Privacy Control signal in your browser.

9. HOW LONG DO WE KEEP YOUR INFORMATION?

We keep each category of personal information only for the retention periods described in Section 6, unless a longer retention period is required by law, regulatory obligation, or client contract. When information is no longer needed for its original purpose, we will either:

Delete or permanently anonymize the information so it can no longer be associated with an identified or identifiable individual; or
Where immediate deletion is not technically feasible, securely store and isolate the information from any further use or processing until secure deletion is possible.

10. DATA MINIMIZATION AND PURPOSE LIMITATION

Our data minimization and purpose limitation practices are foundational to our privacy program. We adhere to the following principles:

Limited Collection: We collect only the data elements that are strictly required to deliver the specific services requested by each client. We do not collect surplus data.
Client-Directed Data Use: All processing activities are performed strictly in accordance with client instructions and for no other purpose.
Restricted Access: Access to personal data is limited to authorized Company personnel and approved partner organizations with a legitimate need to access such data to perform services.
Defined Processing Purposes: Data is not repurposed for any activity not expressly authorized by the client in writing.
No Independent Data Compilation: We do not independently compile, build, or maintain personal data databases beyond what is required by client engagements.
Compliance with Client Requirements: We align our data minimization practices with any additional restrictions specified by clients in their respective data processing agreements.
Ongoing Monitoring and Review: We regularly review our data minimization practices to identify and address any deviations from applicable standards.

11. HOW DO WE KEEP YOUR INFORMATION SAFE?

We have implemented appropriate technical and organizational security measures designed to protect the personal information we process against unauthorized access, alteration, disclosure, or destruction. These measures include, but are not limited to, access controls, encryption, data segmentation, employee training, and vendor oversight programs. However, no electronic transmission over the internet or information storage technology can be guaranteed to be 100% secure. Transmission of personal information to and from our Services is undertaken at the user’s own risk. You should access our Services only within a secure environment and take reasonable precautions to protect your own data and account credentials.

12. DO WE COLLECT INFORMATION FROM MINORS?

We do not knowingly collect personal data from, or direct marketing to, children under the age of eighteen (18). Our Services are not directed at individuals under the age of eighteen (18). If you are aware or have reason to believe that personal data about a child under the age of eighteen (18) has been collected through our Services or submitted to us without appropriate parental or guardian consent, please contact us immediately at Compliance@thedatagroup.com so that we may take appropriate remedial action.

13. WHAT ARE YOUR PRIVACY RIGHTS?

Depending on your jurisdiction, you may have a range of rights with respect to your personal information. These may include the right to access, correct, delete, or port your personal data, as well as the right to object to or restrict certain processing activities. In some jurisdictions, you may also have the right to lodge a complaint with the applicable data protection supervisory authority. To opt out of interest-based advertising, please visit: http://www.aboutads.info/choices/.

How to Submit a Request

You may submit a request to exercise your privacy rights by (1) completing our Consumer Privacy Request Form at https://thedatagroup.com/privacy/consumer-optout-request-form/; (2) calling us toll-free at 800-262-5609; or (3) emailing Compliance@thedatagroup.com. To opt out of the sale or sharing of your personal information, you may also use the “Do Not Sell or Share My Personal Information” link on our website or enable the Global Privacy Control in your browser. California residents may also submit a deletion request to all registered data brokers through DROP at https://privacy.ca.gov.

Verification and Authorized Agents

To protect your information, we verify requests to know, access, correct, or delete. We do not require verification for requests to opt out of sale or sharing. You may designate an authorized agent to submit a request on your behalf. We may require the agent to provide signed written permission from you, and we may ask you to verify your identity directly with us, unless the agent holds a valid power of attorney.

Response Timing

We will confirm receipt of a request to know, access, correct, or delete within 10 business days and respond within 45 calendar days of receipt. If we need more time, we may extend this period by an additional 45 calendar days where permitted by law, and we will notify you of the extension and the reason for it. We process requests to opt out of sale or sharing as soon as feasibly possible and no later than 15 business days after receipt.

Appeals

If we decline to take action on your request, you may appeal our decision by emailing Compliance@thedatagroup.com with the subject line “Privacy Request Appeal” within a reasonable period after receiving our decision. We will respond to your appeal in writing within the period required by applicable law (generally 45 or 60 days) and explain the reasons for our decision. If your appeal is denied, you may contact the Attorney General of your state of residence.

14. CONSUMER REQUEST METRICS

In accordance with California Civil Code § 1798.99.85 and applicable CCPA regulations (Cal. Code Regs. tit. 11, § 7102), we publish the following metrics for consumer privacy requests received during the most recent calendar year:

Request Type	Received	Completed	Avg. Response Time
Right to Delete	39,784	39,784	10 days
Right to Access / Know	39,784	39,784	10 days
Know What Is Sold / Shared	39,784	39,784	10 days
Opt-Out of Sale / Sharing	39,784	39,784	10 days
Limit Sensitive Personal Information	39,784	39,784	10 days

This data is updated annually no later than July 1 of each calendar year. For questions regarding these metrics or to submit a consumer request, please contact: Compliance@thedatagroup.com.

15. INDIVIDUAL RIGHTS AND OPT-OUT FOR LIST RENTALS

Individuals whose personal information may appear in third-party data used for list rental services have the following rights:

Access and Correction Requests: Individuals may request to know what personal information about them may be used in list rental activities and may request corrections to inaccurate information.
Opt-Out of List Rentals: We honor opt-out requests by working with our data partners to remove opted-out individuals from future list rental datasets.
Right to Deletion: Upon a verified deletion request, we delete the individual’s personal information from our own records (retaining only the suppression information needed to honor the request), direct our service providers and contractors to delete it, and notify the relevant data partners of the request and require that partners honor it within their own systems.
California Delete Act (DROP) Requests: As of August 1, 2026, we access DROP at least once every 45 days and process all deletion requests received through it, subject only to the exceptions permitted by law. If we cannot verify a DROP request, we treat it as a request to opt out of the sale or sharing of the consumer’s personal information. After processing a DROP request, we continue to delete any personal information about that consumer that we later obtain at least once every 45 days, and we do not sell or share it unless the consumer requests otherwise.

To exercise any of the above rights, contact: Compliance@thedatagroup.com. We only work with third-party data providers who comply with data privacy regulations and respect individual opt-out requests.

Opt-Out Processing Timelines and Downstream Propagation

We are committed to honoring opt-out requests in a timely and thorough manner. Specifically:

Opt-out requests will be processed as soon as feasibly possible, and in no event later than fifteen (15) business days after receipt. Opt-out requests do not need to be verified.
We will propagate opt-out signals to any downstream data partners or subcontractors that have received the relevant data or any portion thereof, and we contractually require those partners to honor such requests.
We honor opt-out requests submitted through any universal opt-out mechanism recognized under applicable law, including the Global Privacy Control (GPC) signal. Our website is configured to recognize and process GPC signals as valid opt-out requests for the sale or sharing of personal information. When we have processed an opt-out preference signal, our website will display a message (such as “Opt-Out Request Honored”) confirming that your request has been processed.
We will not re-add individuals who have opted out to active datasets or permit their inclusion in future list rentals without re-obtaining valid consent consistent with applicable law. For California residents, we will wait at least twelve (12) months before asking a consumer who has opted out to opt back in.
We maintain records of all opt-out requests and the disposition of each for a minimum of three (3) years.

To submit an opt-out request, contact Compliance@thedatagroup.com.

Data Broker Registration and Compliance Transparency

The Data Group is a data broker under California Civil Code § 1798.99.80 and is registered with CalPrivacy. Our registration is publicly available on CalPrivacy’s Data Broker Registry. We are also registered as a data broker with the Texas Secretary of State (Tex. Bus. & Com. Code ch. 509) and the Vermont Secretary of State (9 V.S.A. § 2446). We maintain and honor mechanisms by which individuals may exercise their opt-out and deletion rights as required by applicable data broker statutes. We will promptly update this policy if our registration status changes.

16. DATA BREACH NOTIFICATION

In the event of a data security incident involving personal information, we follow a structured incident response protocol that includes the following steps:

Detection and Assessment: Identifying and evaluating the scope and nature of any suspected breach as rapidly as possible.
Containment and Mitigation: Taking immediate steps to contain the breach and prevent further unauthorized access or disclosure.
Investigation: Conducting a thorough investigation to determine the cause of the breach, the categories and volume of data involved, and the individuals potentially affected.
Notification of Affected Individuals: Where required by applicable law, providing affected individuals with notice within the period required by law (for example, within 30 calendar days of discovery for California residents under Cal. Civ. Code § 1798.82 and within 30 days for Florida residents under Fla. Stat. § 501.171) that includes: a description of the nature of the breach; the categories of personal data involved; the mitigation steps taken; protective recommendations for affected individuals; and our contact information for further inquiries.
Notification of Authorities: Reporting the breach to relevant regulatory authorities as required by applicable law and within mandatory timeframes (for example, to the California Attorney General within 15 calendar days of notifying affected individuals where more than 500 California residents are affected, and to the Florida Department of Legal Affairs within 30 days where 500 or more Florida residents are affected).
Ongoing Monitoring and Prevention: Implementing enhanced monitoring measures and evaluating systemic improvements to prevent recurrence.

Users also play a role in protecting their data. You should use strong, unique passwords, enable two-factor authentication where available, and promptly report any suspicious activity related to your account or personal information to us at Compliance@thedatagroup.com.

17. CONTROLS FOR DO-NOT-TRACK FEATURES

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected.

We recognize and honor the Global Privacy Control (GPC) signal as a valid opt-out of the sale and sharing of personal information where required by applicable law, including the CCPA/CPRA and similar state statutes. With respect to other Do-Not-Track (DNT) signals, no uniform technology standard for recognizing and implementing DNT signals has been finalized beyond GPC. We will continue to monitor developments in this area and update our practices accordingly. If you have questions about our response to specific opt-out signals, please contact us at Compliance@thedatagroup.com.

18. DO CALIFORNIA RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?

Yes. California residents have specific rights under the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). These include:

Right to Know: The right to know what categories and specific pieces of personal information we have collected, the sources of that information, the business or commercial purpose for collecting it, and the categories of third parties with whom we share it.
Right to Delete: The right to request deletion of personal information we have collected, subject to certain exceptions.
Right to Correct: The right to request correction of inaccurate personal information.
Right to Opt-Out of Sale or Sharing: We sell personal information (including through list rentals) and share personal information for cross-context behavioral advertising. You have the right to direct us not to sell or share your personal information. You may exercise this right by clicking the “Do Not Sell or Share My Personal Information” link on our website, by enabling the Global Privacy Control in your browser, by calling 800-262-5609, or by emailing Compliance@thedatagroup.com.
Right to Limit Use of Sensitive Personal Information: You have the right to limit our use and disclosure of your sensitive personal information to purposes permitted by law by using the “Limit the Use of My Sensitive Personal Information” link on our website.
Right to Non-Discrimination: The right not to receive discriminatory treatment for exercising any CCPA/CPRA rights.
Right to Know What Is Sold or Shared: The right to know the categories of personal information we have sold or shared about you and the categories of third parties to whom it was sold or shared.
Financial Incentives: We do not offer financial incentives or price or service differences in exchange for the retention, sale, or sharing of personal information.

Shine the Light Law

California residents may, once per calendar year and at no charge, request and obtain from us information about the categories of personal information disclosed to third parties for their direct marketing purposes in the preceding calendar year, and the names and addresses of those third parties. To make such a request, please contact us at Compliance@thedatagroup.com.

Additional Rights for Minors Under 18

We do not have actual knowledge that we sell or share the personal information of consumers under sixteen (16) years of age, and we do not sell or share such personal information without affirmative authorization as required by law. Individuals between thirteen (13) and sixteen (16) years of age must opt in to any sale or sharing. Individuals under thirteen (13) require parental or guardian opt-in consent. Where required by state law (for example, Maryland), we do not sell, or process for targeted advertising, the personal data of consumers we know or should have known are under eighteen (18) years of age.

19. YOUR RIGHTS UNDER ADDITIONAL PRIVACY LAWS

Residents of various U.S. states have additional privacy rights under applicable state law beyond those described in this Policy. The specific rights available to you depend on your state of residence and the applicable privacy statute. A detailed description of state-specific rights is set forth in Section 22 of this Policy. To exercise any applicable rights, or for more information about your rights under state privacy law, please contact us at Compliance@thedatagroup.com.

20. DO WE MAKE UPDATES TO THIS POLICY?

We may update this Privacy Policy from time to time to reflect changes in applicable law, our business practices, or the nature of the personal information we process. When we make updates, the “Last Updated” date at the top of this Policy will be updated accordingly. We review and update this Policy at least once every twelve (12) months. For material changes to this Policy, we will endeavor to provide prominent notice by posting a notice on our website or by sending a direct notification to affected individuals where we have contact information for them. We encourage you to review this Policy periodically to stay informed about how we are protecting your information.

21. HOW CAN YOU CONTACT US?

If you have questions, concerns, or requests related to this Privacy Policy or your personal information, please contact us by any of the following means:

Email: Compliance@thedatagroup.com
Mail: Chief Privacy Officer, The Data Group, 3208 E Colonial Drive, Suite 118, Orlando, FL 32803
Phone: 800-262-5609
Website: https://thedatagroup.com/
Consumer Privacy Request Form: https://thedatagroup.com/privacy/consumer-optout-request-form/
Or for California residents: https://thedatagroup.com/privacy/california-consumer-privacy-act/

22. STATE-SPECIFIC PRIVACY RIGHTS

This section describes additional privacy rights available to residents of specific states. To submit a request under any of the following provisions, please contact Compliance@thedatagroup.com or submit a Consumer Privacy Request Form available through our website.

22.1 Florida Residents — Florida Digital Bill of Rights (FDBR)

The FDBR’s consumer rights provisions apply to controllers that meet certain thresholds, including more than $1 billion in global annual gross revenue. Florida residents may have the following rights under the FDBR:

Right to Access — to confirm whether we are processing your personal data and access such data
Right to Correct — to correct inaccuracies in your personal data
Right to Delete — to delete personal data you have provided to us or that we have obtained
Right to Opt-Out of Sale — to opt out of the sale of your personal data
Right to Data Minimization — we collect only the personal data reasonably necessary and proportionate to the purposes for which it is processed
Right to Non-Discrimination — you will not be discriminated against for exercising your rights