The categories of personal information we collect depend on how you interact with us, our Services, and the requirements of applicable law. We collect personal information that you provide to us, including personal information we collect in our business-to-business relationships, personal information we obtain automatically when you use our Services, and personal information from other sources such as third-party service providers, our business partners, and other organizations, as described below. We aim to limit our collection of personal information to only the personal information that is adequate, relevant, and reasonably necessary to serve the purposes for which it was collected.

A. Personal Information You Provide to Us Directly

We collect the following personal information that you provide to us when engaging with our Services or enter into a business relationship with us (e.g., when you register on our website, use our website or Services, or apply for a financial product; from your transactions with us, including your financial product purchases, repayments, and disbursements; and your communications with us):

Identifiers

• name
• email address
• home address
• telephone number
• date of birth
• Social Security number
• driver’s license, state identification, or passport number
• industry credentials

Commercial Information

• commercial information regarding the Services, including the solar or home improvement agreement in relation to your financial product or any other business relationship with us

Professional or Employment-Related Information

• position and employer
• industry credentials

Geographic Information

• such as the city and state where you are located

Sensitive Personal Information

• bank account information
• driver’s license, state identification or passport number
• Social Security number
• geolocation information

Other Identifying Information That May Be Collected

• digital signature
• income information

B. Personal Information Collected Automatically

Internet or Other Electronic Activity

• information about your visits to and use of the Services to help us maintain the appropriate features, functionality, and user experience
• IP address, browser type, referral source, length of visit, and page views, through the use of log files
• cookies, pixel tags, local shared objects, or other similar technologies

Audio and Video Information

• audio and video recordings of conversations with customer service agents

C. Personal Information Collected from Third Parties

Commercial Information

• commercial information from our business partners regarding your use of our Services

Other Identifying Information Collected

• credit report, credit score, and credit related information from credit bureaus
• public records and other information from service providers

We may process your personal information for the following business or commercial purpose:

• Transactional: We use your contact information and other identifying information, to provide you with the services and products you request or to otherwise maintain our business relationship with you, including:
  • providing and managing Services you have requested making offers of credit on behalf of Mosaic and/or Mosaic’s successors, assignees, affiliates, partners, vendors, representatives, third party lending partners, financial partners, loan brokers, or loan servicing providers
  • assessing your eligibility to invest on the Mosaic platform
  • creating borrower profiles on our website
  • tailoring our services
  • otherwise enhancing features, functionality, and customer experience

• Security: We use your contact information and other identifying information, to ensure the security and integrity of our business, including:
  • protecting against fraud and security threats, and otherwise managing risks
  • verifying your identity and authenticating your identity

• Marketing: We use your contact information, other identifying information, and internet or other electronic activity for:
  • communicating with you regarding services that may be of interest
  • communicating with other financial companies for joint marketing purposes
  • evaluating and improving the Services and other offerings

• Legal: We may use your personal information for:
  • satisfying legal or regulatory requirements or law enforcement requests

We use aggregated information in the administration of the Services to improve its usability and to evaluate the success of particular marketing and advertising campaigns, search engine optimization strategies and other marketing activities, as well as for security purposes. We use non-identifying and aggregated information to help optimize the Services based on the needs of our users. To the extent that we retain any personal information in deidentified form, we publicly commit to maintaining and using the deidentified data without attempting to reidentify the deidentified data.

We may also use your personal information for the following business or commercial purposes:

• Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards.
• Helping to ensure security and integrity to the extent the use of your personal information is reasonably necessary and proportionate for these purposes.
• Debugging to identify and repair errors that impair existing intended functionality.
• Performing services on behalf of Mosaic, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytic services, providing storage, or providing similar services on behalf of the business.
• Undertaking internal research for technological development and demonstration.
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business.
  

• Service Providers: From time to time, we may establish a business relationship with other businesses to provide services to our company (“Service Providers”). For example, we may contract with Service Providers to provide certain services, such as hosting and maintenance, data storage and management, and marketing and promotions. We only provide our Service Providers with the personal information necessary for them to perform these services on our behalf. Each Service Provider must agree to use reasonable security procedures and practices, appropriate to the nature of the information involved, to protect your personal information from unauthorized access, use, or disclosure. Service Providers are prohibited from using personal information other than as specified by us.
• Our Affiliates: We may disclose information with businesses controlling, controlled by, or under common control with Mosaic. If Mosaic is merged, acquired, or sold, or in the event of a transfer of some or all of our assets, we may disclose or transfer your personal information in connection with such transaction.
• Non-Affiliates: We may disclose your personal information with certain non-affiliated, non-profit organizations that provides news and information related to the solar industry.
• Legal Process: We cooperate with government and law enforcement officials and private parties to enforce and comply with the law. We may disclose personal information about you to government or law enforcement officials or private parties if, in our discretion, we believe it is necessary or appropriate in order to respond to legal requests (including court orders and subpoenas), to protect the safety, property, or rights of our company or of any third party, to prevent or stop any illegal, unethical, or legally actionable activity, or to comply with the law.
• Secondary Market Transactions: We may disclose personal information with businesses in relation to financial transactions on the secondary market including but not limited to whole loan sales and securitization.
• Other Legitimate Business Purposes: We may disclose your personal information with third parties as appropriate to carry out our legitimate business purposes.
• With your Consent: We may disclose your personal information with your consent.

Modifying or deleting information about you:

Customers can access information about themselves (such as name, email address, and mailing address) that we collect and maintain by visiting their borrower portal. You can access and review the personal contact information you submit by accessing the borrower portal provided by your loan servicer who may be Mosaic and/or any of Mosaic’s successors, assignees, affiliates, partners, vendors, representatives, third party lending partners, financial partners, or loan servicing providers. To update your personal profile information on Mosaic’s platform, you can log in to your account using your email address and password specified at the time of registration. Click on the “Settings” section of “My Account” and make changes to your profile as necessary. Please note that if the servicing of your loan is transferred to an entity other than Mosaic, then you will have to update your personal profile with your new loan servicer, not Mosaic. You will be provided with notice of any loan servicing transfer in writing. If you believe that information reported by the credit bureau is inaccurate, please contact the credit bureau to make any changes.

All other requests to change or remove information we collect about you can be sent to us at support@joinmosaic.com. We will respond to your request within a reasonable timeframe. We may not be able to modify or delete information in all circumstances. Due to the regulated nature of our industry, we are under legal requirements to retain certain data and are generally not able to delete consumer transactional data upon request. Certain regulations issued by state and/or federal government agencies may require us to maintain and report demographic information on the collective activities of our customers. We may also be required to maintain information about you for at least seven years to comply with applicable federal and state laws regarding recordkeeping, reporting, and audits.

Opt-out of any sharing of your personal information:

Customers may opt-out of any sharing of their personal information, such as name, email address, and mailing address, that we may share with certain non-affiliates from time to time. Any requests to opt-out of any sharing can be sent to us by email at: optout@joinmosaic.com or by calling (810) 678-6881.

We may collect information automatically when you use our Services.

• Automatic Collection of Personal Information. We may collect certain personal information automatically when you use our Services, such as your Internet protocol (IP) address, user settings, MAC address, cookie identifiers, mobile advertising and other unique identifiers, browser or device information, and location information (including approximate location derived from IP address). We may also automatically collect personal information regarding your use of our Services, such as pages that you visit before, during and after using our Services, information about the links you click, the types of content you interact with, the frequency and duration of your activities, and other information about how you use our Services.
• Cookie Policy (and Other Technologies). We, as well as third parties that provide content, advertising, or other functionality on our Services, may use cookies, pixel tags, session replay, and other technologies (“Technologies”) to automatically collect information through your use of our Services. For example:
  • Cookies. Cookies are small text files placed in device browsers that store preferences and facilitate and enhance your experience.
  • Pixel Tags/Web Beacons. A pixel tag (also known as a web beacon) is a piece of code embedded in our Services that collects information about engagement on our Services. The use of a pixel tag allows us to record, for example, that a user has visited a particular web page or clicked on a particular advertisement. We may also include web beacons in e-mails to understand whether messages have been opened, acted on, or forwarded.

Our uses of these Technologies fall into the following general categories:

• • Operationally Necessary. This includes Technologies that allow you access to our Services, applications, and tools that are required to identify irregular website behavior, prevent fraudulent activity, improve security, or allow you to make use of our functionality;
  • Performance-Related. We may use Technologies to assess the performance of our Services, including as part of our analytic practices to help us understand how individuals use our Services (see Analytics below);
  • Functionality-Related. We may use Technologies that allow us to offer you enhanced functionality when accessing or using our Services. This may include identifying you when you sign into our Services or keeping track of your specified preferences, interests, or past items viewed;
  • Advertising- or Targeting-Related. We may use first party or third-party Technologies to deliver content, including ads relevant to your interests, on our Services or on third-party digital properties. See “Your Privacy Choices and Rights” below to understand your choices regarding these Technologies.
  • Analytics. We may use Technologies and other third-party tools to process analytics information on our Services. These Technologies allow us to better understand how our digital Services are used and to continually improve and personalize our Services. Our analytics partners include:
    • Google Analytics. For more information about how Google uses your personal information (including for its own purposes, e.g., for profiling or linking it to other data), please visit Google Analytics’ Privacy Policy. To learn more about how to opt-out of Google Analytics’ use of your information, please click here.
    • LinkedIn Analytics. For more information about how LinkedIn uses your personal information, please visit LinkedIn Analytics’ Privacy Policy. To learn more about how to opt-out of LinkedIn’s use of your information, please click here.

“Do Not Track” and other Opt-Out Preference Signals

Certain laws require that operators of websites disclose how they respond to a “Do Not Track” signal. However, because there is not yet a common understanding of how to interpret Do Not Track signals, we do not currently respond to Do Not Track signals, if any, that we might receive from browsers. If you have any questions about cookies and other technologies, please visit http://www.allaboutcookies.org/ or http://networkadvertising.org/, or contact us as indicated in the How You Can Contact Us section below.

We are committed to maintaining the security, integrity, accessibility, and confidentiality of your personal information to the extent appropriate for the volume and nature of the personal information. We maintain physical, electronic, and procedural safeguards that meet or exceed industry standards for financial institutions.

We protect your personal information by storing it in encrypted form on computers not publicly accessible via the Internet. We control access to this information via secure web pages and limit access to employees and third parties on a need-to-know basis. We do not allow visibility to Social Security numbers or bank account information via the Services.

We employ firewalls and other security technologies to protect our servers from external attack. We enable our servers with Secure Socket Layer (SSL) technology to establish a secure connection between your computer and our servers, creating a private “conversation” that cannot be viewed or accessed by other parties. We test our systems regularly to ensure that our security mechanisms are up to date.

We also employ session time-outs to protect your account. You will be logged out of the Services automatically after a specified period of inactivity. This time-out feature reduces the risk of others being able to access your account if you leave your computer unattended.