Goldfinch Metals, LLC US Privacy Notice

1. Your Consent

This Privacy Notice sets forth the Platform’s current policies and practices with respect to nonpublic Personal Data of the users of the Platform. By using the Platform or our Services, you agree with the terms of this Privacy Notice. Whenever you submit information to us via the Platform, as well as over the phone, you consent to the collection, use, and disclosure of that information in accordance with this Privacy Notice.

We put the needs of our customers first. The information gathered from you through the Platform includes Personal Data such as your name, phone number(s), and email address, is stored in our in-house database and is used to contact you in response to your inquiries. Any information shared electronically with us is subject to this Privacy Notice.

PLEASE READ THE FOLLOWING PRIVACY NOTICE CAREFULLY BEFORE USING THE PLATFORM OR OUR SERVICES. BY USING THE PLATFORM OR OUR SERVICES, YOU SIGNIFY YOUR ASSENT TO THIS PRIVACY NOTICE. IF YOU DO NOT ASSENT TO THIS PRIVACY NOTICE, PLEASE DO NOT USE THE PLATFORM OR SERVICES.

2. Scope of this Privacy Notice

This Privacy Notice only applies to you if you are resident of the United States. If you are not a resident of the United States, please review the applicable privacy notice for the jurisdiction where you reside.

For the purposes of this Privacy Notice, “Personal Data” means information that is linked or reasonably linkable to a particular individual or household. However, the following categories of information are not Personal Data:

• Publicly available information;
• Deidentified or aggregated data; or
• Information otherwise excluded under the applicable state and federal privacy laws (US Privacy Laws).

This Privacy Notice provides the following information to US residents:

• Categories of Personal Data we collect;
• Purposes for which we use Personal Data;
• Categories of Personal Data we disclose to third parties;
• Categories of third parties to which we disclose Personal Data; and
• How US residents can exercise their rights under US Privacy Laws.

3. Categories of Personal Data

We collect Personal Data from you through our Platform and over the phone in order to provide you with more information about our services and to manage our relationship with you. You will voluntarily provide most of this information directly to us. We also use cookies and similar tracking technologies, including pixels, tags, SDKs, web beacons, local storage technologies, and mobile advertising identifiers, in the Platform and in certain marketing communications, which collect your IP address and certain other information from you when you use our Platform. We also collect information using analytics tools, including when you access or use the Platform.

Our Platform, products and Services are all directed to and intended for people who are at least 18 years old or older. We do not knowingly collect Personal Data from anyone under 13 years of age. We do not draw inferences from your Personal Data to build your consumer profile.

We obtain the categories of Personal Data listed below from the following categories of sources:

• Directly from you. For example, when you provide us with some information through the Platform or call us, we collect certain information from you, including your name, billing address, payment information (including credit card numbers, email address, and phone number.)
• Indirectly from you. When you access or use the Platform, we automatically collect certain information about your device, including information about your device, operating system, application version, device identifiers, browser type (where applicable), IP address, time zone, and information regarding your interactions with the Platform, time zone, and some of the cookies that are installed on your device. Additionally, as you use the Platform, we may collect information about your use of the Platform, including Services that you view and information about how you interact with the Platform.

We collect this automatically collected information ("Usage Information") using the following technologies:

• “Cookies and Similar Technologies" are small data files or technologies that may be stored on or accessed through your device and often include a unique identifier. These technologies help us recognize users, remember preferences, analyze usage, and improve the Platform. For more information about cookies, and how to disable cookies, visit http://www.allaboutcookies.org.
• “Log files” refers to information automatically collected when you use the Platform, including your IP address, device type, operating system, app version, device identifiers, usage information, crash reports, and the date and time of your interactions with the Platform.
• “Web beacons”, “tags”, and “pixels” and Similar Tracking Technologies are electronic tools used to collect information about how users interact with the Platform, our communications, and other digital content, including usage patterns and engagement metrics.

For more information on the automatically collected information please see Section 7 (Cookie and Similar Technology Policy).

The table below outlines the categories of Personal Data we collect about US residents and whether and how they are disclosed to third parties.

When we refer to sale or sharing in this Privacy Notice we mean exchanging Personal Data with a third party for money or anything of value. For more information please see Section 10 (Notice of Right to Opt-Out of Sale/Sharing for Targeted Advertising).

4. Categories of Sensitive Personal Data

When you create an account through the Platform or use our Services, we may collect your passport, ID card or Social Security Number. We collect this information as required by law for Anti-Money Laundering (AML) transactions to file a form 8300 with the IRS. We do not use your Sensitive Personal Data for any other purposes.

5. Use of Personal Data

We use Personal Data for the purposes described above. Consistent with applicable US Privacy Law and choices and controls that may be available to you, we may use your Personal Data to:

• Provide you with information about the products and services that you request or view. For example, by sending you marketing emails you have asked to receive;
• Communicate with you about the products and services we offer, including responding to your emails, phone calls, and other inquiries;
• Operate, understand, optimize, develop, or improve our Platform, products, services, and operations;
• Provide you with tailored content, services, advertisements and offers from our brands;
• Verifying your identity and to process your purchases and other transactions;
• Screen our orders for potential risk or fraud;
• Fulfill product purchases;
• Send notice of changes to our policies;
• Improve our customer service and product offerings;
• Conduct research and analytics related to our operations;
• Protect our legal rights and interests; and
• Comply with any obligations, laws, regulations, or rules to which we are subject, including by cooperating with regulators and other public authorities, such as by responding to any requests for information or complying with our reporting and other legal obligations.

Personal Data may also be used or disclosed as otherwise permitted or required by applicable law.

6. Disclosing Personal Data

We share Personal Data with the following categories of third parties:

• Service Providers: We use service providers to operate the Platform, provide Services, or assist with marketing/research.
• Processors: We use processors to securely handle Personal Data on our behalf and only on our instructions. These companies may not use your Personal Data for their own purposes.
• Our Analytics and Advertising Partners: We use analytics services to collect and process certain data and to provide you with relevant advertising. These services may also collect information about your use of certain other websites, apps, and online resources.
• Data Cooperative: We participate in a Co-op with other companies for the purpose of improving our products and services, enhancing fraud detection, and providing more relevant content and offers to our users. As part of this Co-op, we may share for valuable consideration certain information about you—such as name and contact details—to a shared database. All shared data is processed in accordance with applicable US Privacy Laws.

See the table above for more details about how different categories of Personal Data are disclosed.

We may share your Personal Data with trusted third parties who assist us in operating our Platform, conducting our business, or providing the Services to you on our behalf, such as sending you marketing emails. In sharing Personal Data with these third-party vendors, we require that they keep your Personal Data confidential and are prohibited from using your Personal Data for purposes other than those related to the services for which we are using them.

Otherwise, we may share your Personal Data to enforce our Transaction Agreement & Terms and Conditions, to protect the rights, property, and safety of ourselves and others, to comply with legal process, or in other cases if we believe in good faith that disclosure is required by law. Examples include responding to a subpoena or similar legal process, protecting against fraud, and cooperating with law enforcement or regulatory authorities.

We will not share your opt-in to an SMS campaign with any third party for purposes unrelated to providing you with the services. We may share your Personal Data, including your SMS opt-in or consent status, with third parties that help us provide our messaging services, including but not limited to platform providers, phone companies, and any other vendors who assist us in the delivery of text messages.

7. Cookie and Similar Technology Policy

The Platform uses cookies, software development kits ("SDKs"), pixels, tags, web beacons, local storage technologies, mobile advertising identifiers, and other similar technologies (collectively, "Tracking Technologies"). Some Tracking Technologies operate through the website, while others operate through the mobile application. We use Tracking Technologies in the Platform and in certain communications to:

• Make sure our Platform functions as it should;
• Recognize you when you access the Platform;
• Understand how you use the Platform;
• Present you with customized options relating to your interests, based on your previous use of the Platform;
• Aggregate data about Platform usage and interactions so that we can offer better Platform experiences and tools in the future.
• Help keep track of items you put into your shopping cart, including when you have abandoned your cart; and
• To send cart reminder messages via SMS or push notification.

Please note that some of the Tracking Technologies in the Platform are third party Tracking Technologies (e.g. Google advertising cookies) which we do not control. In that instance, please view the relevant third party’s website for details of their privacy policy.

Use of certain Tracking Technologies, may result in the disclosure of information regarding your use of the Platform, including content viewing and engagement activity, to the providers of those technologies.

Where required by applicable law, we will obtain your consent before deploying certain non-essential Tracking Technologies. Information collected through Tracking Technologies may be disclosed to the providers of those technologies and other third parties as described in this Privacy Notice.

Please note that your mobile device's operating system and certain in-app settings may provide options to manage or limit the collection and use of information through Tracking Technologies, such as local storage, mobile advertising identifiers, and analytics tools. You may also be able to control certain tracking and advertising preferences through your device settings. Please be aware that disabling or restricting these technologies may affect the functionality and performance of certain features of the mobile application.

For more information about cookies and how to disable and/or delete them, please visit www.allaboutcookies.org.

You may be able to manage your preferences regarding certain non-essential Tracking Technologies through the mobile app settings or your device settings. You can also opt-out of non-essential cookies through our website by managing your cookie preferences on the website. Please note that technologies necessary for the operation of the Platform cannot be disabled.

• SDKs (Software Development Kits). SDKs are tools provided by third parties that may be integrated into the mobile application to facilitate functionality, analytics, advertising, security, fraud prevention, and other services.
• Mobile Advertising Identifiers. Mobile devices may assign advertising identifiers, such as Apple's Identifier for Advertisers (IDFA) or Google's Android Advertising ID (AAID), which may be used to recognize devices, measure advertising effectiveness, and support analytics and marketing activities.
• Pixels, Tags, and Web Beacons. These technologies may be incorporated into the Platform or our communications to help us understand how users interact with the Platform, measure engagement, and evaluate the effectiveness of our services and marketing efforts. Our website may use analytics and advertising technologies, including Google Analytics, Meta Pixel, Google Ads, LinkedIn Insight Tag, and similar technologies.
• Local Storage Technologies. The Platform may use local storage, cached data, browser storage, and similar technologies to store information on your device, remember your preferences, improve functionality, and enhance your user experience.
• Device and Recognition Technologies. We and our service providers may use device identifiers, statistical modeling, and similar technologies to recognize devices and users, improve security, prevent fraud, analyze usage patterns, and provide a more personalized experience.

We may use Tracking Technologies for a variety of purposes, including: (i) to allow you to use and access the Platform including for the prevention of fraudulent activity and improved security functionality; (ii) to assess the performance of the Platform, including as part of our analytic practices or otherwise to improve the content, products or services offered through the Platform; (iii) to offer you enhanced functionality when accessing the Platform, including identifying you when you sign in, keeping track of your specified preferences and/or to track your activities; and (iv) to deliver content relevant to your interests based on how you interact with our content.

Global Privacy Control. Global Privacy Control ("GPC") is a browser-based preference signal that allows users to communicate certain privacy choices automatically to websites. Where required by applicable law, we will recognize and process valid GPC signals received through our website as a request to opt out of applicable sales, sharing, or targeted advertising activities. GPC functionality does not generally apply within native mobile applications. Users of the mobile application may manage certain privacy and advertising preferences through available application or device settings.

8. Email Marketing

Opting Out of Marketing Communications. You can opt-out of receiving marketing communications from us by contacting us and providing the names/email address that you would like removed from our marketing databases and added to our “Do Not Contact list”.

You can also stop receiving promotional e-mails at any time by clicking on the “unsubscribe” link at the bottom of any promotional e-mail that you receive from us.

9. Exercising Your Personal Data Rights

You have certain rights in relation to your Personal Data. Under certain circumstances, and subject to legal conditions, you may have the following rights:

• Right to Know. You may request that we disclose to you the categories of Personal Data we collect about you, the categories of sources from which we collected that Personal Data, the categories of Personal Data we sold or disclosed, our business or commercial purposes for collecting and selling such Personal Data, the categories of third parties with whom we shared such personal information, and the specific pieces of Personal Data we collected about you over the past 12 months.
• Right to Access. You have the right to confirm whether or not we are processing your Personal Data and access such personal information. Please note that this right might be subject to certain limitations.
• Right to Data Portability. You can request to obtain a portable copy of your Personal Data.
• Right to Request Deletion of Your Personal Data. You may request we delete some or all of the Personal Data we maintain about you, subject to certain exceptions.
• Opt-out of “Sale”/ “Sharing” of Your Personal Data. For purposes of this Privacy Notice, “sell” means the sharing of your Personal Data to an outside party for monetary or other valuable consideration, subject to certain exceptions in applicable privacy laws. We provide a path for you to exercise your right to opt-out. Please see Section 10 (Right to Opt-Out).
• Right to opt out of targeted advertising. You have the right to opt out of the use of your Personal Data for targeted or cross-context behavioral advertising.
• Right to Correct Inaccurate Personal Data. Taking into account the nature of the Personal Data and the purposes of the processing, this right provides an individual with the ability to seek to correct or update Personal Data that individual considers that we hold about that individual.
• Right to Limit Use of Sensitive Personal Data. This right is limited to Sensitive Personal Data used for the purpose of inferring characteristics about an individual. We do not collect or use Sensitive Personal Data for the purpose of inferring characteristics about an individual, therefore we do not offer a path to exercise this right.
• Right of Non-Discrimination and Non Retaliation. You have the right not to be subject to any discrimination or subject to retaliation for exercising any of these rights. We will not deny goods or services, charge you a different price, or provide a different level or quality of goods or services just because you exercised your rights.
• Shine the Light. California Civil Code Section 1798.83, also known as the "Shine the Light" law, permits California residents to annually request, free of charge, information about the Personal Data (if any) disclosed to third parties for direct marketing purposes in the preceding calendar year. To make a request, please contact us.
• Right against automated decision making. This is a prohibition against making decisions about individuals based solely on automated processes without human input. We do not engage in automated decision making.
• Right to opt out of profiling. You have the right to opt out of profiling in furtherance of decision that produce legal or similarly significant effects concerning you, where applicable.
• Right to appeal. Where we decline to take action regarding your request to exercise any privacy right, we must allow you to appeal the decision and provide instructions on how you may request such an appeal.
• Right to withdraw consent. You have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on your consent before its withdrawal.
• Right to confirm processing. You have the right to request confirmation as to whether we are processing your Personal Data.
• Right to opt out of the processing of your Personal Data for the purposes of targeted advertising and for profiling in furtherance of decisions, including, solely automated decisions that produce legal or similarly significant effects.

When We Do Not Act on a Request – Appeal Process. In some cases, we may not act on your requests (e.g., if we cannot do so under other laws that apply). When this is the case, we will explain our reasons for not providing you with the information or taking the action (e.g., correcting data) you requested. Additionally, you have the right to appeal our decision.

To exercise any of these rights, please contact us , call our toll free number at ________________________, or fill out the form available through the Platform.

Please put “Request Regarding Personal Data” in the Subject line of the email or at the beginning of your message.

We may deny certain requests, or fulfill a request only in part, based on our legal rights and obligations.

Your request must:

• Provide sufficient information for us to reasonably verify that you are the person about whom we collected Personal Data or an authorized representative of such person; and
• Describe your request with sufficient detail for us to properly understand, evaluate, and respond to it.

To protect your privacy, we may need to authenticate your identity before we respond to your rights request. We will verify identity by confirming other relevant personal information. We may ask you for additional information as part of this process, including the last 4 digits of your telephone number. If you do not complete the verification process, we may be unable to process your request. Any information you provide to authenticate your identity will only be used to process your rights request and not for any other purpose. Please be aware that we do not accept or process rights requests submitted through other means.

We will respond to your rights request within 45 days, though in certain cases we may inform you that we will need up to another 45 days to act on your request. If we suspect fraudulent or malicious activity on or from your account, we will delay taking action on your request until we can appropriately verify your identity and the request as authentic. Also note that each of the rights are subject to certain exceptions.

We reserve the right to decline to process, or charge a reasonable fee for, requests from a US resident that are manifestly unfounded, excessive, or repetitive.

10. Right to Opt-Out

US Privacy Laws give US residents the right to direct a business that “sells” or “shares” their Personal Data to stop selling and/or sharing their Personal Data at any time. As described in Section 6 we may share your information with third-parties, including for valuable consideration and for the purposes of “cross-context behavioral advertising,” also referred to as “targeted advertising.” An example of targeted advertising is displaying advertisements to a person where the advertisement is selected based on Personal Data obtained from their activities over time and across non-affiliated websites or applications to predict their preferences or interests. In certain situations and as detailed above, we share for targeted advertising Personal Data with third parties. You (or your authorized representative) may submit a request to us by visiting the following Internet Web page link:

"Do Not Sell or Share My Personal Information"

Once you make an opt-out request, we will wait at least twelve (12) months before asking you to reauthorize personal information sales. However, you may change your mind and opt back in to personal information sales at any time by following the same link.

11. Notice of Right to Limit the Use of Sensitive Personal Information

You have the right to limit some uses of Sensitive Personal Data. In particular, you may direct companies not to use Sensitive Personal Data except as necessary to provide goods or services you have requested or other exempt purposes.

12. Testimonials

We may display personal testimonials in the Platform in addition to other endorsements. With your consent, we may post your testimonial along with your name and city/state of residence. If you wish to update or delete your testimonial, you can contact us.

13. Children’s Data

We do not knowingly collect or use the Personal Data of children under 13. If you believe that we have collected the Personal Data of a child under 13, please contact us.

14. Authorized Agent Requests

You may designate an authorized agent to make a rights request on your behalf. Your authorized agent may submit such a request by following the same method described above in the section titled Exercising Your Personal Data Rights. We may require verification of your authorized agent’s authority in addition to the information we require for verification of your identity. If you wish to submit a verifiable consumer request on behalf of another individual, we will also need sufficient information to verify that the individual is the person about whom we collected Personal Data and that you are authorized to submit the request on their behalf. For requests to know, access, correct or delete Personal Data, we may ask you to provide sufficient evidence to show that you have provided the authorized agent signed permission to act on your behalf, verified your own identity directly with us pursuant to the instructions set forth in this Privacy Notice, and directly confirmed with us that you provided the authorized agent permission to submit the request on your behalf.

15. Changes to this Privacy Notice

This Privacy Notice describes the types of information we currently collect, and the ways we use and protect that information. From time to time, we may collect different types of information and use that information in different ways. In these cases, we may edit this policy to explain the new practices. Because protecting your privacy is very important to us, we do not expect major changes in policy. However, if we do make significant changes in our practices, we may provide notice through the Platform, including within the mobile application, on the website, by email, or through other appropriate communications channels so that you will know to review the revised policy. For changes to how we collect, use, process, or share Personal Data, we’ll provide opportunity to consent or opt out as required by applicable law, and such changes will not apply retroactively without your consent.

16. Contact Us

If you have any questions or concerns regarding this Privacy Notice, contact us or call our toll free number at ______________________