GOLDEN BAY DRYWALL, INC. (#2026264)

Sutton Specialty Insurance Company 1855 Griffin Road, Suite B-390 Dania Beach, Florida 33004 SS Privacy 10 21 7 B. Consumer Right to a Notice of Collection. A business subject to the CCPA must, at or before the point of collection of Pl, inform a consumer as to the categories to be collected and the purposes for which it shall be used. A service provider that receives or collects Pl on behalf of, or at the direction of, a covered business may not be required to provide a notice of collection. C. Consumer Right to Know. A covered business must disclose in its privacy policy the Pl it has collected, sold, or disclosed for a business purpose in the past 12 months . Collection: A business must disclose the following in response to a verifiable request: • The categories of Pl the business has collected about the consumer; • The categories of sources from which that Pl was collected; • The business or commercial purpose for collecting or selling Pl; • The categories of third parties with which the business shares Pl; and • The specific pieces of Pl the business has collected about the consumer making the request; Sale: A business that sells Pl or discloses it for a business purpose must disclose, in response to a verifiable request, the following: • The categories of Pl collected about the individual consumer • The categories of Pl the business sold about the individual consumer, and the categories of third parties to which it was sold. Or, if the business has not sold any of the consumer's Pl, it must state that fact. • The categories of Pl the business has disclosed about the individual consumer for a business purpose. Or, if the business has not disclosed the consumer's Pl for a business purpose, it must state that fact. D. Consumer Right to Delete Directed to a Covered Business. A California consumer has the right to request that a covered business delete his/her Pl, subject to certain exceptions. Once a request is reasonably verified by the covered business, the Pl requested to be deleted must be removed from the records held by that business. The business must also direct its Service Providers with whom the informati on was shared to also delete the information, unless it is subject to an exception . A request to delete may be denied if retaining the information is necessary for the business or its Service Providers to: 1. Complete the transaction for which it collected the Pl, provide a good or service requested by the consumer, take action reasonably anticipated within the context of the ongoing business relationship with the consumer, or otherwise perform a contract with the consumer. Docusign Envelope ID: C32ED128-E8C0-4517-B42B-471D21968944