QUICKEN LINK Privacy Policy

---

 Notice of Privacy Practices: Controller

Our privacy practices when we act as a data controller are set forth in our Global Privacy Notice, including:

• the types of personal data collected
• the purposes for which we collect personal data
• the type of third parties to whom we disclose personal data,
• our practices relating to the collection and use of personal data,
• the right of individuals to access their personal data
• the choices and means we offer for limiting use and disclosure of personal data.

Notice of Privacy Practices: Processor

When we act as a data processor, the controller determines the types of personal data collected, and the practices relating to the collection and use of personal data collected.

Our rights and obligations as a processor are defined by a written data processing addendum (“DPA”) executed between us and the controller. In general, we process personal data according to applicable law and the instructions provided by the data controller. The data controller is responsible for ensuring it:

• has a lawful basis for collecting the personal data provided to us
• has provided appropriate notices and disclosures to data subjects as required under applicable law
• has the right to allow transfer of personal data to the United States
• has otherwise complied with all applicable laws relating to the collection and processing of personal data
• provides responses to requests from individuals to access their personal data, and
• provides appropriate choices and means to individuals to limit the use and disclosure of their personal data.

When acting as a processor, we disclose personal data:

• to our affiliates and subprocessors for the purpose of operating our business and/or providing our services
• to third parties at the controller's request
• when required to make disclosures pursuant to law or in response to lawful requests from governmental authorities, including in response to national security, government interests, or law enforcement requests.

Onward Transfers of Personal Data

When transferring personal data to a processor (or subprocessor) (an “Onward Transfer”), we:

• require the processor or subprocessor to enter into a written DPA
• require the processor or subprocessor to process the personal data for only limited and specific purposes defined in the agreement
• take reasonable and appropriate steps to ensure that the personal data is processed in a manner consistent with the DPF Principles,
• require the processor or subprocessor to notify us if the processor determines that it can no longer meet its obligations under the DPF Principles,
• take reasonable and appropriate steps to stop and remediate unauthorized processing, and
• will provide a summary or representative copy of the relevant privacy protections in our agreements with our processors to the Department of Commerce upon request.

We remain liable under the DPF Principles if our processor or any other person or entity to whom our processor transfers personal data processes personal data in a manner not consistent with the DPF Principles, unless we demonstrate that we are not responsible for the unauthorized processing.

Other Disclosures

We also disclose personal data (a) for the purpose of operating our business and providing our Services as described in our Global Privacy Notice and related privacy policies, (b) to third parties at the controller's request, (c) if required to make disclosures pursuant to law, or (d) in response to lawful requests from governmental authorities, including in response to national security, government interest, or law enforcement requests.

Data Subject Choice - Secondary Purposes

When we act as a controller we do not disclose or use personal data for a purpose different from the purposes for which it was originally collected unless subsequently authorized by the data subject.

Data Security

Our Global Privacy Notice contains a description of the measures we employ to protect the confidentiality, integrity, and availability of personal data we process.

Recourse, Enforcement, and Liability