Wave's Notice about the California Consumer Privacy Act (CCPA)

Your California privacy rights

The California Consumer Privacy Act of 2018, (Cal. Civ. Code §1798.100 et seq., as amended, "CCPA") gives California residents rights and control over their personal information. Wave Financial Inc. ("Wave", "We", "Our" or "Us") provides this statement to those residents ("You or "Your") in accordance with requirements under the CCPA to make certain disclosures about the collection and processing of their personal information.

Subject to certain limitations, if you are a California resident, the CCPA gives you the following rights over your information:

• For the period covering the 12 months preceding your request, you may request that we disclose to you the categories and specific pieces of information collected about you, the categories of sources from which we collected that information, and the purposes for which your information was collected.
• You may request that we delete information we collected from you.
• You have the right not to be discriminated against for exercising these rights over your information.

We do not sell your personal information

Under the CCPA, a business that sells California residents' personal information to others:

1) must give notice to California residents before selling their personal information to others,

and

2) must provide California residents the right to opt out of the sale of their personal information.

Wave does not sell personal information, including personal information of anyone under 16 years old. Thus, these notification and opt-out requirements do not apply to Wave.

What information do we collect?

As part of providing products and services to you, we may collect information, including personal information, about you or your business when you use our services.

Personal information is data that can be used to identify you individually. The information we may collect includes, but is not limited to:

• Contact information (e.g., name, phone number, address, and email address);
• Social Security number and other government identification numbers (e.g. EIN, driver’s license number);
• Date of birth;
• Financial information (e.g., income, revenue, assets, credits, deductions, expenses, and bank account information);
• Payment data (e.g., checking, debit and credit card account numbers, and payment history);
• Geo-location information;
• Website, mobile application, and email usage data (e.g., interactions with a website, application or advertisement);
• Device information (e.g., internet protocol (IP) address, device type, unique identifier, app version, operating system, network data, and phone state);
• Login information;
• Demographic information;
• Professional or employment-related information.

Who do we share your information with?

The privacy and security of your information is important to us. We do not sell or rent your information (including your Social Security number). We may disclose your information as permitted by law or with your consent to third parties with whom we have a written contract limiting the use and disclosure of your information. We may share your information to support the products and services you request, or provide you with information on products and services that may benefit you.

For example:

• Service providers. We may disclose your personal information to service providers who perform business functions on our behalf, such as hosting our website or processing payments. We may also share your personal information and a record of any transactions you conduct on our websites. Pursuant to our vendor management program, we require all service providers to have written contracts with us that require them to safeguard your information and prohibit them from selling, retaining, using or disclosing your information for any purpose other than for the specific purpose of performing the contract.
• Communications with the IRS and state tax authorities. The IRS and state tax authorities may require or request we disclose certain personal and system information in order to process or electronically file your tax return. This information may include, but is not limited to, your name, Social Security number, IP addresses, unique device identifiers, bank account numbers, and tax return preparation user activity metrics (e.g., time to complete the tax return).
• Responses to legal requests. We may disclose your information when we have a good faith belief that such disclosure is required or permitted by law pursuant to a legal request. This may occur in connection with a court order, legal process, or other judicial, administrative or investigative proceeding that produces a request for information from us. In certain situations, we may be required to disclose your information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.
• Protection of Wave and others. We may disclose your information when we believe that disclosure is necessary to protect your rights and safety, the rights and safety of others, or our rights and safety. We may disclose your information to proper federal, state, or local officials in order to—and only to the extent necessary—inform the official of activities that may constitute, or may have constituted, a violation of any criminal law, or to assist the official in investigating or prosecuting a violation of criminal law.
• Aggregate data. We may disclose aggregate information compiled using information that does not identify you individually or personally. This may include, for example, the total number of site views from a particular state or the average number of invoices sent per business.

Right to say no to the sale of your personal information

As explained above, the CCPA requires businesses that sell personal information to allow California residents the ability to opt out of the selling of their information.

Again, Wave does not sell personal information, thus these notification and opt-out requirements do not apply to Wave.

Requesting disclosure or deletion of your information

California residents may make a request pursuant to their rights under the CCPA by emailing ccpa-requests@waveapps.com or calling us toll-free at 1 (877) 596-0796.

When receiving a request, we will verify that the individual making the request is the resident to whom the personal information subject to the request pertains. Government identification may be required.