Effective Date: January 1, 2023

RealEstate Listing Service Corporation dba Dorothy.com “Dorothy.com” and our affiliate and subsidiary (collectively, “Dorothy.com” “we,” “our,” or “us”) are committed to privacy and to transparency in our information practices. This Privacy Policy describes how we collect, use, disclose, and otherwise process the personal information described in this Privacy Policy, as well as the rights and choices individuals have regarding such personal information. This Privacy Policy applies to the extent we process personal data on our own behalf, as a controller or business.

If you are a California resident, please be sure to review Section 17B. California Residents for important information about the categories of personal information we collect and disclose as well as your rights under California privacy laws.

You can click the links below to go directly to a particular section in our Privacy Policy.
SCOPE OF THIS PRIVACY POLICY OUR COLLECTION OF PERSONAL INFORMATION PURPOSES AND LEGAL BASIS FOR OUR PROCESSING DISCLOSURE OF PERSONAL INFORMATION Aggregate and Non-identifiable Data COOKIES, TRACKING, AND ANALYTICS INTEREST-BASED ADVERTISING SOCIAL FEATURES AND THIRD-PARTY PLUG INS INTERNATIONAL TRANSFERS OF PERSONAL INFORMATION SECURITY DATA RETENTION YOUR RIGHTS AND CHOICES CHILDREN THIRD-PARTY WEBSITES CHANGES TO THIS PRIVACY POLICY CONTACT US ADDITIONAL INFORMATION FOR CERTAIN JURISDICTIONS EEA and the United Kingdom California Residents. Residents of Other U.S. States

1. SCOPE OF THIS PRIVACY POLICY

This Privacy Policy applies to our collection, use, disclosure, and other processing of personal information related to:

• Our websites (each, a “Website”) and mobile applications (each, an “App”) that display or link to this Privacy Policy and our other services, products, and technology solutions (collectively, the “Services”).
• Former, current, and prospective clients, brokers, independent agents, and customers.
• Other individuals who use our Services, whose personal information we receive is related to the Services, or who otherwise interact or communicate with us related to our Services or our business.
• Our collection, use, disclosure, and processing of personal information about individuals will vary depending on the circumstances. This Privacy Policy is intended to describe our overall privacy and data protection practices.

Not covered by this Privacy Policy. This Privacy Policy does not apply to our employees and non-employee workers.

Additional privacy notices. In some cases, different or additional notices about our data collection and processing practices may be provided and applied to our processing of certain personal information. The additional notice will control to the extent there is a conflict with this Privacy Policy, with respect to your personal information that is subject to that notice.

2. OUR COLLECTION OF PERSONAL INFORMATION

Generally, we collect your personal information on a voluntary basis. However, if you decline to provide certain personal information that is marked mandatory, you may not be able to access certain Services, or we may be unable to fully respond to your inquiry.

We may collect personal information directly from individuals, automatically related to the use of the Services, and in some cases, from third parties (such as social networks, platform providers, payment processors, data providers, and operators of certain third-party services that we use). In some cases (such as where required by law), we ask for your consent or give you certain choices prior to collecting or using certain personal information.

Information we collect directly. We collect information that you provide to us, such as:

• When you create an account, provide contact information, or send other personal information to us.
• When you complete or submit a form through our Services, for example, “Contact Us” or “More Information” forms or various QR Code topics.
• When you participate in surveys or contests, submit orders or requests, register for, or use our Services, contact us through one of our QR Codes, or otherwise contact us.
• Information you submit or provide such as real estate searches and preferences, whether you plan on buying or selling real estate, home search criteria, information about financing for the purchase of real estate, and other information related to the purchase or sale of real estate.

Information we collect from third parties. We may collect or receive personal information about you and your property from third-party sources, such as public databases, joint marketing partners, social media platforms (including from people with whom you are friends or otherwise connected), brokers and affiliated agents, and other real estate professionals, and third parties. For example:

•  Social media. If you choose to link, create, or log in to your my.dorothy.com account with a social media service (e.g., Twitter, Facebook, Instagram, etc.), or if you engage with a separate app or website that communicates with the Services, we may receive personal information about you or your connections from that service. In many cases, you can control what personal information you share with us through privacy settings available on third-party social media services.
• Real estate professionals. If you interact or list a property with a broker, independent agent, or other real estate professional associated with a Dorothy.com brand, we may receive personal information about you and your property from them, such as your name and property address, listing, and contact information, among other things. These real estate professionals may be affiliated with independently owned and operated brokerages, or with Dorothy.com company.
• Property records. We may collect information about individuals and real estate property through public databases, such as property ownership and tax records maintained by state, local, and county agencies.

 

3. PURPOSES AND LEGAL BASIS FOR OUR PROCESSING

Certain laws, including the EU General Data Protection Regulation (“GDPR”), UK and Brazil data protection laws, and similar laws require that we inform applicable individuals of the legal basis for our use and other processing of their personal information. In this section, we described the purposes for which will collect, use, disclose, and otherwise process personal information, as well as the legal bases for such processing, generally, under such privacy laws.

• Legal bases under certain privacy laws. Pursuant to the GDPR, UK, and Brazil data protection law, and similar laws we collect, use and otherwise process personal information for the following legal bases:
• Performance of contract: as necessary to enter or carry out the performance of our contract with you.
• Compliance with laws: for compliance with legal obligations and/or defense against legal claims, including those in labor and employment law, social security, data protection, tax, and corporate compliance laws.
• Our legitimate interests: in furtherance of our legitimate business interests including, for example:

1. Tracking Member profit shares “Bricks”.
2.  Sharing profit shares with Members annually.
3. Performance of contracts with franchisees and other parties.
4. Implementation and operation of global support (e.g., IT) services. for our business operations
5. Use of LEO to improve our Services, including marketing and analytics.
6. Use of LEO to integrate other industries into (L)ocations, (E)ntities, or (O)rganizations.
7. Marketing and advertising.
8. Fraud prevention, including misuse of company IT systems or money laundering.
9. Physical, IT, and network perimeter security.
10. Internal investigations.
11. Mergers, acquisitions, reorganization, and other business transactions

• With your consent: in some cases, we rely on your consent to collect and process your personal information. (See Section 17A below for information about withdrawing your consent.) In addition, we may process your personal information where necessary to protect the vital interests of any individual.
• Purposes of processing. While the purposes for which we may process personal information will vary depending upon the circumstances, in general, we collect, use, disclose, and otherwise process personal information for the purposes set forth below, as well as the legal basis for such processing, as applicable under relevant laws (see above for a further explanation of these legal bases):
• Providing support and services: including, for example, sending or facilitating communications among you, independent real estate professionals and our affiliated entities, and other users of the Services, providing products and services you request (and sending related information), operate our Services; to communicate with you about your access to and use of our Services; to respond to your inquiries; to provide troubleshooting, fulfill your requests and provide technical support; and for other customer service and support purposes. (Legal basis: performance of our contract with you; and our legitimate interests)
• Analyzing and improving our business: including to better understanding of how users access and use our Services, evaluating and improving our Services and business operations, and developing new features, offerings, and services; conducting surveys, and other evaluations, such as customer satisfaction surveys; and for other research and analytical purposes. (Legal basis: our legitimate interests) Personalizing content and experiences: including providing or recommending features, content, social connections, and referrals; tailoring content we send or display on our Services; offering location customization and personalized help and instructions; and otherwise personalizing your experiences. (Legal basis: our legitimate interests and/or with your consent)
• Advertising, marketing, and promotional purposes: including to reach you with more relevant ads and to evaluate, measure, and improve the effectiveness of our ad campaigns; to send you newsletters, offers, or other information we think may interest you; to contact you about our Services or information we think may interest you; and to administer promotions and contests. (Legal basis: our legitimate interests and/or with your consent)
• Securing and protecting our business: including protecting and securing our business operations, assets, Services, network, and information and technology resources; to investigate, prevent, detect, and take action regarding fraud, unauthorized access, situations involving potential threats to the rights or safety of any person or third party, or other unauthorized activities or misconduct. (Legal basis: our legitimate interests and/or compliance with laws)
• Defending our legal rights: including to manage and respond to actual and potential legal disputes and claims, and to otherwise establish, defend or protect our rights or interests, including in the context of anticipated or actual litigation with third parties. (Legal basis: our legitimate interests and/or compliance with laws)
• Planning and facilitating business transactions: related to any actual or contemplated merger, acquisition, asset sale or transfer, financing, bankruptcy, or restructuring of all or part of our business. (Legal basis: our legitimate interests and/or compliance with laws)
• Auditing, reporting, corporate governance, and internal operations: including relating to financial, tax, and accounting audits; audits and assessments of our operations, privacy, security, and financial controls, risk, and compliance with legal obligations; and our general business, accounting, record keeping, and legal functions. (Legal basis: our legitimate interests and/or compliance with laws)
• Complying with legal obligations: including complying with the law, our legal obligations, and legal process, such as warrants, subpoenas, court orders, and regulatory or law enforcement requests. (Legal basis: our legitimate interests and/or compliance with laws)

 

4. DISCLOSURE OF PERSONAL INFORMATION

We may disclose the personal information we collect to third parties, as reasonably necessary for the purposes described above and as otherwise directed or consented to by you, including:

• Service providers: third-party service providers who use this information to perform services for us, such as hosting providers, auditors, advisors, consultants, and customer service and support providers.
• Subsidiaries and affiliates: to our subsidiary and affiliated companies (i.e., companies under common ownership, control, or management with us), who may process your personal information in accordance with the principles of this Privacy Policy, including to share relevant news, information, and offers with you. Where required by applicable law, we will obtain your consent to such sharing.
• Third parties: to third parties to provide our Services, respond to or carry out your requests, and/or with your consent, including to:

1. Independent real estate professionals and owners and operators of real estate brokerage companies to enable them to provide services you request through the Services.
2. Third parties to provide you a service you requested through a partnership or promotional offering made by a third party or us.
3. The public if you submit to a public part of the Services, such as comments, social media posts, or other features viewable by the public or generally by registered users of the Services.
4. Third parties with whom you choose to let us share information, for example, other apps or websites that integrate with the Services, or those with Services with which we integrate.
5. Third parties we work with to provide you with more personalized content and ads and to track the effectiveness of campaigns.

• Business transfers: as part of any actual or contemplated merger, sale, and transfer of our assets, acquisition, financing, or restructuring of all or part of our business, bankruptcy, or similar event; and prior to the completion of such a transfer, where necessary for due diligence or to plan for the transfer, such as to lenders, auditors, and third-party advisors, such attorneys, and consultants, where permitted by law.
• Legally required: where we are required to do so by law or legal process (e.g., to law enforcement, courts, or others, or in response to a subpoena or court order).
• Protect our rights: where we believe it necessary to respond to claims asserted against us or, comply with legal process (e.g., subpoenas or warrants), enforce or administer our agreements and terms, for fraud prevention, risk assessment, investigation, and to protect the rights, property, or safety of us, our clients and customers or others. including personal information, related to litigation and other legal claims or proceedings in which we are involved, as well as for our internal accounting, auditing, compliance, recordkeeping, and legal functions.

 

5. Aggregate and Non-identifiable Data

We may also use and disclose aggregate, anonymous, and other non-identifiable data related to our business and the Services for quality control, analytics, research, development, and other purposes. Where we use, disclose, or process de-identified data (data that is no longer reasonably linked or linkable to an identified or identifiable natural person, household, or personal or household device) we will maintain and use the information in deidentified form and not attempt to reidentify the information, except as permitted by applicable privacy laws (such as to confirm whether our deidentification processes are reasonable and adequate).

 

6. COOKIES, TRACKING, AND ANALYTICS

Our Services may use first-party and third-party cookies, pixel tags, plugins, and other tools to gather device, usage, and browsing information when users visit our Services. For instance, when you visit our Services, our server may record your IP address (and associated location information) and other information such as the type of your internet browser, your Media Access Control (MAC) address, computer type (Windows or Macintosh), screen resolution, operating system name and version, device manufacturer and model, language, and the pages you view and links you select on the Services, as well as date and time stamps associated with your usage of and activities on our Services.

We use the information for security purposes, to facilitate navigation, to improve, analyze and optimize our Services and their functionality, to personalize and improve your experience while using the Services, to improve and measure our advertising campaigns, and to better reach users with relevant advertising both on our Services and on third party websites.

Cookies are small text files that a website transfers to your hard drive to store and sometimes collect information about your usage of websites, such as time spent on the websites, pages visited, language preferences, and other anonymous traffic data. You can control the way in which cookies are used by altering your browser settings. You may refuse to accept cookies by activating the setting on your browser that allows you to reject cookies. However, if you select such a setting, this may affect the functioning of our Services. Unless you have adjusted your browser setting so that it will refuse cookies, our system will issue cookies when you access or log on to our Service.

If you have disabled one or more cookies, we may still use information collected from cookies before your disabled preference was set. However, we will stop using the disabled cookie to collect any further information.

Pixel tags and other similar technologies. Pixel tags (also known as web beacons and clear GIFs) may be used in connection with some Websites to, among other things, track the actions of users of the Websites (including email recipients), measure the success of our marketing campaigns, and compile statistics about usage of the Websites and response rates. We and our service providers may also use pixel tags in HTML emails to our customers, to help us track email response rates, identify when our emails are viewed, track whether our emails are forwarded, and conduct analytics.

Most browsers collect certain information, such as your IP address, device type, screen resolution, operating system version, and internet browser type and version. This information is gathered automatically and stored in log files.

Our websites use automated devices and applications operated by third parties, such as Google Analytics, which uses cookies and similar technologies to collect and analyze information about the use of the Websites and report on activities and trends. This service may also collect information regarding the use of other websites, apps, and online resources. You can learn about Google’s practices and opt out of the collection of your browsing data by Google Analytics at https://tools.google.com/dlpage/gaoptout. Please note that our websites do not recognize or respond to browser “do-not-track” requests or other browser privacy signals.

 

7. INTERNET-BASED ADVERTISING

On some of our websites, we may work with third-party ad networks, analytics companies, measurement services, and others (“third-party ad companies”) to display advertising on our Services and to manage our advertising on third-party sites, mobile apps, and online services. We and these third-party ad companies may use cookies, pixels tags and other tools to collect information on our websites (and on third-party sites and services), such as browsing history, IP address, device ID, cookie and advertising IDs, and other identifiers, general location information and, with your consent, your device’s geolocation information; we and these third-party ad companies use this information to provide you more relevant ads and content and to evaluate the success of such ads and content.

 

8. SOCIAL FEATURES AND THIRD-PARTY PLUGINS

The Services may integrate with social sharing features and other related tools which let you log in to the Services or share actions you take on the Services. Your use of such features enables the sharing of information with your friends or the public, depending on the settings you establish with the social sharing service. Please refer to the privacy policies of those social sharing services for more information about how they handle the data you provide to or share through them.

 

9. INTERNATIONAL TRANSFERS OF PERSONAL INFORMATION

Dorothy.com is headquartered in the United States and may have affiliates and service providers in multiple jurisdictions. As such your personal information may be transferred to the United States and other jurisdictions where we or our service providers have operations, and may be subject to disclosure to the governments, courts, or law enforcement or regulatory agencies of such of these jurisdictions upon transfer. Some of these jurisdictions—including the United States—may not provide the same level of data protection as your home country. In such cases, we rely on suitable personal information transfer safeguards. You may request a copy or information about those safeguards by contacting us as detailed below.

 

10. SECURITY We use technical, administrative, and physical controls in place to help protect personal information from unauthorized access, use, and disclosure. Even so, despite our efforts, no security measure is ever perfect or impenetrable. If the security of your account has been compromised, please immediately notify us in accordance with Section 16. Contact Us.

 

11. DATA RETENTION We will retain your personal information for the period necessary to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required or permitted by law. We may retain personal information for longer where required by our legal and regulatory obligations, professional indemnity obligations, or where we believe it is necessary to establish, defend or protect our legal rights and interests or those of others. With respect to the data and files we handle as a processor, we retain this personal information in accordance with our client’s instructions.

 

12. YOUR RIGHTS AND CHOICES

We provide several ways for you to exercise certain privacy choices regarding your personal information processed by us, as described in this section. We are committed to respecting the privacy rights of individuals under all privacy laws applicable to us. Some privacy laws require that we provide specific information about individual rights to applicable consumers, which we have set forth in Section 17 of this Privacy Policy. California residents, please review Section 17B. California Residents for information about your California privacy rights.

Marketing. You may opt out of receiving marketing-related communications from us on a going-forward basis by contacting us or by using the unsubscribe mechanism contained in each email. We will try to comply with your request(s) as soon as reasonably practicable. Please note that if you opt out of receiving marketing-related emails from us, we may still send you important administrative messages, from which you cannot opt out.

Cookies preferences. To review and update your preferences for most types of cookies (other than those that are necessary) for one of our sites change your cookie preferences in your browser.

Deactivation. You can deactivate your account at any time by contacting us at the email address at the bottom of this page. However, you will not be able to access many of the services to deactivate your account. Please note that even if you request deactivation of your account, it may take some time to fulfill this request.

Access, amendment, and deletion. Under applicable privacy laws, you may have the right to request to review, make amendments, have deleted, or otherwise exercise your rights over the personal information that we hold, subject to certain legal limitations and requirements. If you are subject to such a privacy law, you may submit a request to us related to your personal information:

• By submitting an email request to us at dataprivacy@Dorothy.com

We will process in accordance with and where required by applicable law and with respect to your personal information that is linked or linkable to the email or phone number that you use to send us your request and the verifiable information provided by you as a part of your request. We will take steps to verify your identity before implementing your request.

Please note that we may need to retain certain information for recordkeeping purposes and/or to complete any transactions that you began prior to requesting a change or deletion. There may also be residual information that will remain within our databases and other records, which will not be removed. We may not always be able to fully address your request, for example, if it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way.

In any case, if there are Bricks associated with a phone number, email, or Entity then the phone number, email, and/or Entity will be “rolled-off”. This will also exclude the Entity from participation in annual profits sharing until “rolled on”.

 

13. CHILDREN

These Services are not intended or directed to children under the age of 16, and we do not knowingly collect any personal information, or knowingly track the use of our Services, from children. If we have actual knowledge that personal information about a child under 16 years old has been collected, then we will take appropriate steps to try and delete such personal information.

 

14. THIRD-PARTY WEBSITES The Services may contain links to third-party services. We do not own, operate, or control the websites of third parties, including those of independently owned and operated franchisees. Accordingly, this Privacy Policy does not apply to any services maintained or operated by third parties. When you click on those links, you will go to a third-party website where you will be subject to that service’s privacy policy or similar statement and terms of use, and we encourage you to read that policy statement. We are not responsible for the privacy practices of other services, and we expressly disclaim any liability for their actions, including actions related to the use and disclosure of personal information by those third parties.

 

15. CHANGES TO THIS PRIVACY POLICY

We may amend this Privacy Policy at any time. If we make any material change in how we collect, use, disclose, or otherwise process personal information, we will post a notice regarding such a change on the Services. Any material changes to this Privacy Policy will be effective 10 days after our posting of the updated Privacy Policy or as otherwise required by applicable law. Where required to do so by law, we may seek your prior consent to any material changes we make to this Privacy Policy.

 

16. CONTACT US

If you have any questions or concerns about this Privacy Policy, please use the following contact information:

• Email: dataprivacy@Dorothy.com
• Mailing address: 1522 Lago Vista Blvd Palm Harbor, FL 344 Attn: Data Privacy

 

17. ADDITIONAL INFORMATION FOR CERTAIN JURISDICTIONS

Residents of certain states have additional rights under applicable privacy laws, as described in this section.

If you are a resident of the EEA or the United Kingdom, please review Section 17.A below for additional information about your privacy rights under applicable privacy laws. If you are a resident of the United States, please review Section 17.B below for additional information about the categories of personal information we collect about you and your privacy rights under applicable California privacy laws and Section 17.C below for additional information about privacy rights under other U.S. state privacy laws.

A. EEA and the United Kingdom The GDPR and UK data protection laws (where applicable), give data subjects the following rights regarding their personal information:

• Right of access: You have the right to obtain from us confirmation as to whether or not personal information concerning you is being processed, and where that is the case, to request access to the personal information. The accessed information includes – among others – the purposes of the processing, the categories of personal information concerned, and the recipients or categories of recipients to whom the personal information has been or will be disclosed. You have the right to obtain a copy of the personal information undergoing processing. For further copies requested by you, we may charge a reasonable fee based on administrative costs.
• Right to rectify and complete personal information: you can request the rectification of inaccurate data and the completion of incomplete data. We will inform relevant third parties to whom we have transferred your data about the rectification and completion if we are legally obliged to do so.
• Right to erasure (right to be forgotten): You have the right to obtain from us the erasure of personal information concerning you in limited circumstances where:

1. it is no longer needed for the purposes for which it was collected;
2. you have withdrawn your consent (where the data processing was based on consent);
3. following a successful right to object.
4. it has been processed unlawfully; or
5. the data must be erased to comply with a legal obligation to which we are subject. We are not required to comply with your request to erase personal information if the processing of your personal information is necessary for compliance with a legal obligation, or the establishment, exercise, or defense of legal claims.

• Right to restriction of processing: You have the right to obtain from us the restriction of processing your personal information. In this case, the respective data will be marked and only processed by us for certain purposes. This right can only be exercised, subject to certain limitations, where: (i) the accuracy of your personal information is contested; (ii) the processing is unlawful, but you do not want the personal information erased; (iii) it is no longer needed for the purposes for which it was collected, but you still need it to establish, exercise or defend legal claims; or (iv) you have exercised the right to object, and verification of overriding grounds is pending.
• Right to data portability: You have the right to receive the personal information concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format and you have the right to transmit those data to another entity without hindrance from us, but in each case only where the processing is (a) based on your consent or on the performance of a contract with you, and (b) also carried out by automated means.
• Right to object: You have the right to object at any time to any processing of your personal information which has our legitimate interests as its legal basis. You may exercise this right without incurring any costs. If you raise an objection, we have an opportunity to demonstrate that we have compelling legitimate interests which override your rights and freedoms. The right to object does not exist if the processing of your personal information is necessary to take steps prior to entering into a contract or to fulfill a contract already concluded.
• Right to object to our use of your personal information for direct marketing: You can request that we change the way we contact you for marketing purposes. You can request that we not transfer your personal information to unaffiliated third parties for the purposes of direct marketing or any other purposes.
• Right to withdraw consent: if you have given us your consent for the processing of your personal information, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
• Right to obtain a copy of safeguards: you can ask to obtain a copy of or reference to, the safeguards under which your personal information is transferred outside the EU/EEA. We may redact data transfer agreements to protect commercial terms.
• Right to lodge a complaint with your local supervisory authority: You have a right to lodge a complaint with your local supervisory authority if you have concerns about how we are processing your personal information. We ask that you please attempt to resolve any issue with us first, although you have a right to contact your supervisory authority at any time. You may submit your GDPR request to us via:
  • Our online web form

B. California Residents.

This section provides California residents with additional information regarding our collection, use, and disclosure of their personal information, as well as their privacy rights, under California privacy laws.

In this section, we provide additional information to California residents about how we handle their personal information, as required by the California Consumer Privacy Act (“CCPA”). This section does not address or apply to our handling of personal information that is exempt under the CCPA.

Categories of personal information that we collect and disclose. Our collection, use, and disclosure of personal information about a California resident will vary depending upon the circumstances and nature of our interactions or relationship with such residents. Below we describe the categories of personal information we may collect about California residents (including the categories of personal information that we have collected about California residents in the past 12 months):

• Identifiers: includes direct identifiers such as a real name, alias, address, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.
• Customer records: paper and electronic customer records containing personal information, which you provide to us to access or use our Services, such as name, digital signature, address, telephone number, email and other contact information, government identifiers, and financial and payment information.
• Characteristics of protected classifications: such as disability and health information (e.g., which we may collect in order to, for example, make accommodation available to you at events we host).
• Commercial information: including records of real property, products or services purchased, obtained, or considered, or other purchasing or use histories or tendencies.
• Usage data: internet or other electronic network activity Information including without limitation browsing history, search history, and information regarding a consumer’s interaction with an Internet website, application, or advertisement.
• Location data: location information about a particular individual or device.
• Audio, Video, and Other Electronic Data: audio, electronic, visual, thermal, olfactory, or similar information such as CCTV footage and thermal screenings (e.g., collected from visitors to our offices), photographs, and call recordings.
• Employment history: professional or employment-related information.
• Education information: education history and background.
• Profiles and inferences: Inferences are drawn from any of the information identified above to create a profile reflecting a resident’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, or aptitudes.
• Sensitive personal information: in limited circumstances, we may collect certain information considered to be sensitive personal information under the CCPA, including Social Security number and tax ID; driver’s license, state identification card, passport number, or other government identifier; financial account number and payment card data; and geolocation data.
• Categories of third parties. Below we describe the third parties to whom we may disclose each category of personal information for a business or commercial purpose:
• Identifiers:
  • service providers
  • advisors and agents
  • government entities and law enforcement
  • affiliates and subsidiaries
  • real estate professionals
  • advertising networks
  • analytics providers
  • social networks
  • operating systems and platforms
• Customer records:
  •  service providers
  • advisors and agents
  • government entities and law enforcement
  • affiliates and subsidiaries
  • real estate professionals
  • operating systems and platforms
• Characteristics of protected classifications:
  • service providers
  • advisors and agents
  • government entities and law enforcement
  • affiliates and subsidiaries
• Commercial information:
  • service providers
  • advisors and agents
  • government entities and law enforcement
  • affiliates and subsidiaries
  • real estate professionals
  • data analytics providers
  • social networks
  • operating systems and platforms
• Usage data:
  • Service providers
  • advisors and agents
  • government entities and law enforcement
  • affiliates and subsidiaries
  • real estate professionals
  • advertising networks
  • data analytics providers
  • social networks
  • operating systems and platforms
• Location data:
  • service providers  
  • advisors and agents
  • government entities and law enforcement
  • affiliates and subsidiaries
  • real estate professionals
  • operating systems and platforms
• Audio, video, and other electronic data:
  •  service providers
  • advisors and agents
  • government entities and law enforcement
  • affiliates and subsidiaries
  • real estate professionals
• Employment History:
  • service providers
  • advisors and agents
  • government entities and law enforcement
  • affiliates and subsidiaries
  • real estate professionals
• Education information:
  • service providers
  • advisors and agents
  • government entities and law enforcement
  • affiliates and subsidiaries
  • real estate professionals
• Profiles and inferences:
  • service providers
  • advisors and agents
  • government entities and law enforcement
  • affiliates and subsidiaries
  •  real estate professionals
  • advertising networks
  • data analytics providers
  • social networks
• Sensitive personal information:
  • service providers
  •  advisors and agents
  • government entities and law enforcement
  • affiliates and subsidiaries
  • real estate professionals

In addition, we may disclose any of the categories of personal information we collect about you to other third parties as directed by or consented to by you, or where necessary to fulfill your specific requests.

Sales and sharing. The CCPA defines a “sale” as disclosing or making available personal information to a third party in exchange for monetary or other valuable consideration, and “sharing” broadly includes disclosing or making available personal information to a third party for purposes of cross-context behavioral advertising. While we do not disclose personal information to third parties in exchange for monetary compensation, we may “sell” or “share” (as defined by the CCPA): (i) identifiers, usage data, customer records, commercial information, and profiles with our affiliates and subsidiary companies (e.g., so that they may improve or enhance their own records and for other purposes); and (ii) identifiers, usage data and commercial information to ad networks, social media platforms and data analytics providers (e.g., in order to improve and measure our ad and marketing campaigns).

• Sources of Personal Information. We may collect personal information from the following sources:
• Directly from the individual
• Real estate professionals, including brokers and independent agents of Dorothy.com brands
• Property records, public records and other publicly available sources
• Advertising networks
• Data analytics providers
• Social networks
• Government entities
• Data brokers A
• ffiliate and subsidiary companies
• Service providers

Purposes of Collection, Use and Disclosure. As described in more detail in Section 3. Use of Personal Information and Section 4. Disclosures of Personal Information, we collect, use, disclose and otherwise process personal information (including sensitive personal information) for the following business or commercial purposes or as otherwise directed or consented to by you:

• Providing support and services
• Analyzing and improving our business
• Personalizing content and experiences
• Advertising, marketing, and promotional purposes
• Securing and protecting our business
• Defending our legal rights
• Planning and facilitating business transactions
• Auditing, reporting, corporate governance, and internal operations
• Complying with legal obligations

Retention. We will retain your personal information for the period necessary to fulfill the purposes outlined in this Privacy Policy or otherwise disclosed to you at the time of collection unless a longer retention period is required or permitted by law. We may retain personal information for longer where required by our legal and regulatory obligations, professional indemnity obligations, or where we believe it is necessary to establish, defend or protect our legal rights and interests or those of others.

Rights of California Residents. In general, California residents have the following rights under the CCPA: California residents’ rights. Under the CCPA, California residents have the following rights (subject to certain limitations) with respect to the personal information we collect and maintain about them:

• Opt out of sales and sharing: opt out of our sale and sharing of their personal information.
• Limit uses and disclosures of sensitive personal information: to limit certain uses or disclosures of sensitive personal information to those uses authorized by the CCPA.
• Deletion: to request deletion of their personal information, subject to certain exceptions.
• To know/access: to know what personal information we have collected about them, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about them.
• Correction: to request correction of inaccurate personal information. Non-discrimination: not to be subject to discriminatory treatment for exercising their rights under the CCPA.

Submitting CCPA Requests. California residents may exercise their CCPA privacy rights to know/access, delete, correct, and limit the use/disclosure of sensitive personal information by submitting a verifiable request to us via:

• Our online web form

We will respond to verifiable requests received from California residents as required by law. When you submit a request to know or a request to delete, we will take steps to verify your request by matching the information provided by you with the information we have in our records. You must complete all required fields on our web form (or otherwise provide us with this information via the above toll-free number) so that we can process and verify your request. We will process your request based on the personal information in our records that is linked or reasonably linkable to the information provided in your request. In some cases, we may request additional information in order to verify your request or where necessary to process your request. If we are unable to adequately verify a request, we will notify the requestor. Authorized agents may initiate a request on behalf of another individual by contacting us via email or phone; authorized agents will be required to provide proof of their authorization and we may also require that the relevant consumer directly verify their identity and the authority of the authorized agent.

Rights Under California Shine the Light Law. California residents may request from businesses with whom they have an established business relationship (1) a list of categories of personal information, such as name, address, e-mail address, and the type of services provided to the customer, that a business has disclosed to third parties during the immediately preceding calendar year for the third parties direct marketing purposes and (2) the names and addresses of all such third parties. To request the above information please contact us by writing to us under the “Contact Us” section above. We will respond to such requests within 30 days of receipt.

For more information about our privacy practices, contact us as set forth in Section 16. above.

C. Residents of Other U.S. States Residents of certain U.S. states (including Virginia) may have additional rights under applicable privacy laws, subject to certain limitations. These rights may include:

• Correction: to correct inaccuracies in their personal information, considering the nature and purposes of the processing of the personal information.
• Deletion: to delete personal information provided to or obtained by us.
• Access: to confirm whether we are processing their personal information and to obtain a copy of their personal information in a portable and, to the extent technically feasible, readily usable format.
• Opt-Out: to opt out of certain types of processing, including:
  • to opt out of the “sale” of their personal information.
  • to opt out of targeted advertising by us.
  • to opt out of any processing of personal information for purposes of making decisions that produce legal or similarly significant effects.

You may submit a request to exercise your privacy rights via:

• Our online web form.