PRIVACY NOTICE CALIFORNIA This PRIVACY NOTICE FOR CALIFORNIA RESIDENTS (“Notice”) is intended to supplement the information contained in the Privacy Policy http://www.amerisure.com/Privacy-Policy of the Amerisure Mutual Holdings Company, Inc. and its affiliates (hereinafter “Amerisure”) and applies only to those who reside in the State of California (“consumers” or “you”). Amerisure adopts this Notice in compliance with the California Consumer Privacy Act of 2018 (“CCPA”) and other California privacy laws and regulations. The terms used in this Notice, and which are also defined by the CCPA are intended to have the same meaning. Information Collected by Amerisure: Amerisure is dedicated to ensuring financial protection for our policyholders by providing quality products and exceptional service. In order to provide quality products and services, we may require access to certain personal information. This personal information may be used in underwriting, administering policies, or in handling claims. Amerisure collects information that identifies, relates to, describes, references, and is capable of being associated with, or could reasonably be linked, either directly or indirectly, with a particular consumer or household (“Personal Information”).Within the last (12) months, Amerisure has collected the following categories of personal information from consumers:

Category	Examples	Collected
A. Identifiers.	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver’s license number, passport number, or other similar identifiers.	YES
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	A name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.	YES
C. Protected classification characteristics under California or federal law.	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).	YES
D. Commercial information.	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	YES
E. Biometric information.	Physiological, behavioral, and biological characteristics, genetic information, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, face prints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.	YES
F. Internet or other similar network activity.	Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement.	YES
G. Geolocation data.	Physical location or movements, except to the extent related to or embedded within other categories in this chart.	NO
H. Sensory data.	Audio, electronic, visual, thermal, olfactory, or similar information.	YES
I. Professional or employment-related information.	Current or past job history or performance evaluations.	YES
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	NO
K. Inferences drawn from other personal information.	Profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	YES

Amerisure obtains the categories of personal information identified in (A) through (K) above from the following source categories:

• Directly from its policyholders and agents. For example, from documents that policyholders or agents provide in the procurement of insurance services.
• Indirectly from its policyholders and agents. For example, through data and other information collected in connection with underwriting, administering policies, or handling claims.
• Directly and indirectly through activity on amerisure.com, through other Amerisure websites and Amerisure vendors, or through non-affiliated third-party vendor websites. For example, from policyholder or agent submissions through website portals.
• From third parties that interact with Amerisure in connection with any insurance services Amerisure performs. For example, information collected from independent insurance agents or brokers, policyholders, a claimant, a claimant’s employer (in the case of a workers compensation claim), persons who may have witnessed an incident which lead to a claim, or persons retained by the claimant or by Amerisure in the process of administering a policy or adjusting a claim, such as repair shops, physicians, attorneys, or accountants.

Use of Your Personal Information:

Amerisure may use or disclose the personal information we collect for one or more of the following business purposes:

• To fulfill or meet any reason(s) for which the information is provided. For example, if you provide us with personal information in order for us to offer you insurance services, we will use that information in underwriting, administering policies, or handling claims.
• To provide you with information, products or services that you may request from us.
• To provide you with notifications or other notices concerning our products or services, events, updates, or other news, that may be of interest to you.
• To carry out obligations and enforce rights associated with contractual obligations existing between you and Amerisure. For example, including, but not limited to billing and collections.
• For purposes of providing, supporting, personalizing, and improving the features and appearance of our website, its, contents, and its presentation to you.
• For testing, research, analysis, and development, of our products and services including our Website, products, and services
• For research, analysis, product development, and design.
• To properly protect the rights, property, or safety of Amerisure, our clients or others, including responding to law enforcement requests, as applicable law, a court order, or other governmental regulation; and
• In our evaluation or conduct of a merger, restructuring, dissolution, reorganization, or in a sale or transfer of some or all of Amerisure’s assets related to a bankruptcy, liquidation, or other similar proceeding in which personal information held by Amerisure is one of the required assets to be transferred to accomplish the intended purpose of the transaction.

Amerisure does not collect any categories of personal information or use your personal information for any materially different or related purposes without providing you with notice.

Sharing of Your Personal Information:

Amerisure requires that employees having access to personal information of another person take special precautions to protect the confidentiality of that personal information. Access to personal information is limited to those employees who have a need for that information in order to perform their job responsibilities.

Amerisure limits disclosure of the categories of personal information indicated above. Such information is only shared with affiliated and non-affiliated third parties to the extent necessary to service an insurance policy or a claim, or as permitted or required by law. Third

parties with whom personal information may be shared for these purposes include Amerisure’s independent insurance agents and brokers, the policyholder, persons retained to assist with the effective and efficient administration of policies and claims (such as appraisers, repair shops and medical provides) and others may be permitted by law. Only authorized persons are permitted to access personal information.

Any non-affiliated third party with whom we share non-public personal information may use that information only for the purpose of performing their responsibilities to Amerisure or one of our policyholders or claimants. They are further required to protect the confidential nature of the non-public personal information. This means they may not copy or disclose non-public personal information to any other person, including their employees who do not need non-public personal information to perform their obligations to Amerisure or one of our policyholders or claimants.

In the preceding twelve (12) months, Amerisure has disclosed the above referenced categories of personal information for a business purpose or purposes, but has not “sold” any such personal information as that term is commonly understood. While Amerisure does not provide your personal information in exchange for any monetary consideration, with your consent we may share your information for purposes that could be deemed a “sale” as defined under applicable California law. For example, if you consent to advertising cookies on our website, we may exchange information related to your use of our website with one or more vendors in exchange for information to help with our marketing and website development purposes.

Your Rights and Choices under California Law:

California Law provides California residents with specific rights regarding their personal information. You may exercise certain rights and choices with Amerisure as follows:

Access to Specific Information and Data Portability Rights:

You have the right to request that Amerisure disclose certain information to you about Amerisure’s collection and use of your personal information over the past 12 months. Once Amerisure receives and confirms your verifiable consumer request for personal information, we will disclose to you:

• The categories of personal information we collected about you.
• The categories of sources from which the personal information was collected.
• Our business or commercial purpose for collecting that personal information.
• The categories of third parties with whom we share that personal information.
• The specific pieces of personal information we collected about you.
• If we “sold” or disclosed your personal information for a business purpose, the categories of personal information sold or disclosed and to whom.

Deletion Request Rights:

You have the right to request that Amerisure delete any of your personal information that Amerisure collected and retained about you, subject to certain exceptions. Once we receive and confirm your verifiable consumer request for deletion, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.

Amerisure may deny your verifiable consumer request for deletion if retaining the information is necessary for us or our third-party service providers to:

1. Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
3. Debug products to identify and repair errors that impair existing intended functionality.
4. Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
5. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 seq.).
6. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
7. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
8. Comply with a legal obligation.
9. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

Exercising Access, Data Portability, and Deletion Rights:

To exercise your access, data portability, and deletion rights, you may submit a verifiable consumer request to us by:

• Calling us at (800) 257-1900; or
• Visiting http://amerisure.com/

You or a person registered with the California Secretary of State who is authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. You may only make a verifiable consumer request twice within a 12-month period and your request must:

1. Provide sufficient information to enable Amerisure to reasonably verify that you are the person about whom we collected personal information or that you are an authorized representative of that individual; and,
2. Provide sufficient information and detail which enables Amerisure to understand, evaluate, and respond to your request.

We cannot respond to your request or provide you with personal information if Amerisure cannot reasonably verify that the request was made by you, by you on behalf of your minor child, or by a person registered with the California Secretary of State who is authorized to act on your behalf or the behalf of your minor child. You will not be required to create an account with Amerisure to make a verifiable consumer request. Personal information that may be provided within a verifiable consumer request will only be used verify the requester’s identity and request authority.

Response Time and Format of Response:

Amerisure strives to respond to all verifiable consumer requests within 45 days of receipt. However, we may need more time to respond to your request – such as an additional 45 days to respond to and deliver the information you requested to you. If additional response time is needed, Amerisure will inform you of the reason for delay, and the additional amount of time Amerisure will need to respond to your request (not to exceed 90 days from Amerisure’s receipt of your initial verifiable consumer request). If you have an account with us, the response will be delivered in writing to you at that account. If you do not have an account with us, we will deliver the response to you in writing to you by mail, or electronically, as you may choose to elect.

Amerisure’s response to your verifiable consumer requests will cover the 12-month period preceding Amerisure’s initial receipt of your verifiable consumer request. The response will be provided in a readily usable format so that your personal information can be transmitted by you from one entity to another without hindrance.

A fee will not be charged in processing or responding to a verifiable consumer request unless such request is excessive, repetitive, or manifestly unfounded. If such a request is made, and it is determined that a fee will be required for any of the reasons stated above, Amerisure will inform you of the same and provide you with a cost estimate before completing your request.

Personal Information Sales Opt-Out and Opt-In Rights

If you are age 16 or older, you have the right to direct us to not sell your personal information at any time. We do not sell the personal information of consumers we actually know are less than 16 years old. As summarized above, while Amerisure does not provide your personal information in exchange for any monetary consideration, with your consent we may share your information for purposes that could be deemed a “sale” as defined under applicable California law. For example, if you consent to advertising cookies on our website, we may exchange information related to your use of our website with one or more vendors in exchange for information to help with our marketing and website development purposes. Amerisure Consumers who opt-in to personal information sales may opt-out of future sales at any time.

To exercise the right to opt-out, you (or your authorized representative) may submit a request to us by visiting the following link:

Do Not Sell or Share My Personal Information

Non-Discrimination by Amerisure:

Amerisure does not discriminate against California residents who exercise their rights under the CCPA, and unless permitted by the CCPA, Amerisure will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services

Changes to Our Privacy Notice:

Amerisure may amend or change this Notice from time to time, at its sole discretion, by posting updated terms and conditions on its website or by providing written notice to you by e-mail, through a website, or U.S. Mail. You agree to be bound by any modifications, changes, or revisions made by Amerisure to this Notice. You agree that you are responsible for reviewing these Notice regularly, and your continued use of this website or any other Amerisure website constitutes your acceptance of any modifications, changes, or revisions to Amerisure’s online services or this Notice.