BIPA

Biometric Data Privacy and Retention Policy and Written Consent

Purpose

Progressive Finance Holdings, LLC, Prog Leasing, LLC, Approve.Me LLC, and their affiliates (collectively “Prog Leasing,” “we,” “us,” or “our”) has instituted this Biometric Data and Retention Policy to define the policy and procedures for our collection, storage, retention, disclosure, use, protection, and destruction of the biometric data you provide using Prog Leasing’s third-party service provider’s identity verification platform (the “Platform”). Biometric Data is provided to Prog Leasing in connection with our identification, fraud prevention, and related auditing practices in support of our legal and regulatory compliance obligations, policies, and procedures (the “Purpose”).

It is Prog Leasing’s policy to ensure that Biometric Data is used and handled in accordance with Biometric Laws, as defined below.

Scope

This Policy applies to any of our current or prospective customers that may be required to use the Platform to upload Biometric Data in connection with the Purpose.

Biometric Data Defined

“Biometric Laws” means all applicable international, federal, state, or local law or regulation governing the collection, possession, or use of biometric data, biometric information, or biometric identifiers, including the Illinois Biometric Privacy Act, 740 ILCS 14/1, et seq.

“Biometric Data” means any biological characteristics of a person, or information based upon such a characteristic, including characteristics such as those defined as “Biometric Identifiers” and “Biometric Information” under Biometric Laws.

“Biometric Identifier” means a retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry, or any additional characteristics defined as such under Biometric Laws.

“Biometric Information” means any information, regardless of how it is captured, converted, stored, or shared, based on an individual’s biometric identifier used to identify an individual, or any additional characteristic or measurement defined as such under Biometric Laws.

Purpose for Collection

We have instituted certain procedures pursuant to which we collect, store, use, retain, and transmit Biometric Data solely for the Purpose.

As part of our process, we use the Platform, which may require you to upload your Biometric Data via the Platform. The Platform collects Biometric Data from you for purposes of identity verification in connection with the Purpose.

Written Release

Prog Leasing requires any current or potential customer who uses the Platform to sign a written consent authorizing Prog Leasing, its third-party service providers, and their subcontractors to collect, capture, use, store, obtain, possess, disclose or re-disclose Biometric Data for activities in connection with the Purpose, or to maintain backup copies necessary for related activities in connection with the Purpose, even if such activities never occur. Prog Leasing’s third-party service providers and their third-party subcontractors can only access such data pursuant to Prog Leasing’s instructions and authorization. The form of written consent is attached hereto as Exhibit A.

Use, Disclosure, Protection, Storage, and Destruction of Biometric Data

Biometric Data will only be used for the Purpose and related activities set forth in this Policy. Prog Leasing will not sell, lease, trade, or otherwise profit from Biometric Data. Prog Leasing will not disclose, re-disclose, provide access to or otherwise disseminate any Biometric Data outside of the terms of the Policy, unless:

1. You or your legally authorized representative provides consent to such disclosure;
2. The disclosed data completes a transaction requested or authorized by you or your legally authorized representative;
3. The disclosure is required by state or federal law or municipal ordinance; or
4. The disclosure is required pursuant to a valid warrant or subpoena issued by a court of competent jurisdiction.

Prog Leasing’s third-party service providers and subcontractors have contractually represented that they do not sell, lease, trade or profit from such data, and that they use reasonable standards of care within their industries for any storage, transmittal or protection from disclosure of any such data.

Disclosure to California Residents

In addition to the notice provided by this Policy, California residents have certain rights under California law. California residents should review the Prog Leasing California Privacy Policy to learn more about their rights and Prog Leasing’s data management practices.

Retention Schedule and Guidelines for Permanently Destroying Biometric Data

Prog Leasing shall retain Biometric Data only until, and shall request that its third-party service providers and their subcontractors destroy such data when, the first of the following occurs:

1. The initial purpose for collecting or obtaining such Biometric Data has been satisfied, such as the termination of the relationship between you and Prog Leasing; or
2. Within 3 years of your last interaction with Prog Leasing.

If legal obligations require us to retain Biometric Data for longer than the above, we will destroy such data not later than the first anniversary of the date the data is no longer required to be maintained by law.

Data Storage

We will use a reasonable standard of care to store, transmit, and protect from disclosure any paper or electronic Biometric Data collected. Such storage, transmission, and protection from disclosure shall be performed in a manner that is the same as or more protective than the manner in which we store, transmit, and protect from disclosure other confidential and sensitive information, including personally identifiable information as defined by applicable laws or regulations governing privacy, data security, and breach response.

Policy Questions

If you have any questions regarding this policy or if you have questions that are not addressed in this policy, please contact by email at privacy@progleasing.com, via phone at 877-898-1970, or the Privacy Office at Prog Leasing, LLC, 256 W Data Drive, Draper, UT 84020.

Effective Date: February 9, 2024

EXHIBIT A – WRITTEN CONSENT

I agree to the collection by Progressive Finance Holdings, LLC, Prog Leasing, LLC, Approve.Me LLC, and their affiliates (collectively “Prog Leasing”) of my biometric data via Prog Leasing’s third-party service provider’s identity verification platform (the “Platform”), which it may collect as part of Prog Leasing’s identification, fraud prevention, and related auditing practices in connection with its legal and regulatory compliance obligations, policies, and procedures (the “Purpose”). I acknowledge that my biometric data that I upload to the Platform is securely stored for the duration of time identified in the Biometric Data Privacy and Retention Policy. I acknowledge and understand that Prog Leasing uses biometric data for the Purpose.

I have received a copy of Prog Leasing’s Biometric Data Privacy and Retention Policy and I understand that my biometric data will be used, retained, protected, and destroyed in accordance with that Policy.

As a condition of receiving products or services from Prog Leasing, I voluntarily consent to the collection, capture, storage, access to, use, possession, obtaining of, and/or disclosure or re-disclosure of my biometric data by Prog Leasing, its third-party service providers, and any of their subcontractors in accordance with the Biometric Data Privacy and Retention Policy. I provide this consent for purposes of ensuring compliance with privacy laws related to the collection of biometric data.

Additionally, and in consideration for the mutual promises contained in the Biometric Data Privacy and Retention Policy, I hereby release and forever discharge Prog Leasing from any and all claims, causes of action, and demands, whatsoever, known or unknown, that I may have arising under or relating to Biometric Laws.