Your Rights Under the California Consumer Privacy Act of 2018

Updated: August 4, 2026

California Consumer Privacy Rights Statement (“Statement”)

The California Consumer Privacy Act (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”) includes additional privacy protections for consumers. It requires businesses to be transparent about how they collect, share and use consumers’ personal data. 

This statement supplements the information contained in the Privacy Policy [make this a hyper link] of Expansion Capital Group, LLC (“ECG,” “We,” “Us,” or “Our”) and applies solely to visitors, users, and others who reside in the State of California (“consumers” or “you”). We adopt this Statement to comply with the CCPA/CPRA and other California privacy laws. 

ECG collects certain personal information about individuals in connection with providing the financial services applied for by the business entities with whom those individuals are associated. The categories of the information that We collect, together with the business purpose for which they will be used, are as follows:

1. Personal Information, as broadly defined under CPRA, includes any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal Information includes, but is not limited to, the following if it identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household: 

a. Identifiers such as a real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number or other similar identifiers. 

b. Any personal information described in subdivision (e) of Section 1798.80 of the California Civil Code.

c. Characteristics of protected classifications under California or federal laws. 

d. Commercial information, including records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. 

e. Biometric information. 

f. Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an internet website application, or advertisement. 

g. Geolocation data. 

h. Audio, electronic, visual, thermal, olfactory, or similar information. 

i. Professional or employment-related information. 

j. Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privact Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99). 

k. Inferences drawn from any of the information identified in this subdivision to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

l. Sensitive personal information. 

2. Personal Information is used for the following business purposes:

a. To complete the transaction for which you applied;
b. To detect against identity theft, fraud or other illegal activity, and to prosecute those responsible for such activity;
c. To identify and repair errors that impair intended functionality in ECG systems;
d. To exercise a right provided by law;
e. To comply with the California Electronic Communications Privacy Act;
f. To engage in public or peer-reviewed statistical research;
g. To enable solely internal uses related to the financial services that ECG provides;
h. To comply with the legal and regulatory obligations of ECG;
i. To use your information, internally, in a lawful manner compatible with the context in which you provided the information;
j. To refer your request for financial services to a referral partner of ECG that may be able to provide the desired services when ECG cannot;
k. To develop analytical models, both internally and using third-party service providers, to improve ECG’s underwriting, fraud prevention, retention, sales or marketing practices;
l. To pursue legal remedies on defaulted financing agreements;
m. To comply with internal and regulatory customer identification requirements aimed, among other things, at the prevention of identity theft, terrorism, money laundering, and other criminal activities;
n. To remain in contact with you throughout the term of any financial services agreement that you may enter with ECG or a referral partner of ECG;
o. To offer additional financial services to you;
p. To assess the market for financial services and initiate marketing of those services to you and/or others;
q. To comply with requirements of internal and external audits of ECG;
r. To enable collection efforts by third parties on behalf of ECG on defaulted financing agreements;
s. To engage representation in legal matters, including litigation, bankruptcy proceedings and other matters related to the financial services offered by ECG;
t. To update information in the records of ECG and its referral partners;
u. To allow vendors to provide additional related customer data or analysis;
v. To allow funding partners of ECG to initiate the service of financing transactions should ECG be unable to do so;
w. To allow funding partners of ECG to assess portfolio performance; and
x. To assess the methods in which financial services are provided to the customers of ECG.

3.  Sensitive Personal Information means:

a. Personal information that reveals:

1) A consumer’s social security, driver’s license, state identification card, or passport number. 

2) A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to the account. 

3) A consumer’s precise geolocation. 

4) A consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership. 

5) The contents of a consumer’s mail, email, or text messages unless the business is the intended recipient of the communication. 

6) A consumer’s genetic data.

b. 

1) The processing of biometric information for the purpose of uniquely identifying a consumer. 

2) Personal information collected and analyzed concerning a consumer’s health. 

3) Personal information collected and analyzed concerning a consumer’s sex life or sexual orientation. 

4.  Sensitive Personal Information is used for the same purposes as those listed above for Personal Information. 

Certain Rights of California Residents.
If you are an individual who is in the State of California for other than a temporary or transitory purpose or an individual domiciled in California but outside the state for a temporary or transitory purpose, you have certain rights under the CCPA/CPRA:

1. Right to Know. You have the right to request that we disclose certain information to you about our collection and use of your Personal Information. Once we receive and verify your request, We will disclose to you, if requested: (a) the categories of Personal Information that has been collected about you in the 12 months preceding your request, (b) the categories of sources from which the Personal Information is collected, (c) the business or commercial purpose for collecting, selling, or sharing Personal Information, (d) the categories of third parties to whom We disclosed Personal Information, (e) the specific pieces of Personal Information that ECG has collected about you. You may exercise this right no more than twice in a 12-month period. You will not be charged for the exercise of this right.

To request the disclosure of information as provided above, call 800-894-5277, toll free, or email ccpa@ecg.com.
For purposes of your protection against identity theft, ECG must be able to verify that the person making the request is the person about whom the information has been collected or another authorized by such person to act on their behalf. This will be done in accordance with the procedures set forth below under “Verification of Requests”.

2. Right to Delete. You have the right to request that ECG delete the Personal Information that We have collected about you, notify any service providers or contractors to delete your Personal Information from their records, and notify all third parties to whom the business has sold or shared such Personal Information, to delete your Personal Information, unless this proves impossible or involves disproportionate effort. 
To request the deletion of information, call 800-894-5277, toll free, or email ccpa@ecg.com.

ECG is not required to delete your information under certain circumstances, including, among others, if it is needed (a) to complete the transaction for which it was collected, (b) to ensure security and integrity to the extent the use of the personal information is reasonably necessary and proportionate for those purposes, (c) to debug and repair errors that impair existing intended functionality, (d) to exercise free speech, ensure the right of another consumer to exercise that consumer’s right to free speech, or exercise another right provided for by law, (e) to comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code, (f) to engage in public or peer-reviewed scientific, historical, or statistical research that conforms or adheres to all other applicable ethics and privacy laws, when the business’s deletion of the information is likely to render impossible or seriously impair the ability to complete such research, if the consumer has provided informed consent, (g) to enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business and compatible with the context in which the consumer provided the information, and (h) to comply with a legal obligation. See Section 1798.105 of the CCPA/CPRA for more details. If a request for deletion is denied, in whole or in part, you will be notified of the basis for such denial.

For purposes of your protection against identity theft, ECG must be able to verify that the person making the request is the person about whom the information has been collected or another authorized by such person to act on their behalf. This will be done in accordance with the procedures set forth below under “Verification of Requests”

3. Right to Correct Inaccurate Information. You have the right to correct inaccurate Personal Information that We obtain about you. 

4. Right to Know What Personal Information is Sold or Shared. You have the right to request (a) the categories of Personal Information that the ECG collected about you, (b) the categories of Personal Information that ECG sold or shared about you and the categories of third parties to whom the Personal Information was sold or shared, by category or categories of Personal Information for each category of third parties to whom the Personal Information was sold or shared, and (c) the categories of Personal Information that the business disclosed about the consumer for a business purpose and the categories of persons to whom it was disclosed for a business purpose. You may exercise this right no more than twice in a 12-month period.

ECG shall disclose, pursuant to subparagraph (C) of paragraph (5) of subdivision (a) of Section 1798.130 (a) the category or categories of consumers’ Personal Information it has sold or shared, or if ECG has not sold or shared consumers’ Personal Information, We shall disclose that fact, and (b) the category or categories of consumers’ Personal Information it has disclosed for a business purpose, or if ECG has not disclosed consumers’ Personal Information for a business purpose, We shall disclose that fact. 

5. Right to Opt-Out of Sale or Sharing. You have the right to opt out of the sale or sharing of your Personal Information. 

6. Right to Limit the Use and Disclosure of Sensitive Personal Information. You have the right to limit the use or disclosure of your Sensitive Personal Information if used to infer characteristics about you. 

To opt out of the sale or sharing of your Personal Information or limit the use and disclosure of your Sensitive Personal Information call 800-894-5277, toll free, email ccpa@ecg.com or click on the button below: 

Do Not Sell My Personal Information

For purposes of your protection against identity theft, ECG must be able to verify that, if a person other than yourself is making the request, the person making the request is a person authorized by you to act on your behalf. This will be done in accordance with the procedures set forth below under “Verification of Requests”.
NOTE: If you exercise your right to opt out, ECG will not be able to refer your application to one of our referral partners for possible financing should ECG be unable to provide the financing requested.

Verification of Requests
For purposes of your protection against identity theft, ECG must be able to verify that the person making one of the requests identified above is the person about whom the information has been collected or another authorized by such person to act on their behalf.

1. If you make a request to know the Personal Information of yours that ECG collects, discloses or sells, we will Confirm receipt of that request within 10 calendar days of its receipt. In that confirmation, we will describe the verification process and will identify those pieces of data that you must provide in order for us to match them to data already in our possession. Once you have provided the required data and, as applicable, signed declaration, we will process your request. Normally, assuming that you are prompt in sending the required data in, you should receive a response from us within 45 calendar days of receipt of your request. If we are unable to verify your identity to the levels specified at law, you will be referred to our general business practices regarding the collection, maintenance, and sale of personal information. If we determine that disclosure of your Personal Information would create a substantial, articulable, and unreasonable risk to the security of that Personal Information, your account with us, or the security of our systems or networks, we will not provide specific pieces of Personal Information.

2. If you make a request to delete the Personal Information of yours that ECG collects, discloses or sells, we will Confirm receipt of that request within 10 calendar days of its receipt. In that confirmation, we will describe the verification process and will identify those pieces of data that you must provide in order for us to match them to data already in our possession. Once you have provided the required data, we will process your request. We will comply with your request to delete by deleting that information from our existing systems, as provided by law, by de-identifying that information or by aggregating that information. Normally, assuming that you are prompt in sending the required verification data in, you should receive a response from us within 45 calendar days of receipt of your request. In that response we will specify the manner in which we have deleted your information. If we are unable to verify your identity to the levels specified at law, your request will be treated as a request to opt-out of sale of your Personal Information. ECG is not required to delete your information under certain circumstances, including, among others, if it is needed (a) to complete the transaction for which it was collected, (b) to ensure security and integrity to the extent the use of the Personal Information is reasonably necessary and proportionate for those purposes, (c) to debug and repair errors that impair existing intended functionality, (d) to exercise free speech, ensure the right of another consumer to exercise that consumer’s right to free speech, or exercise another right provided for by law, (e) to comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code, (f) to engage in public or peer-reviewed scientific, historical, or statistical research that conforms or adheres to all other applicable ethics and privacy laws, when the business’s deletion of the information is likely to render impossible or seriously impair the ability to complete such research, if the consumer has provided informed consent, (g) to enable solely internal uses that are reasonably aligned with the expectations of the consumer based on the consumer’s relationship with the business and compatible with the context in which the consumer provided the information, and (h) to comply with a legal obligation. 

3. If you make a request to correct inaccurate Personal Information, we will Confirm receipt of that request within 10 calendar days of its receipt. In that confirmation, we will describe the verification process and will identify those pieces of data that you must provide in order for us to match them to data already in our possession. Once you have provided the required data, we will process your request. We will comply with your request to correct inaccurate Personal Information by making the requested corrections in our existing systems,

4. If you use an authorized agent to submit a request to know or a request to delete, you will both be required to provide written permission for the person submitting the request to do so and be required to submit information verifying your own identity, as though you were making the request yourself.

Other Important Related Matters
You will not be discriminated against as a result of your exercise of any of the rights provided by the CCPA/CPRA. See Section 1798.125 of the CCPA for more details.

ECG does not collect, maintain, disclose or sell the personal information of minors under 16 years of age.

The rights provided to California consumers under the CCPA/CPRA are in addition to those provided under federal law. Please see the ECG Privacy Policy, a link to which is provided on the ECG Homepage.