California Consumer Privacy Act Policy

You have the right to request that we disclose to you information about the collection and use of your personal information over the last 12 (twelve) months, including:

• The categories of personal information we have collected about you

• The categories of sources from which we have collected the personal information

• The business or commercial purpose for collecting or selling personal information

• The categories of third parties to whom we share personal information

• The specific pieces of personal information we have collected about you

• The categories of personal information we have disclosed about you for a business purpose

• The categories of third parties to whom your personal information as disclosed, by categories or Categories of personal information disclosed.

We have not sold personal information about consumers in the last 12 months.

To exercise any of your rights described in this California Consumer Privacy Act Policy, please submit a request to us by contacting us via one of the following methods:

1-800-507-4495

THREE Customer Service P.O. Box 34987 Omaha, Nebraska 68134

We will contact you to collect additional information to verify your identity. Depending on the nature of the request, we will require you to provide either two or three pieces of information to allow us to verify that you are the person about whom we collected personal information. We may also require you to submit a signed declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request. Any information we collect for the purpose of verifying your identity will not be used for any other purpose. If we are unable to verify that you are the person about whom we collected personal information, or that you have authority to make the request on that person's behalf, we will notify you that we will not be able to respond to your request. We will endeavor to respond to your request within 45 (forty-five) days of the date you submit it. If we require additional time, we will notify you of the extension in writing. We will not respond to more than two requests from the same consumer in any 12 month period.

“Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal information does not include publicly available information. We may collect various types of personal information.

We collect each category of personal information about consumers from the following categories of sources:

• Directly from you or someone providing information on your behalf, such as an insurance agent or your employer in connection with obtaining commercial insurance

• External data sources, such as consumer reporting agencies and other companies that provide data related to a specific consumer, business, or property

• Via our website, directly or indirectly from information submitted through a web portal or through the use of cookies and other data tracking systems

• Sources used to facilitate the transaction of insurance and the investigation of associated claims including, but not limited to, medical providers, regulators, auditors, attorneys, investigators, adjusters, and other insurance companies

We collect each category of personal information about consumers for the following business or commercial purposes:

• Directly from you or someone providing information on your behalf, such as an insurance agent or your employer in connection with obtaining commercial insurance

• External data sources, such as consumer reporting agencies and other companies that provide data related to a specific consumer, business, or property

• Via our website, directly or indirectly from information submitted through a web portal or through the use of cookies and other data tracking systems

• Sources used to facilitate the transaction of insurance and the investigation of associated claims including, but not limited to, medical providers, regulators, auditors, attorneys, investigators, adjusters, and other insurance companies

We will provide you notice and obtain your explicit consent if we collect additional categories of personal information or use the personal information we previously collected for materially different purposes.

We may disclose your personal information to a third party for business purposes. In the preceding twelve (12) months, we have disclosed the following categories of personal information for a business purpose:

• Category A: Identifiers.

• Category B: California Customer Records personal information categories.

• Category C: Protected classification characteristics under California or federal law.

• Category D: Commercial Information.

• Category F: Internet or Other Electronic Network Activity Information.

• Category G: Geolocation Data.

• Category H: Sensory Data.

• Category I: Professional or employment-related information.

• Category J: Non-public education information.

• Category K: Inferences drawn from other personal information.

We share personal information about consumers with the following categories of third parties:

• Entities that facilitate our transaction of insurance and the investigation of associated claims

• Third Party Administrators, independent adjusters, outside counsel, investigators, and other parties for purposes of investigating and resolving claims

• Regulatory and other government agencies

• Consumer reporting agencies or insurance support organizations

• Entities that have an interest in policies issued by us, such as a certificate holders, additional insureds, group policy owners, or lienholders

• Entities who perform administrative, business, professional, or employment functions on our behalf

• Insurers, reinsurers, policyholders, and claimants

• To our lawyers, accountants and auditors

• As otherwise required by law

We have not sold personal information about consumers in the last 12 (twelve) months.

The CCPA confers certain rights on consumers regarding personal information, including:

• The right to know what personal information we have collected about the consumer, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purposes for collecting, selling or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about the consumer

• The right to delete personal information we have collected from the consumer, subject to certain exceptions

• The right to correct inaccurate personal information that we maintain about the consumer

• The right not to receive discriminatory treatment by us for the exercise of privacy rights conferred by the CCPA

• If the consumer is an employee, an applicant for employment, or an independent contractor, the right not to be retaliated against for the exercise of the consumer's rights

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions described below. Once we receive and verify your request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for us or our service providers, or contractors to:

• Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you

• Assist our network or information systems detect security incidents that compromise the availability, authenticity, integrity, and confidentiality of stored or transmitted personal information

• Ensure the physical safety of any individual

• Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law

• Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et seq.)

• Engage in public or peer-reviewed scientific, historical, or statistical research that conforms or adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's ability to complete such research, if you previously provided informed consent

• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us and compatible with the context in which you provided the information

• Comply with a legal obligation

You have the right to request that we correct any inaccurate personal information that we retain about you. Once we receive and verify your request, we will use commercially reasonable efforts to correct (and direct our service providers and contractors to correct) your personal information in our records, unless the information is found to be accurate.

A business may not discriminate against a consumer because the consumer exercised any of the foregoing rights.

You may use an authorized agent to submit requests to us as described in this privacy notice. An authorized agent is a natural person or a business entity that you have authorized to act on your behalf. If you use an authorized agent to submit a request to us, we will require you to (1) provide the authorized agent with written permission to make requests on your behalf and then verify the consumer's own identity directly with us; or (2) provide the authorized agent with a power of attorney pursuant to California Probate Code sections 4000 to 4665. We may deny a request from an agent that does not submit proof that they have been authorized by you to act on your behalf.

For questions or concerns about our privacy policies or practices, please contact us at (866) 720-7861. If you have a disability, you may contact us to access this notice in an alternative format.

In accordance with the CCPA, this California Consumer Privacy Policy does not apply to:

• Certain medical information governed by the Confidentiality of Medical Information Act

• Certain information that is furnished to or collected from a consumer reporting agency in accordance with the Fair Credit Reporting Act

• Personal information collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act, and implementing regulation, or the California Financial Information Privacy Act

• Information collected, processed, sold, or disclosed pursuant to the Driver's Privacy Protection Act of 1994

• Certain information collected about a consumer in the course of their employment or application for employment

• Certain information collected about a consumer in the scope of a business-to-business transaction or communication

This policy was last updated on September 2, 2026. We may change this policy at any time.