National Retail Solutions, Inc.
Privacy Policy


Effective as of December 20, 2023


  1. General

    National Retail Solutions, Inc. (“NRS”) is committed to protecting the privacy of your personal information.

    This Privacy Policy (the “Policy”) sets forth our policies and procedures regarding the collection, use and sharing of your personal information. We also explain the steps we take to protect your information and how you can limit the collection, use and sharing of your information.

    This Policy applies to the following unless otherwise noted:

    • users of our products and services, including our POS terminals and NRS Pay (collectively, the “ NRS Products ”);

    • users and visitors of our websites, including nrsplus.com , nrspay.com , nrsdigitalmedia.com , nrsmarket.com , clubnrs.com , homeimprovementpos.com , nrsinsights.com , nrscinch.com and nrsmarketplace.com (collectively, the “ NRS Websites ”);

    • members of any NRS sponsored loyalty or rewards programs (collectively, the “ NRS Reward Programs ”);

    • users of our apps, including the ‘My NRS Store’ app and the ‘BR Club’ Shopping app (collectively, the “ NRS Apps ”); and

    • users of web stores that NRS has created for retailers to sell their store’s products online (collectively, the “ NRS Web Stores ”).


      When we use the term “ Services ” it collectively refers to the NRS Products, the NRS Websites, the NRS Reward Programs, the NRS Apps, and the NRS Web Stores. When we refer to NRS or “us,” or “we,” we’re talking about National Retail Solutions, Inc.

      You should also read the terms of service for each Service that you use, which can be found at the applicable NRS Website, NRS App or NRS Web Store.

      We may update this Policy from time to time and you should review it periodically for changes.
      Any updated Policy will be posted at the NRS Websites, the NRS Apps and in the NRS Web Stores.


  2. Information We Collect

    NRS may receive and collect both personal and non-identifying information from you when we operate and provide you with the Services, when you install, access or use the Services and when you communicate with us. Personal information means information either on its own or in conjunction with other data that enables a specific person to be identified, but does not include “de-identified,” “anonymous,” or “aggregate” information, which is not otherwise associated with a specific person. Non-identifying information means information that by itself cannot be used to identify a specific person ( e.g., zip code).


    1. Information You Provide . Depending on the particular Service, you may provide the following personal information:


      • name

      • address

      • email address

      • mobile or other phone number

      • payment information, including credit or debit card details and bank account info

      • date of birth

      • Social Security Number or EIN

      • other personal information necessary to verify you and/or account, including citizenship status

      • other personal information you provide to us for customer support purposes, surveys, sweepstakes or product feedback


    2. Information We Collect . Depending on the particular Service, we may automatically collect the following information:


      • items purchased or redeemed through any of the Services

      • login and other credentials

      • Service related diagnostic and performance information, including how you use our Services and performance logs

      • information about your device and store, including model, browser, operating system, platform type, application software, mobile network, device identifiers and numbers, and Internet connection speed

      • browsing, searching and buying activity

      • IP address

      • logs of web portal access

      • advertisement campaign conversions

      • NRS Websites and NRS Web Stores visited and websites you come from and go to next

      • NRS App feature usage and stored content

      • personal, phone or social network contact information

      • device identification number

      • geolocation and device location information if you enable location features

      • transactional information when you purchase one of our Services or certain other products


    3. Information Provided by Third Parties . When you install, access or use the Services we may obtain the following information from third party sources:

      • credit information from credit reporting agencies

      • transactional information when you purchase a Service or a product through a Service, including receipts or information from app stores or other third parties processing your payment

      • aggregate information from outside companies that collect consumer information such as demographic and interest data (examples of this information include gender, age range, sports enthusiast, or pet owner)

      • unique marketing and/or device IDs, contact and other marketing lead information from third parties, including from app stores

      • users of our Services may provide us with your email address or phone number through the purchase/use of a Service, our refer-a-friend programs, their mobile address book or social networking platforms

      • other information from third parties that helps us operate, provide, understand, customize, support and market our Services


  3. How We Use Information

    We may use all the information we collect and receive to help us operate, provide, improve, understand, customize, support, and market our Services (and some third party services). In addition, we may use your information for general, operational and administrative purposes, including maintaining your account, authenticating you and contacting you. As used in this Policy, the terms “use,” “using” and “processing” information include using cookies or other similar technologies on a computer/phone/device, subjecting the information to statistical or other analysis and using or handling information in any way, including but not limited to, scanning, collecting, storing, evaluating, aggregating, modifying, deleting, using, combining, disclosing and sharing information among our affiliates both in and outside the United States and to select service providers and vendors.

    1. Our Services . We analyze how our customers use our Services and use that information to evaluate and improve our Services, to research, develop, and test new services and features, and to conduct troubleshooting activities. For example:


      • we communicate with you about our Services and features and let you know about our terms and policies and other important updates;

      • we may target particular advertisements or other content to you based information we have collected or you provided;

      • we may digitally scan content stored in the NRS Apps, including without limitation, your user information, and use this information to provide you with targeted information and advertising;

      • we use your information to respond to you when you contact us. Our communications with you, including phone conversations, chats and emails, may be monitored and recorded by us for quality assurance or for legal, regulatory or training purposes; and

      • we verify accounts and activity, and promote safety and security, such as by investigating suspicious activity or violations of our terms, to ensure our Services are being used legally.


    2. Web Technologies . The NRS Websites, NRS Apps and NRS Web Stores may use certain web technologies such as “cookies” or “web beacons.” We use cookies, small text files stored locally on your computer or device to serve as markers, to operate, provide, improve and customize our Services and your experiences. For example, we use cookies to understand which of our FAQs are most popular and to show you relevant content related to our Services. Additionally, we may use cookies to remember your choices, such as your language preferences. Web beacons are used to tell us how and when pages in our sites are visited, by how many people, their point of origin and operating system and to monitor performance with our Services. These technologies do not collect personal information. We do not honor any web browser “do not track” signals or other mechanisms that provide you the ability to exercise choice regarding the collection of information about your online activities over time and across third party websites or online services. We use and share this data and information to deliver customized content and advertising, to ensure that you see the correct product information, to manage the frequency with which you see an advertisement, to tailor advertisements to better match your interests, and to understand the effectiveness of our advertising. The content may be delivered on the NRS Websites, on non-NRS websites, on the NRS Apps, on NRS Web Stores, by our representatives, and via email, SMS, push notifications or other NRS services. In addition, if you respond to or interact with a particular advertisement, you may later receive a targeted advertisement as a result of an ad server or ad network concluding that you fit within a particular audience we are trying to reach.


    3. Web Analysis . We use certain Google Analytics Advertising Features, including Remarketing and Demographics and Interest Reporting. Google Analytics is a web analysis service provided by Google that allows us to collect data about the traffic on the NRS Websites through Google cookies and other identifiers, which enables us, among other things, to create user segments based on demographic or interest data and to deliver relevant advertising. Google utilizes the data collected to track and examine the use of our websites and to prepare reports on the activities and share them with other Google services. Google may use the data collected to contextualize and personalize the ads of its own advertising network. You may be able to opt out of the Google Analytics Advertising Features through your browser ads settings or by visiting Google’s Ads Settings page.


    4. NRS Apps . We engage certain service providers and vendors who use mobile software development kits to passively collect information from users of the NRS Apps. We use this data primarily to help us deliver personalized notifications and to identify you in a unique manner across other devices or browsers for the purposes of customizing advertisements or content.


  4. How We Share Information

    We may share all the information we collect and receive with our affiliates, both in and outside the United States, and to select service providers and vendors, to help us operate, provide, improve, understand, customize, support, and market our Services (and some third party services), and for general, operational and administrative purposes, including maintaining your account, authenticating you and contacting you. We also share information with each NRS store with which you interact. When we share information with our service providers and vendors, we require them to use your information only in accordance with our instructions and terms or with express permission from you and not to sell your information. In addition, you share your information as you use and communicate through our Services.


    1. Information Shared Within the NRS Family of Companies . We may share information within the NRS family of companies, including our affiliates both in and outside the United States (collectively, the “NRS Family of Companies ”) primarily to operate, provide, support and market our Services. For example, we may share your information with various NRS affiliates in order to process your transaction.


    2. Information Shared with our Service Providers and Vendors . We work with various service providers and vendors for a variety of business purposes such as to help us offer, operate, provide, improve, understand, customize, support and market our Services. We may share information with these service providers and vendors to the extent reasonably necessary for them to perform work on our and your behalf. For example, we may provide your credit card information and billing address to our payment processing company solely for the purpose of processing payment for a transaction you have requested. In addition, NRS shares certain information, including unique marketing identifiers, email addresses and mobile phone numbers (full or only partial), with some of our service providers and vendors, including tobacco companies, Google and Facebook, for marketing, advertising, rewards/loyalty programs and analysis purposes, including the delivery of advertising campaigns and preparing and sharing aggregate business and marketing reports, demographic profiling and to deliver targeted advertising about products and services. All the foregoing categories exclude text messaging originator opt in data and consent; this information will not be shared with any third parties. In addition, no mobile information will be shared with third parties/affiliates for marketing/promotional purposes. When we share information with our service providers and vendors, we request that these parties protect your information and limit their use of the data to the purposes for which it was provided, and not to sell your information. NRS does not sell, rent or lease its customer lists to third parties. NRS does on occasion sell certain pieces of personal information, such as personal identifiers, of some of our stores’ customers to data processors. Finally, if you purchase products or services offered jointly by NRS and one of our service providers or vendors, your customer information may be received by both NRS and the service provider or vendor that is providing the product or service. For these jointly offered products and services, you should also review the other company’s privacy policy, which may include practices that are different from the practices described here.


    3. Special Circumstances . We may share information in certain special circumstances. For example:


      • to comply with valid legal process including subpoenas, court orders and search warrants, and as otherwise permitted or required by law;

      • to assist law enforcement in cases involving danger of death or serious physical injury to any person or in other emergencies;

      • to protect our rights or property, or the safety of our customers or employees;

      • to protect against fraudulent, malicious, abusive, unauthorized or unlawful use of our Services and to protect our network, Services, devices and users from such use;

      • to advance or defend against complaints or legal claims in court, administrative proceedings and elsewhere;

      • to prospective purchasers of all or part of our business or assets;

      • to outside auditors, lawyers and regulators; and

      • with your consent.


    4. Information Shared with Advertising Entities or Social Networks . You may see third party advertisements on our products and Services, the NRS Websites, the NRS Apps, and/or the NRS Web Stores. Some advertisements are chosen by companies that place advertisements on behalf of advertisers. These companies, often called ad servers, may place and access cookies on your device to collect information about your visit. The information they collect from our sites is in a form that does not identify you personally. This information may be combined with similar data obtained from other websites to help our advertisers better reach their targeted audiences. Targeting may be accomplished by tailoring advertising to interests that they infer from your browsing of our sites and your interaction with other websites where these ad servers also are present. If you choose to interact with specific advertisers who advertise on our products and Services, the NRS Websites, the NRS Apps, or the NRS Web Stores, the information you provide to them is subject to the conditions of their specific privacy policies. The NRS Websites, NRS Apps and NRS Web Stores also include plug-ins and widgets that may provide information to their associated social networks or entities about the NRS page you visit, even if you do not click on or otherwise interact with the plug-in or widget.


    5. When You Share Information . You share your information as you use and communicate through our Services. Stores with whom you communicate may store or share your information (including your phone number or messages) with others on and off our Services.


  5. Your Rights and How To Limit Sharing Of Information

    You have choices about how we use and share your information and there are additional protections that may apply with regard to certain information we collect.

    1. Telemarketing . Federal “Do Not Call” laws allow you to place your phone numbers on the National Do Not Call Registry to prevent telemarketing calls to those numbers. To add your numbers to this list, please call 1-888-382-1222, or visit www.donotcall.gov . Most telemarketing laws allow companies to contact their own customers without consulting the Federal or State Do Not Call lists. If you would like to be removed from NRS’s telemarketing list, please contact us at 800-215-0931 or [email protected] . Please allow 30 days for your telephone number to be removed from any sales programs that are currently underway. Please note that we may still call you regarding your Services and account even if you remove your number from our telemarketing list.


    2. Email, Text Messages and Push Notifications . Marketing emails you receive from us will include an unsubscribe feature usually found at the bottom of the email that you may use to opt out of receiving future marketing emails. Marketing text and SMS messages from us also contain an opt-out feature that you can use to prevent future marketing text and SMS messages from us. You may refuse to consent to receive calls and texts from NRS and its affiliates that require your consent, including autodialed, pre-recorded or artificial voice telemarketing calls. You may also withdraw your previously given consent to receive such calls and texts. You can opt out of receiving push notifications from us via the NRS Apps by going to your device “Settings” and clicking on “Notifications,” and then changing those settings for the applicable app. Please note that you cannot withdraw your consent to receive certain in app messages from us. Your ability to manage some of our Services could be limited if you withdraw your consent to receive text and SMS messages. In those cases NRS does not recommend using those Services without authorization to receive such messages.


    3. Online Information . You have choices about whether certain information collected on the NRS Websites, NRS Apps and NRS Web Stores is used to customize advertising based on predictions generated from your visits over time and across different websites and apps. Similarly, many mobile devices offer controls you can set to limit the advertising use of information collected across mobile apps on your device. Please note that many opt outs use browser cookies or device controls and are specific to the device and browser you are using. If you buy a new computer, change web browsers or devices or delete the cookies on your computer, you may need to opt out again. In addition, ads you receive may still be tailored using other techniques such as publisher, device or browser-enabled targeting. You should check the privacy policies of the products, sites, apps and services you use to learn more about any such techniques and your options. You also can limit the collection of certain website information by deleting or disabling cookies. Most browsers enable you to erase cookies from your computer hard drive, block all cookies, or receive a warning before a cookie is stored. Disabling cookies may prevent you from using specific features on our sites and other websites, such as ordering products or services and maintaining an online account.


  6. Additional State Privacy Rights

    If you are a resident of any of the following states, then the additional terms in the applicable Exhibit to this Privacy Policy also apply to you:

    California – see Exhibit A to this Privacy Policy

    Colorado – see Exhibit B to this Privacy Policy

    Connecticut – see Exhibit C to this Privacy Policy

    Utah – see Exhibit D to this Privacy Policy

    Virginia – see Exhibit E to this Privacy Policy


  7. Other Information
    1. Keeping Children Safe . NRS does not knowingly market to or collect information from children under the age of 16 without obtaining verifiable parental consent. If you allow a child to use your device or our Services, you should be aware that their information could be collected as described in this Policy. We encourage parents to be involved in the online activities of their children to ensure that no information is collected from a child without parental permission.


    2. Security . NRS has technical, organizational and physical safeguards in place to help protect against unauthorized access to, use or disclosure of the information we collect and store. Employees are trained on the importance of protecting privacy and on the proper access to, use and disclosure of customer information. NRS secures information on computer servers in a controlled, secure environment, protected from unauthorized access, use or disclosure. We use Secure Socket Layer (SSL) encrypted protection to protect the personal information transmitted to the NRS Websites and NRS Web Stores. The NRS Websites, NRS Apps and NRS Web Stores are PCI compliant in connection with your credit card information. Although we work hard to protect your information that we collect and store, no program is 100% secure and we cannot guarantee that our safeguards will prevent every unauthorized attempt to access, use or disclose that information. NRS maintains security and incident response plans to handle incidents involving unauthorized access to information we collect or store. If you become aware of a security issue, please contact us.


    3. Contact Information . If you have questions, concerns or suggestions related to our Policy or our privacy practices you may contact us at:


      National Retail Solutions, Inc.
      520 Broad Street, 3rd floor
      Newark, NJ 07102

      800-215-0931

      Email: [email protected] .


    4. Links to and from non-NRS Websites and Content . The NRS Websites, NRS Apps and NRS Web Stores may contain links to non-NRS sites. In addition, NRS content may be included on websites that are not associated with NRS. We have no control over these non-NRS sites and are not responsible for the content on these sites or platforms or the privacy policies and practices employed by these sites and platforms. We recommend that you review the policies and practices of the sites you visit.

    5. Social Networking . Some of our Services may allow you to participate in blog discussions, message boards, chat rooms, and other forms of social networking and to post reviews. Please be aware that these forums are accessible to others. We urge you to not submit any personal information to these forums because any information you post can be read, collected, shared, or otherwise used by anyone who accesses the forum. NRS is not responsible for the information you choose to submit in these forums. If you post content to information sharing forums, you are doing so by choice and you are providing consent to the disclosure of this information.


    6. Changes to this Policy . We reserve the right to make changes to this Policy, so please check back periodically for changes. You will be able to see that changes have been made by checking to see the effective date posted at the beginning of the Policy.


  8. ©2023 National Retail Solutions, Inc. All rights reserved.



    Exhibit A

    California Consumers

    If you are a resident of California, then the following section also applies to you.


    1. Personal Information . Personal information includes information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information does not include publicly available information, including information lawfully made available to the general public by the consumer or from widely distributed media, and deidentified or aggregate consumer information . NRS may collect and use the following categories of personal information regarding California residents:

      Categories of Personal Information Collected

      Specific Personal Information Collected within Category

      Categories of Sources of Personal Information

      Is this info Sold, Shared (1) and/or Disclosed for a Business Purpose and Categories of to Whom

      Business or Commercial Purposes for Collection and Use of Personal Information

      Personal Identifiers and Information, including items listed in subdivision (e) of Section 1798.80 of California Civil Code

      name, address, email address, phone number, birthdate, device and marketing identifiers, IP address, payment and financial information, credit/debit card number and details, bank account number and information, personal information necessary to verify you or your account, security code and login credentials, and other personal information you provide

      consumer, consumer’s device, automatic collection by NRS, credit reporting companies, financial companies, 3 rd party vendors that provide NRS with transactional services, data resellers

      Sold – yes


      Categories of third parties to whom NRS may sell personal information: data processors


      Shared – no


      Disclosed for a Business Purpose – yes


      Categories of third parties to whom NRS discloses personal information for a business purpose: NRS family of companies, including our affiliates both in and outside the United States; our service providers and vendors to the extent reasonably necessary for them to perform work on our and your behalf (e.g., credit card processors); other NRS stores with which you interact; ad networks; data analytics providers; social networks; law enforcement; prospective purchasers of our business; outside auditors and lawyers; and government entities, agencies and regulators


      Sold – no

      To manage our products and services, including to help us operate, provide, evaluate, improve, monitor, customize, bill and support our products and services

      To maintain the quality of our products and services, including to improve, upgrade, and enhance our products and services

      To maintain and service your account, including to process orders and payments

      To communicate with you about our terms and policies

      To verify you, your account activity and your information

      To detect, investigate and report fraud, abuse or illegal use of our products and services or customer accounts

      To provide customer service

      To perform due diligence, credit and fraud prevention checks

      To maintain accurate record keeping

      To ensure security and integrity of our customers’ personal information

      To perform product, marketing and organizational analysis

      To provide advertising and marketing to our customers

      To measure our marketing campaigns and to audit consumer interactions

      To comply with regulations and legal requirements

      To comply with contractual requirements

      For risk management and compliance

      For legal advice and defense of claims

      For general, operational and administrative purposes

      Commercial information

      records of products or services purchased and used, diagnostic and service performance information, credit information from reporting agencies, transactional information, and other purchasing or consuming histories

      consumer, consumer’s device, automatic collection by NRS, credit reporting companies, financial companies, 3rd party vendors that provide NRS with transactional services, data resellers

      Sold – no
      Shared – no

      Disclosed for a Business Purpose – yes


      Categories of third parties to whom NRS discloses personal information for a business purpose: see list under Personal Identifiers and Information

      Internet or other electronic network activity information

      browsing history, search history, messages, personal, phone or social network contact information, device information, device contacts, and information regarding a consumer’s interaction and usage with our websites, apps, web stores and advertisements

      consumer, consumer’s device, automatic collection by NRS, credit reporting companies, financial companies, 3 rd party vendors that provide NRS with transactional services, data resellers

      Sold – no Shared – no

      Disclosed for a Business Purpose – yes


      Categories of third parties to whom NRS discloses personal information for a business purpose: see list under Personal Identifiers and Information

      Geolocation data (if you enable location features in apps)

      location of device

      consumer, consumer’s device, automatic collection by NRS

      Sold – no

      Shared – no

      Disclosed for a Business Purpose – yes

      Categories of third parties to whom NRS discloses personal information for a business purpose: see list under Personal Identifiers and Information

      Inferences drawn from any of the information above

      profile reflecting the consumer’s purchasing and marketing preferences; aggregate information from third parties

      consumer, consumer’s device, automatic collection by NRS, credit reporting companies, financial companies, 3rd party vendors that provide NRS with transactional services, data resellers

      Sold – no
      Shared – no

      Disclosed for a Business Purpose – yes


      Categories of third parties to whom NRS discloses personal information for a business purpose: NRS family of companies, including our affiliates both in and outside the United States; our vendors and partners to the extent reasonably necessary for them to perform work on our and your behalf (e.g., credit card processors); ad networks; data analytics providers; social networks; and prospective purchasers of our business

      (1) Share and Shared mean sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration.


    2. Sensitive Personal Information . NRS may collect limited sensitive personal information and limits the use of that information to those uses which are necessary for us to perform the services and provide the goods consumers have requested and for other uses as authorized by applicable California privacy laws and regulations. NRS may collect the following sensitive personal information:


      Categories of Sensitive Personal Information Collected

      Is this info Sold or Shared (1)

      Business or Commercial Purposes for Collection and Use of Sensitive Personal Information

      1. account log-in, financial account, debit card or credit card number in combination with any required security or access code, password, or credentials allowing access to an account

      2. precise geolocation (if you enable location features in apps)

      3. social security number

      Sold – no
      Shared – no

      To perform the services and provide the goods requested by the consumer, including to help us operate, provide, customize, bill and support our products and services

      To verify consumer’s age

      To ensure the security and integrity of our customers’ personal information, including to prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information


      For short-term, transient use, including but not limited to non-personalized advertising shown as part of a consumer’s current interaction with NRS


      To perform services on our behalf, including to maintain or service accounts, provide customer service, process or fulfill orders and transactions, verify customer information, process payments, provide financing, provide analytic services, provide storage, or provide similar services on behalf of our business


      To maintain the quality and safety of our products and services, including to improve, upgrade, and enhance our products and services

      To resist malicious, deceptive, fraudulent, or illegal actions directed at our business and to prosecute those responsible for those actions

      To ensure the physical safety of natural persons

      (1) Share and Shared mean sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or by electronic or other means, a consumer’s personal information to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration.


    3. Your Rights . As a California resident you have certain additional rights regarding your personal information under the California Consumer Privacy Act of 2018 and (starting on January 1, 2023) the California Privacy Rights Act of 2020 (collectively, the “ CCPA ”).


      1. Right to Know and Access Personal Information Collected – you have the right to request the following from NRS: categories of personal information collected; categories of sources of personal information; business or commercial purpose for collecting, selling or sharing your personal information; categories of third parties with whom we disclose your personal information; and the specific pieces of personal information that we have collected about you.


      2. Right to Know Personal Information Sold, Shared or Disclosed – you have the right to request the following from NRS: categories of personal information collected; categories of personal information sold or shared by NRS; categories of third parties to whom NRS has sold or shared your personal information; categories of personal information NRS has disclosed for a business purpose; and categories of persons to whom NRS has disclosed your personal information for a business purpose.


      3. Right of No Retaliation – NRS does not discriminate against any California consumer who exercises any of the consumer’s rights under the CCPA. Pursuant to the CCPA NRS is permitted to (a) charge a consumer a different price or rate and/or provide a different level of service to the consumer if that difference is reasonably related to the value provided to the consumer by the consumer’s data, (b) offer loyalty, rewards, premium features, discounts, or club

        card programs to its customers, and (c) offer financial incentives, including payments, as compensation for the collection, sale, sharing or retention of personal information.


      4. Right to Delete – you have the right to request that NRS delete any personal information that it has collected about you. There are exceptions to this right and NRS does not have to delete your personal information if it is reasonably necessary to complete a transaction with you, to provide you with goods or services you requested, to comply with our legal obligations, and as otherwise provided in the CCPA. In addition, if your personal information is deleted you may not be able to purchase or use our products and services.


      5. Right to Correct Inaccurate Personal Information – you have the right to request that NRS correct any inaccurate personal information that it maintains about you.


      6. Right to Opt Out of Sale or Sharing of Personal Information – NRS may sell (as defined in the CCPA) certain pieces of your personal information. NRS does not share (as defined in the CCPA) your personal information. You have the right to request that NRS not sell or share your personal information to third parties. To exercise this right please go to https://www.idt.net/ccpa-do-not-sell/ and complete the form. We will also process any opt-out of sale/sharing preference signal that meets the requirements set forth in the CCPA and its regulations. NRS does not intentionally collect the personal information of a consumer under the age of 16. NRS does not intentionally sell or share the personal information of a consumer under the age of 16 unless the consumer (if age 13-16) or the consumer’s parent (for consumers under 13) affirmatively authorizes the sale or sharing.


      7. Right to Limit Use and Disclosure of Sensitive Personal Information – NRS does not use your sensitive personal information (as defined in the CCPA) for purposes other than as set forth in the CCPA. Nonetheless, you have the right to direct NRS to limit its use of your sensitive personal information to that use which is necessary for NRS to perform the services and provide the goods you requested from NRS, to ensure the security and integrity of your personal information, to perform services on our behalf, including to maintain or service accounts, provide customer service, process or fulfill orders and transactions, verify customer information, process payments, provide analytic services, to maintain the quality of our products and services, and as otherwise provided in the CCPA. Please note that sensitive personal information that is collected or processed by NRS without the purpose of inferring characteristics about a consumer, is not subject to this section, and shall be treated as personal information. To exercise this right please go to https://www.idt.net/ccpa-do-not-sell/ and complete the form.


    4. How to Exercise Your Rights . To exercise your rights to know and access your personal information collected, sold, shared or disclosed by NRS, or to exercise your right to delete your personal information or to correct inaccurate personal information, please go to https://www.idt.net/ccpa-request/ and complete the form. To exercise your right to opt out of the sale or sharing of your personal information, or to exercise your right to limit the use and disclosure of your sensitive personal information please go to https://www.idt.net/ccpa-do-not-sell/ and complete the form. We will also process any opt-out of sale/sharing preference signal that meets the requirements set forth in the CCPA and its regulations. In addition, you can exercise your rights by contacting us at 800-215-0931 or [email protected] . Your authorized agent can make these requests on your behalf using the same links and methods.

    5. Verification of Consumer Requests . In order to comply with a consumer request, NRS must reasonably verify the requestor. A record of each request is made as soon as it is received by our data protection team. NRS will use all reasonable measures to verify the identity of the individual making the request. We will utilize the requested data to ensure that we can verify the requestor’s identity and where we are unable to do so, we may contact you for further information, or ask you to provide evidence of your identity prior to responding to your request. This is to protect your data and rights. If a third party, relative or representative is requesting the data on your behalf, we will verify their authority to act for you and may contact you and them to confirm you and their identity and gain your authorization prior to responding to the request.


    6. Responding to Consumer Requests . NRS will attempt to confirm receipt of each request by contacting the requestor either at the email or telephone number submitted, through the consumer’s account or by other electronic means. NRS will attempt to verify each request and if it is able to verify a request will provide a response (if necessary and applicable) within 45 days of the receipt of the request, which time period may be extended by NRS for an additional 45 days. If a delay is necessary, NRS will contact the requestor within the original 45 day period and provide the reasons for the delay. NRS may charge a fee or refuse to act on any request that is manifestly unfounded or excessive. All NRS responses shall be in writing and cover the previous 12 month period unless the consumer requests information beyond the 12 month period (only applies to personal information collected on or after January 1, 2022). Where possible the response shall be sent through the consumer’s account. Otherwise, the response shall be sent by mail or electronically. NRS is not obligated to provide a response to a consumer more than two times in any 12 month period. The CCPA contains certain exemptions and exceptions to the exercise of some of these rights. If one or more of those exemptions or exceptions applies to your request, then we may not be able to act upon your request. Where possible we will inform you of the reasons for not acting upon your request.


    7. How Long will NRS Retain Your Personal Information . NRS retains your personal information for only as long as is necessary to carry out the purposes described above in this privacy policy, and we have strict review and retention policies in place to meet these obligations. This time period may vary depending on the type of information and the services used, as detailed below, and applicable law, which may require us to maintain information for a set amount of time. After such time, we will either delete or anonymize your information or, if this is not possible (for example, because the information has been stored in backup archives), then we will securely store your information and isolate it from any further use until deletion is possible. We may also retain aggregate information beyond this time for research purposes and to help us develop and improve our services. You cannot be identified from anonymized information retained or used for these purposes.


      1. Customer account information. We store your account information for as long as your account is active and a reasonable period thereafter in case you decide to re-activate your service. We also retain some of your information as necessary to comply with our legal obligations, to resolve disputes, to enforce our agreements, to support business operations, and to continue to develop and improve our services. We are required under certain applicable tax laws to keep your basic personal information (name, address, contact details) for a minimum of six years after which time it will be destroyed unless required to be kept for other purposes.

      2. Communications usage information. While you are an active customer, we retain the communications usage information generated by your use of our services until the information is no longer necessary to provide our services, and for a reasonable time thereafter as necessary to comply with our legal obligations, to resolve disputes, to enforce our agreements, to support business operations, and to continue to develop and improve our services.

      3. Marketing information, cookies and web beacons. Where you have consented to us using your details for direct marketing, we will keep such data until you notify us otherwise and/or withdraw your consent. We retain information derived from cookies and other tracking technologies for a reasonable period of time from the date such information was created.

      4. Device information. We collect device-specific information from you. If you do not revoke our access to this information via the privacy settings on your device, we will retain this information for as long as your account is active.


    8. For More Info . For more information on your rights and our obligations under the CCPA please send an email to [email protected] . For California residents with a disability please send an email to [email protected] for information on how to access this policy in another format.





    Exhibit B

    Colorado Consumers

    If you are a resident of Colorado, then the following section also applies to you.


    1. Personal Data . Personal Data. Personal data includes any information that is linked or reasonably linkable to an identified or identifiable individual. Personal data does not include de-identified data or publicly available information. NRS may collect and process the following categories of personal data regarding Colorado residents:

      Categories of Personal Data Collected or Processed

      Specific Personal Data Collected within Category

      Is this data Sold, Shared with Third Parties, Processed for Targeted Advertising or Processed for Profiling in furtherance of Decisions that Produce Legal or Significant Effects and Categories of to Whom

      Purposes for Collection and Processing of Personal Data

      Personal Identifiers and Information

      name, address, email address, phone number, birthdate, device and marketing identifiers, IP address, payment and financial information, credit/debit card number and details, bank account number and information, personal information necessary to verify you or your account, security code and login credentials, and other personal information you provide

      Sold – yes

      Categories of third parties to whom NRS may sell personal data: data processors

      Processed for Targeted Advertising – no

      Processed for Profiling in furtherance of Decisions that Produce Legal or Significant Effects – no

      Shared with Third Parties – yes

      Categories of third parties to whom NRS shares personal data for a business purpose: NRS family of companies, including our affiliates both in and outside the United States; our service providers and vendors to the extent reasonably necessary for them to perform work on our and your behalf (e.g., payment processors); ad networks; data analytics providers; social networks; law enforcement; prospective purchasers of our business; outside auditors and lawyers; and government entities, agencies and regulators

      To manage our products and services, including to help us operate, provide, evaluate, improve, monitor, customize, bill and support our products and services

      To maintain the quality of our products and services, including to improve, upgrade, and enhance our products and services

      To maintain and service your account, including to process orders and payments

      To communicate with you about our terms and policies

      To verify you, your account activity and your information

      To detect, investigate and report fraud, abuse or illegal use of our products and services or customer accounts

      To provide customer service

      To perform due diligence, credit and fraud prevention checks

      To maintain accurate record keeping

      To ensure security and integrity of our customers’ personal information

      To perform product, marketing and organizational analysis

      To provide advertising and marketing to our customers

      To measure our marketing campaigns and to audit consumer interactions

      To comply with regulations and legal requirements

      To comply with contractual requirements

      For risk management and compliance

      For legal advice and defense of claims

      For general, operational and administrative purposes

      Commercial Information

      records of products or services purchased and used, diagnostic and service performance information, credit information from reporting agencies, transactional information, and other purchasing or consuming histories

      Sold – no

      Processed for Targeted Advertising – no

      Processed for Profiling in furtherance of Decisions that Produce Legal or Significant Effects – no

      Shared with Third Parties – yes

      Categories of third parties to whom NRS shares personal data for a business purpose: see list under Personal Identifiers and Information

      Internet or other Electronic Network Activity Information

      browsing history, search history, messages, personal, phone or social network contact information, device information, device contacts, and information regarding a consumer’s interaction and usage with our websites, apps and advertisements

      Sold – no

      Processed for Targeted Advertising – no

      Processed for Profiling in furtherance of Decisions that Produce Legal or Significant Effects – no

      Shared with Third Parties – yes

      Categories of third parties to whom NRS shares personal data for a business purpose: see list under Personal Identifiers and Information

      Geolocation Data (if you enable location features in apps)

      location of device

      Sold – no

      Processed for Targeted Advertising – no

      Processed for Profiling in furtherance of Decisions that Produce Legal or Significant Effects – no

      Shared with Third Parties – yes

      Categories of third parties to whom NRS shares personal data for a business purpose: see list under Personal Identifiers and Information

      Inferences drawn from any of the information above

      profile reflecting the consumer’s purchasing and marketing preferences, aggregate information from third parties

      Sold – no

      Processed for Targeted Advertising – no

      Processed for Profiling in furtherance of Decisions that Produce Legal or Significant Effects – no

      Shared with Third Parties – yes

      Categories of third parties to whom NRS discloses personal data for a business purpose: NRS family of companies, including our affiliates both in and outside the United States;
      our vendors and partners to the extent reasonably necessary for them to perform work on our and your behalf (e.g., payment processors); ad networks; data analytics providers;
      social networks; and prospective purchasers of our business

       

    2. Your Rights. As a Colorado resident you have certain additional rights regarding your personal data under the Colorado Privacy Act (the “COPA”):


      1. Right to Confirm if a Controller is Processing Your Personal Data and to Access Personal Data – you have the right to request that NRS confirm whether or not it has collected and processed personal data about you and to access the personal data that we have collected about you;


      2. Right to Correct Inaccurate Personal Data – you have the right to request that NRS correct any inaccurate personal data that we maintain about you;


      3. Right to Delete – you have the right to request that NRS delete any personal data that it has collected about you. There may be exceptions to this right and NRS does not have to delete your personal data if it is reasonably necessary to complete a transaction with you, to provide you with goods or services you requested, to comply with our legal obligations, and as otherwise provided by Colorado law. In addition, if your personal data is deleted you may not be able to purchase or use our products and services;


      4. Right to Obtain Copy of Personal Data in Portable Format – you have the right to obtain from NRS a copy of the personal data that we maintain about you in a portable format;


      5. Right to Opt-Out of the Processing of Personal Data for purposes of Targeted Advertising, Sale, or Profiling with Legal Effects – NRS may sell (as defined in the COPA) certain pieces of your personal data. NRS does not process your personal data for Targeted Advertising (as defined in the COPA) or process your personal data for Profiling (as defined in the COPA) for decisions that produce legal or similarly significant effects. You have the right to request that NRS not process your personal data for those purposes. To exercise this right please go to https://www.idt.net/copa-request and complete the form.


    3. How to Exercise Your Rights . To exercise any of your rights, please (i) go to https://www.idt.net/copa-request/ and complete the form, or (ii) send an email to [email protected] detailing your request(s). The COPA applies to individuals who are Colorado residents, but does not apply to individuals acting in a commercial context. An authorized agent may submit an opt-out request on your behalf using the same methods listed in this section.

    4. Authentication of Consumer Requests . In order to comply with a consumer request, NRS must reasonably authenticate the request. A record of each request is made as soon as it is received by our data protection team. NRS will use all reasonable measures to authenticate the identity of the individual making the request. We will utilize the requested data to ensure that we can verify the requestor’s identity and where we are unable to do so, we may contact you for further information, or ask you to provide evidence of your identity prior to responding to your request. This is to protect your data and rights. If a third party, agent or representative is submitting an opt-out request on your behalf, we will verify their authority to act for you and may contact you and them to confirm your and their identity and to gain your authorization prior to taking action upon the request.


    5. Appeal of Refusal to Take Action . If NRS refuses to take action on your request you have the right to appeal that refusal within 30 days of your receipt of NRS’s response by sending an email to [email protected] and requesting an appeal. Within 45 days of NRS’s receipt of your appeal, we will inform you of any action taken or not taken in response to the appeal, including the reasons for our decision. If your appeal is denied, then you may contact the Colorado Attorney General at https://coag.gov/ or 720-508-6000.






    Exhibit C

    Connecticut Consumers

    If you are a resident of Connecticut, then the following section also applies to you.


    1. Personal Data . Personal Data. Personal data includes any information that is linked or reasonably linkable to an identified or identifiable individual. Personal data does not include de-identified data or publicly available information. NRS may collect and process the following categories of personal data regarding Connecticut residents:

      Categories of Personal Data Collected or Processed

      Specific Personal Data Collected within Category

      Is this data Sold, Shared with Third Parties, or Processed for Targeted Advertising and Categories of to Whom

      Purposes for Collection and Processing of Personal Data

      Personal Identifiers and Information

      name, address, email address, phone number, birthdate, device and marketing identifiers, IP address, payment and financial information, credit/debit card number and details, bank account number and information, personal information necessary to verify you or your account, security code and login credentials, and other personal information you provide

      Sold – yes

      Categories of third parties to whom NRS may sell personal data: data processors

      Processed for Targeted Advertising – no

      Shared with Third Parties – yes

      Categories of third parties to whom NRS shares personal data for a business purpose: NRS family of companies, including our affiliates both in and outside the United States; our
      service providers and vendors to the extent reasonably necessary for them to perform work on our and your behalf (e.g., payment processors); ad networks; data analytics providers;
      social networks; law enforcement; prospective purchasers of our business; outside auditors and lawyers; and government entities, agencies and regulators

      To manage our products and services, including to help us operate, provide, evaluate, improve, monitor, customize, bill and support our products and services

      To maintain the quality of our products and services, including to improve, upgrade, and enhance our products and services

      To maintain and service your account, including to process orders and payments

      To communicate with you about our terms and policies

      To verify you, your account activity and your information

      To detect, investigate and report fraud, abuse or illegal use of our products and services or customer accounts

      To provide customer service

      To perform due diligence, credit and fraud prevention checks

      To maintain accurate record keeping

      To ensure security and integrity of our customers’ personal information

      To perform product, marketing and organizational analysis

      To provide advertising and marketing to our customers

      To measure our marketing campaigns and to audit consumer interactions

      To comply with regulations and legal requirements

      To comply with contractual requirements

      For risk management and compliance

      For legal advice and defense of claims

      For general, operational and administrative purposes

      Commercial Information

      records of products or services purchased and used, diagnostic and service performance information, credit information from reporting agencies, transactional information, and other purchasing or consuming histories

      Sold – no

      Processed for Targeted Advertising – no

      Shared with Third Parties – yes

      Categories of third parties to whom NRS shares personal data for a business purpose: see list under Personal Identifiers and Information

      Internet or other Electronic Network Activity Information

      browsing history, search history, messages, personal, phone or social network contact information, device information, device contacts, and information regarding a consumer’s interaction and usage with our websites, apps and advertisements

      Sold – no

      Processed for Targeted Advertising – no

      Shared with Third Parties – yes

      Categories of third parties to whom NRS shares personal data for a business purpose: see list under Personal Identifiers and Information

      Geolocation Data (if you enable location features in apps)

      location of device

      Sold – no

      Processed for Targeted Advertising – no

      Shared with Third Parties – yes

      Categories of third parties to whom NRS shares personal data for a business purpose: see list under Personal Identifiers and Information

      Inferences drawn from any of the information above

      profile reflecting the consumer’s marketing and purchasing preferences, aggregate information from third parties

      Sold – no

      Processed for Targeted Advertising – no

      Shared with Third Parties – yes

      Categories of third parties to whom NRS discloses personal data for a business purpose: NRS family of companies, including our affiliates both in and outside the United States; our vendors and partners to the extent reasonably necessary for them to perform work on our and your behalf (e.g., payment processors); ad networks; data analytics providers; social networks; and prospective purchasers of our business

       

    2. Sensitive Data . The only sensitive data (as defined in the CTPA) that NRS may collect and process is precise geolocation data (as defined in the CTPA) from its apps primarily for transaction compliance reasons if the user enables the app’s location feature.

    3. Your Rights. As a Connecticut resident you have certain additional rights regarding your personal data under the Connecticut Privacy Act (the “CTPA”):


      1. Right to Confirm if a Controller is Processing Your Personal Data and to Access Personal Data – you have the right to request that NRS confirm whether or not it has collected and processed personal data about you and to access the personal data that we have collected about you;


      2. Right to Correct Inaccurate Personal Data – you have the right to request that NRS correct any inaccurate personal data that we maintain about you;


      3. Right to Delete – you have the right to request that NRS delete any personal data that it has collected about you. There may be exceptions to this right and NRS does not have to delete your personal data if it is reasonably necessary to complete a transaction with you, to provide you with goods or services you requested, to comply with our legal obligations, and as otherwise provided by Connecticut law. In addition, if your personal data is deleted you may not be able to purchase or use our products and services;


      4. Right to Obtain Copy of Personal Data in Portable Format – you have the right to obtain from NRS a copy of the personal data that we maintain about you in a portable format;


      5. Right to Opt-Out of the Processing of Personal Data for purposes of Targeted Advertising, Sale, or Profiling with Legal Effects – NRS may sell (as defined in the CTPA) certain pieces of your personal data. NRS does not process your personal data for Targeted Advertising (as defined in the CTPA) or process your personal data for Profiling (as defined in the CTPA) for decisions that produce legal or similarly significant effects. You have the right to request that NRS not process your personal data for those purposes. To exercise this right please go to https://www.idt.net/ctpa-request and complete the form.


    4. How to Exercise Your Rights . To exercise any of your rights, please go to https://www.idt.net/ctpa-request and complete the form. The CTPA applies to individuals who are Connecticut residents, but does not apply to individuals acting in a commercial context. An authorized agent may submit an opt-out request on your behalf using the same method listed in this section.

    5. Authentication of Consumer Requests . In order to comply with a consumer request, NRS must reasonably authenticate the request. A record of each request is made as soon as it is received by our data protection team. NRS will use all reasonable measures to authenticate the identity of the individual making the request. We will utilize the requested data to ensure that we can verify the requestor’s identity and where we are unable to do so, we may contact you for further information, or ask you to provide evidence of your identity prior to responding to your request. This is to protect your data and rights. If a third party, agent or representative is submitting an opt-out request on your behalf, we will verify their authority to act for you and may contact you and them to confirm your and their identity and to gain your authorization prior to taking action upon the request.


    6. Responding to Consumer Requests . NRS will attempt to authenticate each request and if it is able to authenticate a request it will provide a response (if necessary and applicable) within 45 days of the receipt of the request, which time period may be extended by NRS for an additional 45 days. If a delay is necessary, NRS will contact the requestor within the original 45 day period and provide the reasons for the delay. All NRS responses shall be in writing. The response shall be sent by mail or electronically. If NRS is not able to process your request, we will inform you of that and (where possible) of the reasons for not acting upon your request.


    7. Appeal of Refusal to Take Action . If NRS refuses to take action on your request you have the right to appeal that refusal within 30 days of your receipt of NRS’s response by sending an email to [email protected] and requesting an appeal. Within 60 days of NRS’s receipt of your appeal, we will inform you of any action taken or not taken in response to the appeal, including the reasons for our decision. If your appeal is denied, then you may contact the Connecticut Attorney General by email at [email protected] or by phone at 860-808-5318.






    Exhibit D

    Utah Consumers . If you are a resident of Utah, then the following section also applies to you.


    1. Personal Data . Personal data includes any information that is linked or reasonably linkable to an identified or identifiable individual. Personal data does not include de-identified data, aggregated data or publicly available information. NRS may collect and process the following categories of personal data regarding Utah residents:

      Categories of
      Personal Data
      Collected or
      Processed

      Specific Personal
      Data Collected
      within Category

      Is this data Sold,
      Shared with Third
      Parties and/or
      Processed for
      Targeted
      Advertising and
      Categories of to
      Whom

      Purposes for
      Collection and
      Processing of
      Personal Data

      Personal Identifiers and
      Information

      name, address, email address, phone number, birthdate, device and marketing identifiers, IP address, payment and financial information, credit/debit card number and details, bank account number and information, personal information necessary to verify you or your account, security code and login credentials, and other personal information you provide

      Sold to Third Parties – yes

      Categories of third parties to whom NRS may sell personal data: data processors

      Processed for Targeted Advertising – no

      Shared with Third Parties – yes

      Categories of third parties to whom NRS shares personal data for a business purpose: NRS family of companies, including our affiliates both in and outside the United States; our service providers and vendors to the extent reasonably necessary for them to perform work on our and your behalf (e.g., payment processors); ad networks; data analytics providers; social networks; law enforcement; prospective purchasers of our business; outside auditors and lawyers; and government entities, agencies and regulators

      To manage our products and services, including to help us operate, provide, evaluate, improve, monitor, customize, bill and support our products and services

      To maintain the quality of our products and services, including to improve, upgrade, and enhance our products and services

      To maintain and service your account, including to process orders and payments

      To communicate with you about our terms and policies

      To verify you, your account activity and your information

      To detect, investigate and report fraud, abuse or illegal use of our products and services or customer accounts

      To provide customer service

      To perform due diligence, credit and fraud prevention checks

      To maintain accurate record keeping

      To ensure security and integrity of our customers’ personal information

      To perform product, marketing and organizational analysis

      To provide advertising and marketing to our customers

      To measure our marketing campaigns and to audit consumer interactions

      To comply with regulations and legal requirements

      To comply with contractual requirements

      For risk management and compliance

      For legal advice and defense of claims

      For general, operational and administrative purposes

      Commercial information

      records of products or services purchased and used, diagnostic and service performance information, credit information from reporting agencies, transactional information, and other purchasing or consuming histories

      Sold to Third Parties – no

      Processed for Targeted Advertising – no

      Shared with Third Parties – yes
      Categories of third parties to whom NRS shares personal data for a business purpose: see list under Personal Identifiers and Information

      Internet or other
      Electronic Network
      Activity Information
      browsing history, search history, messages, personal, phone or social network contact information, device information, device contacts, and information regarding a consumer’s interaction and usage with our websites, apps and advertisements

      Sold to Third Parties – no

      Processed for Targeted Advertising – no

      Shared with Third Parties – yes

      Categories of third parties to whom NRS shares personal data for a business purpose: see list under Personal Identifiers and Information

      Geolocation Data (if you enable location features in apps)

      location of device

      Sold to Third Parties – no

      Processed for Targeted Advertising – no

      Shared with Third Parties – yes

      Categories of third parties to whom NRS shares personal data for a business purpose: see list under Personal Identifiers and Information

      Inferences drawn from
      any of the information
      above

      profile reflecting the
      consumer’s marketing
      preferences; aggregate
      information from third
      parties

      Sold to Third Parties – no

      Processed for Targeted Advertising – no

      Shared with Third Parties – yes

      Categories of third parties to whom NRS discloses personal data for a business purpose: NRS family of companies, including our affiliates both in and outside the United States; our vendors and partners to the extent reasonably necessary for them to perform work on our and your behalf (e.g., payment processors); ad networks; data analytics providers; social networks; and prospective purchasers of our business

    2. Sensitive Data . The only sensitive data (as defined in the UTPA) that NRS may collect and process is specific geolocation data (as defined in the CTPA) from its apps primarily for transaction compliance reasons if the user enables the app’s location feature. Users of our apps can enable or disable an app’s location feature in the app.

    3. Your Rights . As a Utah resident you have certain additional rights regarding your personal data under the Utah Privacy Act (the “UTPA”):


      1. Right to Confirm if a Controller is Processing Your Personal Data and to Access Your Personal Data – you have the right to request that NRS confirm whether or not it has collected and processed personal data about you and to access the personal data that we have collected about you;

      2. Right to Delete – you have the right to request that NRS delete any personal data that you provided to it. There may be exceptions to this right and NRS does not have to delete your personal data if it is reasonably necessary to complete a transaction with you, to provide you with goods or services you requested, to comply with our legal obligations, and as otherwise provided by Utah law. In addition, if your personal data is deleted you may not be able to purchase or use our products and services;

      3. Right to Obtain Copy of Personal Data in Portable Format – you have the right to obtain from NRS a copy of the personal data that you previously provided to us in a portable format; and

      4. Right to Opt-Out of the Processing of Personal Data for purposes of Targeted Advertising and/or Sale – NRS may sell (as defined in the UTPA) certain pieces of your personal data. NRS does not process your personal data for Targeted Advertising (as defined in the UTPA). You have the right to request that NRS not process your personal data for those purposes. To exercise this right please go to https://www.idt.net/utpa-request/ and complete the form.

    4. How to Exercise Your Rights . To exercise any of your rights, please go to https://www.idt.net/utpa-request and complete the form. The UTPA applies to individuals who are Utah residents, but does not apply to individuals acting in a commercial context. An authorized agent may submit an opt-out request on your behalf using the same method listed in this section.

    5. Authentication of Consumer Requests . In order to comply with a consumer request, NRS must reasonably authenticate the request. A record of each request is made as soon as it is received by our data protection team. NRS will use all reasonable measures to authenticate the identity of the individual making the request. We will utilize the requested data to ensure that we can verify the requestor’s identity and where we are unable to do so, we may contact you for further information, or ask you to provide evidence of your identity prior to responding to your request. This is to protect your data and rights. If a third party, agent or representative is submitting an opt-out request on your behalf, we will verify their authority to act for you and may contact you and them to confirm your and their identity and to gain your authorization prior to taking action upon the request.


    6. Responding to Consumer Requests . NRS will attempt to authenticate each request and if it is able to authenticate a request it will provide a response (if necessary and applicable) within 45 days of the receipt of the request, which time period may be extended by NRS for an additional 45 days. If a delay is necessary, NRS will contact the requestor within the original 45 day period and provide the reasons for the delay. All NRS responses shall be in writing. The response shall be sent by mail or electronically. If NRS is not able to process your request, we will inform you of that and (where possible) of the reasons for not acting upon your request.




Exhibit E

Virginia Consumers . If you are a resident of Virginia, then the following section also applies to you.


  1. Personal Data . Personal data includes any information that is linked or reasonably linkable to an identified or identifiable natural person. Personal data does not include de-identified data or publicly available information. NRS may collect and process the following categories of personal data regarding Virginia residents:

    Categories of
    Personal Data
    Collected and
    Processed

    Specific Personal
    Data Collected
    within Category

    Is this data Sold,
    Shared with Third
    Parties and/or
    Processed for
    Targeted
    Advertising and
    Categories of to
    Whom

    Purposes for
    Collection and
    Processing of
    Personal Data

    Personal Identifiers and
    Information

    Name; address; email
    address; phone number;
    birthdate; device and
    marketing identifiers; IP
    address; payment and
    financial information;
    credit/debit card number
    and details; bank account
    number and information;
    personal information
    necessary to verify you
    or your account; security
    code and login
    credentials; and other
    personal information you
    provide

    Sold – yes
    Categories of third
    parties to whom NRS
    may sell personal
    information: data
    processors
    Processed for Targeted
    Advertising – no
    Shared with Third Parties
    – yes
    Categories of third
    parties to whom NRS
    shares personal data for a
    business purpose: NRS
    family of companies,
    including our affiliates
    both in and outside the
    United States; our service
    providers and vendors to
    the extent reasonably
    necessary for them to
    perform work on our and your behalf (e.g., credit
    card processors); other
    NRS stores with which
    you interact; ad
    networks; data analytics
    providers; social
    networks; law
    enforcement; prospective
    purchasers of our
    business; outside auditors
    and lawyers; and
    government entities,
    agencies and regulators

    To manage our products
    and services, including to
    help us operate, provide,
    evaluate, improve,
    monitor, customize, bill
    and support our products
    and services
    To maintain the quality of
    our products and services,
    including to improve,
    upgrade, and enhance our
    products and services
    To maintain and service
    your account, including to
    process orders and
    payments
    To communicate with you
    about our terms and
    policies
    To verify you, your
    account activity and your
    information
    To detect, investigate and
    report fraud, abuse or illegal use of our products
    and services or customer
    accounts
    To provide customer
    service
    To perform due diligence,
    credit and fraud
    prevention checks
    To maintain accurate
    record keeping
    To ensure security and
    integrity of our
    customers’ personal
    information
    To perform product,
    marketing and
    organizational analysis
    To provide advertising
    and marketing to our
    customers
    To measure our marketing
    campaigns and to audit
    consumer interactions
    To comply with
    regulations and legal
    requirements
    To comply with
    contractual requirements
    For risk management and
    compliance
    For legal advice and
    defense of claims
    For general, operational
    and administrative
    purposes 

    Commercial information

    records of products or
    services purchased and
    used; diagnostic and
    service performance
    information; credit
    information from
    reporting agencies;
    transactional
    information; and other
    purchasing or consuming
    histories

    Sold – no Processed for Targeted Advertising – no Shared with Third Parties – yes Categories of third parties to whom NRS shares personal data for a business purpose: see list under Personal Identifiers and Information 

    Internet or other
    Electronic Network
    Activity Information
    browsing history; search
    history; messages;
    personal, phone or social
    network contact
    information; device
    information; device
    contacts; and information
    regarding a consumer’s
    interaction and usage
    with our websites, apps
    and advertisements

    Sold – no Processed for Targeted Advertising – no Shared with Third Parties – yes Categories of third parties to whom NRS shares personal data for a business purpose: see list under Personal Identifiers and Information

    Geolocation Data (if you enable location features in apps)

    location of device

    Sold – no
    Processed for Targeted
    Advertising – no
    Shared with Third Parties
    – yes
    Categories of third parties to whom NRS
    shares personal data for a
    business purpose: see
    list under Personal
    Identifiers and
    Information

    Inferences drawn from
    any of the information
    above

    profile reflecting the
    consumer’s marketing
    preferences; aggregate
    information from third
    parties

    Sold – no
    Processed for Targeted
    Advertising – no
    Shared with Third Parties
    – yes
    Categories of third
    parties to whom NRS
    discloses personal data
    for a business purpose:
    NRS family of
    companies, including our
    affiliates both in and
    outside the United States;
    our vendors and partners
    to the extent reasonably
    necessary for them to
    perform work on our and
    your behalf (e.g., credit
    card processors); other
    NRS stores with which
    you interact; ad
    networks; data analytics
    providers; social
    networks; and
    prospective purchasers of
    our business

  2. Sensitive Data . The only sensitive data (as defined in the VCDPA) that NRS may collect and process is precise geolocation data (as defined in the VCDPA) primarily for transaction compliance and fulfillment reasons if the user enables the location feature in our apps.

  3. Your Rights . As a Virginia resident you have certain additional rights regarding your personal data under the Virginia Consumer Data Protection Act (the “VCDPA”):


    1. Right to Confirm if a Controller is Processing Your Personal Data and to Access Personal Data – you have the right to request that NRS confirm whether or not it has collected and processed personal data about you and to access the personal data that we have collected about you;

    2. Right to Correct Inaccurate Personal Data – you have the right to request that NRS correct any inaccurate personal data that we maintain about you;

    3. Right to Delete – you have the right to request that NRS delete any personal data that it has collected about you. There may be exceptions to this right and NRS does not have to delete your personal data if it is reasonably necessary to complete a transaction with you, to provide you with goods or services you requested, to comply with our legal obligations, and as otherwise provided by Virginia law. In addition, if your personal data is deleted you may not be able to purchase or use our products and services;

    4. Right to Obtain Copy of Personal Data in Portable Format – you have the right to obtain from NRS a copy of the personal data that we maintain about you in a portable format;

    5. Right to Opt-Out of the Processing of Personal Data for purposes of Targeted Advertising, Sale, or Profiling with Legal Effects – NRS may sell (as defined in the VCDPA) certain items of your personal data, but NRS does not process your personal data for Targeted Advertising (as defined in the VCDPA) or process your personal data for Profiling (as defined in the VCDPA) for decisions that produce legal or similarly significant effects. You have the right to request that NRS not process your personal data for those purposes. To exercise this right please go to https://www.idt.net/vcdpa-request/ and complete the form.

  4. How to Exercise Your Rights . To exercise any of your rights, please go to https://www.idt.net/vcdpa-request/ and complete the form. The VCDPA applies to individuals who are Virginia residents, but does not apply to individuals acting in a commercial context./p>

  5. Authentication of Consumer Requests . In order to comply with a consumer request, NRS must reasonably authenticate the request. A record of each request is made as soon as it is received by our data protection team. NRS will use all reasonable measures to authenticate the identity of the individual making the request. We will utilize the requested data to ensure that we can verify the requestor’s identity and where we are unable to do so, we may contact you for further information, or ask you to provide evidence of your identity prior to responding to your request. This is to protect your data and rights.


  6. Responding to Consumer Requests . NRS will attempt to authenticate each request and if it is able to authenticate a request it will provide a response (if necessary and applicable) within 45 days of the receipt of the request, which time period may be extended by NRS for an additional 45 days. If a delay is necessary, NRS will contact the requestor within the original 45 day period and provide the reasons for the delay. All NRS responses shall be in writing. The response shall be sent by mail or electronically. If NRS is not able to process your request, we will inform you of that and (where possible) of the reasons for not acting upon your request.


  7. Appeal of Refusal to Take Action . If NRS refuses to take action on your request you have the right to appeal that refusal within 30 days of your receipt of NRS’s response by sending an email to [email protected] and requesting an appeal. Within 60 days of NRS’s receipt of your appeal, we will inform you of any action taken or not taken in response to the appeal, including the reasons for our decision. If your appeal is denied, then you may contact the Virginia Attorney General at (804)786-2071 to submit a complaint.