College Savings Holdings, Inc. (“CSH”, “us”, “we” or “our”) is committed to respecting the privacy of your personal information. Through our brands and websites, including SavingforCollege.com, we aim to provide our users with guidance and resources related to the challenge of paying for higher education costs. In order to do this, we collect certain personal information from you (the “information”). This Privacy Policy (this “Policy”) sets forth our policies and procedures regarding the collection, use and sharing of your Information and your options to limit such collection, use and sharing.

This Policy applies to (i) users of our www.SavingforCollege.com, www.TheGradCafe.com, www.TheCollegeMonk.com websites, and affiliated products and services, whether accessed or purchased through our websites or otherwise; (ii) visitors to our websites; and (iii) participants in our sweepstakes and other promotional programs (collectively, the “Services”). You should review any additional terms of service provided for any Services that you access and use.

We may update this Policy from time to time, and you should review it periodically for changes. Any updated Policy will be posted on our website. Your access or use of this website or the Services constitutes your acceptance of this Policy, including any updates as posted.

CSH receives and collects both personal and non-identifying information from you when we operate and provide you with the Services, when you access or use the Services and when you communicate with us. Personal information means information either on its own or in conjunction with other data that enables a specific person to be identified, but does not include “de-identified,” “anonymous,” or “aggregate” information, which is not otherwise associated with a specific person. Non-identifying information means information that by itself cannot be used to identify a specific person (e.g., a person’s ZIP Code).

A. Information You Provide

Depending on the particular Service, you may provide the following information in connection with our Services, which may include personal information:

• name, address, email address, mobile phone number
• payment information, including credit or debit card details
• birthdate
• social security number
• education or employment information
• other personal information necessary to verify you and/or your phone number
• other personal information you provide to us for customer support purposes, surveys, sweepstakes, product feedback, reviews, or comments
• business information such as EINs, bank account information and employee information

B. Information We Collect

Depending on the particular Service, we may automatically collect the following information:

• password and login credentials
• Service related diagnostic and performance information, including how you use our Services and performance logs
• personal, phone or social network contact information
• information about your device, including model, browser, operating system, platform type, application software, mobile network, device identifiers and numbers, and Internet connection speed
• browsing, searching and buying activity
• IP address
• CSH websites visited and websites you come from and go to next
• certain data on your device, including your contacts, the phone numbers in your address book, favorite lists and other installed apps and programs
• device location information if you use our location features
• transactional information when you purchase a CSH product or service or affiliated product or service
• call and chat recording and transcripts when you communicate with or using our representatives, affiliates or websites
• certain information you disclose when commenting, reviewing or communicating on our websites or affiliate websites

C. Information Provided by Third Parties

When you install, access or use the Services, we may obtain the following information from third-party sources:

• credit information from credit reporting agencies
• transactional information when you purchase a CSH product or service, including receipts or information from app stores or other third parties processing your payment
• aggregate information from outside companies that collect consumer information such as demographic and interest data (examples of this information include gender, age range, academic background, school interests or career interests)
• unique marketing IDs, contact and other marketing lead information from third parties
• your email address or phone number as provided by users of our Services through the purchase/use of our Services, our referral programs, their contact lists or social networking platforms
• other information from third parties that helps us operate, provide, understand, customize, support and market our Services

A. Our Services

We use all the information we collect and receive to help us operate, provide, improve, understand, customize, support, and market our Services. In addition, we use your information for general, operational and administrative purposes, including maintaining your account, authenticating your identity and contacting you. As used in this Policy, the terms “use,” “using” and “processing” information include using cookies or other similar technologies on a computer/phone/device, subjecting the information to statistical or other analysis, and using or handling information in any way, including but not limited to, scanning, collecting, storing, evaluating, aggregating, modifying, deleting, using, combining, disclosing and sharing information among our affiliates and to third parties. We also collect information from third parties, which we may use or analyze on its own or in conjunction with information we have collected ourselves.

B. Web Technologies

CSH may use certain web technologies such as “cookies” or “web beacons.” We use cookies, small text files stored locally on your computer or device to serve as markers, to operate, provide, improve and customize our Services and your experiences. For example, we use cookies to understand which of our Services are most popular and to show you relevant content related to our Services. Additionally, we may use cookies to remember your choices, such as your language preferences. Web beacons are used to tell us how and when pages in our sites are visited, by how many people, their point of origin and operating system, and to monitor performance with our Services. Some or all of our Services may not be accessible while using web browser “do not track” signals or other mechanisms that provide you the ability to exercise choice regarding the collection of information about your online activities over time and across third-party websites or online services. We use and share this data and information to deliver customized content and advertising, to ensure that you see the correct product information, to manage the frequency with which you see an advertisement, to tailor advertisements to better match your interests, and to understand the effectiveness of our advertising. The content may be delivered on our websites, on non-CSH websites, by our representatives and affiliates, and via email, SMS, push notifications or our other Services. In addition, if you respond to or interact with a particular advertisement, you may later receive a targeted advertisement as a result of an ad server or ad network concluding that you fit within a particular audience.

C. Web Analysis and Remarketing

We may use certain third-party remarketing and analysis services, including Google Analytics Advertising Features such as Remarketing and Demographics and Interest Reporting. Google Analytics is a web analysis service provided by Google that allows us to collect data about the traffic on our websites through Google cookies and other identifiers, which enables us, among other things, to create user segments based on demographic or interest data and to deliver relevant advertising. Google utilizes the data collected to track and examine the use of our websites and to prepare reports on the activities and share them with other Google services. Google may use the data collected to contextualize and personalize the ads of its own advertising network. You may be able to opt out of the Google Analytics Advertising Features through your browser ads settings or by visiting Google’s Ads Settings page. Similar web analytic and remarketing tools we may use employ similar cookie technology for similar purposes, including social media sites. You should consult the policies and opt-out options on any social media or other site you use.

We share the information we collect and receive with our affiliates, and with select third parties, to help us operate, provide, improve, understand, customize, support, and market our Services, and for general, operational and administrative purposes, including maintaining your account, authenticating your identity and contacting you. In addition, you may share your information with such affiliates or third parties as you use and communicate through our Services.

A. Information Shared Within the CSH Family of Companies.

We share information within the CSH family of companies, including our affiliates, primarily to operate, provide, support and market our Services.

B. Information Shared with Third Parties.

We work with various third-party vendors and partners for a variety of business purposes such as to help us offer, operate, provide, improve, understand, customize, support and market our Services. We share information with these vendors and partners to the extent reasonably necessary for them to perform work on our behalf or as our partners and vendors. When you provide information to us, you agree to be contacted by such third parties, vendors and partners. In addition, we share certain information, including unique marketing identifiers, email addresses, and mobile phone numbers, with third parties for marketing, advertising, and analysis purposes, including the delivery of advertising campaigns and preparing and sharing aggregate business and marketing reports and demographic profiling. In certain circumstances, we may receive a fee or other compensation for such sharing. When we share information with third parties, we request that our vendors and partners protect your information and limit their use of the data to the purposes for which it was provided. Finally, if you purchase products or services offered jointly by CSH and one of our partners, your customer information may be received by both CSH and our partner that is providing the product or service. For these jointly offered products and services, you should also review the partner company’s privacy policy, which may include practices that are different from the practices described here.

C. Special Circumstances.

We may further share information in certain special circumstances. For example:

• To comply with valid legal process including subpoenas, court orders and search warrants, and as otherwise permitted or required by law
• To assist law enforcement in cases involving danger of death or serious physical injury to any person or in other emergencies
• To protect our rights or property, or the safety of our customers or employees
• To protect against fraudulent, malicious, abusive, unauthorized or unlawful use of our Services and to protect our network, Services, devices and users from such use
• To advance or defend against complaints or legal claims in court, administrative proceedings and elsewhere
• To prospective purchasers of all or part of our business or assets
• To outside auditors, lawyers and regulators
• With your consent

D. Information Shared with Third-Party Advertising Entities or Social Networks

You may see third-party advertisements on our websites and affiliate websites. Some advertisements are chosen by companies that place advertisements on behalf of other third-party advertisers. These companies, often called ad servers, may place and access cookies on your device to collect information about your visit. This information may be combined with similar data obtained from other websites to help advertisers better reach their target audiences. Targeting may be accomplished by tailoring advertising to interests that they infer from your browsing of our sites and your interaction with other websites where these ad servers also are present. If you choose to interact with specific advertisers who advertise on our websites and affiliate websites, the information you provide to them is subject to the conditions of their specific privacy policies. Our websites and affiliate websites may also include social network or other third-party plug-ins and widgets that may provide information to their associated social networks or third-parties about the CSH page you visit, even if you do not click on or otherwise interact with the plug-in or widget.

E. When You Share Information

You share your information as you use and communicate through our Services. Your phone number, profile name and photo, and online status may be available to anyone who uses our Services. Users with whom you communicate may store or share your information (including your phone number or messages) with others using or independently of our Services.

A. Telemarketing

Federal “Do Not Call” laws allow you to place your phone numbers on the National Do Not Call Registry to prevent telemarketing calls to those numbers. To add your numbers to this list, please call 1-888-382-1222, or visit www.donotcall.gov. Most telemarketing laws allow companies to contact their own customers without consulting the Federal or State Do Not Call lists. If you would like to be removed from CSH’s telemarketing list, please contact us at info@thecollegemonk.com. Please allow 30 days for your telephone number to be removed from any sales programs that are currently underway. Please note that we may still call you regarding your Services and account even if you remove your number from our telemarketing list. You should contact any third parties directly to request removal from their telemarketing lists.

B. Email, Text Messages and Push Notifications.

Marketing emails you receive from us will include an unsubscribe feature usually found at the bottom of the email or on our website that you may use to opt out of receiving future marketing emails. Marketing text and SMS messages from us also contain an opt-out feature that you can use to prevent future marketing text and SMS messages from us. You may refuse to consent to receive calls and texts from CSH that require your consent, including autodialed, pre-recorded or artificial voice telemarketing calls. You may also withdraw your previously given consent to receive such calls and texts. Please note that you cannot withdraw your consent to receive certain messages from us in connection with your use of our website and Services. Your ability to access some of our Services could be limited if you withdraw your consent to receive text and SMS messages.

C. Online Information.

You have choices about whether certain information collected on our websites is used to customize advertising based on predictions generated from your visits over time and across different websites and apps. Many mobile devices offer controls you can set to limit the advertising use of information collected across mobile apps on your device. Please note that many opt-out options use browser cookies or device controls and are specific to the device and browser you are using. If you buy a new computer, change web browsers or devices or delete the cookies on your computer, you may need to opt out again. In addition, ads you receive may still be tailored using other techniques such as publisher, device or browser-enabled targeting. You should check the privacy policies of all of the products, sites, apps and services you use to learn more about any such techniques and your options. You also can limit the collection of certain website information by deleting or disabling cookies. Most browsers enable you to erase cookies from your computer hard drive, block all cookies, or receive a warning before a cookie is stored. Disabling cookies may prevent you from using specific features on our websites.

If you would like to opt out of having your personal information shared with and sold to third-party companies for their own marketing purposes, please send us an email at info@thecollegemonk.com with the subject line “Opt-Out Request” and include your name, email address, phone number, and a statement of the information you would like to opt out of sharing. Please allow up to thirty (30) days for us to confirm and process your request to the extent required by law. Even if you opt out, certain information may still be shared with or by third parties. You should review carefully the privacy policies of any third-party websites or companies you visit or use and contact them directly to determine your opt-out options.

A. Keeping Children Safe

CSH does not knowingly market to or collect information from children under the age of 13 without obtaining verifiable parental consent. If you allow a child to use your device or our Services, you should be aware that their information could be collected as described in this Policy. We encourage parents to be involved in the online activities of their children to ensure that no information is collected from a child without parental permission.

B. Security

CSH has technical, organizational and physical safeguards in place to help protect against unauthorized access to, use or disclosure of the information we collect and store. Our websites are compliant with the technical and operational standards set out by the Payment Card Industry Security Standards Council in connection with your credit card information. Although we work hard to protect your information that we collect and store, no program is 100% secure, and we cannot guarantee that our safeguards will prevent every unauthorized attempt to access, use or disclose that information. CSH maintains security and incident response plans to handle incidents involving unauthorized access to information we collect or store. If you become aware of a security issue, please contact us.

C. Contact Information.

If you have questions, concerns or suggestions related to our Policy or our privacy practices you may contact us at:

College Savings Holdings, Inc.

444 Brickell Avenue, Suite 820, Miami, FL 33131.

info@thecollegemonk.com

D. Links to and from Non-CSH Websites and Content

The CSH websites may contain links to non-CSH websites. In addition, CSH content may be included on websites that are not associated with CSH. We have no control over these non-CSH sites and are not responsible for the content on these sites or platforms or the privacy policies and practices employed by these sites and platforms. We recommend that you review the policies and practices of the sites you visit.

E. Social Networking

Some of our Services may allow you to participate in blog discussions, message boards, chat rooms, and other forms of social networking and to post reviews. Please be aware that these forums are accessible to others. We urge you to not submit any personal information to these forums because any information you post can be read, collected, shared, or otherwise used by anyone who accesses the forum. CSH is not responsible for the information you choose to submit in these forums. If you post content to information sharing forums, you are doing so by choice and you are providing consent to the disclosure of this information.

If you are a resident of California, you have additional rights to access and control your personal information pursuant to the California Consumer Privacy Act (the “CCPA”).

A. Personal Information We Collect and Share

We collect, use, disclose and sell a range of personal information from our users, of the type and for the purposes as set forth in more detail above. As permitted by applicable law, we do not treat “de-identified,” “anonymous,” or “aggregate” information as personal information, and such information may not be covered by your rights under the CCPA. If you direct us to share your personal information, it is not considered a sale under the CCPA. Disclosures of your personal information amongst CSH entities are also not considered a sale of your personal information.

B. CCPA Privacy Rights

We provide California consumers the privacy rights required under the CCPA. Any request you submit to us to exercise these rights is subject to an identification process. We will not fulfill your CCPA request unless you have provided sufficient information for us to reasonably verify that you are the consumer about whom we have collected personal information and to which your request applies. You may make your request through an authorized personal agent submitting a request on your behalf with a copy of a lawful power of attorney or written signed authorization from you and proof of your identity.

To make a request according to your rights to know about or to request deletion of your personal information (as further set forth below), please submit a request by emailing us at info@thecollegemonk.com with the subject line “CCPA Request” and respond to any follow-up inquiries we may make. We will take steps to verify your identity before complying with the request to protect your privacy and security using your email address. We will send you an email to the email address that you provide to us, and you must take action as described in the email to enable us to verify that the person who made the request controls and has access to the email address associated with the request. We will check our systems for the email address and any information associated with the email address. If you provide us with an email address that has not been used to interact with us on CSH websites, we will not be able to verify your identity or fulfill your request. We reserve the right to modify our verification procedures and may request additional information from you as needed or as required by applicable law.

Some information we maintain about our consumers is not sufficiently associated with enough personal information for us to be able to verify that it is a particular consumer’s personal information (e.g., clickstream data tied only to a pseudonymous browser ID). As required by the CCPA we do not include that personal information in response to verified CCPA requests. If we cannot comply with a request, we will explain the reasons in our response. We will use personal information provided in a verified CCPA request only to verify your identity or authority to make the request and to track and document request responses, unless you also gave it to us for another purpose.

We will make commercially reasonable efforts to identify personal information that we collect, process, store, disclose and otherwise use and to respond to your verified CCPA request. We will typically not charge a fee to fully respond to your requests; provided, however, that we may charge a reasonable fee, or refuse to act upon a request, if your request is excessive, repetitive, unfounded or overly burdensome. If we determine that the request warrants a fee, or that we may refuse it, we will give you notice explaining why we made that decision. You will be provided a cost estimate and the opportunity to accept such fees before we will charge you for responding to your request. Consistent with the CCPA and our interest in the security of your personal information, we will not deliver to you your social security number, an account password, or security questions or answers in response to a CCPA request; however, you may be able to access some of this information yourself through your account if you have an active account with us.

C. Your California Consumer privacy rights are as follows:

1. Right to Know

You have the right to send us a request, no more than twice in a twelve-month period, for any of the following for the period that is twelve months prior to the request date:

• The categories of personal information we have collected about you
• The categories of sources from which we collected your personal information
• The business or commercial purposes for our collecting or selling your personal information
• The categories of third parties to whom we have shared your personal information
• The specific pieces of personal information we have collected about you
• A list of the categories of personal information disclosed for a business purpose in the prior 12 months, or that no disclosure occurred
• A list of the categories of personal information sold about you in the prior 12 months, or that no sale occurred

If we sold your personal information, we will explain:

• The categories of your personal information we have sold
• The categories of third parties to which we sold personal information, by categories of personal information sold for each third-party

You have the right to make or obtain a transportable copy, no more than twice in a twelve-month period, of your personal information that we have collected in the period that is 12 months prior to the request date and are maintaining.

Please note that personal information is retained by us for various time periods and we do not have any obligation to retain it longer than we need it just to be able to respond to your requests, so we may not be able to fully respond to what might be relevant going back 12 months prior to the request.

2. Right to Deletion

Except to the extent we have a basis for retention under CCPA, you may request that we delete your personal information that we have collected directly from you and are maintaining. Our retention rights include, without limitation: (a) to complete transactions and services you have requested or that are reasonably anticipated, (b) for security purposes, (c) for legitimate internal business purposes, including maintaining business records, (d) to comply with law, (e) to exercise or defend legal claims, and (f) to cooperate with law enforcement. Note also that we are not required to delete your personal information that we did not collect directly from you.

3. Do Not Sell

You have the right to opt out of the sale of your personal information by emailing us at info@thecollegemonk.com with your specific request to opt out of the sale of your personal information maintained by CSH and/or opt out of the sale of your personal information for purposes of internet-based advertising.

Please note that opting out of the sale of your personal information for purposes of interest-based advertising does not mean that you will stop seeing ads on our websites or that you will no longer see interest-based ads. You may still see ads on our websites that are tailored to your interests based on personal information that: (i) is not sold by us, (ii) was sold to other digital advertising companies ninety (90) days or more before you opted out of sales of your personal information for purposes of interest-based advertising, or (iii) is sold by sources from which you have not opted out.

We do not knowingly sell the personal information of California consumers we know are under 16 unless we receive an opt-in from the consumer who is at least 13 but under 16, or from the parent or guardian of a California consumer younger than 13. Consumers who opt-in to personal information sales may opt-out at any time. If you think we may have unknowingly collected personal information for sale of yourself or of your child under the age of 13, or if you are at least 13 but under 16, exercising the opt-out will stop our selling of the personal information. We may sell personal information of consumers who are 16 or older that we collected before they turned 16.

4. Legal Exceptions

Notwithstanding anything to the contrary, we may collect, use and disclose your personal information as required or permitted by applicable law, and this may override your CCPA rights. In addition, we need not honor any of your requests to the extent that doing so would infringe upon our or any other party’s rights or conflict with applicable law.

D. Additional California Notices

Separate from your CCPA rights set forth above, you have the following additional rights regarding disclosure of your information to third parties for their own direct marketing purposes:

We may from time to time elect to share certain “personal information” (as defined by California’s Shine the Light law) about you with third parties for those third parties’ direct marketing purposes. California Civil Code § 1798.83 permits California residents who have supplied personal information (as defined in such statute), to us to, under certain circumstances, request and obtain certain information regarding our disclosure, if any, of personal information to third parties for their direct marketing purposes. If this applies, you may obtain the categories of personal information shared and the names and addresses of all third parties that received personal information for their direct marketing purposes during the immediately prior calendar year (e.g. requests made in 2020 will receive information about 2019 sharing activities). To make such a request, please email us at info@thecollegemonk.com with the subject line “Shine the Light California Privacy Rights Request” and include sufficient information for us to determine if this statute applies to you, including a statement that you are a California resident. Please note that we are only required to respond to one request per customer each year.

As these rights and your CCPA rights are not the same and exist under different laws, you must exercise your rights under each law separately.

If you are a resident of Nevada, you have the right to submit a verified request that we not sell your personal information to third parties, as set forth in Nevada Revised Statutes 603A. You may exercise these rights by sending an email to info@thecollegemonk.com with the subject line “Nevada Do Not Sell Request”. Nevada law gives us 60 days to respond to your request, plus an additional 30 days in certain instances. We may request additional information in order to verify your identity and locate your personal information in our possession associated with that email address.