Privacy and Security March 2024 PLEASE READ THIS PRIVACY POLICY CAREFULLY BEFORE USING THIS SITE.

1. Overview

This Privacy Policy describes the policies of Bolt Solutions Inc. and its affiliates, including but not limited to bolt Agency and bolt Access (“bolt,” “we,” “us,” “our”), regarding the collection, use, disclosure, and protection of information that you provide on this website (the “Site”).

bolt understands how important the privacy of personal information is to the users of our website (“Users”). This Privacy Policy will tell you what information we collect about you and about your use of the Site and its services. It will explain the choices you have about how your personally identifiable information is used and how we protect that information. We urge you to read this Privacy Policy carefully. Please note that this is a master privacy policy and some of its provisions only apply to individuals in certain jurisdictions.

Important Note: Nothing in this Privacy Policy is intended to limit in any way your statutory rights, including your rights to a remedy or means of enforcement.

We reserve the right, at our discretion, to change this Privacy Policy at any time, which change will be effective ten (10) days following the modification. Your continued use of our Site following the posting of changes to these terms means you accept these changes. If you do not agree to this Privacy Policy, as modified from time to time, please do not visit or use the Site.

2. Information bolt Collects and How bolt Collects It

For the purpose of this Privacy Policy:

"Personal Information" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, including but not limited to postal address, telephone number, email address, social security number, driver’s license number, Internet Protocol address, employment-related information, and the list of insurance companies with which you will be communicating via the Site.

"Deidentified Information" means information that cannot reasonably be used to infer information about, or otherwise be linked to, a particular consumer, such as aggregated information about the use of our Site and its services.

If you chose to register with the Site for certain services (such as insurance products and services), we require you to submit information on your behalf or on behalf of any third party that may include Personal Information. You represent and warrant that you have the necessary rights and authorizations to submit, use, and authorize bolt to use such third party Personal Information. bolt may also collect through its services electronic data or information that you submitted to an insurer and that you receive from an insurer and/or any third party (“Third-Party Data”). bolt logs information about your transactions performed via the Site. This information includes but is not limited to the following events:

• Logons and logoffs;
• Transmissions of quotes and policies to insurance companies;
• Communication errors; and
• Business rule validation failures.

The Site only collects Personal Information and Third-Party Data as described in this Privacy Policy. You are responsible for ensuring the accuracy of the Personal Information, Deidentified Information, and Third-Party Data you submit via the Site. Inaccurate information will affect the information you receive when using the Site and tools, as well as bolt’s and the insurance companies’ ability to contact you as contemplated in this Privacy Policy. For example, your email address should be kept current because that is how we communicate with you.

Finally, please note that some Personal Information will be used for detecting, taking steps to prevent, and prosecuting fraud or other illegal activity; to identify and repair errors; to conduct audits; and for security purposes. Personal Information may also be used to comply with applicable laws, cooperating with investigations performed by relevant authorities, for law enforcement purposes, and/or to exercise or defend legal claims. In certain cases, we may deidentify Personal Information. We may use Deidentified Information and/or disclose it to third parties for any reason permitted by applicable law (for example, to improve our services and enhance your experience with them).

3. Cookies and Other Tracking Technologies

Some of our Site pages utilize cookies and other tracking technologies. A “cookie” is a small text file that may be used, for example, to collect information about Site activity. Some cookies and other technologies may serve to recall Personal Information previously provided by a User. Most browsers allow you to control cookies, including whether or not to accept them and providing the ability to remove them. You may set most browsers to notify you if you receive a cookie, or you may choose to block cookies with your browser. Browser capabilities vary by browser.

We collect and analyze traffic on the Site by keeping track of the IP addresses of our visitors. IP addresses are unique numeric identifiers that are assigned to each computer browser accessing the Internet.

We work with (or may in the future work with) network analytics service providers and other vendors to provide us with information regarding traffic on the Site, including pages viewed and actions taken when visiting the Site, to provide us with information regarding the use of the Site. Our service providers may collect certain information about your visits to and activity on the Site, as well as other websites or services. They may also set and access their own tracking technologies on your device (including cookies and web beacons) and may use that information to show you targeted advertisements. Some of these third parties may collect Personal Information when you visit the Site or other online websites and services. We may also share certain Deidentified Information with these third parties, including hashed information, in connection with the services they provide to us. These providers may include:

• Cloudflare services: Refer to the additional privacy policy details on Cloudflare’s website (https://www.cloudflare.com/privacypolicy/). Cloudflare collects IP addresses, system configuration information, and other information.
• Netlify services: Refer to the additional privacy policy details on Netlify's website (https://www.netlify.com/privacy/). Netlify collects IP addresses, system configuration information, and other information.
• Google Analytics: The Site uses Google Analytics to collect information about use of the Site. Google Analytics collects information such as how often Users visit the Site, what pages they visit, and what other websites they used prior to visiting the Site. We use the information we receive from Google Analytics to maintain and improve the Site and our products. We do not combine the information collected through the use of Google Analytics with other Personal Information we collect. Google’s ability to use and share information collected by Google Analytics about your visits to the Site is restricted by the Google Analytics Terms of Service and the Google Privacy Policy, which can be found on Google’s website (http://www.google.com/analytics/terms/us.html/). You may also learn more about how Google collects and processes data specifically in connection with Google Analytics on their website (https://policies.google.com/technologies/partner-sites). To prevent your data from being used by Google Analytics, you may download and install the Google Analytics Opt-Out Browser Add-On, which is available on their website (https://tools.google.com/dlpage/gaoptout/).

4. bolt Disclosure of Your Information

bolt will not disclose Personal Information or any Third-Party Data to anyone outside bolt, except as follows:

• De-identified Information. We may use Deidentified Information to improve our services and enhance your experience with the Site and our services. bolt may disclose Deidentified Information to advertisers, content and service providers, and other affiliated and unaffiliated companies.

• Insurance Companies. An insurance company and/or independent insurance agency appointed by an insurance company will use Personal Information and Third-Party Data in combination with other information you provide about your insurance needs for the purpose of obtaining a quote. Ratings criteria vary between participating providers, with each insurance company placing emphasis on particular items of information that you provide.
  Please Note: Third-party insurance companies have their own privacy policies, and bolt is not responsible for these policies nor the products and/or services offered by third-party providers. Please make sure to review the privacy policy of any third-party insurance company from whom you may purchase a policy.

• Financial, Credit, and Government Agencies. To provide you with our services, and only where permitted by law, we may share Personal Information you submit with: (1) certified credit bureaus to verify information regarding your credit report; and (2) government agencies to verify your previous claims history and other relevant information. Your Personal Information is maintained by credit agencies and disclosed by them to others as permitted by law.

• Service Providers. Third-party service providers may be retained or utilized by us and may have access to our Users’ Personal Information for the purpose of processing such information on our behalf. We require that these parties agree to process such information in compliance with our Privacy Policy, and we use reasonably commercial efforts to limit their use of such information and to use other appropriate confidentiality and security measures.

• Business Partners and Affiliates. We may provide Personal Information to business partners with whom we jointly offer products and/or services. We may also share Personal Information with our affiliated companies.

• Advertising Partners. Though our services, we may allow third-party advertising partners to set technologies and other tracking tools to collect information regarding your activities and your device (e.g., your IP address, mobile identifiers, pages visited, location, time of day). We may also combine and share such information and other information (such as demographic information and past purchase history) with third-party advertising partners. These advertising partners may use this information (and similar information collected from other websites) for purposes of delivering targeted advertisements to you when you visit third-party websites within their networks. This practice is commonly referred to as “interest-based advertising” or “online behavioral advertising.” We may allow access to other data collected by the services to share information that may be useful, relevant, valuable, or otherwise of interest to you. If you prefer not to share your Personal Information with third-party advertising partners, you may opt out by following the directions in Section 10 of this Privacy Policy

• Others. We may disclose Personal Information you submit (including Third-Party Data) if we have a good faith belief that disclosure of such information is helpful or reasonably necessary to: (1) comply with any applicable law, regulation, legal process, or governmental request; (2) enforce our Terms and Conditions, including investigations of potential violations thereof; (3) detect, prevent, or otherwise address fraud, security, or technical issues; (4) protect against harm to the rights, property, or safety of bolt, its Users, yourself, or to the public; (5) investigate reports of visitors providing false or misleading information; (6) prevent or investigate reports of credit card fraud or unauthorized use; or (7) protect against misuse or unauthorized use of the Site and/or our services.

5. In the Event of Merger, Sale, or Bankruptcy

In the event that bolt is acquired by or merged with a third-party entity, we reserve the right to transfer or assign to such third-party entity the information we have collected from Users as part of such merger, acquisition, sale, or other change of control. In the event of bankruptcy, insolvency, reorganization, receivership, or assignment for the benefit of creditors, or the application of laws or equitable principles affecting creditors’ rights generally, we may not be able to control how your Personal Information and Third-Party Data is treated, transferred, or used.

6. Security

We maintain physical, electronic, and procedural safeguards that are designed to control and protect Personal Information from unauthorized access. We monitor our systems to prevent unauthorized attempts at intrusion. We review our policies and practices, monitor our computer networks, and test the strength of our security in order to help us ensure the safety of customer information. We adhere to accepted industry privacy standards and comply with our own privacy practices.

We have implemented technical, organizational, and security measures designed to protect your data. However, please note that we cannot guarantee that the information will not be compromised as a result of unauthorized penetration to our servers. As the security of information depends in part on the security of the computer, device, or network that you use to communicate with bolt, please make sure to take appropriate measures to protect this information.

If you have questions about the security of the Site, you may contact us via email at privacy@boltinc.com.

7. Our Employees

We restrict access to nonpublic Personal Information about you to those employees whom we have determined need to know that information to provide products or services to you.

8. Links to Other Sites and Collection of Information by Third Parties

The Site contains links to other sites. Once you enter another website (whether through an advertisement, service, or content link), be aware that bolt is NOT responsible for the privacy practices of such other sites. We encourage you to look for and review the privacy statements of each and every website that you visit through a link or advertisement on the Site.

9. Who Should Use the Site

The Site is for insurance products and services and is not intended for children. We offer insurance products and services and thus do not market any products or services to children under the age of 13 or knowingly collect any information from children under the age of 13. If we become aware that information is or has been submitted by or collected from a child under the age of 13, we will delete this information.

10. Your Choices

You have certain choices about your Personal Information. Where you have consented to the processing of your Personal Information, you may withdraw that consent at any time and prevent further processing by contacting us as described below. Even if you opt out, we may still collect and use non-Personal Information regarding your activities on our services and for other legal purposes as described above.

“Do Not Track.” Do Not Track (“DNT”) is a privacy preference that Users can set in certain web browsers. Please not that we do not respond to or honor DNT signals or similar mechanisms transmitted by web browsers.

Marketing Emails – opt-out: You may choose not to receive marketing email of this type by sending a single email with the subject “BLOCK” to privacy@boltinc.com. Please note that the email must come from the email account you wish to block from receiving marketing emails.

11. Your Privacy Rights

In accordance with applicable law, you may have the right to request:

• Access and/or an electronic copy of your Personal Information;

• Correction of or change to your Personal Information;

You may access the quote information that you provided and update it at any point during the interview by navigating to previous pages and making the necessary changes. Upon completing the interview, but as long as you have not yet purchased a policy, you may revise information you provided during the interview by going to the relevant data entry screen through the top progress bar or by using the “BACK” button. After you have revised the information, proceed forward to get a revised quote reflecting the changes you have made.

• Deletion of your Personal Information; and/or

• Restriction of or objection to processing your Personal Information, including the right to opt in or opt out of sale of your Personal Information to third parties, if applicable, where such requests are permitted by law.

If you would like to exercise any of these rights, you may contact us by email at privacy@boltinc.com.

While we cannot guarantee privacy perfection, we will address any issue to the best of our ability as soon as possible.

We will process such requests in accordance with applicable laws. To protect your privacy, we will take steps to verify your identity before fulfilling your request.

12. CCPA/CPRA Notice to California Residents

Pursuant to the California Consumer Privacy Act (“CCPA”), California Privacy Rights Act (“CPRA”), and other California privacy laws, we are providing the following information to visitors, users, and others who reside in the State of California (“consumers” or “you”). Any capitalized terms used but not defined in this Notice shall have the meanings ascribed to them in the CCPA and/or CPRA.

Information We Collect

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly with a particular consumer or device (“personal information”). In the preceding twelve (12) months, we have collected the following categories of persona information listed below. The data that we collect varies based on your relationship with us.

bolt obtains these categories of personal information listed above from the following categories of sources:

• Directly from you (e.g., from forms you complete or products and services you purchase);
• Indirectly from you (e.g., from observing your actions on the Site); and
• From third-party business partners (such as LexisNexis), who provide data services available in the public domain.

Use of Personal Information

We may use or disclose the personal information we collect for one or more of the following business purposes:

• To fulfill or meet the reason for which the information is provided;
• To address regulatory and legal requirements;
• To provide you with information regarding our products and services;
• To provide you with support respond to your inquiries;
• To provide you with email alerts and other notices or communications regarding our products or services;
• To carry out our obligations and enforce our rights arising from any contracts entered between you and us, such as for billing and collections;
• To improve our website and your customer experience on the website;
• To respond to law enforcement requests and as required by applicable law, court order, or government regulations; or
• As described to you when collecting your personal information or as otherwise set forth in the CCPA and CPRA.

Personal Information Does Not Include

• Publicly available information that is lawfully made available from government records or from public sources, including any information voluntarily published on the Internet;
• Deidentified or aggregated consumer information; and
• Information excluded from the CCPA or CPRA’s scope, such as:
  • Health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPPA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data; and
  • Personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FCRA), the Gramm-Leach-Bliley Act (GLBA), the California Financial Information Privacy Act (FIPA), and the Driver’s Privacy Protection Act of 1994.

Disclosing Personal Information

We may disclose your personal information to a service provider or contractor for a business purpose. The service providers and contractors that receive your personal information from us are obligated to keep the information confidential and to implement appropriate safeguards to protect your personal information.

In the preceding twelve (12) months, we have disclosed the following categories of information (corresponding with the table above) for a business purpose: Category A, Category B, Category C, Category D, Category F, and Category G.

We disclose your personal information for business purposes to the following categories of third parties: our clients, our service providers, and third parties to whom you or your agents authorize us to disclose your personal information in connection with services we provide to you.

In the preceding twelve (12) months, we have not sold any of your personal information.

Your Rights and Choices

The CCPA and CPRA provide consumers that are California residents with specific rights regarding their personal information. This section describes your CCPA and CPRA rights and explains how to exercise those rights.

Because we do not sell or share your information with third parties (other than as necessary to provide the product or service you requested), the right to limit selling or sharing your personal information and the right to limit the disclosure of sensitive personal information do not apply.

Right to Delete Personal Information

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers and contractors to delete) your personal information from our records, unless an exception applies.

We may deny your deletion request if retaining the information is necessary for us or our service providers to:

• Complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service requested by you, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
• Help to ensure security and integrity to the extent your personal information is reasonably necessary and proportionate for those purposes.
• Debug to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another consumer to exercise that consumer’s right of free speech, or exercise another right provided for by law.
• Comply with the California Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.
• Engage in public or peer-reviewed scientific, historical, or statistical research that conforms or adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the ability to complete such research, if you previously provided informed consent.
• To enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us and compatible with the context in which you provided the information.
• Comply with a legal obligation.

Right to Access Personal Information

You have the right to request that we disclose certain information to you about our collection and use of your personal information during your relationship with us, including the last twelve (12) months, if applicable. Once we receive and confirm your verifiable consumer request, we will disclose to you:

• The categories of personal information we have collected about you.
• The categories of sources from which your personal information is collected.
• The business or commercial purpose for collecting, selling, or sharing your personal information.
• The categories of third parties to whom we disclose your personal information.
• The specific pieces of personal information we collected about you (also called a “data portability request”).
• If we disclosed your personal information for a business purpose, a list identifying the personal information categories that each recipient obtained.

You may submit up to two access requests in a 12-month period.

Right to Correct Inaccurate Personal Information

You have the right to request that we correct inaccurate personal information that we may have on you. Once we receive and confirm your verifiable consumer request, we will use commercially reasonable efforts to correct the inaccurate personal information as directed by you.

Exercising Access to Personal Information, Personal Information Correction, Data Portability, and Deletion Rights

If you would like to exercise any of the rights described above, please submit a verifiable consumer request to use by either emailing us at privacy@boltinc.com.

Only you or a person registered with the California Secretary of State that you authorize to act on your behalf may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative; and
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

Response Time and Formatting

We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to ninety (90) days), we will inform you of the reason and extension period in writing. We will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a fee estimate before completing your request.

Non-Discrimination

You will not receive any discriminatory treatment by us if you decide to exercise your rights under the CCPA/CPRA. However, note that some features of our website, products, and/or services may not function without your personal information. Unless permitted by the CCPA/CPRA, we will not:

• Deny you goods or services;
• Charge you different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties;
• Provide you a different level or quality of goods or services; or
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by the CCPA/CPRA that may result in different prices, rates, or quality levels. Any legally permitted financial incentive that we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.

Employment and Job Candidate Date

Our employees, contingent workers, and prospective employees that live in California have the same rights over their employment and job application data. We do not sell or share any employee or job applicant data with anyone other than third-party service providers necessary to complete requested services (e.g., background checks).

Last updated: March 28, 2024.